DOCSLIB.ORG

A Fast New DES Implementation in Software

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
A Fast New DES Implementation in Software A Fast New DES Implementation in Software Eli Biham Computer Science Department Technion Israel Institute of Technology Haif a Israel Email bihamcstechnionacil WWW httpwwwcstechnionacilbiham Abstract In this pap er we descr ib e a f ast new DES implementation Thi s implementation i s about ve times f aster than the f astest known DES implementation on a bit Alpha computer and about three times f aster than than our new optimized DES implementation on bit computers Thi s implementation us e s a nonstandard repre s entation and view the pro ce ssor as a SIMD computer ie as parallel onebit pro ce ssors computing the same instruction We also di scuss the application of this implementation to other ciphers We descr ib e a new optimized standard implementation of DES on bit pro ce ssors which i s about twice f aster than the f astest known standard DES implementation on the same pro ce ssor Our implementations can also b e us e d for f ast exhaustive s earch in software which can nd a key in only a few days or a few weeks on exi sting parallel computers and computer networks Introduction In this pap er we descr ib e a new implementation of DES which can b e very eciently executed in software Thi s implementation i s b e st us e d with a non standard order of the bits of the DES blo cks Thi s implementation do e s not suer f rom high overhead of computing p ermutations of bits Instead we view a pro ce ssor with for example bit words as a SIMD parallel computer which can compute onebit operations s imultaneously while the bits of each blo ck are s et in dierent words of which the rst bit i s always of the rst blo ck the s econd bit b elongs to the s econd blo ck etc The operations that DES us e s are as follows The XOR operation in our view the XOR operation of the pro ce ssor computes onebit XORs The expans ion and p ermutation operations thes e operations do not cost any operation s ince instead of changing the order of words or duplicating words we can addre ss the require d word directly We remain with the S b oxes Usual implementations of S b oxes us e table lo okups However in our repre s entation table lo okups are very inecient s ince we have to collect s ix bits each bit f rom a dierent word Technion - Computer Science Department Technical Report CS0891 1997 Cipher Sp ee d DES Er ic Youngs lib des Gost SAFER Blowsh Our DES Implementation Our DES Implementation tr iple DES Our f astest DES Our f astest DES Triple DES Estimation bas e d on Table The sp ee ds of our implementations and of various ciphers on a MHz Alpha pro ce ssor in Mbps combine them into one index to the table and after the table lo okup take the four re sultant bits and put each of them in a dierent word We obs erved that there i s a much f aster implementation of the S b oxes in our repre s entation they can b e repre s ented by their logical gate circuit In such an implementation each S b ox i s typically repre s ented by about gates and thus we can implement an S b ox by about instructions We actually view the whole cipher by its gate circuit and apply it in software In this implementation we actually compute the circuit times in parallel as the s ize of the pro ce ssor word and thus can gain a high sp ee dup even though we us e very s imple operations In average on bit pro ce ssors each S b ox costs about instructions for each encrypted blo ck while each instruction takes only one clo ck cycle The full circuit of DES contains about gates including the key schedul ing which costs nothing and thus we can compute DES times in about instructions on bit pro ce ssors In average we re sult with about instructions for the encryption of each DES blo ck Conversion f rom and to the standard blo ck repre s entation takes together about instructions p er blo ck and thus encryption of standard repre s entations with our implementation takes about instructions For compar i son our f ast standard implementation of DES descr ib e d in this pap er require s about instructions for each blo ck Table summarize s the sp ee ds of our implementations a standard f ast DES implementation Er ic Youngs lib des and of various f ast ciphers The same idea can b e applied to other ciphers Our implementation of thes e ciphers i s ecient e sp ecially when the cipher do e s not us e all the p ower of the machine instructions ie when each instruction mixe s only a few of the bits such as S b oxes or e ightbit additions on bit pro ce ssors and when the word s ize of the pro ce ssor i s large such as bits when the cipher us e shorter regi sters For Technion - Computer Science Department Technical Report CS0891 1997 example our implementation of Feal i s exp ected to b e about times f aster than direct implementations Both variants of Lucifer and GOST can also b e applied very eciently us ing this implementation Our implementation of ciphers which us e more complex operations such as multiplication or large S b oxes require s more instructions to s imulate the complex operations and i s thus le ss ecient In Section we descr ib e an optimized standard implementation on bit computers It us e s the bit regi sters of a bit pro ce ssor and runs almost twice f aster than the f astest implementation des igned for bit architectures on the same pro ce ssor It even runs f aster than f ast ciphers such as GOST SAFER and Blowsh The sp ee d i s gained by us ing the long bit re gi sters eectively by all other means this i s a standard implementation We sugge st a new DESlike cipher to which we call WDES bas e d on the structure of this f ast implementation but i s about times f aster In Section we di scuss us ing thes e f ast implementations for exhaustive s earch and conclude that it i s applicable even today us ing exi sting general purp os e parallel computers and computer networks The New NonStandard DES Implementation Thi s implementation us e s a nonstandard repre s entation of the data in software and in particular it do e s not have any table lo okup Instead of encrypting many bit words one at a time we encrypt s imultaneously words and each op eration encrypts one bit in each of the words Actually we view a bit pro ce ssor as a SIMD computer with onebit pro ce ssors Thi s implementation s imulates a f ast DES hardware whose number of gates i s minimal and computes each gate by a s ingle instruction In particular the S b oxes are computed by their gatecircuit us ing the XOR AND OR and NOT operations and the p ermutations and expans ions do not require any instruction s ince they can b e viewed as only changing the naming of the regi sters Although the S b oxes are implemented in more instructions than in usual implementations the paralleli sm of this implementation sp ee ds up the implementation much more than the S b ox implementation re duces it Moreover some of the operations can b e optimized out in some cas e s such as if some parts of the S b oxes are s imilar same or complement We repre s ent the S b oxes by their gate circuit us ing the b e stknown XOR AND OR and NOT operations optimized to re duce the total number of gates Although the problem of nding the b e st such circuit i s still open we found the following optimization which require s at most gates p er DES S b ox and only gates in average In the descr iption we denote the s ix input bits by Technion - Computer Science Department Technical Report CS0891 1997 Instructions Expans ion Key mixing P XOR with the left half S b oxes in average loadstore load load store Total p er round Table The number of instructions in each round on Alpha Total Average p er Blo ck IPFP rounds gates p er bit Conversion of repre s entation Table The number of instructions in DES on Alpha abcdef We compute all the functions of d and e into regi sters excluding the constant or constant It require s two NOTs d e and additional operations d e d e are already known Thi s computation i s done only once for each S b ox For each output bit of the S b ox we compute the re sult us ing thes e functions We us e s ix operations for each line of the S b ox and s ix operations to combine the re sults together operations for each output bit In total we us e at most gates for each S b ox but in average we need only about gates p er S b ox Each combination of four values the four values of b c or the four values of a f eg combining the quarters of each of the four lines b c b c b c b c or combining the four lines are combined by assuming the rst cas e b f f c f f c f f f f f 00 10 00 01 00 01 10 11 00 where the underlined values are known constants and f S abcdef where bc d e are the actual values of the input f i s one of the values kept in regi sters bc above and a f are the values assumed for a f to b e instantiated in the next step More accurately in the intermediate steps we compute the combinations of S b ox entrie s as sugge sted by the above equation eg f f f f f 00 00 01 00 10 f f f f rather than the various values of the entrie s themselves 00 01 10 11 Tables and descr ib e the maximum number of gates p er round and for the 20 full DES Therefore we exp ect the sp ee d to b e about Mbps on Technion - Computer Science Department Technical Report CS0891 1997 MHz Alpha pro ce ssors In practice we achieve sp ee ds of about Mbps s ince the pro ce ssor can apply more than one instruction in each clo ck cycle Conversion b etween the standard and the nonstandard repre s entations can also b e done in about instructions
Load more

Recommended publications
  • FIPS 140-2 Non-Proprietary Security Policy Oracle Linux 7 NSS
    FIPS 140-2 Non-Proprietary Security Policy Oracle Linux 7 NSS Cryptographic Module FIPS 140-2 Level 1 Validation Software Version: R7-4.0.0 Date: January 22nd, 2020 Document Version 2.3 © Oracle Corporation This document may be reproduced whole and intact including the Copyright notice. Title: Oracle Linux 7 NSS Cryptographic Module Security Policy Date: January 22nd, 2020 Author: Oracle Security Evaluations – Global Product Security Contributing Authors: Oracle Linux Engineering Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA 94065 U.S.A. Worldwide Inquiries: Phone: +1.650.506.7000 Fax: +1.650.506.7200 oracle.com Copyright © 2020, Oracle and/or its affiliates. All rights reserved. This document is provided for information purposes only and the contents hereof are subject to change without notice. This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose. Oracle specifically disclaim any liability with respect to this document and no contractual obligations are formed either directly or indirectly by this document. This document may reproduced or distributed whole and intact including this copyright notice. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Oracle Linux 7 NSS Cryptographic Module Security Policy i TABLE OF CONTENTS Section Title
    [Show full text]
  • Miss in the Middle
    Miss in the middle By: Gal Leonard Keret Miss in the Middle Attacks on IDEA, Khufu and Khafre • Written by: – Prof. Eli Biham. – Prof. Alex Biryukov. – Prof. Adi Shamir. Introduction • So far we used traditional differential which predict and detect statistical events of highest possible probability. Introduction • A new approach is to search for events with probability one, whose condition cannot be met together (events that never happen). Impossible Differential • Random permutation: 휎 푀0 = 푎푛푦 퐶 표푓 푠푖푧푒 푀0. • Cipher (not perfect): 퐸 푀0 = 푠표푚푒 퐶 표푓 푠푖푧푒 푀0. • Events (푚 ↛ 푐) that never happen distinguish a cipher from a random permutation. Impossible Differential • Impossible events (푚 ↛ 푐) can help performing key elimination. • All the keys that lead to impossibility are obviously wrong. • This way we can filter wrong key guesses and leaving the correct key. Enigma – for example • Some of the attacks on Enigma were based on the observation that letters can not be encrypted to themselves. 퐸푛푖푔푚푎(푀0) ≠ 푀0 In General • (푀0, 퐶1) is a pair. If 푀0 푀0 → 퐶1. • 푀 ↛ 퐶 . 0 0 Some rounds For any key • ∀ 푘푒푦| 퐶1 → 퐶0 ↛ is an impossible key. Cannot lead to 퐶0. Some rounds Find each keys Decrypt 퐶1back to 퐶0. IDEA • International Data Encryption Algorithm. • First described in 1991. • Block cipher. • Symmetric. • Key sizes: 128 bits. • Block sizes: 64 bits. ⊕ - XOR. ⊞ - Addition modulo 216 ⊙ - Multiplication modulo 216+1 Encryption security • Combination of different mathematical groups. • Creation of "incompatibility“: ∗ • 푍216+1 → 푍216 ∗ • 푍216 → 푍216+1 ∗ ∗ Remark: 푍216+1 doesn’t contain 0 like 푍216 , so in 푍216+1 0 will be converted to 216 since 0 ≡ 216(푚표푑 216).
    [Show full text]
  • Report on the AES Candidates
    Rep ort on the AES Candidates 1 2 1 3 Olivier Baudron , Henri Gilb ert , Louis Granb oulan , Helena Handschuh , 4 1 5 1 Antoine Joux , Phong Nguyen ,Fabrice Noilhan ,David Pointcheval , 1 1 1 1 Thomas Pornin , Guillaume Poupard , Jacques Stern , and Serge Vaudenay 1 Ecole Normale Sup erieure { CNRS 2 France Telecom 3 Gemplus { ENST 4 SCSSI 5 Universit e d'Orsay { LRI Contact e-mail: [email protected] Abstract This do cument rep orts the activities of the AES working group organized at the Ecole Normale Sup erieure. Several candidates are evaluated. In particular we outline some weaknesses in the designs of some candidates. We mainly discuss selection criteria b etween the can- didates, and make case-by-case comments. We nally recommend the selection of Mars, RC6, Serp ent, ... and DFC. As the rep ort is b eing nalized, we also added some new preliminary cryptanalysis on RC6 and Crypton in the App endix which are not considered in the main b o dy of the rep ort. Designing the encryption standard of the rst twentyyears of the twenty rst century is a challenging task: we need to predict p ossible future technologies, and wehavetotake unknown future attacks in account. Following the AES pro cess initiated by NIST, we organized an op en working group at the Ecole Normale Sup erieure. This group met two hours a week to review the AES candidates. The present do cument rep orts its results. Another task of this group was to up date the DFC candidate submitted by CNRS [16, 17] and to answer questions which had b een omitted in previous 1 rep orts on DFC.
    [Show full text]
  • State of the Art in Lightweight Symmetric Cryptography
    State of the Art in Lightweight Symmetric Cryptography Alex Biryukov1 and Léo Perrin2 1 SnT, CSC, University of Luxembourg, [email protected] 2 SnT, University of Luxembourg, [email protected] Abstract. Lightweight cryptography has been one of the “hot topics” in symmetric cryptography in the recent years. A huge number of lightweight algorithms have been published, standardized and/or used in commercial products. In this paper, we discuss the different implementation constraints that a “lightweight” algorithm is usually designed to satisfy. We also present an extensive survey of all lightweight symmetric primitives we are aware of. It covers designs from the academic community, from government agencies and proprietary algorithms which were reverse-engineered or leaked. Relevant national (nist...) and international (iso/iec...) standards are listed. We then discuss some trends we identified in the design of lightweight algorithms, namely the designers’ preference for arx-based and bitsliced-S-Box-based designs and simple key schedules. Finally, we argue that lightweight cryptography is too large a field and that it should be split into two related but distinct areas: ultra-lightweight and IoT cryptography. The former deals only with the smallest of devices for which a lower security level may be justified by the very harsh design constraints. The latter corresponds to low-power embedded processors for which the Aes and modern hash function are costly but which have to provide a high level security due to their greater connectivity. Keywords: Lightweight cryptography · Ultra-Lightweight · IoT · Internet of Things · SoK · Survey · Standards · Industry 1 Introduction The Internet of Things (IoT) is one of the foremost buzzwords in computer science and information technology at the time of writing.
    [Show full text]
  • New Comparative Study Between DES, 3DES and AES Within Nine Factors
    JOURNAL OF COMPUTING, VOLUME 2, ISSUE 3, MARCH 2010, ISSN 2151-9617 152 HTTPS://SITES.GOOGLE.COM/SITE/JOURNALOFCOMPUTING/ New Comparative Study Between DES, 3DES and AES within Nine Factors Hamdan.O.Alanazi, B.B.Zaidan, A.A.Zaidan, Hamid A.Jalab, M.Shabbir and Y. Al-Nabhani ABSTRACT---With the rapid development of various multimedia technologies, more and more multimedia data are generated and transmitted in the medical, also the internet allows for wide distribution of digital media data. It becomes much easier to edit, modify and duplicate digital information .Besides that, digital documents are also easy to copy and distribute, therefore it will be faced by many threats. It is a big security and privacy issue, it become necessary to find appropriate protection because of the significance, accuracy and sensitivity of the information. , which may include some sensitive information which should not be accessed by or can only be partially exposed to the general users. Therefore, security and privacy has become an important. Another problem with digital document and video is that undetectable modifications can be made with very simple and widely available equipment, which put the digital material for evidential purposes under question. Cryptography considers one of the techniques which used to protect the important information. In this paper a three algorithm of multimedia encryption schemes have been proposed in the literature and description. The New Comparative Study between DES, 3DES and AES within Nine Factors achieving an efficiency, flexibility and security, which is a challenge of researchers. Index Terms—Data Encryption Standared, Triple Data Encryption Standared, Advance Encryption Standared.
    [Show full text]
  • Cryptography Overview Cryptography Basic Cryptographic Concepts Five
    CS 155 Spring 2006 Cryptography Is A tremendous tool Cryptography Overview The basis for many security mechanisms Is not John Mitchell The solution to all security problems Reliable unless implemented properly Reliable unless used properly Something you should try to invent yourself unless you spend a lot of time becoming an expert you subject your design to outside review Basic Cryptographic Concepts Five-Minute University Encryption scheme: functions to encrypt, decrypt data key generation algorithm Secret key vs. public key -1 Public key: publishing key does not reveal key -1 Father Guido Sarducci Secret key: more efficient, generally key = key Hash function, MAC Everything you could remember, five Map input to short hash; ideally, no collisions MAC (keyed hash) used for message integrity years after taking CS255 … ? Signature scheme Functions to sign data, verify signature Web Purchase Secure communication 1 Secure Sockets Layer / TLS SSL/TLS Cryptography Standard for Internet security Public-key encryption Key chosen secretly (handshake protocol) Originally designed by Netscape Key material sent encrypted with public key Goal: “... provide privacy and reliability between two communicating applications” Symmetric encryption Two main parts Shared (secret) key encryption of data packets Signature-based authentication Handshake Protocol Client can check signed server certificate Establish shared secret key using public-key cryptography Signed certificates for authentication And vice-versa, in principal Record
    [Show full text]
  • AES and 3-DES Encryption Support for SNMP Version 3
    AES and 3-DES Encryption Support for SNMP Version 3 The AES and 3-DES Encryption Support for SNMP Version 3 feature enhances the encryption capabilities of Simple Network Management Protocol (SNMP) Version 3. The AES and 3-DES Encryption Support for SNMP Version 3 feature adds Advanced Encryption Standard (AES) 128-bit encryption in compliance with RFC 3826. • Finding Feature Information, on page 1 • Prerequisites for AES and 3-DES Encryption Support for SNMP Version 3, on page 1 • Information About AES and 3-DES Encryption Support for SNMP Version 3, on page 2 • How to Configure AES and 3-DES Encryption Support for SNMP Version 3, on page 3 • Additional References , on page 5 • Feature Information for AES and 3-DES Encryption Support for SNMP Version 3, on page 6 Finding Feature Information Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to https://cfnng.cisco.com/. An account on Cisco.com is not required. Prerequisites for AES and 3-DES Encryption Support for SNMP Version 3 • The network management station (NMS) must support Simple Network Management Protocol (SNMP) Version 3 to be able to use this feature.
    [Show full text]
  • Data Encryption Standard
    Data Encryption Standard The Data Encryption Standard (DES /ˌdiːˌiːˈɛs, dɛz/) is a Data Encryption Standard symmetric-key algorithm for the encryption of electronic data. Although insecure, it was highly influential in the advancement of modern cryptography. Developed in the early 1970s atIBM and based on an earlier design by Horst Feistel, the algorithm was submitted to the National Bureau of Standards (NBS) following the agency's invitation to propose a candidate for the protection of sensitive, unclassified electronic government data. In 1976, after consultation with theNational Security Agency (NSA), the NBS eventually selected a slightly modified version (strengthened against differential cryptanalysis, but weakened against brute-force attacks), which was published as an official Federal Information Processing Standard (FIPS) for the United States in 1977. The publication of an NSA-approved encryption standard simultaneously resulted in its quick international adoption and widespread academic scrutiny. Controversies arose out of classified The Feistel function (F function) of DES design elements, a relatively short key length of the symmetric-key General block cipher design, and the involvement of the NSA, nourishing Designers IBM suspicions about a backdoor. Today it is known that the S-boxes that had raised those suspicions were in fact designed by the NSA to First 1975 (Federal Register) actually remove a backdoor they secretly knew (differential published (standardized in January 1977) cryptanalysis). However, the NSA also ensured that the key size was Derived Lucifer drastically reduced such that they could break it by brute force from [2] attack. The intense academic scrutiny the algorithm received over Successors Triple DES, G-DES, DES-X, time led to the modern understanding of block ciphers and their LOKI89, ICE cryptanalysis.
    [Show full text]
  • Camellia: a 128-Bit Block Cipher Suitable for Multiple Platforms – Design Andanalysis
    Camellia: A 128-Bit Block Cipher Suitable for Multiple Platforms – Design andAnalysis Kazumaro Aoki1, Tetsuya Ichikawa2, Masayuki Kanda1, Mitsuru Matsui2, Shiho Moriai1, Junko Nakajima2, and Toshio Tokita2 1 Nippon Telegraph and Telephone Corporation, 1-1 Hikarinooka, Yokosuka, Kanagawa, 239-0847Japan {maro,kanda,shiho}@isl.ntt.co.jp 2 Mitsubishi Electric Corporation, 5-1-1 Ofuna, Kamakura, Kanagawa, 247-8501 Japan {ichikawa,matsui,june15,tokita}@iss.isl.melco.co.jp Abstract. We present a new 128-bit block cipher called Camellia. Camellia supports 128-bit block size and 128-, 192-, and 256-bit keys, i.e., the same interface specifications as the Advanced Encryption Stan- dard (AES). Efficiency on both software and hardware platforms is a remarkable characteristic of Camellia in addition to its high level of se- curity. It is confirmed that Camellia provides strong security against differential and linear cryptanalyses. Compared to the AES finalists, i.e., MARS, RC6, Rijndael, Serpent, and Twofish, Camellia offers at least comparable encryption speed in software and hardware. An optimized implementation of Camellia in assembly language can encrypt on a Pen- tium III (800MHz) at the rate of more than 276 Mbits per second, which is much faster than the speed of an optimized DES implementation. In addition, a distinguishing feature is its small hardware design. The hard- ware design, which includes encryption and decryption and key schedule, occupies approximately 11K gates, which is the smallest among all ex- isting 128-bit block ciphers as far as we know. 1 Introduction This paper presents a 128-bit block cipher called Camellia, which was jointly developed by NTT and Mitsubishi Electric Corporation.
    [Show full text]
  • A Comparison of Cryptographic Algorithms: DES, 3DES, AES, RSA
    www.symbiosisonline.org www.symbiosisonlinepublishing.com Symbiosis ISSN Online: 2474-9257 Research Article Journal of Computer Science Applications and Information Technology Open Access A Comparison of Cryptographic Algorithms: DES, 3DES, AES, RSA and Blowfish for Guessing Attacks Prevention Mohammed Nazeh Abdul Wahid*, Abdulrahman Ali, Babak Esparham and Mohamed Marwan Limkokwing University of Creative and Technology, Post Graduate Centre, Cyberjaya, Malaysia Received: June 22, 2018; Accepted: July 12, 2018; Published: August 10, 2018 *Corresponding author: Mohammed Nazeh Abdul Wahid, Senior Lecturer, Limkokwing university of creative technology, Post Graduate Centre, Cyberjaya, Malaysia, Tel: +60104339985; E-mail: [email protected] Abstract Encryption is the process of encoding information or data in key (also called secret-key) and Asymmetric-key (called public- order to prevent unauthorized access. These days we need to secure key) encryption [2]. the information that is stored in our computer or is transmitted via evaluation is a network security system for an application using internet against attacks. There are different types of cryptographic the Aproposed secure Wi-Fi algorithm. system As for for wireless some cryptographicnetworks: experimental system, it methods that can be used. Basically, the selecting cryptographic is commonly used to secure communication channels by using method depends on the application demands such as the response public key exchanges based on algorithms such as RSA, DES, AES, cryptographic algorithms has its own weak and strong points. In this paper,time, bandwidth,we will present confidentiality the result of and the implementationintegrity. However, and analysiseach of the key used to encrypt data sent over an unsecured Internet that applied on several cryptographic algorithms such as DES, 3DES, channel.Triple DES In andaddition, Blowfish.
    [Show full text]
  • Miss in the Middle Attacks on IDEA and Khufu
    Miss in the Middle Attacks on IDEA and Khufu Eli Biham? Alex Biryukov?? Adi Shamir??? Abstract. In a recent paper we developed a new cryptanalytic techni- que based on impossible differentials, and used it to attack the Skipjack encryption algorithm reduced from 32 to 31 rounds. In this paper we describe the application of this technique to the block ciphers IDEA and Khufu. In both cases the new attacks cover more rounds than the best currently known attacks. This demonstrates the power of the new cryptanalytic technique, shows that it is applicable to a larger class of cryptosystems, and develops new technical tools for applying it in new situations. 1 Introduction In [5,17] a new cryptanalytic technique based on impossible differentials was proposed, and its application to Skipjack [28] and DEAL [17] was described. In this paper we apply this technique to the IDEA and Khufu cryptosystems. Our new attacks are much more efficient and cover more rounds than the best previously known attacks on these ciphers. The main idea behind these new attacks is a bit counter-intuitive. Unlike tra- ditional differential and linear cryptanalysis which predict and detect statistical events of highest possible probability, our new approach is to search for events that never happen. Such impossible events are then used to distinguish the ci- pher from a random permutation, or to perform key elimination (a candidate key is obviously wrong if it leads to an impossible event). The fact that impossible events can be useful in cryptanalysis is an old idea (for example, some of the attacks on Enigma were based on the observation that letters can not be encrypted to themselves).
    [Show full text]
  • Impossible Differential Cryptanalysis of Reduced Round Hight
    1 IMPOSSIBLE DIFFERENTIAL CRYPTANALYSIS OF REDUCED ROUND HIGHT A THESIS SUBMITTED TO THE GRADUATE SCHOOL OF APPLIED MATHEMATICS OF MIDDLE EAST TECHNICAL UNIVERSITY BY CIHANG˙ IR˙ TEZCAN IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF MASTER OF SCIENCE IN CRYPTOGRAPHY JUNE 2009 Approval of the thesis: IMPOSSIBLE DIFFERENTIAL CRYPTANALYSIS OF REDUCED ROUND HIGHT submitted by CIHANG˙ IR˙ TEZCAN in partial fulfillment of the requirements for the degree of Master of Science in Department of Cryptography, Middle East Technical University by, Prof. Dr. Ersan Akyıldız Director, Graduate School of Applied Mathematics Prof. Dr. Ferruh Ozbudak¨ Head of Department, Cryptography Assoc. Prof. Dr. Ali Doganaksoy˘ Supervisor, Mathematics Examining Committee Members: Prof. Dr. Ersan Akyıldız METU, Institute of Applied Mathematics Assoc. Prof. Ali Doganaksoy˘ METU, Department of Mathematics Dr. Muhiddin Uguz˘ METU, Department of Mathematics Dr. Meltem Sonmez¨ Turan Dr. Nurdan Saran C¸ankaya University, Department of Computer Engineering Date: I hereby declare that all information in this document has been obtained and presented in accordance with academic rules and ethical conduct. I also declare that, as required by these rules and conduct, I have fully cited and referenced all material and results that are not original to this work. Name, Last Name: CIHANG˙ IR˙ TEZCAN Signature : iii ABSTRACT IMPOSSIBLE DIFFERENTIAL CRYPTANALYSIS OF REDUCED ROUND HIGHT Tezcan, Cihangir M.Sc., Department of Cryptography Supervisor : Assoc. Prof. Dr. Ali Doganaksoy˘ June 2009, 49 pages Design and analysis of lightweight block ciphers have become more popular due to the fact that the future use of block ciphers in ubiquitous devices is generally assumed to be extensive.
    [Show full text]