DOCSLIB.ORG

IN2120 Information Security Cryptography Outline Terminology

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
IN2120 Information Security Cryptography Outline Terminology Outline What is cryptography? Brief crypto history IN2120 Information Security Symmetric cryptography Stream ciphers Cryptography Block ciphers Hash functions Asymmetric cryptography Encryption Nils Gruschka Diffie-Hellman key exchange University of Oslo Digital signatures Post-Quantum Crypto Cryptography IN2120 2 Terminology What can cryptography do? Cryptology Crypto can provide the following security services: Confidentiality: Cryptography Cryptanalysis Makes data unreadable to entities who do not have the appropriate cryptographic keys, even if they have the data. Data Integrity: Cryptography is the science of secret writing with the goal of Entities with the appropriate cryptographic keys can verify that data is correct and has hiding the meaning of a message. not been altered, either deliberately or accidentally. Authentication: Cryptanalysis is the science of breaking cryptography. Entities who communicate can be assured that the other user/entity or the sender of a Cryptology covers both cryptography and cryptanalysis. message is what it claims to be. Digital Signature and PKI (Public-Key Infrastructure): Strong proof of data origin which can be verified by 3rd parties. Scalable (to the whole Internet) distribution of cryptographic keys. Cryptography IN2120 3 Cryptography IN2120 4 Taxonomy of cryptographic Evolution of Ciphers functions Cryptographic Functions Classical Medieval Pre-WW2 WW2 Pre-2000 Post-2000 ciphers ciphers ciphers ciphers ciphers ciphers Transposition Poly- One-time Complex DES AES alphabetic mechanics Scytale pad Feistel Rijmen & Hash Substitution Ciphers Enigma Daemen Functions + Vernam Transposition 1916 Vigenère Symmetric S Asymmetric A Substution 1566 SP-networks Asymmetric One secret key Public key used for Caesar Info-theory crypto cipher Post- used for both encryption and private Shannon Diffie Quantum encryption and decryption key used for decryption Hellman Asymmetric crypto Block Stream Also called BC AD 1799 1800 1939 1940 1975 1976 2000 2001 -key Cryptography IN2120 5 Cryptography IN2120 6 Terminology Symmetric cryptography (secret key) Encryption: plaintext (cleartext) M is converted into a ciphertext C Alice Bob under the control of a key k. Secret key Secret key We write C = E(M, k). Decryption with key k recovers the plaintext M from the ciphertext C. We write M = D(C, k). Message Message Symmetric ciphers: the secret key is used for both encryption and decryption. Algorithm Algorithm Ciphertext Asymmetric ciphers: Pair of private and public keys where it is encryption decryption computationally infeasible to derive the private decryption key from Plaintext Plaintext the corresponding public encryption key. authorized to encrypt and decrypt Cryptography IN2120 7 Cryptography IN2120 8 Strength of Ciphers Factors for cryptographic strength: Historic ciphers, like the Caesar Letter frequencies Key size. Cipher, are weak because they in English Exhaustive key-search time depends on the key size. fail to hide statistical regularities in the ciphertext. Typical key size for a symmetric cipher is 256 bit. 256 Attacker must try 2 /2 keys on average to find the key, which would take CC millions of years, which is not practical. Caesar Cipher With N different keys, the key size is log2(N). Algorithm strength. Key discovery by cryptanalysis can exploit statistical regularities in the ciphertext. by Unknown Author is licensed under under Authorislicensed Unknown by To prevent cryptanalysis, the bit-patterns / characters in the ciphertext should have a uniform distribution, i.e. all bit-patterns / characters should be ThisPhoto BY-SA equally probable. Cryptography IN2120 9 Cryptography IN2120 10 Claude Shannon (1916 2001) -P Network The Father of Information Theory MIT / Bell Labs Removes statistical regularities in ciphertext plaintext Information Theory - Defined the binary digit bit) as information unit Substitutions & Permutations S S . S Substitute bits e.g. 0001 with 0110 Defined information entropy to measure P amount of information Permute parts e.g. part-1 to part-2 S S . S Cryptography relationship between input and output Model of secrecy systems D influences many output bits ... E Defined perfect secrecy Iterated S-P functions a specific S S S Principle of S-P encryption (substitution & number of times . permutation) to hide statistical regularities Functions must be invertible P ciphertext Cryptography IN2120 11 Cryptography IN2120 12 AES - Advanced Encryption Standard Block Cipher DES (Data Encryption Standard) from 1977 had a 56-bit key and a Block cipher 64-bit block. In the mid-1990s DES could be cracked with exhaustive key search. Plaintext blocks In 1997, NIST announced an open competition for a new block n bits cipher to replace DES. Rijndael designed by Vincent Rijmen Key Block and Joan Daemen from Belgium) was Cipher nominated as AES (Advanced Encryption Standard) in 2001. n bits AES has key sizes of 128, 192 or 256 bit and block size of 128 bit. Ciphertext blocks Cryptography IN2120 13 Cryptography IN2120 14 Block Ciphers: Modes of Operation Electronic Code Book (ECB) Block ciphers can be used in different modes in order to provide Simplest mode of operation specific security protection. Plaintext data is divided into blocks M1, M2 n Common modes include: Each block is then processed separately Plaintext block and key used as inputs to the encryption algorithm M M Electronic Code Book (ECB) Insecure 1 2 Mn Cipher Block Chaining (CBC) K Encrypt K Encrypt K Encrypt Output FeedBack (OFB) C1 C2 Cn Cipher FeedBack (CFB) Secure CounTeR Mode (CTR) K Decrypt K Decrypt K Decrypt M1 M2 Mn Cryptography IN2120 15 Cryptography IN2120 16 Electronic Code Book (ECB-mode) Vulnerability of ECB-mode THIS IS A SIMPLE PLAINTEXT MESSAGE. Encryption Encryption Encryption X&jÜ Ji8(clÄ+#/2Haq% 7Ö1k5a$jA~Kq1 ü AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Encryption Encryption Encryption Lo%91Pa*/qF8Ql0 Lo%91Pa*/qF8Ql0 Lo%91Pa*/qF8Ql0 Cryptography IN2120 17 Cryptography IN2120 18 CTR One-Time-Pad (Gilbert Vernam, 1917) Counter Mode Bob Alice Shared secret Shared secret OTP key K OTP key K k1, k2, k3 ki k1, k2, k3 ki Message Message encryptionCiphertext decryption ci = mi ki mi = ci ki c1, c2, c3 ci bitwise bitwise Plaintext XOR addition XOR-addition Plaintext message M message M Property of bitwise XOR addition: ki ki = 0 and mi = ci ki = mi ki ki OTP offers perfect security assuming the OTP key is perfectly random, of same length as the message, and only used once Cryptography Cryptography IN2120 20 The perfect cipher: One-Time-Pad Block Cipher vs. Stream Cipher Block cipher Stream cipher Plaintext blocks Key Note that the key n bits stream repeats itself and is not totally random, hence a Key stream cipher is not Key Block stream a One-Time-Pad. Cipher generator Key stream n bits Old version used a paper tape of random data Ciphertext blocks Plaintext stream Ciphertext stream Modern versions can use DVDs with Gbytes of random data Cryptography IN2120 21 Cryptography IN2120 22 Hash Functions Idea: characteristic for the large dataset or (Extremely simple) example: take the last 4 digits of a credit card number INTEGRITY CHECK FUNCTIONS Image Source: https://www.syssolutionsllc.com/page/Addons/CreditCardHolderName Source: Image Cryptography IN2120 23 Cryptography IN2120 24 Hash functions (message digest functions) Properties of hash functions Requirements for a one-way hash function h: x ? x x ? ? ? 1.Ease of computation: given x, it is easy to compute h(x). 2.Compression: h maps inputs x of arbitrary bitlength to outputs h(x) of a fixed bitlength n. 3.One-way: given a value y, it is computationally infeasible to find an h(x) h(.) h(x) h(x) h(.) input x so that h(x)=y. 4.Collision resistance: it is computationally infeasible to find x and , Ease of Pre-image Collisions Weak collision Strong where x , with h(x)=h( ) (note: two variants of this property). computation resistance exist but are resistance collision hard to find (2nd pre-image resistance resistance) Cryptography IN2120 25 Cryptography IN2120 26 Applications of hash functions Well-known hash functions Comparing files MD5 (1991): 128 bit digest. Relatively easy to break by finding collisions, due to short digest and poor design. Not to be used in new applications, but may be used in Protection of password legacy applications. Authentication of SW distributions SHA-1 (Secure Hash Algorithm):160 bit digest. Designed by NSA in 1995 to operate Bitcoin with DSA (Digital Signature Standard). Attacks exist. Not recommended, but Generation of Message Authentication Codes (MAC) sometimes still in use. Digital signatures SHA-2 designed by NSA in 2001 provides 224, 256, 384, and 512 bit digest. Pseudo number generation/Mask generation functions Considered secure. Replacement for SHA-1. Key derivation SHA-3: designed by Joan Daemen + others in 2010. Standardized in 2015. Digest of: 224, 256, 384, and 512 bit. SHA-3 has little use, because SHA-2 is considered strong. Cryptography IN2120 27 Cryptography IN2120 28 Hash Function for Integrity Protection Message Authentication Codes h(M) A message M with a simple message hash h(M) can be changed by attacker. hash In communications, we need to verify the origin of data, i.e. we need message hash sent together Verify h(M) = h( ) authentication. with message M MAC (message authentication code) can use hash function as h(M, k) i.e. with hash h( ) message M and a secret key k as input. Hash To validate and authenticate a message, the receiver has to share the same function secret key used to compute the MAC with the sender. Hash A third party who does not know the key cannot validate the MAC. function Received Alice Message M Bob message Cryptography IN2120 29 Cryptography IN2120 30 Practical message integrity with MAC MAC and MAC functions h(M,K) Terminology MAC MAC is the computed message authentication code h(M, k) MAC sent Verify h(M,K) = h( ) MAC function is the algorithm used to compute a MAC together with message M MAC functions, a.k.a.
Load more

Recommended publications
  • The Design of Rijndael: AES - the Advanced Encryption Standard/Joan Daemen, Vincent Rijmen
    Joan Daernen · Vincent Rijrnen Theof Design Rijndael AES - The Advanced Encryption Standard With 48 Figures and 17 Tables Springer Berlin Heidelberg New York Barcelona Hong Kong London Milan Paris Springer TnL-1Jn Joan Daemen Foreword Proton World International (PWI) Zweefvliegtuigstraat 10 1130 Brussels, Belgium Vincent Rijmen Cryptomathic NV Lei Sa 3000 Leuven, Belgium Rijndael was the surprise winner of the contest for the new Advanced En­ cryption Standard (AES) for the United States. This contest was organized and run by the National Institute for Standards and Technology (NIST) be­ ginning in January 1997; Rij ndael was announced as the winner in October 2000. It was the "surprise winner" because many observers (and even some participants) expressed scepticism that the U.S. government would adopt as Library of Congress Cataloging-in-Publication Data an encryption standard any algorithm that was not designed by U.S. citizens. Daemen, Joan, 1965- Yet NIST ran an open, international, selection process that should serve The design of Rijndael: AES - The Advanced Encryption Standard/Joan Daemen, Vincent Rijmen. as model for other standards organizations. For example, NIST held their p.cm. Includes bibliographical references and index. 1999 AES meeting in Rome, Italy. The five finalist algorithms were designed ISBN 3540425802 (alk. paper) . .. by teams from all over the world. 1. Computer security - Passwords. 2. Data encryption (Computer sCIence) I. RIJmen, In the end, the elegance, efficiency, security, and principled design of Vincent, 1970- II. Title Rijndael won the day for its two Belgian designers, Joan Daemen and Vincent QA76.9.A25 D32 2001 Rijmen, over the competing finalist designs from RSA, IBl\!I, Counterpane 2001049851 005.8-dc21 Systems, and an English/Israeli/Danish team.
    [Show full text]
  • A Quantitative Study of Advanced Encryption Standard Performance
    United States Military Academy USMA Digital Commons West Point ETD 12-2018 A Quantitative Study of Advanced Encryption Standard Performance as it Relates to Cryptographic Attack Feasibility Daniel Hawthorne United States Military Academy, [email protected] Follow this and additional works at: https://digitalcommons.usmalibrary.org/faculty_etd Part of the Information Security Commons Recommended Citation Hawthorne, Daniel, "A Quantitative Study of Advanced Encryption Standard Performance as it Relates to Cryptographic Attack Feasibility" (2018). West Point ETD. 9. https://digitalcommons.usmalibrary.org/faculty_etd/9 This Doctoral Dissertation is brought to you for free and open access by USMA Digital Commons. It has been accepted for inclusion in West Point ETD by an authorized administrator of USMA Digital Commons. For more information, please contact [email protected]. A QUANTITATIVE STUDY OF ADVANCED ENCRYPTION STANDARD PERFORMANCE AS IT RELATES TO CRYPTOGRAPHIC ATTACK FEASIBILITY A Dissertation Presented in Partial Fulfillment of the Requirements for the Degree of Doctor of Computer Science By Daniel Stephen Hawthorne Colorado Technical University December, 2018 Committee Dr. Richard Livingood, Ph.D., Chair Dr. Kelly Hughes, DCS, Committee Member Dr. James O. Webb, Ph.D., Committee Member December 17, 2018 © Daniel Stephen Hawthorne, 2018 1 Abstract The advanced encryption standard (AES) is the premier symmetric key cryptosystem in use today. Given its prevalence, the security provided by AES is of utmost importance. Technology is advancing at an incredible rate, in both capability and popularity, much faster than its rate of advancement in the late 1990s when AES was selected as the replacement standard for DES. Although the literature surrounding AES is robust, most studies fall into either theoretical or practical yet infeasible.
    [Show full text]
  • SHA-3 and the Hash Function Keccak
    Christof Paar Jan Pelzl SHA-3 and The Hash Function Keccak An extension chapter for “Understanding Cryptography — A Textbook for Students and Practitioners” www.crypto-textbook.com Springer 2 Table of Contents 1 The Hash Function Keccak and the Upcoming SHA-3 Standard . 1 1.1 Brief History of the SHA Family of Hash Functions. .2 1.2 High-level Description of Keccak . .3 1.3 Input Padding and Generating of Output . .6 1.4 The Function Keccak- f (or the Keccak- f Permutation) . .7 1.4.1 Theta (q)Step.......................................9 1.4.2 Steps Rho (r) and Pi (p).............................. 10 1.4.3 Chi (c)Step ........................................ 10 1.4.4 Iota (i)Step......................................... 11 1.5 Implementation in Software and Hardware . 11 1.6 Discussion and Further Reading . 12 1.7 Lessons Learned . 14 Problems . 15 References ......................................................... 17 v Chapter 1 The Hash Function Keccak and the Upcoming SHA-3 Standard This document1 is a stand-alone description of the Keccak hash function which is the basis of the upcoming SHA-3 standard. The description is consistent with the approach used in our book Understanding Cryptography — A Textbook for Students and Practioners [11]. If you own the book, this document can be considered “Chap- ter 11b”. However, the book is most certainly not necessary for using the SHA-3 description in this document. You may want to check the companion web site of Understanding Cryptography for more information on Keccak: www.crypto-textbook.com. In this chapter you will learn: A brief history of the SHA-3 selection process A high-level description of SHA-3 The internal structure of SHA-3 A discussion of the software and hardware implementation of SHA-3 A problem set and recommended further readings 1 We would like to thank the Keccak designers as well as Pawel Swierczynski and Christian Zenger for their extremely helpful input to this document.
    [Show full text]
  • Advanced Encryption Standard AES Alternatives
    Outline Advanced Encryption Standard AES Alternatives CPSC 467b: Cryptography and Computer Security Instructor: Michael Fischer Lecture by Ewa Syta Lecture 5 January 23, 2012 CPSC 467b, Lecture 5 1/35 Outline Advanced Encryption Standard AES Alternatives Advanced Encryption Standard AES Alternatives CPSC 467b, Lecture 5 2/35 Outline Advanced Encryption Standard AES Alternatives Advanced Encryption Standard CPSC 467b, Lecture 5 3/35 Outline Advanced Encryption Standard AES Alternatives New Standard Rijndael was the winner of NISTs competition for a new symmetric key block cipher to replace DES. An open call for algorithms was made in 1997 and in 2001 NIST announced that AES was approved as FIPS PUB 197. Minimum requirements: I Block size of 128-bits I Key sizes of 128-, 192-, and 256-bits I Strength at the level of triple DES I Better performance than triple DES I Available royalty-free worldwide Five AES finalists: I MARS, RC6, Rijndael, Serpent, and Twofish CPSC 467b, Lecture 5 4/35 Outline Advanced Encryption Standard AES Alternatives Details Rijndael was developed by two Belgian cryptographers Vincent Rijmen and Joan Daemen. Rijndael is pronounced like Reign Dahl, Rain Doll or Rhine Dahl. Name confusion I AES is the name of a standard. I Rijndael is the name of a cipher. I AES is a restricted version of Rijndael which was designed to handle additional block sizes and key lengths. CPSC 467b, Lecture 5 5/35 Outline Advanced Encryption Standard AES Alternatives More details AES was a replacement for DES. I Like DES, AES is an iterated block cipher. I Unlike DES, AES is not a Feistel cipher.
    [Show full text]
  • Exploring NIST LWC/PQC Synergy with R5sneik How SNEIK 1.1 Algorithms Were Designed to Support Round5
    Exploring NIST LWC/PQC Synergy with R5Sneik How SNEIK 1.1 Algorithms were Designed to Support Round5 Markku-Juhani O. Saarinen∗ PQShield Ltd. Prama House, 267 Banbury Road Oxford OX2 7HT, United Kingdom [email protected] Abstract. Most NIST Post-Quantum Cryptography (PQC) candidate algorithms use symmetric primitives internally for various purposes such as “seed expansion” and CPA to CCA transforms. Such auxiliary symmetric operations constituted only a fraction of total execution time of traditional RSA and ECC algorithms, but with faster lattice algorithms the impact of symmetric algorithm characteristics can be very significant. A choice to use a specific PQC algorithm implies that its internal symmetric compo- nents must also be implemented on all target platforms. This can be problematic for lightweight, embedded (IoT), and hardware implementations. It has been widely ob- served that current NIST-approved symmetric components (AES, GCM, SHA, SHAKE) form a major bottleneck on embedded and hardware implementation footprint and performance for many of the most efficient NIST PQC proposals. Meanwhile, a sepa- rate NIST effort is ongoing to standardize lightweight symmetric cryptography (LWC). Therefore it makes sense to explore which NIST LWC candidates are able to efficiently support internals of post-quantum asymmetric cryptography. We discuss R5Sneik, a variant of Round5 that internally uses SNEIK 1.1 permutation-based primitives instead of SHAKE and AES-GCM. The SNEIK family includes parameter selections specifically designed to support lattice cryptography. R5Sneik is up to 40% faster than Round5 for some parameter sets on ARM Cortex M4, and has substantially smaller implementation footprint. We introduce the concept of a fast Entropy Distribution Function (EDF), a lightweight diffuser that we expect to have sufficient security properties for lattice seed expansion and many types of sampling, but not for plain encryption or hashing.
    [Show full text]
  • Advanced Encryption Standard AES Is a Block Cipher That Comes from The
    Advanced Encryption Standard AES is a block cipher that comes from the cipher Rijndael invented by Joan Daemen and Vincent Rijmen. It won the AES contest in 2000. It is a block cipher. The block length and key length for Rijndael can be chosen inde- pendently to be 128, 192 or 256 bits. AES specifies that the block size is 128 bits. It has 10, 12 or 14 rounds, depending on the key length. The rounds do not have a Feistel structure. It was designed to be simple, to be resistant against all known attacks and to have fast and compact code on many platforms. 1 Rijndael was based on an older cipher called Square. The was one known attack on Square, and the designers of Rijndael fixed it in Rijn- dael. The design specifications of Rijndael are pub- lic. In 2009, the first known attack on AES was published. A related-key attack takes 2119 steps to break 256-bit AES and 2176 steps to break 192-bit AES. This attack does not work on 128-bit AES, whose fastest known attack is brute force and takes 2128 steps. None of these attacks is feasible. There are attacks on AES with a reduced num- ber of rounds. 2 Rijndael has 10, 12 or 14 rounds, if the key length is 128, 192 or 256 bits. Different parts of the Rijndael algorithm op- erate on the intermediate result, called the State. The State is a square array of bytes with four rows and four columns. The Key is expanded and placed in an array W[4*(Nr+1)], where Nr is the number of rounds.
    [Show full text]
  • The Making of Rijndael
    The making of Rijndael The making of Rijndael Joan Daemen1 and Vincent Rijmen2 1Radboud University 2KU Leuven Histocrypt 2019, June 23-26, Mons, Belgique 1 / 30 The making of Rijndael The setting Dark ages Dark ages of symmetric cryptography Before the discovery of differential and linear cryptanalysis Research in stream ciphers dominated by linear feedback shift register (LFSR) bases schemes study of properties of sequences, e.g., linear complexity Research in block ciphers dominated by Data Encryption Standard (DES) design rationale not published study of properties of (vector) boolean functions 2 / 30 . The making of Rijndael The setting Dark ages How to build a block cipher, back then Claude Shannon’s concepts: confusion: mainly associated with non-linearity diffusion: mixing of bits Property-preserving paradigm security of a block cipher lies in its S-boxes build strong cipher with right properties …from S-boxes with same properties Non-linearity distance to linear functions bent and almost perfect non-linear (APN) functions Diffusion avalanche effect strict avalanche criterion (SAC) 4 / 30 The making of Rijndael The setting Age of enlightenment: discovery of LC/DC Discovery of differential and linear cryptanalysis Biham and Shamir 1990: differential cryptanalysis (DC) exploits high-probability difference propagation to guess a partial key used in remaining rounds propagation along trail Q with probability DP(Q) Matsui 1992: linear cryptanalysis (LC) exploits high correlations over all but a few rounds to guess a partial key used
    [Show full text]
  • Crypto: Symmetric-Key Cryptography
    Computer Security Course. Dawn Song Crypto: Symmetric-Key Cryptography Slides credit: Dan Boneh, David Wagner, Doug Tygar Dawn Song Overview • Cryptography: secure communication over insecure communication channels • Three goals – Confidentiality – Integrity – Authenticity Brief History of Crypto • 2,000 years ago – Caesar Cypher: shifting each letter forward by a fixed amount – Encode and decode by hand • During World War I/II – Mechanical era: a mechanical device for encrypting messages • After World War II – Modern cryptography: rely on mathematics and electronic computers Modern Cryptography • Symmetric-key cryptography – The same secret key is used by both endpoints of a communication • Public-key cryptography – Two endpoints use different keys Attacks to Cryptography • Ciphertext only – Adversary has E(m1), E(m2), … • Known plaintext – Adversary has E(m1)&m1, E(m2)&m2, … • Chosen plaintext – Adversary picks m1, m2, … (potentially adaptively) – Adversary sees E(m1), E(m2), … • Chosen ciphertext – Adversary picks E(m1), E(m2), … (potentially adaptively) – Adversary sees m1, m2, … One-time Pad • K: random n-bit key • P: n-bit message (plaintext) • C: n-bit ciphertext • Encryption: C = P xor K • Decryption: P = C xor K • A key can only be used once • Impractical! Block Cipher • Encrypt/Decrypt messages in fixed size blocks using the same secret key – k-bit secret key – n-bit plaintext/ciphertext n bits n bits Plaintext Block E, D Ciphertext Block Key k Bits Feistel cipher Encryption Start with (L0, R0) Li+1=Ri L1 R1 Rn Ln Ri+1=Li xor F(Ri,Ki) Li Ri Rn+1-i Ln+1-i Decryption Start with (Rn+1, Ln+1) Ri=Li+1 Li=Ri+1 xor F(Li+1,Ki) DES - Data Encryption Standard (1977) • Feistel cipher • Works on 64 bit block with 56 bit keys • Developed by IBM (Lucifer) improved by NSA • Brute force attack feasible in 1997 AES – Advanced Encryption Standard (1997) • Rijndael cipher – Joan Daemen & Vincent Rijmen • Block size 128 bits • Key can be 128, 192, or 256 bits Abstract Block Ciphers: PRPs and PRFs PRF: F: K X Y such that: exists “efficient” algorithm to eval.
    [Show full text]
  • Ascon V1.2. Submission to NIST
    Ascon v1.2 Submission to NIST Christoph Dobraunig Maria Eichlseder Florian Mendel Martin Schläffer May 31, 2021 [email protected] https://ascon.iaik.tugraz.at Contents 1 Introduction4 2 Specification5 2.1 Algorithms in the Ascon Cipher Suite..................5 2.2 Recommended Parameter Sets.......................6 2.3 State and Notation.............................7 2.4 Authenticated Encryption.........................8 2.4.1 Initialization.............................8 2.4.2 Processing Associated Data....................9 2.4.3 Processing Plaintext/Ciphertext................. 10 2.4.4 Finalization............................. 10 2.5 Hashing................................... 11 2.5.1 Initialization............................. 11 2.5.2 Absorbing Message......................... 12 2.5.3 Squeezing.............................. 12 2.6 Permutation................................. 13 2.6.1 Addition of Constants....................... 13 2.6.2 Substitution Layer......................... 14 2.6.3 Linear Diffusion Layer....................... 14 3 Security Claims 15 3.1 Authenticated Encryption......................... 15 3.2 Hashing................................... 16 4 Features 17 4.1 Properties of Ascon ............................. 17 4.1.1 Features for Lightweight Applications.............. 19 4.1.2 Features for High-Performance Applications.......... 20 5 Design Rationale 21 5.1 Design of the Modes............................ 21 5.1.1 Choice of the Mode for Authenticated Encryption....... 21 5.1.2 Choice of the Mode for Hashing and Extendable Output Func- tion.................................. 22 5.1.3 Choice of the Family Members.................. 23 5.1.4 Choice of the Initial Values.................... 24 5.2 Design of the Permutation......................... 24 5.2.1 Choice of the Round Constants.................. 24 5.2.2 Choice of the Substitution Layer................. 24 5.2.3 Choice of the Linear Diffusion Layer............... 25 2 6 Security Analysis 27 6.1 Overview of Best Known Attacks....................
    [Show full text]
  • Innovations in Symmetric Cryptography
    Innovations in symmetric cryptography Joan Daemen STMicroelectronics, Belgium SSTIC, Rennes, June 5, 2013 1 / 46 Outline 1 The origins 2 Early work 3 Rijndael 4 The sponge construction and Keccak 5 Conclusions 2 / 46 The origins Outline 1 The origins 2 Early work 3 Rijndael 4 The sponge construction and Keccak 5 Conclusions 3 / 46 The origins Symmetric crypto around ’89 Stream ciphers: LFSR-based schemes no actual design many mathematical papers on linear complexity Block ciphers: DES design criteria not published DC [Biham-Shamir 1990]: “DES designers knew what they were doing” LC [Matsui 1992]: “well, kind of” Popular paradigms, back then (but even now) property-preservation: strong cipher requires strong S-boxes confusion (nonlinearity): distance to linear functions diffusion: (strict) avalanche criterion you have to trade them off 4 / 46 The origins The banality of DES Data encryption standard: datapath 5 / 46 The origins The banality of DES Data encryption standard: F-function 6 / 46 The origins Cellular automata based crypto A different angle: cellular automata Simple local evolution rule, complex global behaviour Popular 3-bit neighborhood rule: 0 ⊕ ai = ai−1 (ai OR ai+1) 7 / 46 The origins Cellular automata based crypto Crypto based on cellular automata CA guru Stephen Wolfram at Crypto ’85: looking for applications of CA concrete stream cipher proposal Crypto guru Ivan Damgård at Crypto ’89 hash function from compression function proof of collision-resistance preservation compression function with CA Both broken stream cipher in
    [Show full text]
  • The Block Cipher SQUARE
    The Block Cipher SQUARE Joan Daemen 1 Lars Knudsen 2 Vincent Rijmen .2 1 Banksys Haachtesteenweg 1442 B-1130 Brussel, Belgium Daemen. J@banksys. be 2 Katholieke Universiteit Leuven , ESAT-COSIC K. Mercierlaan 94, B-3001 Heverlee, Belgium lars. knudsen@esat, kuleuven, ac. be vincent, rijmen@esat, kuleuven, ac. be Abstract. In this paper we present a new 128-bit block cipher called SQUARE. The original design of SQUARE concentrates on the resistance against differential and linear cryptanalysis. However, after the initial design a dedicated attack was mounted that forced us to augment the number of rounds. The goal of this paper is the publication of the resulting cipher for public scrutiny. A C implementation of SQUARE is available that runs at 2.63 MByte/s on a 100 MHz Pentium. Our M68HC05 Smart Card implementation fits in 547 bytes and takes less than 2 msec. (4 MHz Clock). The high degree of parallellism allows hardware implementations in the Gbit/s range today. 1 Introduction In this paper, we propose the block cipher SQUARE. It has a block length and key length of 128 bits. However, its modular design approach allows extensions to higher block lengths in a straightforward way. The cipher has a new self-reciprocM structure, similar to that of THREEWAY and SHARK [2, 15]. The structure of the cipher, i.e., the types of building blocks and their in- teraction, has been carefully chosen to allow very efficient implementations on a wide range of processors. The specific choice of the building blocks themselves has been led by the resistance of the cipher against differential and linear crypt- analysis.
    [Show full text]
  • The Rijndael Block Cipher, Other Than Encryption
    Joan Daemen Vincent Rijmen Note on naming Rijndael Note on naming 1. Introduction After the selection of Rijndael as the AES, it was decided to change the names of some of its component functions in order to improve the readability of the standard. However, we see that many recent publications on Rijndael and the AES still use the old names, mainly because the original submission documents using the old names, are still available on the Internet. In this note we repeat quickly the new names for the component functions. Additionally, we remind the reader on the difference between AES and Rijndael and present an overview of the most important references for Rijndael and the AES. 2. References [1] Joan Daemen and Vincent Rijmen, AES submission document on Rijndael, June 1998. [2] Joan Daemen and Vincent Rijmen, AES submission document on Rijndael, Version 2, September 1999. http://csrc.nist.gov/CryptoToolkit/aes/rijndael/Rijndael.pdf [3] FIPS PUB 197, Advanced Encryption Standard (AES), National Institute of Standards and Technology, U.S. Department of Commerce, November 2001. http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf [4] Joan Daemen and Vincent Rijmen, The Design of Rijndael, AES - The Advanced Encryption Standard, Springer-Verlag 2002 (238 pp.) 3. Naming The names of the component functions of Rijndael have been modified between the publication of [2] and that of [3]. Table 1 lists the two versions of names. We recommend using the new names. Old naming New naming ByteSub SubBytes ShiftRow ShiftRows MixColumn MixColumns AddRoundKey AddRoundKey Table 1: Old and new names of the Rijndael component functions 4.
    [Show full text]