1 / 52

Modern Block Ciphers

Modern Block Ciphers. CSE 651: Introduction to Network Security. Summary. Block Ciphers (Chapter 3) Feistel Cipher Structure (Chapter 3) DES: Data Encryption Standard (Ch. 3) 3DES (Ch 6.1) AES: Advanced Encryption Standard (Ch. 5.2). Monoalphabetic Substitution Cipher.

lotus
Download Presentation

Modern Block Ciphers

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Modern Block Ciphers CSE 651: Introduction to Network Security

  2. Summary • Block Ciphers (Chapter 3) • Feistel Cipher Structure (Chapter 3) • DES: Data Encryption Standard (Ch. 3) • 3DES (Ch 6.1) • AES: Advanced Encryption Standard (Ch. 5.2)

  3. MonoalphabeticSubstitution Cipher • Shuffle the letters and map each plaintext letter to a different random ciphertext letter: Plain letters: abcdefghijklmnopqrstuvwxyz Cipher letters: DKVQFIBJWPESCXHTMYAUOLRGZN Plaintext: ifwewishtoreplaceletters Ciphertext: WIRFRWAJUHYFTSDVFSFUUFYA • What does a key look like?

  4. Playfair Key Matrix • Use a 5 x 5 matrix. • Fill in letters of the key (w/o duplicates). • Fill the rest of matrix with other letters. • E.g., key = MONARCHY.

  5. Vigenère Cipher • Simplest polyalphabeticsubstitution cipher • Consider the set of all Caesar ciphers: { Ca, Cb, Cc, ..., Cz } • Key: e.g. security • Encrypt each letter using Cs, Ce, Cc, Cu,Cr, Ci, Ct, Cy in turn. • Repeat from start after Cy. • Decryption simply works in reverse.

  6. Basic idea of modern block ciphers • From classical ciphers, we learn two techniques that may improve security: • Encrypt multiple letters at a time • Use multiple ciphertext alphabets (Polyalphabetic ciphers) • Combining these two techniques • encrypt eight (or more) letters at a time • called a block cipher • and use an extremely large number of ciphertext alphabets • will be called modes of operation

  7. Block Ciphers • In general, a block cipher replaces a block of N plaintext bits with a block of N ciphertext bits. (E.g., N = 64 or 128.) • A block cipher is a monoalphabetic cipher. • Each block may be viewed as a gigantic character. • The “alphabet” consists of 2N gigantic characters. • Each particular cipher is a one-to-one mapping from the plaintext “alphabet” to the ciphertext “alphabet”. • There are 2N! such mappings. • A secret key indicates which mapping to use.

  8. Ideal Block Cipher • An ideal block cipher would allow us to use any of these 2N! mappings. • The key space would be extremely large. • But this would require a key of log2(2N!) bits. • If N = 64, log2(2N!) ≈ N x 2N ≈ 1021 bits ≈ 1011 GB. • Infeasible!

  9. Practical Block Ciphers • Modern block ciphers use a key of K bits to specify a random subset of 2K mappings. • If K ≈ N, • 2K is much smaller than 2N! • But is still very large. • If the selection of the 2K mappings is random, the resulting cipher will be a good approximation of the ideal block cipher. • Horst Feistel, in1970s, proposed a method to achieve this.

  10. The Feistel Cipher Structure • Input: a data block and a key • Partition the data block into two halves L and R. • Go through a number of rounds. • In each round, • R does not change. • L goes through an operation that depends on R and a round key derived from the key.

  11. The Feistel Cipher Structure

  12. Round i Li-1 Ri-1 ki f + Li Ri

  13. Mathematical Description of Round i

  14. Feistel Cipher

  15. DES: The Data Encryption Standard • Most widely used block cipher in the world. • Adopted by NIST in 1977. • Based on the Feistel cipher structure with 16 rounds of processing. • Block = 64 bits • Key = 56 bits • What is specific to DES is the design of the F function and how round keys are derived from the main key.

  16. Design Principles of DES • To achieve high degree of diffusion and confusion. • Diffusion: making each plaintext bit affect as many ciphertext bits as possible. • Confusion: making the relationship between the encryption key and the ciphertext as complex as possible.

  17. DES Encryption Overview

  18. Round Keys Generation • Main key: 64 bits. • 56-bits are selected and permuted using Permuted Choice One (PC1); and then divided into two 28-bit halves. • In each round: • Left-rotate each half separately by either 1 or 2 bits according to a rotation schedule. • Select 24-bits from each half, and permute the combined 48 bits. • This forms a round key.

  19. Permuted Choice One (PC1)

  20. Initial Permutation IP • IP: the first step of the encryption. • It reorders the input data bits. • The last step of encryption is the inverse of IP. • IP and IP-1 are specified by tables (see Stallings book, Table 3.2) or http://en.wikipedia.org/wiki/DES_supplementary_material

  21. Round i Li-1 Ri-1 32 ki F 48 32 32 + Li Ri

  22. The F function of DES

  23. The Expansion Permutation E

  24. The S-Boxes • Eight S-boxes each map 6 to 4 bits • Each S-box is specified as a 4 x 16 table • each row is a permutation of 0-15 • outer bits 1 & 6 of input are used to select one of the four rows • inner 4 bits of input are used to select a column • All the eight boxes are different.

  25. Box S1 0 1 2 3 • For example, S1(101010) = 6 = 0110.

  26. Permutation Function P

  27. Avalanche Effect • Avalanche effect: • A small change in the plaintext or in the key results in a significant change in the ciphertext. • an evidence of high degree of diffusion and confusion • a desirable property of any encryption algorithm • DES exhibits a strong avalanche effect • Changing 1 bit in the plaintext affects 34 bits in the ciphertext on average. • 1-bit change in the key affects 35 bits in the ciphertext on average.

  28. Attacks on DES • Brute-force key search • Needs only two plaintext-ciphertext samples • Trying 1 key per microsecond would take 1000+ years on average, due to the large key space size, 256 ≈ 7.2×1016. • Differential cryptanalysis • Possible to find a key with 247 plaintext-ciphertext samples • Known-plaintext attack • Liner cryptanalysis: • Possible to find a key with 243 plaintext-ciphertext samples • Known-plaintext attack

  29. DES Cracker • DES Cracker: • A DES key search machine • contains 1536 chips • Cost: $250,000. • could search 88 billion keys per second • won RSA Laboratory’s “DES Challenge II-2” by successfully finding a DES key in 56 hours. • DES is feeling its age. A more secure cipher is needed.

  30. Multiple Encryption with DES • In 2001, NIST published the Advanced Encryption Standard (AES) to replace DES. • But users in commerce and finance are not ready to give up on DES. • As a temporary solution to DES’s security problem, one may encrypt a message (with DES) multiple times using multiple keys: • 2DES is not much securer than the regular DES • So, 3DES with either 2 or 3 keys is used

  31. 2DES • Consider 2DES with two keys: C = EK2(EK1(P)) • Decryption: P = DK1(DK2(C)) • Key length: 56 x 2 = 112 bits • This should have thwarted brute-force attacks? • Wrong!

  32. Meet-in-the-Middle Attack on 2DES • 2-DES: C = EK2(EK1(P)) • Given a known pair (P, C), attack as follows: • Encrypt P with all 256 possible keys for K1. • Decrypt C with all 256 possible keys for K2. • If EK1’(P) = DK2’(C), try the keys on another (P’, C’). • If works, (K1’, K2’) = (K1, K2) with high probability. • Takes O(256) steps; not much more than attacking 1-DES. EK1 EK2 P C

  33. AES: Advanced Encryption Standard

  34. AES: Advanced Encryption Standard • In1997, NIST began the process of choosing a replacement for DES and called it the Advanced Encryption Standard. • Requirements: block length of 128 bits, key lengths of 128, 192, and 256 bits. • In 2000, Rijndael cipher (by Rijmen and Daemen) was selected. • An iterated cipher, with 10, 12, or 14 rounds. • Rijndael allows various block lengths. • But AES allows only one block size: 128 bits.

  35. Figure 5.1 AES Encryption and Decryption

More Related