Week 4. : Block Ciphers and DES

Size: px

Start display at page:

Download "Week 4. : Block Ciphers and DES"

Cori Flynn
5 years ago
Views:

1 Week 4. : Block Ciphers and DES

2 Model of Symmetric Cryptosystem Cryptanalyst Adversary M K E Insecure Channel D Plaintext M Ciphertext C Secure Channel Plaintext M Key K Shared Secret Key C = E K (M) D K (C) = M 2

3 Encryption Function Encryption Round keys Encryption Key Schedule Decryption Key Schedule Decryption Round keys Decryption Function Block Cipher A Simplified View Input Message (Plaintext) Session Key Input Message (Ciphertext) E E D D Output Message (Ciphertext) Output Message (Plaintext) 3

4 Most Popular Symmetric Ciphers American standards DES 56 bit key 3DES AES contest AES , 192, 256 bit key Other popular algorithms IDEA RC5 Blowfish CAST Serpent RC6 Twofish Mars 4

Feistel-type Ciphers Feistel network An elegant variant of S-P networks that could be implemented using a single algorithm for both encryption and decryption F( ) does not need to be invertible Horst

5 Feistel-type Ciphers Feistel network An elegant variant of S-P networks that could be implemented using a single algorithm for both encryption and decryption F( ) does not need to be invertible Horst Feistel is best known for his work on the Feistel network construction a common method for constructing encryption algorithms. In 1977, he was recognized at the IBM Corporate Technical Recognition Event (CTRE) for "devising a scheme encrypting binary data which is especially significant to IBM products and is the basis for the recently announced Federal Information Processing Standard adopted by the U.S. Commerce Department." His work at IBM led to the development of the pioneering Lucifer and Data Encryption Standards (DES) ciphers, and as a result of his efforts, IBM announced the 3845 and 3846 data encryption devices and the IBM cryptographic subsystem. Feistel earned a bachelor's and a master's degree in physics from MIT and Harvard, respectively. Before joining IBM, he worked with the U.S. Air Force Cambridge Research Center (AFCRC), MIT's Lincoln Laboratory and the Mitre Corporation 5

6 Block Cipher Architecture - Feistel-type (Enc & Dec) Plaintext L 0 R 0 R r Ciphertext L r round 1 F K 1 F K r round 2 L 1 R 1 F K 2 R r-1 F L r-1 K r-1 round r L r-1 R r-1 F K r R 1 F L 1 K 1 R r Ciphertext L r L 0 Plaintext R 0 6

7 Design of Feistel-type Ciphers Design of F-function The only non-linear part in the Feistel-type cipher Need not to be invertible Typically uses S-boxes (Substitution boxes) for non-linearity May also contain mixing (permutation) part of the S-box outputs Determines the ultimate security Design of Key scheduling algorithm Algorithm for deriving as many round keys as necessary from a fixed user key On-the-fly vs. off-line calculation Number of rounds Depends on the strength of round function (F-function) A safety margin should be considered for long-term security Determined through the analysis of the whole algorithm against most powerful known cryptanalysis techniques 7

Data Encryption Standard (DES) DES - History 1976 adopted as a federal standard 1977 official publication as FIPS PUB 46 1983, 1987, 1993 recertified for another 5 years Design Criteria of DES

8 Data Encryption Standard (DES) DES - History 1976 adopted as a federal standard 1977 official publication as FIPS PUB , 1987, 1993 recertified for another 5 years Design Criteria of DES Provide a high level of security Completely specify and easy to understand Security must depend on hidden key, not algorithm Available to all users Adaptable for use in diverse applications Economically implementable in electronic device Able to be validated Exportable Plaintext block 64 bits DES Ciphertext block 64 bits Key 56 bits * FIPS: Federal Information Processing Standards 8

9 2 Main Blocks of DES P 64 K PC-1 56 L0(32) IP f R0(32) PC-2 Rot Rot 16 Round PC-2 R16 L16 Round function FP C 64 Key Scheduling 9

10 DES Round Function Plaintext M(64) IP LE 0 (32) RE 0 (32) f LE 1 (32) RE 1 (32) f LE 2 (32) RE 2 (32) f LE 15 (32) RE 15 (32) f K 1 K 2 K 3 K 16 RE 16 (32) LE 16 (32) IP 1 Ciphertext C(64) 10

11 Initial Permutation & Final Permutation IP (Initial permutation) IP 1 (Final permutation) cf.) The 58th bit of x is the first bit of IP(x) 11

12 Function f(k i,re i-1 ) RE i-1 (32bits) E Expansion E 48bits K i (48bits) S 1 S 2 S 3 S 4 S 5 S 6 S 7 S 8 S-box P Permutation P 32bits 12

13 Expansion E & Permutation P Expansion E cf.) 32-bits are expanded into 48-bits. Some bits are selected more than once. Permutation P bit 32-bit permutation 13

14 DES S-box (substitution box) (1/3) b 1 b 2 b 3 b 4 b 5 b 6 S 1 Look-up a value from the table using b 1 b 6 : row b 2 b 3 b 4 b 5 : column Sb 1 Sb 2 Sb 3 Sb 4 b 1 b 6 : row S 1 -box table Sb b 2 b 3 b 4 b 5 : column 14

15 DES S-boxes(2/3) 8 S-boxes (6 4 bits) some known design criteria not linear Any one bit of the inputs changes at least two output bits S(x) and S(x ) differs at least 2 bits S(x) S(x 11ef00) for any ef Resistance against DC etc. The actual design principles have never been revealed (US classified information) 15

16 DES S-Boxes(3/3) - examples S 3 -box S 4 -box HW : For the S 4 -box, check whether the following property holds S 5 (x) and S 5 (x ) differs at least 2 bits 16

17 Key Scheduling Key (64) PC 1 C 0 (28) D 0 (28) LS 1 LS 1 C 1 (28) D 1 (28) PC 2 K 1 LS 2 LS 2 C 2 (28) D 2 (28) PC 2 K 2 LS 16 LS 16 C 16 (28) D 16 (28) PC 2 K 16 17

18 Permuted Choice 1 (PC 1 ) bit -> 56 bit (Actual key size of DES is 56-bit) cf.) Do not use the parity check bits preventing from input error was not selected. 18

19 Permuted Choice 2 (PC 2 ) bit -> 48 bit Note that 9, 18, 22, 25, 35, 38, 43 and 54-th bits were not selected reserved for parity check 19

20 Left Shift LS s Iteration Shift Iteration Shift LS 1 1 LS 9 1 LS 2 1 LS 10 2 LS 3 2 LS 11 2 LS 4 2 LS 12 2 LS 5 2 LS 13 2 LS 6 2 LS 14 2 LS 7 2 LS 15 2 LS 8 2 LS

21 Known Weakness of DES Complementary Prop. If C= E(K,P), C = E(K, P) Weak Key : 4 keys E(K, E(K,P))=P Semi-weak Keys : 12 keys (6 pairs) E(K 1, E(K 2,P))=P Key Exhaustive Search :

DES Cracking Machine (I) DES - Controversies Unknown design criteria Slow in software Too short key size 56 bits DES Crack Machine Can test over 90 billion keys per second EFF's "Deep Crack" and the

22 DES Cracking Machine (I) DES - Controversies Unknown design criteria Slow in software Too short key size 56 bits DES Crack Machine Can test over 90 billion keys per second EFF's "Deep Crack" and the Distributed.Net computers were testing 245 billion keys per second On Jan. 19, 1999, RSA DES-III Challenge was deciphered after searching 22hr and 15min. Identifier: DES-Challenge-III Cipher: DES Start: January 18, :00 AM PST Prize: $10,000 IV: da 4b be f1 6b 6e 98 3d Plaintext: See you in Rome (second AES Conference, March 22-23, 1999) 22

23 DES Cracking Machine (II) Distributed.Net + EFF 100,000 PC on Network 56hr Main_Page EFF(Electronic Frontier Foundation), 1989 Specific tools 22hr 15min 250,000$ EFF_DES_cracker P. Kocher 23

of Bochum, Germany Commercially available 120 FPGA s of type XILINX

24 DES Cracking Machine(III) COPACOBANA) Cost- Optimized Parallel COde Breaker is an FPGA Machine by Univ. of Bochum, Germany Commercially available 120 FPGA s of type XILINX Spartan run in parallel 10,000$ of ¼ of EFF project i/eff_des_cracker 24

25 Double DES & 3DES How to strengthen existing DES implementations? Double DES Essentially no security increase: E K1 (P) = X = D K2 (C) Meet-in-the-middle attack! K 1 K 2 K 2 K 1 P E X E C C D X D P 3DES Three-key or Two-key 3DES: K 1 = K 3 K 1 K 2 K 3 K 3 K 2 K 1 P E A D B E C C D B E A D P 25

Data Encryption Standard

ECE 646 Lecture 7 Data Encryption Standard Required Reading W. Stallings, "Cryptography and Network-Security," 5th Edition, Chapter 3: Block Ciphers and the Data Encryption Standard Chapter 6.1: Multiple