Post on 19-Jan-2016
1
The Data Encryption Standard
2
Outline
4.1 Introduction 4.4 DES 4.5 Modes of Operation 4.6 Breaking DES 4.7 Meet-in-the-Middle Attacks
3
4.1 Introduction In 1973, NBS, later to become NIST, issued a
public request seeking a crypto algo to become a national standard.
In 1974, IBM submitted an algo called LUCIFER. The NBS forwarded it to NSA, which reviewed it
and, after some modifications, returned a version that was essentially the DES.
In 1975, NBS released DES, as well as a free license for its use.
In 1977, NBS made it the official data encryption standard.
4
Introduction
From 1975 on, there has been controversy surrounding DES. Some regarded the key size as too small. Many were worried about NSA’s involvement.
In 1990, Eli Biham and Adi Shamir showed how their method of differential cryptanalysis could be used to attack DES. The DES algo involves 16 rounds; differential cryptanaysis would be more efficient than exhaustively searching all possible keys if the algo used at most 15 rounds.
5
Introduction
The DES has lasted for a long time, but is becoming outdated. Brute force searches (see Sec 4.6), though expensive, can now break the system. Therefore, NIST replaced it with a new system in the year 2000.
The DES is a block cipher; namely, it breaks the plaintext into blocks of 64 bits, and encrypts each block separately.
6
4.4 DES
Description of DES DES is a special type of iterated cipher called a
Feistel cipher. In a Feistel cipher, each state ui is divided into two
halves of equal length, say Li and Ri. Round function g: g(Li-1, Ri-1, Ki)=(Li, Ri), where
Invertible:
).,( 11
1
iiii
ii
KRfLR
RL
.
),(1
1
ii
iiii
LR
KLfRL
7
Plaintext
Ciphertext
L0
L16=R15
R15=L14 xor f(R14,K15)
R2=L0 xor f(R0,K1)
R1=L0 xor f(R0,K1)
R0
R16=L15 xor f(R15,K16)
L15=R14
L1=R0
L2=R1
IP
f
f
IP -1
f
K 1
K 2
K 16
Overview of DES
One round
8
DES Initial permutation IP: IP(x)=L0R0
Inverse permutation IP-1: y=IP-1(R16L16) Note L16 and R16 are swapped before IP-1 is applied.
Each Li and Ri is 32 bits in length. The function
takes as input a 32-bit string (the right half of the current state) and a round key.
Key schedule (K1,K2,…,K16) consists of 48-bit round keys that are derived from the 56-bit key, K.
324832 }1,0{}1,0{}1,0{: f
9
DES Suppose we denote the first argument of f
function (Figure A) by A, and the second argument by J.
A is expanded to 48-bit according to a fixed expansion function E.
Compute and write the result as concatenation of eight 6-bit strings B=B1B2B3B4B5B6B7B8.
The next step uses eight S-boxes (S1,…,S8), Given a bitstring of length 6, Bj=b1b2b3b4b5b6.
b1b6 determine the row r of Sj, and b2b3b4b5 determine the column c of Sj. We compute Cj=Sj(Bj).
The bitstring C=C1C2C3C4C5C6C7C8 is permuted according to the permutation P. Then f (A,J)=P(C).
JA )E(
46 }1,0{}1,0{: iS
10
A
E(A)
J
f(A,J)
E
+
B1 B2 B3 B4 B5 B6 B7 B8
S1 S2
S3
S4
S5
S6
S7
S8
C1 C2 C3 C4 C5 C6 C7 C8
P
Figure AThe DES f function
11
S1
14 4 13 1 2 15 11 8 3 10 6 12 5 9 0 7
0 15 7 4 14 2 13 1 10 6 12 11 6 5 3 8
4 1 14 8 13 6 2 11 15 12 9 7 3 10 5 0
15 12 8 2 4 9 1 7 5 11 3 14 10 0 6 13
S2
15 1 8 14 6 11 3 4 9 7 2 13 12 0 5 10
3 13 4 7 15 2 8 14 12 0 1 10 6 9 11 5
0 14 7 11 10 4 13 1 5 8 12 6 9 3 2 15
13 8 10 1 3 15 4 2 11 6 7 12 0 5 14 9
S3
10 0 9 14 6 3 15 5 1 13 12 7 11 4 2 8
13 7 0 9 3 4 6 10 2 8 5 14 12 11 15 1
13 6 4 9 8 15 3 0 11 1 2 12 5 10 14 7
1 10 13 0 6 9 8 7 4 15 14 3 11 5 2 12
S4
7 13 14 3 0 6 9 10 1 2 8 5 11 12 4 15
13 8 11 5 6 15 0 3 14 7 2 12 1 10 14 9
10 6 9 0 12 11 7 13 15 1 3 14 5 2 8 4
3 15 0 6 10 1 13 8 9 4 5 11 12 7 2 14S-boxes
Example B
12
S5
2 12 4 1 7 10 11 6 8 5 3 15 13 0 14 9
14 11 2 12 4 7 13 1 5 0 15 10 3 9 8 6
4 2 1 11 10 13 7 8 15 9 12 5 6 3 0 14
11 8 12 7 1 14 2 13 6 15 0 9 10 4 5 3
S6
12 1 10 15 9 2 6 8 0 13 3 4 14 7 5 11
10 15 4 2 7 12 9 5 6 1 13 14 0 11 3 8
9 14 15 5 2 8 12 3 7 0 4 10 1 13 11 6
4 3 2 12 9 5 15 10 11 14 1 7 6 0 8 13
S7
4 11 2 14 15 0 8 13 3 12 9 7 5 10 6 1
13 0 11 7 4 9 1 10 14 3 5 12 2 15 8 6
1 4 11 13 12 3 7 14 10 15 6 8 0 5 9 2
6 11 13 8 1 4 10 7 9 5 0 15 14 2 3 12
S8
13 2 8 4 6 15 11 1 10 9 3 14 5 0 12 7
1 15 13 8 10 3 7 4 12 5 6 11 0 14 9 2
7 11 4 1 9 12 14 2 0 6 10 13 15 3 5 8
2 1 14 7 4 10 8 13 15 12 9 0 3 5 6 11S-boxes
13
DES
Example B: We show how to compute an output of S-box S1 with input 101000.
b1b6=10 which is 2 b2b3b4b5=0100 which is 4 Output is row 2 and column 4 of S1.
Note: rows are numbered 0,1,2,3 and columns are 0,1,2,…15
So the output is 13 which is 1101 in binary.
14
DES The expansion function E is specified by the
following table:
If A=(a1,a2,…,a32) then
E(A)=(a32,a1,a2,a3,a4,a5,a4,…,a31,a32,a1).
E bit-selection table
32 1 2 3 4 5
4 5 6 7 8 9
8 9 10 11 12 13
12 13 14 15 16 17
16 17 18 19 20 21
20 21 22 23 24 25
24 25 26 27 28 29
28 29 30 31 32 1
15
DES
The permutation P is as follows:
If C=(c1,c2,…,c32) then
P(C)=(c16,c7,c20,c21,c29,…,c11,c4,c25).
P
16 7 20 21
29 12 28 17
1 15 23 26
5 18 31 10
2 8 24 14
32 27 3 9
19 13 30 6
22 11 4 25
16
DES Key scheduling:
17
DES
18
4.5 Modes of Operation
Four modes of operation for DES: Electronic codebook mode (ECB mode) Cipher feedback mode (CFB mode) Cipher block chaining mode (CBC mode) Output feedback mode (OFB mode)
ECB mode corresponds to the naive use of a block cipher:
x1,x2,…of 64-bit plaintext blocks, encrypted with the same key K, producing a string of ciphertext blocks, y1,y2,…
19
Modes of Operation
CBC mode: initialization vector IV and y0=IV .1 ),( 1 ixyey iiKi
IV=y0
+
x1
eK
y1
+
x2
eK
y2
encrypt IV=y0
+
y1
dK
x1
+
y2
dK
x2
decrypt
Figure 3.9 CBC mode
20
Modes of Operation
OFB mode: a synchronous stream cipher (cf. section 1.1.7) z0=IV, then keystream z1z2…
encryption:
.1for ),( 1 izez iKi
.1for , izxy iii
IV=z0 eK +
x1
y1
eK +
x2
y2encrypt
IV=z0 eK +
y1
x1
eK +
y2
x2decrypt
21
Modes of Operation
CFB mode: y0=IV keystream: encryption:
.1for ),( 1 iyez iKi
.1for , izxy iii
IV=y0 eK +
x1
y1
eK +
x2
y2encrypt
IV=y0 eK +
y1
x1
eK +
y2
x2decrypt
Figure 3.10 CFB mode
22
Modes of Operation
Some properties: In ECB and OFB modes, changing one 64-bit
plaintext block, xi, causes the corresponding ciphertext block, yi, to be altered, but other ciphertext blocks are not affected.
It is useful in some cases, like communicating on an unreliable channel.
In CBC and CFB modes, if a plaintext block xi is changed, then yi and all subsequent ciphertext blocks will be affected.
These modes can be used to produce a message authentication code (MAC).
23
4.6 Breaking DES The S-boxes, being the non-linear components
of the cryptosystem, are vital to its security. DES was to make differential cryptanalysis
infeasible. Differential cryptanalysis was known to IBM
when they design DES, but it was kept secret for almost 20 years until Biham and Shamir invented the technique in the early 1990’s.
The most pertinent criticism of DES is that the size of the keyspace, 256, is too small.
24
Breaking DES
Many people try to design a special purpose
machine to do exhaustive key search.
Eg: “DES Cracker” contained 1536 chips and
could search 88 billion keys per second. It
won RSA Laboratory’s “DES Challenge II-2”
by successfully finding a DES key in 56 hours.
25
Breaking DES Other than exhaustive key search, differential
cryptanalysis and linear cryptanalysis are the most important attacks. (linear attack is more efficient)
In 1994, Matsui implemented the attack by using 243 plaintext-ciphertext pairs with the same key. It took 40 days to generate the pairs and 10 days to find the key.
DES is still secure theoretically due to the extremely large number of pairs required. An adversary is impossible to collect that amount of pairs.
26
Breaking DES There are two main approaches to achieving increased
security. 1. Use DES multiple times – Triple DES 2. Find a new system that employs a larger key size than 56 bits – AES (Rijndael) The idea behind multiple DES schemes: 1. Double DES encrypts the plaintext by first encrypting with one key and then encrypting again using a different key.(one might guess that Double DES should double the keyspace to 2112. However, this in not true! See Sec 4.7)
27
Breaking DES 2. Triple DES (a level of security eq. to a 112-bit key) There are two ways Triple DES can be implemented: (1) Choose three keys, K1, K2, K3 and perform
EK1(EK2(EK3(m))).
(2) Choose two keys, K1 and K2, and perform
EK1(DK2(EK1(m))
Both versions of Triple DES are resistant to meet-in-the-middle attacks. However, there are
other attacks on (2).
28
4.7 Meet-in-the-Middle Attacks
Starting with plaintext message m, the
ciphertext is c=Ek2(Ek1(m)). To decrypt, simply
compute m=Dk1(Dk2(c)). Eve will need to
discover both k1 and k2 to decrypt their
messages. Does this provide greater security?
No
29
4.7 Meet-in-the-Middle Attacks
Assume Eve has intercepted a message m and a
doubly encrypted ciphertext c=Ek2(Ek1(m)). She wants
to find k1 and k2. She first computes and stores Ek(m)
for all possible keys k. She then computes Dk(c) for all
possible keys k. Finally, she compares the two lists. If
there are several matches, she then takes another
plaintext-ciphertext pair and do further test …