The RC5 Encryption Algorithm: Two Years On Lisa Yin

1. The RC5 Encryption Algorithm: Two Years OnLisa Yin • RC5 Encryption • Ron Rivest, December 1994 • Fast Block Cipher • Software and Hardware Implementations • Variable Key Size, Block Size, Round Number • Provides flexibility in performance and security • Data-Dependant Rotations • Good against advanced types of attack • Simple Encryption Routine • Easy to Implement and Analyze

2. The RC5 Encryption Algorithm: Two Years OnLisa Yin • Attacks against RC5 and other types of block ciphers • Exhaustive Key Search • Statistical Test • Differential Cryptanalysis • Linear Cryptanalysis • Timing Attacks

3. The RC5 Encryption Algorithm: Two Years OnLisa Yin • Linear Cryptanalysis • Basic Idea: Find a linear relation among bits of plaintext, ciphertext and key which hold with a probability that is not equal to 1/2. This “Linear Approximation” can potentially be used to obtain information about the key • Linear Cryptanalysis against RC5 • Kaliski and Yin in 1995 • Analyzed the basic structure of the encryption routine as well as the properties of data dependant rotations to see if it is possible to construct differential characteristics and linear approximations of RC5 that are useful • Discovered that the data-dependant rotations and incompatibility between different arithmetic operations help prevent against attacks

4. The RC5 Encryption Algorithm: Two Years OnLisa Yin • Differential Cryptanalyst • Basic Idea: Choose two plaintext with a certain difference between them so that the resulting ciphertexts have a difference with a specific value with a probability better than expected • Useful in deriving certain bits of the key • Differential Cryptanalystagainst RC5 • Knudsen and Meier in 1996 • Careful analysis of relations between input, output and subkeys used in the first two rounds of encryption • Improved plaintext requirement over Kaliski and Yin by a factor of 512 • Considered existence of certain weaker keys for RC5 which can further enhance their attacks

5. The RC5 Encryption Algorithm: Two Years OnLisa Yin Summary Of Data Requirements for a Successful attack against RC5 The symbol “ > “indicates that the attack is impossible even at a theoretical level Yin, Y. (1997). "The RC5 Encryption Algorithm: Two Years On." CryptoBytes, Winter 1997

6. The RC5 Encryption Algorithm: Two Years OnLisa Yin • Timing Attacks • Basic Idea: obtain information about key by recording and analyzing the time used for cryptographic operations that involve the key • Timing Attacks against RC5 • Kocher 1995 • RC5 is subject to timing attacks • If RC5 is on platform where the time for computing a single rotation is proportional to the rotation amount • RC5 is resistant to timing attacks • If RC5 is on platform where the time for computing a single rotation is constant

7. The RC5 Encryption Algorithm: Two Years OnLisa Yin • Other attack studies • Moriai, Aoki and Ohta • Focused on linear approximations for fixed keys rather than the average over all possible keys • Considered mini-version of RC5 with reduced word size and computed the percentage of keys that yield ciphers less resistant to linear cryptanalysis than average case analysis • Interesting but little practical significance

8. The RC5 Encryption Algorithm: Two Years OnLisa Yin • Conclusions • Cryptanalytic Results against RC5 are encouraging • Acceptance of RC5 is growing • “Two years on, it seems that the RC5 encryption algorithm offers a computationally inexpensive way of providing secure encryption” Yin, Y. (1997). "The RC5 Encryption Algorithm: Two Years On." CryptoBytes, Winter 1997