1

The Data Encryption Standard

2

Outline

4.1 Introduction 4.4 DES 4.5 Modes of Operation 4.6 Breaking DES 4.7 Meet-in-the-Middle Attacks

3

4.1 Introduction In 1973, NBS, later to become NIST, issued a

public request seeking a crypto algo to become a national standard.

In 1974, IBM submitted an algo called LUCIFER. The NBS forwarded it to NSA, which reviewed it

and, after some modifications, returned a version that was essentially the DES.

In 1975, NBS released DES, as well as a free license for its use.

In 1977, NBS made it the official data encryption standard.

4

Introduction

From 1975 on, there has been controversy surrounding DES. Some regarded the key size as too small. Many were worried about NSA’s involvement.

In 1990, Eli Biham and Adi Shamir showed how their method of differential cryptanalysis could be used to attack DES. The DES algo involves 16 rounds; differential cryptanaysis would be more efficient than exhaustively searching all possible keys if the algo used at most 15 rounds.

5

Introduction

The DES has lasted for a long time, but is becoming outdated. Brute force searches (see Sec 4.6), though expensive, can now break the system. Therefore, NIST replaced it with a new system in the year 2000.

The DES is a block cipher; namely, it breaks the plaintext into blocks of 64 bits, and encrypts each block separately.

6

4.4 DES

Description of DES DES is a special type of iterated cipher called a

Feistel cipher. In a Feistel cipher, each state ui is divided into two

halves of equal length, say Li and Ri. Round function g: g(Li-1, Ri-1, Ki)=(Li, Ri), where

Invertible:

).,( 11

1

iiii

ii

KRfLR

RL

.

),(1

1

ii

iiii

LR

KLfRL

7

Plaintext

Ciphertext

L0

L16=R15

R15=L14 xor f(R14,K15)

R2=L0 xor f(R0,K1)

R1=L0 xor f(R0,K1)

R0

R16=L15 xor f(R15,K16)

L15=R14

L1=R0

L2=R1

IP

f

f

IP -1

f

K 1

K 2

K 16

Overview of DES

One round

8

DES Initial permutation IP: IP(x)=L0R0

Inverse permutation IP-1: y=IP-1(R16L16) Note L16 and R16 are swapped before IP-1 is applied.

Each Li and Ri is 32 bits in length. The function

takes as input a 32-bit string (the right half of the current state) and a round key.

Key schedule (K1,K2,…,K16) consists of 48-bit round keys that are derived from the 56-bit key, K.

324832 }1,0{}1,0{}1,0{: f

9

DES Suppose we denote the first argument of f

function (Figure A) by A, and the second argument by J.

A is expanded to 48-bit according to a fixed expansion function E.

Compute and write the result as concatenation of eight 6-bit strings B=B1B2B3B4B5B6B7B8.

The next step uses eight S-boxes (S1,…,S8), Given a bitstring of length 6, Bj=b1b2b3b4b5b6.

b1b6 determine the row r of Sj, and b2b3b4b5 determine the column c of Sj. We compute Cj=Sj(Bj).

The bitstring C=C1C2C3C4C5C6C7C8 is permuted according to the permutation P. Then f (A,J)=P(C).

JA )E(

46 }1,0{}1,0{: iS

10

A

E(A)

J

f(A,J)

E

+

B1 B2 B3 B4 B5 B6 B7 B8

S1 S2

S3

S4

S5

S6

S7

S8

C1 C2 C3 C4 C5 C6 C7 C8

P

Figure AThe DES f function

11

S1

14 4 13 1 2 15 11 8 3 10 6 12 5 9 0 7

0 15 7 4 14 2 13 1 10 6 12 11 6 5 3 8

4 1 14 8 13 6 2 11 15 12 9 7 3 10 5 0

15 12 8 2 4 9 1 7 5 11 3 14 10 0 6 13

S2

15 1 8 14 6 11 3 4 9 7 2 13 12 0 5 10

3 13 4 7 15 2 8 14 12 0 1 10 6 9 11 5

0 14 7 11 10 4 13 1 5 8 12 6 9 3 2 15

13 8 10 1 3 15 4 2 11 6 7 12 0 5 14 9

S3

10 0 9 14 6 3 15 5 1 13 12 7 11 4 2 8

13 7 0 9 3 4 6 10 2 8 5 14 12 11 15 1

13 6 4 9 8 15 3 0 11 1 2 12 5 10 14 7

1 10 13 0 6 9 8 7 4 15 14 3 11 5 2 12

S4

7 13 14 3 0 6 9 10 1 2 8 5 11 12 4 15

13 8 11 5 6 15 0 3 14 7 2 12 1 10 14 9

10 6 9 0 12 11 7 13 15 1 3 14 5 2 8 4

3 15 0 6 10 1 13 8 9 4 5 11 12 7 2 14S-boxes

Example B

12

S5

2 12 4 1 7 10 11 6 8 5 3 15 13 0 14 9

14 11 2 12 4 7 13 1 5 0 15 10 3 9 8 6

4 2 1 11 10 13 7 8 15 9 12 5 6 3 0 14

11 8 12 7 1 14 2 13 6 15 0 9 10 4 5 3

S6

12 1 10 15 9 2 6 8 0 13 3 4 14 7 5 11

10 15 4 2 7 12 9 5 6 1 13 14 0 11 3 8

9 14 15 5 2 8 12 3 7 0 4 10 1 13 11 6

4 3 2 12 9 5 15 10 11 14 1 7 6 0 8 13

S7

4 11 2 14 15 0 8 13 3 12 9 7 5 10 6 1

13 0 11 7 4 9 1 10 14 3 5 12 2 15 8 6

1 4 11 13 12 3 7 14 10 15 6 8 0 5 9 2

6 11 13 8 1 4 10 7 9 5 0 15 14 2 3 12

S8

13 2 8 4 6 15 11 1 10 9 3 14 5 0 12 7

1 15 13 8 10 3 7 4 12 5 6 11 0 14 9 2

7 11 4 1 9 12 14 2 0 6 10 13 15 3 5 8

2 1 14 7 4 10 8 13 15 12 9 0 3 5 6 11S-boxes

13

DES

Example B: We show how to compute an output of S-box S1 with input 101000.

b1b6=10 which is 2 b2b3b4b5=0100 which is 4 Output is row 2 and column 4 of S1.

Note: rows are numbered 0,1,2,3 and columns are 0,1,2,…15

So the output is 13 which is 1101 in binary.

14

DES The expansion function E is specified by the

following table:

If A=(a1,a2,…,a32) then

E(A)=(a32,a1,a2,a3,a4,a5,a4,…,a31,a32,a1).

E bit-selection table

32 1 2 3 4 5

4 5 6 7 8 9

8 9 10 11 12 13

12 13 14 15 16 17

16 17 18 19 20 21

20 21 22 23 24 25

24 25 26 27 28 29

28 29 30 31 32 1

15

DES

The permutation P is as follows:

If C=(c1,c2,…,c32) then

P(C)=(c16,c7,c20,c21,c29,…,c11,c4,c25).

P

16 7 20 21

29 12 28 17

1 15 23 26

5 18 31 10

2 8 24 14

32 27 3 9

19 13 30 6

22 11 4 25

16

DES Key scheduling:

17

DES

18

4.5 Modes of Operation

Four modes of operation for DES: Electronic codebook mode (ECB mode) Cipher feedback mode (CFB mode) Cipher block chaining mode (CBC mode) Output feedback mode (OFB mode)

ECB mode corresponds to the naive use of a block cipher:

x1,x2,…of 64-bit plaintext blocks, encrypted with the same key K, producing a string of ciphertext blocks, y1,y2,…

19

Modes of Operation

CBC mode: initialization vector IV and y0=IV .1 ),( 1 ixyey iiKi

IV=y0

+

x1

eK

y1

+

x2

eK

y2

encrypt IV=y0

+

y1

dK

x1

+

y2

dK

x2

decrypt

Figure 3.9 CBC mode

20

Modes of Operation

OFB mode: a synchronous stream cipher (cf. section 1.1.7) z0=IV, then keystream z1z2…

encryption:

.1for ),( 1 izez iKi

.1for , izxy iii

IV=z0 eK +

x1

y1

eK +

x2

y2encrypt

IV=z0 eK +

y1

x1

eK +

y2

x2decrypt

21

Modes of Operation

CFB mode: y0=IV keystream: encryption:

.1for ),( 1 iyez iKi

.1for , izxy iii

IV=y0 eK +

x1

y1

eK +

x2

y2encrypt

IV=y0 eK +

y1

x1

eK +

y2

x2decrypt

Figure 3.10 CFB mode

22

Modes of Operation

Some properties: In ECB and OFB modes, changing one 64-bit

plaintext block, xi, causes the corresponding ciphertext block, yi, to be altered, but other ciphertext blocks are not affected.

It is useful in some cases, like communicating on an unreliable channel.

In CBC and CFB modes, if a plaintext block xi is changed, then yi and all subsequent ciphertext blocks will be affected.

These modes can be used to produce a message authentication code (MAC).

23

4.6 Breaking DES The S-boxes, being the non-linear components

of the cryptosystem, are vital to its security. DES was to make differential cryptanalysis

infeasible. Differential cryptanalysis was known to IBM

when they design DES, but it was kept secret for almost 20 years until Biham and Shamir invented the technique in the early 1990’s.

The most pertinent criticism of DES is that the size of the keyspace, 256, is too small.

24

Breaking DES

Many people try to design a special purpose

machine to do exhaustive key search.

Eg: “DES Cracker” contained 1536 chips and

could search 88 billion keys per second. It

won RSA Laboratory’s “DES Challenge II-2”

by successfully finding a DES key in 56 hours.

25

Breaking DES Other than exhaustive key search, differential

cryptanalysis and linear cryptanalysis are the most important attacks. (linear attack is more efficient)

In 1994, Matsui implemented the attack by using 243 plaintext-ciphertext pairs with the same key. It took 40 days to generate the pairs and 10 days to find the key.

DES is still secure theoretically due to the extremely large number of pairs required. An adversary is impossible to collect that amount of pairs.

26

Breaking DES There are two main approaches to achieving increased

security. 1. Use DES multiple times – Triple DES 2. Find a new system that employs a larger key size than 56 bits – AES (Rijndael) The idea behind multiple DES schemes: 1. Double DES encrypts the plaintext by first encrypting with one key and then encrypting again using a different key.(one might guess that Double DES should double the keyspace to 2112. However, this in not true! See Sec 4.7)

27

Breaking DES 2. Triple DES (a level of security eq. to a 112-bit key) There are two ways Triple DES can be implemented: (1) Choose three keys, K1, K2, K3 and perform

EK1(EK2(EK3(m))).

(2) Choose two keys, K1 and K2, and perform

EK1(DK2(EK1(m))

Both versions of Triple DES are resistant to meet-in-the-middle attacks. However, there are

other attacks on (2).

28

4.7 Meet-in-the-Middle Attacks

Starting with plaintext message m, the

ciphertext is c=Ek2(Ek1(m)). To decrypt, simply

compute m=Dk1(Dk2(c)). Eve will need to

discover both k1 and k2 to decrypt their

messages. Does this provide greater security?

No

29

4.7 Meet-in-the-Middle Attacks

Assume Eve has intercepted a message m and a

doubly encrypted ciphertext c=Ek2(Ek1(m)). She wants

to find k1 and k2. She first computes and stores Ek(m)

for all possible keys k. She then computes Dk(c) for all

possible keys k. Finally, she compares the two lists. If

there are several matches, she then takes another

plaintext-ciphertext pair and do further test …