Symmetric Key Ciphers. “Even as we learn more about security – how to design cryptographic algorithms, how to build secure operating systems – we build systems with less security.” --Bruce Schneier ‘Secrets and Lies: Digital
Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.
“Even as we learn more about security – how to design cryptographic algorithms, how to build secure operating systems – we build systems with less security.”
--Bruce Schneier
‘Secrets and Lies: Digital
Security in a networked World’
Wiley, 2000
used for
Objectives:
= function of a large number of ‘characters’ in the plaintext.
In ciphertext all the characters should have ideally an equal frequency of occurrence.
For every language: frequency of characters, digrams ( two letter sequences) and trigrams are known. statistical analysis to decipher encrypted information.
Note: In a non-precise way of speaking, Entropy means uncertainty.
1945: “Introduce diffusion and confusion through cryptographic algorithms”, said CLAUDE SHANNON.
DIFFUSION:
CONFUSION:
IMPORTANT: Substitution or Permutation: easy to break by using statistical analysis; strength due to non-linear functional transformation.
The strength of an encryption algorithm depends upon:
1883: Jean Guillaumen Hubert Victor Fransois Alexandre
Auguste Kerckhoff von Nieuwenhof: “ Cryptosystems should
rely on the secrecy of the key, but not of algorithm.”
Advantages of Openness: 1994: A hacker published the source code of RC4, a secret encryption algorithm, designed by RSA Data security Inc. attacks, that exposed several weaknesses of RC4
Given: plaintext 8-bit, Key 10-bit
Output: ciphertext 8-bit
( IP-1 ( IP (X) )) = X.
SDES may be said to have two ROUNDS of the
function fk.
Simplified DES scheme:ciphertext = IP-1 (fk2 (SW (fk1 ( IP (plaintext))))) Plaintext = IP-1 (fk1 (SW (fk2 ( IP (ciphertext)))))
10-bit Key
DECRYPTION
ENCRYPTION
8-bit plaintext
P10
8-bit plaintext
Shift
IP
IP-1
K1
K1
P8
fk
fk
Shift
SW
SW
K2
K2
P8
fk
fk
IP
IP-1
8-bit ciphertext
8-bit ciphertext
Plaintext = IP-1 (fk1 (SW (fk2 ( IP (ciphertext))))).
P10 :
3 5 2 7 4 10 1 9 8 6
P8:
K1 = P8 ( Shift (P10 (Key)))
K2 = P8 ( Shift ( Shift (P10 (Key)))).
6 3 7 4 8 5 10 9
10 bit key
1
10
P10
3 5 2 7 4 10 1 9 8 6
P10
5
5
Circular left shift by 1, separately on
the left and the right halves
LS-1
LS-1
5
5
P8
5
5
P8
6 3 7 4 8 5 10 9
K1
8
LS-2
Circular left shift by 2 , separately on
the left and the right halves
LS-2
5
5
P8
6 3 7 4 8 5 10 9
P8
K2
8
P10
3 5 2 7 4 10 1 9 8 6
6 3 7 4 8 5 10 9
P8
10-bit key = 1 0 1 0 0 0 0 0 1 0
1 0 0 0 0 0 1 1 0 0 P1O
0 0 0 0 1 1 1 0 0 0 LS-1 LS-1
1 0 1 0 0 1 0 0 = K1P8
0 0 1 0 0 0 0 0 1 1 LS-2 LS-2
0 1 0 0 0 0 1 1 = K2P8
8-bit plaintext
8
IP
2 6 3 1 4 8 5 7
IP
R1
L1
4
IP-1
4
4 1 3 5 7 2 8 6
E/P
K1
E/P
4 1 2 3 2 3 4 1
8
EPR
+
4
L2
4 R2
S0
S1
2
R22
2
L22
P4
4
R3
+
4
L3
4
SW
L5
4 4
R5
0 1 2 3
S0 =
0
1
2
3
0 1 2 3
0
1
2
3
S1 =
P4
2 4 3 1
Permutation IP is applied to the 8-bit plaintext to
generate L1 and R1, the left and the right halves.
INPUT to fk:
2
4
L22
S0 box
4
2
S1 box
R22
Given the 4 bits of L2 (or R2) part. Pick up the ijth element of S0 (or of S1), where
i = 1st and 4th bits; j = 2nd and 3rd bits.
Then convert this element to a 2-bit binary number.
Step4: (L22 : R22) goes through a permutation P4 to produce a 4-bit R3.
P4
2 4 3 1
Plaintext = 1 0 1 1 1 1 0 1
0 1 1 1 1 1 1 0
L1 = 0 1 1 1
R1 = 1 1 1 0
EPR = 0 1 1 1 1 1 0 1
EPR K1 = 1 1 0 1 1 0 0 1
Row : first and fourth bit
Column : 2nd and 3rd bit
For S0:
L2 = 1 1 0 1
Therefore Row = 3 Column = 2
L22 = 3 11
For S1:
R2 = 1 0 0 1
Row = 3 Column = 0
R22 = 2 1 0
L22 : R22 1 1 1 0
R3 = 1 0 1 1
L3 = R3 L1
= 1 1 0 0
L5 = 1 1 1 0
R5 = 1 1 0 0
4
4
R5
L5
E/P
8
EPR2
K2
+
L6
4
R6
4
S0
S1
2
L62
2
R62
P4
4
R7
4
+
L7
4
IP-1
8
c8
EPR2 K2 = 0 0 1 0 1 0 1 0
L6 = 0 0 1 0
R6 = 1 0 1 0
For S0:
Row = 0 Column = 1
L62 = 0 0 0
For S1:
Row = 2 Column = 1
R62 = 0 0 0
R7 = 0 0 0 0
L7 = R7 L5
= 1 1 1 0
L7 : L5 = 1 1 1 0 1 1 0 0
C8 = 0 1 1 1 0 1 0 1
c8
8
IP
c9
8
4
R9
4
L9
E/P
EPR3
8
K2
LA
4
4
RA
S0
S1
LA2
2
2
RA2
P4
RB
4
+
LB
4
LC
RC
4
4
C9 = 1 1 1 0 1 1 0 0
EPR3 = 0 1 1 0 1 0 0 1
LA : RA = EPR3 K2
= 0 0 1 0 1 0 1 0
S0: Row = 0 Column = 1
LA2 = 0 => 0 0
S1: Row = 2 Column = 1
RA2 = 0 => 0 0
R7 = 0000 LB = 1110
LC = 1100 RC = 1110
4
RC
LC
4
E/P
8
EPR4
K1
+
RD
LD
4
4
S0
S1
2
RE2
LE2
2
P4
RF
4
+
LF
4
IP-1
8
P8
LD : RD = EPR4 K1
= 1 1 0 1 1 0 0 1
S0: Row = 3 Column = 2
LE2 = 3 => 1 1
S1: Row = 3 Column = 0
RE2 = 2 => 1 0
LE2 : RE2 = 1 1 1 0
RF = 1 0 1 1
LF = LC RF
= 0 1 1 1
LF : RC = 0 1 1 1 1 1 1 0
P8 = 1 0 1 1 1 1 0 1
“As far as the laws of mathematics refer to reality, they are not certain, and as far as they are certain, they do not refer to reality.”
DES: a public standard. But its design criterion has not
been published.
64 bit plaintext goes through
to produce 64 bit ciphertext.
32bits
28 bits
28 bits
32bits
R i-1
C i-1
D i-1
L i-1
32
32
Expansion/
permutation (E table)
Left shift (s)
Left shift (s)
48
F
K i
Permutation/contraction
(permuted choice 2)
XOR
48
48
Substitution/
choice (S-box)
32
Permutation
(P)
32
XOR
R i
D i
L i
C i
Ki: sub-key for the ith round
While i ≤ 16,
xi = Li:Ri
Li = Ri-1
Ri = Li F(Ri-1 , Ki)
Recapitulation:
Table T1: IP
58 50 42 34 26 18 10 2
60 52 44 36 28 20 12 4
62 54 46 38 30 22 14 6
64 56 48 40 32 24 16 8
57 49 41 33 25 17 9 1
59 51 43 35 27 19 11 3
61 53 45 37 29 21 13 5
63 55 47 39 31 23 15 7
Table T2: IP-1
40 8 48 16 56 24 64 32
39 7 47 15 55 23 63 31
38 6 46 14 54 22 62 30
37 5 45 13 53 21 61 29
36 4 44 12 52 20 60 28
35 3 43 11 51 19 59 27
34 2 42 10 50 18 58 26
33 1 41 9 49 17 57 25
Input Permutation permutes the position of bits as
follows:
Input 1 2 3 4 …… 61 62 63 64
Position
Output40 8 48 16 …… 49 17 57 25
Position
IP(plaintext) = L(0): R(0),
where L(0) and R(0) are the left –half and the right-half
of the output after the permutation done through IP.
Inverse Input Permutation reverses it back.
Thus IP-1( IP( X)) = X
Regular in structure, so that hardware is simple
IP does not add to security. It makes the function a
little complex.
IP(675a6967 5e5a6b5a) = (ffb2194d 004df6fb)
IP-1(068dddcd 1d4ccebf) = 974affbf, 86022d1f
Reference:Lawrie Brown, “Cryptography: lecture 8”. available athttp://www.cs.adfa.edu.au/archive/teaching/studinfo/ccs3/lectures/less08.html
After IP, 64 bits are divided into left-half (L(0)) and
Right-half (R(0)).
During Round1, L(0):R(0) will be operated by Fk1 to produce L(1):R(1), where FK1 is the function Fk with subkey K1.
L i: R i will be the output.
Figure 2 shows the function FKi .
32bits
28 bits
28 bits
32bits
R i-1
C i-1
D i-1
L i-1
32
32
Expansion/
permutation (E table)
Left shift (s)
Left shift (s)
48
F
K i
Permutation/contraction
(permuted choice 2)
XOR
48
48
Substitution/
choice (S-box)
32
Permutation
(P)
32
XOR
R i
D i
L i
C i
The part in yellow, in the previous slide, shows the sub
key generation. After PC1, the circular rotations are
independent for the left half and the right-half.
ENCRYPTION: In the i-th round,
Li = Ri-1
Ri = Li-1 F(Ri-1, Ki)
= Li-1P(S( E(Ri-1) Ki ))
Where E: expansion from 32 bits to 48
S: Using 8 S-boxes to convert 48 bits to 32 bits – each S
box converts 6 bits to 4 bits
P: permutation
Table T6: E/P
32 1 2 3 4 5
4 5 6 7 8 9
8 9 10 11 12 13
12 13 14 15 16 17
16 17 18 19 20 21
20 21 22 23 24 25
24 25 26 27 28 29
28 29 30 31 32 1
is converted by Expansion/permutation through table T6 to …… defghi hijklm lmnopq ……
AUTOKEYING/ AUTOCLAVING: The duplicated outside bits in each group of 6 act as a key to the following S-box, allowing the data (as well as the key) to influence the S-box operation.
Reference: A F Webster & S E Tavares "On the Design of S-boxes", in Advances in Cryptology - Crypto 85, Lecture Notes in Computer Science, No 218, Springer-Verlag, 1985, pp 523-534
Table T7: S-Boxes
0 1 2
15
14 4 13 1 2 15 11 8 3 10 6 12 5 9 0 7
0 15 7 4 14 2 13 1 10 6 12 11 9 5 3 8
4 1 14 8 13 6 2 11 15 12 9 7 3 10 5 0
15 12 8 2 4 9 1 7 5 11 3 14 10 0 6 13
0
1
2
3
S1
S2
Table T8: P
16 7 20 21 29 12 28 17
1 15 23 26 5 18 31 10
2 8 24 14 32 27 3 9
19 13 30 6 22 11 4 25
E(Ri-1) = E(004df6fb) = 20 00 09 1b 3e 2d 1f 36
Converts 32 bits to 48 bits. The output is in 8 groups of 6bits – the first digit = 2bits; the second digit = 4 bits
Ki = 38 09 1b 26 2f 3a 27 0f
-- K1 from Slide 44
E(Ri-1) Ki = 18 09 12 3d 11 17 38 39
Input to S boxes: 48bits divided into 8 groups
of 6 bits each.S(18 09 12 3d 11 17 38 39) = 5fd25e03
P(5fd25e03) = 746fc91a
The input key: 56 bits
Hardware Design: the 8, 16, 24, 32, 40, 48, 56 and 64th bit is always the odd parity bit. 64 bit key
Software design: the key is stated in ASCII code. Each character of 8 bits, with the first bit being zero plus 7 bits of code. (!)
Since DES was designed with the viewpoint of
hardware implementation, the conversion to 56
bits is done by neglecting every 8th bit.
PC1 converts to 56 bits and permutes.
shift (of 1 or 2 bits) on the Left-half (Ci-1) and Right-half (Di-1) separately (Output: Ci of 28 bits and Di of 28 bits)
of 48 bits each
Table T3: PC-1
57 49 41 33 25 17 9
1 58 50 42 34 26 18
10 2 59 51 43 35 27
19 11 3 60 52 44 36
63 55 47 39 31 23 15
7 62 54 46 38 30 22
14 6 61 53 45 37 29
21 13 5 28 20 12 4
PC1 generates C0 and D0, the left and the right halves respectively.
C0 Read the first column of the input 64-bit key from bottom up. Write it row-wise from left to right. Repeat for the second, the third and the lower-half ofthe fourth column respectively.
D0 Read the seventh column of the input 64-bit key from bottom up. Write it row-wise from left to right. Repeat for the sixth, the fifth and the upper-half of the fourth column respectively.
Probably the conversion to the two halves was done
due to the limitation of the hardware of seventies.
Thus DES has a 56 bit key K consisting of C0 and D0.
All the sub keys K1 to K16 are of 48 bits.
To generate these keys, K goes through
followed by a Permuted Choice (PC-2) which permutes as well as ‘contracts’ to produce a sub-key K1 of 48 bits.
followed by a Permuted Choice (PC-2) which permutes as well as ‘contracts’ to produce a sub-key K2 of 48 bits.
followed by a Permuted Choice (PC-2) which permutes as well as ‘contracts’ to produce a sub-key K16 of 48 bits.
LS-j is left circular shift by j bits, on the two halves of
the 56 bits separately. j is given by Table 5.
KB2 = LS-j(KB1)
KB3 = LS-j(KB2)
.
KBi = LS-j(Kbi-1)
.
KB16 = LS-j(KB15)
Table T-4: PC-2: The upper 3 rows (24bits) refer to the left half Ci. (It affects S-boxes 1 to 4.) Similarly the remaining 24 bits refer to Di (and affect S-boxes 5 to 8).
14 17 11 24 1 5 3 28
15 6 21 10 23 19 12 4
26 8 16 7 27 20 13 2
41 52 31 37 47 55 30 40
51 45 33 48 44 49 39 56
34 53 46 42 50 36 29 32
Table T-5 The number of circular Left Shifts
Round number 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
Bits rotated 1 1 2 2 2 2 2 2 1 2 2 2 2 2 2 1
Di follows the same shifts as Ci.
Example Trace of DES Key Schedule:Reference:Lawrie Brown, “Cryptography: lecture 8”. available athttp://www.cs.adfa.edu.au/archive/teaching/studinfo/ccs3/lectures/less08.html
Key = PC2(C,D): Given in 16 HEX digits, in 8 pairs. The first digit is
of 2bits (a value lying between 0 and 3), the second digit is of 4bits.
PC2(C,D)=(38 09 1b 26 2f 3a 27 0f)
PC2(C,D)=(28 09 19 32 1d 32 1f 2f)
PC2(C,D)=(39 05 29 32 3f 2b 27 0b)
PC2(C,D)=(29 2f 0d 10 19 2f 1d 3f)
PC2(C,D)=(03 25 1d 13 1f 3b 37 2a)
PC2(C,D)=(1b 35 05 19 3b 0d 35 3b)
PC2(C,D)=(03 3c 07 09 13 3f 39 3e)
PC2(C,D)=(06 34 26 1b 3f 1d 37 38)
PC2(C,D)=(07 34 2a 09 37 3f 38 3c)
PC2(C,D)=(06 33 26 0c 3e 15 3f 38)
PC2(C,D)=(06 02 33 0d 26 1f 28 3f)
PC2(C,D)=(14 16 30 2c 3d 37 3a 34)
PC2(C,D)=(30 0a 36 24 2e 12 2f 3f)
PC2(C,D)=(34 0a 38 27 2d 3f 2a 17)
PC2(C,D)=(38 1b 18 22 1d 32 1f 37)
PC2(C,D)=(38 0b 08 2e 3d 2f 0e 17)
Note that C16 =C0 and D16 = D0
After 16 rounds, IP-1 is the last step, for getting the
encrypted block.
Reference:Lawrie Brown, “Cryptography: lecture 8”. available athttp://www.cs.adfa.edu.au/archive/teaching/studinfo/ccs3/lectures/less08.html
Decryption uses the same algorithm as encryption
except that the application of the sub-keys is
reversed.:
ENCRYPTION: (from slide 49)
Li = Ri-1
Ri = Li-1 F(Ri-1, Ki)
= Li-1P(S( E(Ri-1) Ki ))
Rewriting: DECRYPTION relations are:
Ri-1=Li
Li-1 = Ri F(Ri-1, Ki)
On substituting the value of Ri-1 from the first decryption relation,
Li-1 = Ri F(Li, Ki)
.
.
Sixteenth round with subkey 1 undoes 1st encryption round