CPS2323. Block Ciphers: The Data Encryption Standard (DES)

Transcription

1 Block Ciphers: The Data Encryption Standard (DES)

2 Content Block Ciphers: Constructing Pseudo Random Permutations using confusion/diffusion A call for an industry standard... and the NSA Lucifer and Feistel networks S boxes and non linearity P boxes and the avalanche effect Encryption and decryption functions Cryptanalysis 2/31

3 Pseudo Random Permutations (i) Permutations: Invertible functions where domain = range X X x1 x6 x2 x7 x3 x8 x4... x Bijection: one to one (injective) and onto (surjective) 3/31

4 Pseudo Random Permutations (ii) Block ciphers: length preserving permutations l } X f Y 4/31

5 Pseudo Random Permutations (iii) Truly Random (length preserving) Permutations give us perfectly secret block ciphers i.e. randomly choose an f out of permutations possible 5/31

6 Pseudo Random Permutations (iv) The Random Oracle way Alice needs to send Bob all existing random maps for correct decryption to be possible through an out of band channel. What?! Practical example WWI codebooks x f(x) /31

7 Pseudo Random Permutations (v) The Zimmermann Telegram 7/31

8 Pseudo Random Permutations (vi) PRF or keyed functions Truly random generate only the key i.e. the key fixes the entire f f's output should be indistinguishable from that of a TRF Non trivial! Typically: << e.g. for AES 256 (state of the art): << 8/31

9 Pseudo Random Permutations (vii) Typical constructions follow a product cipher design based on principles established by Claude Shannon in his 1949 seminal work: Communication Theory of Secrecy Systems 9/31

10 Pseudo Random Permutations (viii) Confusion or? Obscure: Y k i.e. if an attacker manages to get to the key from the ciphertext, then a distinguisher has been found In computer security, known plaintext settings are practical Revolves around the non feasibility to model mathematically even parts of the cipher e.g. as a system of linear equations Diffusion or? Obscure: X Y i.e. hide all plaintext patterns/statistics, ranging from letter frequencies to network packet header corresponding ciphertext bits BOTH ARE REQUIRED FOR SECURE CIPHER DESIGN 10/31

11 Pseudo Random Permutations (ix Non linearity A good measure for confusion Avalanche effect A good measure for diffusion Every ciphertext block bit has a 0.5 chance of being affected by some plaintext block bit Alt. A change in a single plaintext block bit on average affects half of the ciphertext bits Alt. (2) The plain/ciphertext blocks are statistically independent 11/31

12 DES (i) 1972 NIST (NBS back then) issued a request for a standardized cipher A milestone in the history of cryptography where the utility of cryptography outside military/government was officialy recognized 1974 IBM's Licufer a block cipher makes the final cut Designed by Horst Feistel in the 60s Modified after NSA was pulled in the conduct a security analysis A move to that led to speculation 1977 Full design released, that included weird looking S boxes 1990's Subject to intense cryptanalysis focusing on breaking S boxes, which turned out to be the point of strength for this algorithm. So far the best known attacks are infeasible Keyspace (256) is the only security issue due to advances in computing power addressed by 3DES 12/31

13 DES (ii) 16 rounds of confusion and diffusion 13/31

14 DES (iii) High level design: Feistel Network L0 L1 d L 0 1 L'0 } xn R1 d d L R0 R R 0 } xn d 1 R'0 14/31

15 DES (iv) Correct decryption Right half just copying no encryption takes place 15/31

16 DES (v) Left half: some more double XOR magic 16/31

17 DES (vi) DES Round Function 17/31

18 DES (vi) S boxes (Substitution boxes) Primary (8 different) components of round function f Provide non linearity 4 permutations of /31

19 DES (vii) Non linearity Otherwise: for a known (x,y), find S(k1) Then, find the 4 possible values for k1 Actually, attacking a single S box discloses only a part of the key: short cut attack on the keyspace Actually, equation has to factor in the multiple round and all other components, however these are all linear 19/31

20 DES (viii) P box (Permutation box) Provides for the Avalanche Effect (diffusion) Cross wires individual bits from the 4 bit S box output to different S boxes in the following rounds 20/31

21 DES (ix) Encryption Bit based function design with efficient h/w implementation in mind (remember a 60s design) Feistel Network Key Schedule 21/31

22 DES (x) Key Schedule encryption Stretches the key into a sequence of subkeys Left shifts compute an entire revolution i.e Handy for decryption 22/31

23 DES (xi) Key Schedule decryption Shift the inverse way Result in using subkeys in reverse order, for correct decryption i.e. Decryption round 1 undoes encryption round 16 using the same subkey etc... 23/31

24 Cryptanalysis (i) DES, being a standard, attracted numerous cryptanalytic effort Healthy, in the sense that in case of known attacks it is much better that these aren't only known by attackers Cryptanalysis typically proceeds by analyzing reduced/vulnerable versions of a cipher and then attempts to extend the attack to the full cipher Ultimately the results of these efforts pointed towards the conclusion that the NSA knew all along what they were doing as far back as the 70s Not only the S boxes are crucial to a block cipher's design, but the DES's S box design render the DES computationally secure against the best known attacks today Bar the small keyspace of course! 24/31

25 Cryptanalysis (ii) Differential cryptanalysis Exploits an alternative avenue of linearity: Linear relations within S box input/output differences in this case Consider a simper version of the DES utilizing the following S box 25/31

26 Cryptanalysis (iii) Cryptanalysis (iii) Note:!!!! 26/31

27 Cryptanalysis (iv) Short cut attack: Chosen plaintext pairs (L,R)(L,R') with the desired Pass them through the cipher whose key you want to attack Keep the pairs conforming to the most likely Brute force across all pairs Given sufficient pairs, the combination that returns the highest number of the expected output difference, is the correct key bit sequence Expected 27/31

28 Cryptanalysis (v) Cipher has got other S boxes, components S boxes switch off with X = X' linear Multiple rounds r: Each disclosed bit halves the keyspace The more vulnerable S boxes the more key bits can be disclosed Scaling to DES: Active attack; 247 chosen plaint text pairs required Considered impractical 28/31

29 Cryptanalysis (vi) Linear cryptanalysis Exploits linear relations among S Box input/output SUB bits 29/31

30 Cryptanalysis (vii) Collect known plaintext/ciphertext pairs Passive attack (note S() does not form part of the equation above ) Once again need to factor in the remaining linear components and the multiple rounds 43 For DES the number of known plaintext/ciphertext pairs is 2 Passive attack A step forward from differential cryptanalysis but still infeasible 30/31

31 Reading List Textbook: Understanding Cryptography: A Textbook for Students and Practitioners: Christof Paar and Jan Pelz. Publisher: Springer, 1st Edition, 2010, ISBN 10: , ISBN 13: Supplementary reading: Applied Cryptography. Bruce Schneier. Publisher: Wiley, 2nd Edition, 1996, ISBN 10: , ISBN 13: Discrete and combinatorial Mathematics: An Applied Introduction. Ralph P Grimaldi. Publisher: Addison Wesley, 5th Edition, 2003, ISBN 10: , ISBN 13: GnuTLS Manual. Handbook of Applied Cryptography. Alfred Menezes, Paul van Oorschot, and Scott Vanstone. Publisher: CRC Press, 1996, ISBN 10: , ISBN 13: Introduction to Modern Cryptography, 2nd Edition. Publisher: Chapman and Hall/CRC Press, 2014, ISBN 10: ISBN 13: /31