Applied Cryptography Data Encryption Standard

Transcription

1 Applied Cryptography Data Encryption Standard Sape J. Mullender Huygens Systems Research Laboratory Universiteit Twente Enschede 1

2 History DES has a checkered history. The book provided fascinating reading material. In brief: 1972: National Bureau of Standards initiated a programme to develop an encryption standard. 1974: After a second request for technology, IBM offered its Lucifer product as input. The NBS requested and got help from the NSA in evaluating the input. 2

3 1975: Details of the algorithm were published. IBM granted a nonexclusive, royalty-free licence for its use. The NBS requested comments. Many comments concerned NSA s input; the key size was reduced from 128 bits to 56 bits a trapdoor was suspected. 3

4 History, contd. 1976: DES was adopted as a federal standard. NSA regrets its cooperation : Various enhancements were published. 1983: The first five-year review of DES was succesful. 1987: NSA (with veto power obtained from Reagan) did not want to recertify the standard. Instead it wanted to certify a series of algorithms which would remain secret. Public outrage prevented this and DES was recertified (but for the very last time!) 1993: DES was recertified. 4

5 How DES works Block cipher, 64-bit blocks plaintext is converted to 64-bit ciphertext, using a 56-bit key (or an 8-byte key with parity note that the parity bit is in the LSB). The algorithm is public; the security is in the key. The algorithm consists of substitutions and permutations, arranged in 16 rounds. It is eminently suited for hardware implementations, but reasonable software implementations can be built too. 5

6 Overview Plaintext K IP L R 0 0 F K 1 L R K 1 1 F 2 L15 R15 K F 16 L R IP Ciphertext 6

7 The Basic Step The basic step is reversible: L i = R i 1 R i = L i 1 F(R i 1, K i ) K L R K R L K F F L R K R L 7

8 The Key During each step, the key is changed by circularly shifting each 28-bit half left by either one or two bits. After the shift, 48 bits out of the 56 are used in the one-way function F. 56 bits 28 bits 48 bits Compression permutation 1 or 2 bits 8

9 The One-Way Function R Composed of an expansion mutation, an XOR operation with the 48-bit partial key, an S-box substitution, and a P-box permutation. Note, that this is a one-way function; that is, it does not have an easily computable inverse. It doesn t have to, because the rounds are invertable even with a noninvertable one-way function. L i R i 32 Expansion S Box R i 48 Ki 9

10 Expansion Permutation, S-Boxes The expansion permutation doesn t permute much. Bits with numbers 0 (mod 4) and 1 (mod 4) are doubled, the others are not The S-boxes map 6 bits down to 4. There are eight different ones. The mapping is done by table lookup; each 4-bit output value is produced by 4 6-bit input values. 10

11 P-Box Permutation The P-Box is a straightforward permutation of the bits

12 Encryption and Decryption The rounds are individually reversible. This makes decryption very similar to encryption: The order of the rounds has to be reversed and, since the difference between rounds is only the key, the sequence of keys has to be reversed. The key shifts are reversed (right shift instead of left shift). Note that the shift amounts were chosen to make the shift around after round 16 to where it started at round 0. The initial and final permutations stay where they are: the initial permutation undoes the final permutation so the first round gets the correct input. 12

13 Modes of DES DES is typically used in one of four modes of operation: ECB: Electronic Codebook Mode CBC: Cipher Block Chaining Mode CFB: Cipher Feedback Mode OFB: Output Feedback Mode 13

14 Electronic Codebook Mode Each block of 64 bits is encrypted and decrypted independent of other blocks. A cryptanalyst with can collect plaintext/ciphertext pairs for known plaintext, compile a codebook and detect repetitions of the input. Block replay is a threat. An attacker can replace a block of ciphertext by a different one undetected by the receiver. Solution: cipher block chaning... 14

15 Cipher Block Chaining Mode Purpose is to make blocks depend on all previous blocks so that block substitution no longer works (a checksum at the end of the message will detend tampering). C i = {P i C i 1 } K P i = C i 1 {C i } K Two identical messages will still encrypt the same, so an initialization vector (a block of random bits) is chosen for C 0. Note that the IV is not secret, but that s okay, none of the other C i are secret either. 15

16 Cipher Feedback Mode Key Key Encrypt 4 3 Shift Shift 4 3 Encrypt P C C P An initialization vector provides the initial contents of the shift register. 16

17 Output Feedback Mode Output Feedback mode generates an input-independent onetime pad that is XOR-ed with the input stream. Key Key Encrypt 4 3 Shift 4 3 Encrypt 4 3 Shift K K P C C P 17

18 OFB Feedback Size Output Feedback mode is not secure unless the feedback size equals the block size (i.e., 64 bits). The cycle time is then Smaller feedback sizes shorten the cycle time to approximately 2 32 not long enough. Key K Encrypt P C 18

19 Weak Keys The halves of the key are shifted. If one key half consists entirely of 1s or 0s, shifting it around won t change it. This creats a substantial weakness. The following keys, therefore, are weak: FFFFFFF FFFFFFF FFFFFFF FFFFFFF 19

20 Complement Keys The encryption is entirely done by shifting and permuting bits and by XOR-ing. The result of shift and permute are independent of value. Due to the propoerty of XOR, therefore: {P} K = C {P } K = C where X is the bitwise complement of X. 20

21 DES and Mathematics If the DES operator formed a group over the set of inputs: K 1, K 2, K 3 : {{P} K1 } K2 = {P} K3 This would imply double DES would be useless. If DES were pure: K 1, K 2, K 3 K 4 : {{{P} K1 } K2 } K3 = {P} K4 and triple DES would be useless. Fortunately, DES is not a group and it is certainly not pure (one implies the other). 21

22 Triple DES Works by encrypting, decrypting and encrypting with three keys (sometimes with two: K 1, K 2, K 1. K 1 K 2 K 3 Encrypt Decrypt Encrypt P Decrypt Encrypt Decrypt C 22

23 DESX Uses whitening which makes a brute-force attack much, much harder. F K 1 K 2 F(K 1, K 2) P Encrypt C 23

24 IDEA Proposed in 1960, by Xuejia Lai and James Massey, IDEA is probably the strongest block cipher around today. It uses three basic operations on 16-bit subblocks: : XOR : Addition modulo 2 16 : Multiplication modulo DES encrypts 64-bit data blocks with a 128-bit key. The basic step shown in the next slide is repeated 8 times. During each step, 6 subkeys are used. 24

25 IDEA Basic Step X 1 X 2 X 3 X 4 Z 1 Z 3 One round Z 2 Z 4 Z 5 Z 6 X 1 X 2 X 3 X 4 Z 1 Z 2 Z 3 Z 4 Output transformation 25

26 IDEA Subkeys There are 6 subkeys for each round and 8 rounds: 48 subkeys. There are four more subkeys for the output transformation: 52 keys total. The 128-bit key is divided into 8 16-bit subkeys. These are used as the first 8 subkeys (6 in round 1, 2 in round 2) Then the key is rotated left 25-bits and is again divided into 8 subkeys (4 in round 2, 4 in round 3) This process repeats 26

27 IDEA Decryption Steps are reversed, key is rotated right, and subkeys are additively or multiplicatively inversed before use (this is data independent, so need only been done once at initialization). 27