Standing the Test of Time: The Data Encryption Standard Susan Landau ast and hard, that is all that cryptographers bit key length was insecure. In spite of such claims, have ever wanted: a system that encrypts DES remained a strong encryption algorithm until quickly but is essentially impossible to the middle of the 1990s—several times longer break. With their reliance on elementary than the government had reason to expect. Now, number theory, public-key systems have however, DES is past the end of its useful lifetime. Fcaptured mathematicians’ imagination. Public-key In the summer of 1998 DES’s insecurity was algorithms are too slow to be used for most data definitively demonstrated when a $250,000 com- transmissions, and instead public-key algorithms puter built by the Electronic Frontier Foundation are used for establishing a key. Then a private-key (EFF) decrypted a DES-encoded message in 56 system does the encryption. Private-key algorithms hours. In January 1999 this was improved to 22 are typically faster than public-key ones. hours through a combination of 100,000 networked The workhorse private-key algorithm is the Data PCs and the EFF machine. But until a substitute is Encryption Standard (DES), which relies on cryp- found, DES remains a de facto standard. The Na- tographic design principles that predate public tional Institute of Standards and Technology key. With the exception of RC4 in Web browsers (NIST)—whose predecessor, the National Bureau of and relatively insecure cable-TV signal encryption, Standards, certified DES—is currently seeking a suc- DES is the most widely used public cryptosystem cessor to the algorithm. The Advanced Encryption in the world. DES is the cryptographic algorithm Standard (AES) will work in three key lengths: 128, used by banks for electronic funds transfer, DES 192, and 256 bits. Fifteen candidates were sub- is used for the protection of civilian satellite com- mitted in June 1998 (there were actually twenty- munications, and a variant of DES is used for UNIX one submissions, but six candidates had not ful- password protection. filled NIST’s requirements). In August 1999 NIST Proposed in 1975 and approved in 1977 as a Fed- eliminated ten of the fifteen. The agency is sched- eral Information Processing Standard,1 DES was im- uled to pick DES’s successor in the summer of mediately attacked by those who felt that its 56- 2000. The winning algorithm will be one whose se- curity should stand well into the new century. Susan Landau is an associate editor of the Notices and is The publication of DES heralded a new era in cryp- senior staff engineer at Sun Microsystems Inc. Her e-mail tography. Academic and industrial researchers had address is [email protected]. an algorithm available for study that the National 1This means the system is approved for sale to the fed- Security Agency had certified as secure. This helped eral government, an important issue for industry. develop a community of public cryptographers. MARCH 2000 NOTICES OF THE AMS 341 When it came time to replace DES, there was a Cryptographers design their algorithms to resist the skilled community to take on the task. following list of increasingly aggressive attacks: In this article I outline DES, the cryptographic • ciphertext-only: The adversary has access to the principles that underly its design, the algorithm’s encrypted communications; twenty-year history, and some of the strongest at- • known-plaintext: the adversary has some plain- tacks against the algorithm. In a subsequent arti- text and its corresponding ciphertext; cle I will present the cryptomathematics that • chosen-text: the adversary chooses the plain- evolved over these two decades and the AES effort. text to be encrypted, or the adversary picks the My intent is to illuminate the mathematics and pol- ciphertext to be decrypted (chosen ciphertext), itics behind block-structured cryptosystems. or the adversary chooses the plaintext to be encrypted depending on ciphertext received What Is Wanted in a Cryptosystem? from previous requests (adaptive chosen plain- Assume that the unencrypted message, the plain- text). text, is a string of bits. It is to be transformed into an Chosen-text attacks are largely used to simplify encrypted string, or ciphertext, by means of a cryp- analysis of cryptosystems, but because of such tographic algorithm and key. So that the recipient can devices as “smart cards” (credit card-sized objects read the message, encryption must be invertible. equipped with a small processor), such attacks Conventional wisdom holds that in order to can occur in practice. defy easy decryption, a cryptographic algorithm If an algorithm uses a k-bit key, the measure of k should produce seeming chaos; that is, ciphertext security is how close the algorithm is to being 2 - should look and test random. In theory an eaves- secure, that is, whether there are methods for dropper should not be able to determine any sig- breaking the system that are significantly better nificant information from an intercepted cipher- than a brute-force search of the entire key space. text. Sometimes an algorithm’s weakness is readily ap- One-time pads, whose keys are strings of random parent; such was the case for “Magenta”, German bits at least as long as the message itself, achieve Telecom’s submission to the AES competition. The this seeming impossibilty. Encryption is simple: if “key scheduling” (the order in which key bits are th th fed to the algorithm) was poorly designed, and pi is the i bit of the plaintext, ki is the i bit of th this insecurity was discovered by rival cryptogra- the key, and ci is the i bit of the ciphertext, then phers during the first public meeting to discuss the ci = pi ki, where is exclusive or, often written XOR, and is simply addition modulo 2. Sender and AES candidates. recipient have a copy of the key. One-time pads Frequently, weaknesses may take years to dis- must be used exactly once; if a key is ever reused, cover. With DES, one strong form of attack, “differ- the system becomes highly vulnerable. In the early ential cryptanalysis”, had apparently been known to the algorithm’s designers, but “linear crypt- 1940s the Soviets made just such a mistake. analysis”, discovered by Mitsuru Matsui [5] eighteen Western intelligence discovered this and exploited years after DES was proposed as a Federal Informa- it. Study of the messages encoded with the reused tion Processing Standard, seems to be new. DES was keys proved quite fruitful.2 The constant need to indeed at least theoretically vulnerable to this type refresh keying material eliminates much of the ad- of attack. Designing secure cryptosystems is a mix- vantage of one-time pads. If we could efficiently and ture of a few well-known principles, some theorems, securely exchange keys, we could almost as easily and, at least at present, some magic. securely transmit the plaintext, and we would have little need for a cryptosystem. Block Cipher Designs Broadly speaking, attacks on a cryptosystem The simplest techniques for encrypting a block of fall into two categories: passive attacks, in which symbols are substitution and permutation. Sub- the adversary monitors the communication chan- stitution replaces a symbol by another; permuta- nel, and active ones, in which the adversary may tion moves the symbols of a block around. Neither transmit messages to obtain information (e.g., ci- simple substitution nor simple permutation work phertext of chosen plaintext). Passive attacks are very well by themselves. Frequency analysis, using easier to mount, but yield less. Attackers hope to the relative commonness of letters, pairs, triples, determine the plaintext from the ciphertext they etc., is a strong tool against both.3 Any message capture; an even more successful attack will de- of reasonable length that is encrypted via a sub- termine the key and thus compromise a whole set stitution or permutation function can be quickly of messages. An assumption first codified by deciphered using this technique; a trained Kerckhoffs in the nineteenth century is that the al- gorithm is known and that the security of the al- 3In English, for example, the letter “e” appears 13% of the gorithm rests entirely in the secrecy of the key. time in text, with “t,r,n,i,o,a,s” being the next most frequent letters. Similarly, there are data on the frequency of var- 2Details may be found at http://www.nsa.gov:8080/ ious letters appearing at the beginning and end of words, docs/venona/. etc. Blanks (spaces) can be ignored. 342 NOTICES OF THE AMS VOLUME 47, NUMBER 3 cryptanalyst can break a simple substitution cipher regardless of the round function f used. Decryp- given only 25 characters of ciphertext. tion is the algorithm run in reverse, with subkeys Nonetheless, substitution and permutation form used in the opposite order. In order to make de- the backbone of modern cryptosystems. Fifty years cryption a genuine inverse of encryption, the final ago Claude Shannon observed that the funda- round of a Feistel cipher switches the ciphertext mental techniques for encryption are confusion— to (Rr ,Lr ). Put another way, in decryption the swap obscuring the relationship between the plaintext is done at the beginning of each round. DES is a and the ciphertext—and diffusion—spreading the 16-round Feistel cipher. change throughout the ciphertext. Substitution is In 1965, when computers were clunky main- the simplest type of confusion, and permutation frames and the networked world was more science is the the simplest method of diffusion. fiction than scientific fact, Congress charged the Cryptanalysis can be viewed as approximation National Bureau of Standards (NBS) with develop- theory; given ciphertext, determine the plaintext ing computer standards for civilian use.