DOCSLIB.ORG

Standing the Test of Time: the Data Encryption Standard, Volume 47

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Standing the Test of Time: the Data Encryption Standard, Volume 47 Standing the Test of Time: The Data Encryption Standard Susan Landau ast and hard, that is all that cryptographers bit key length was insecure. In spite of such claims, have ever wanted: a system that encrypts DES remained a strong encryption algorithm until quickly but is essentially impossible to the middle of the 1990s—several times longer break. With their reliance on elementary than the government had reason to expect. Now, number theory, public-key systems have however, DES is past the end of its useful lifetime. Fcaptured mathematicians’ imagination. Public-key In the summer of 1998 DES’s insecurity was algorithms are too slow to be used for most data definitively demonstrated when a $250,000 com- transmissions, and instead public-key algorithms puter built by the Electronic Frontier Foundation are used for establishing a key. Then a private-key (EFF) decrypted a DES-encoded message in 56 system does the encryption. Private-key algorithms hours. In January 1999 this was improved to 22 are typically faster than public-key ones. hours through a combination of 100,000 networked The workhorse private-key algorithm is the Data PCs and the EFF machine. But until a substitute is Encryption Standard (DES), which relies on cryp- found, DES remains a de facto standard. The Na- tographic design principles that predate public tional Institute of Standards and Technology key. With the exception of RC4 in Web browsers (NIST)—whose predecessor, the National Bureau of and relatively insecure cable-TV signal encryption, Standards, certified DES—is currently seeking a suc- DES is the most widely used public cryptosystem cessor to the algorithm. The Advanced Encryption in the world. DES is the cryptographic algorithm Standard (AES) will work in three key lengths: 128, used by banks for electronic funds transfer, DES 192, and 256 bits. Fifteen candidates were sub- is used for the protection of civilian satellite com- mitted in June 1998 (there were actually twenty- munications, and a variant of DES is used for UNIX one submissions, but six candidates had not ful- password protection. filled NIST’s requirements). In August 1999 NIST Proposed in 1975 and approved in 1977 as a Fed- eliminated ten of the fifteen. The agency is sched- eral Information Processing Standard,1 DES was im- uled to pick DES’s successor in the summer of mediately attacked by those who felt that its 56- 2000. The winning algorithm will be one whose se- curity should stand well into the new century. Susan Landau is an associate editor of the Notices and is The publication of DES heralded a new era in cryp- senior staff engineer at Sun Microsystems Inc. Her e-mail tography. Academic and industrial researchers had address is [email protected]. an algorithm available for study that the National 1This means the system is approved for sale to the fed- Security Agency had certified as secure. This helped eral government, an important issue for industry. develop a community of public cryptographers. MARCH 2000 NOTICES OF THE AMS 341 When it came time to replace DES, there was a Cryptographers design their algorithms to resist the skilled community to take on the task. following list of increasingly aggressive attacks: In this article I outline DES, the cryptographic • ciphertext-only: The adversary has access to the principles that underly its design, the algorithm’s encrypted communications; twenty-year history, and some of the strongest at- • known-plaintext: the adversary has some plain- tacks against the algorithm. In a subsequent arti- text and its corresponding ciphertext; cle I will present the cryptomathematics that • chosen-text: the adversary chooses the plain- evolved over these two decades and the AES effort. text to be encrypted, or the adversary picks the My intent is to illuminate the mathematics and pol- ciphertext to be decrypted (chosen ciphertext), itics behind block-structured cryptosystems. or the adversary chooses the plaintext to be encrypted depending on ciphertext received What Is Wanted in a Cryptosystem? from previous requests (adaptive chosen plain- Assume that the unencrypted message, the plain- text). text, is a string of bits. It is to be transformed into an Chosen-text attacks are largely used to simplify encrypted string, or ciphertext, by means of a cryp- analysis of cryptosystems, but because of such tographic algorithm and key. So that the recipient can devices as “smart cards” (credit card-sized objects read the message, encryption must be invertible. equipped with a small processor), such attacks Conventional wisdom holds that in order to can occur in practice. defy easy decryption, a cryptographic algorithm If an algorithm uses a k-bit key, the measure of k should produce seeming chaos; that is, ciphertext security is how close the algorithm is to being 2 - should look and test random. In theory an eaves- secure, that is, whether there are methods for dropper should not be able to determine any sig- breaking the system that are significantly better nificant information from an intercepted cipher- than a brute-force search of the entire key space. text. Sometimes an algorithm’s weakness is readily ap- One-time pads, whose keys are strings of random parent; such was the case for “Magenta”, German bits at least as long as the message itself, achieve Telecom’s submission to the AES competition. The this seeming impossibilty. Encryption is simple: if “key scheduling” (the order in which key bits are th th fed to the algorithm) was poorly designed, and pi is the i bit of the plaintext, ki is the i bit of th this insecurity was discovered by rival cryptogra- the key, and ci is the i bit of the ciphertext, then phers during the first public meeting to discuss the ci = pi ki, where is exclusive or, often written XOR, and is simply addition modulo 2. Sender and AES candidates. recipient have a copy of the key. One-time pads Frequently, weaknesses may take years to dis- must be used exactly once; if a key is ever reused, cover. With DES, one strong form of attack, “differ- the system becomes highly vulnerable. In the early ential cryptanalysis”, had apparently been known to the algorithm’s designers, but “linear crypt- 1940s the Soviets made just such a mistake. analysis”, discovered by Mitsuru Matsui [5] eighteen Western intelligence discovered this and exploited years after DES was proposed as a Federal Informa- it. Study of the messages encoded with the reused tion Processing Standard, seems to be new. DES was keys proved quite fruitful.2 The constant need to indeed at least theoretically vulnerable to this type refresh keying material eliminates much of the ad- of attack. Designing secure cryptosystems is a mix- vantage of one-time pads. If we could efficiently and ture of a few well-known principles, some theorems, securely exchange keys, we could almost as easily and, at least at present, some magic. securely transmit the plaintext, and we would have little need for a cryptosystem. Block Cipher Designs Broadly speaking, attacks on a cryptosystem The simplest techniques for encrypting a block of fall into two categories: passive attacks, in which symbols are substitution and permutation. Sub- the adversary monitors the communication chan- stitution replaces a symbol by another; permuta- nel, and active ones, in which the adversary may tion moves the symbols of a block around. Neither transmit messages to obtain information (e.g., ci- simple substitution nor simple permutation work phertext of chosen plaintext). Passive attacks are very well by themselves. Frequency analysis, using easier to mount, but yield less. Attackers hope to the relative commonness of letters, pairs, triples, determine the plaintext from the ciphertext they etc., is a strong tool against both.3 Any message capture; an even more successful attack will de- of reasonable length that is encrypted via a sub- termine the key and thus compromise a whole set stitution or permutation function can be quickly of messages. An assumption first codified by deciphered using this technique; a trained Kerckhoffs in the nineteenth century is that the al- gorithm is known and that the security of the al- 3In English, for example, the letter “e” appears 13% of the gorithm rests entirely in the secrecy of the key. time in text, with “t,r,n,i,o,a,s” being the next most frequent letters. Similarly, there are data on the frequency of var- 2Details may be found at http://www.nsa.gov:8080/ ious letters appearing at the beginning and end of words, docs/venona/. etc. Blanks (spaces) can be ignored. 342 NOTICES OF THE AMS VOLUME 47, NUMBER 3 cryptanalyst can break a simple substitution cipher regardless of the round function f used. Decryp- given only 25 characters of ciphertext. tion is the algorithm run in reverse, with subkeys Nonetheless, substitution and permutation form used in the opposite order. In order to make de- the backbone of modern cryptosystems. Fifty years cryption a genuine inverse of encryption, the final ago Claude Shannon observed that the funda- round of a Feistel cipher switches the ciphertext mental techniques for encryption are confusion— to (Rr ,Lr ). Put another way, in decryption the swap obscuring the relationship between the plaintext is done at the beginning of each round. DES is a and the ciphertext—and diffusion—spreading the 16-round Feistel cipher. change throughout the ciphertext. Substitution is In 1965, when computers were clunky main- the simplest type of confusion, and permutation frames and the networked world was more science is the the simplest method of diffusion. fiction than scientific fact, Congress charged the Cryptanalysis can be viewed as approximation National Bureau of Standards (NBS) with develop- theory; given ciphertext, determine the plaintext ing computer standards for civilian use.
Load more

Recommended publications
  • Public-Key Cryptography
    Public Key Cryptography EJ Jung Basic Public Key Cryptography public key public key ? private key Alice Bob Given: Everybody knows Bob’s public key - How is this achieved in practice? Only Bob knows the corresponding private key Goals: 1. Alice wants to send a secret message to Bob 2. Bob wants to authenticate himself Requirements for Public-Key Crypto ! Key generation: computationally easy to generate a pair (public key PK, private key SK) • Computationally infeasible to determine private key PK given only public key PK ! Encryption: given plaintext M and public key PK, easy to compute ciphertext C=EPK(M) ! Decryption: given ciphertext C=EPK(M) and private key SK, easy to compute plaintext M • Infeasible to compute M from C without SK • Decrypt(SK,Encrypt(PK,M))=M Requirements for Public-Key Cryptography 1. Computationally easy for a party B to generate a pair (public key KUb, private key KRb) 2. Easy for sender to generate ciphertext: C = EKUb (M ) 3. Easy for the receiver to decrypt ciphertect using private key: M = DKRb (C) = DKRb[EKUb (M )] Henric Johnson 4 Requirements for Public-Key Cryptography 4. Computationally infeasible to determine private key (KRb) knowing public key (KUb) 5. Computationally infeasible to recover message M, knowing KUb and ciphertext C 6. Either of the two keys can be used for encryption, with the other used for decryption: M = DKRb[EKUb (M )] = DKUb[EKRb (M )] Henric Johnson 5 Public-Key Cryptographic Algorithms ! RSA and Diffie-Hellman ! RSA - Ron Rives, Adi Shamir and Len Adleman at MIT, in 1977. • RSA
    [Show full text]
  • A Quantitative Study of Advanced Encryption Standard Performance
    United States Military Academy USMA Digital Commons West Point ETD 12-2018 A Quantitative Study of Advanced Encryption Standard Performance as it Relates to Cryptographic Attack Feasibility Daniel Hawthorne United States Military Academy, [email protected] Follow this and additional works at: https://digitalcommons.usmalibrary.org/faculty_etd Part of the Information Security Commons Recommended Citation Hawthorne, Daniel, "A Quantitative Study of Advanced Encryption Standard Performance as it Relates to Cryptographic Attack Feasibility" (2018). West Point ETD. 9. https://digitalcommons.usmalibrary.org/faculty_etd/9 This Doctoral Dissertation is brought to you for free and open access by USMA Digital Commons. It has been accepted for inclusion in West Point ETD by an authorized administrator of USMA Digital Commons. For more information, please contact [email protected]. A QUANTITATIVE STUDY OF ADVANCED ENCRYPTION STANDARD PERFORMANCE AS IT RELATES TO CRYPTOGRAPHIC ATTACK FEASIBILITY A Dissertation Presented in Partial Fulfillment of the Requirements for the Degree of Doctor of Computer Science By Daniel Stephen Hawthorne Colorado Technical University December, 2018 Committee Dr. Richard Livingood, Ph.D., Chair Dr. Kelly Hughes, DCS, Committee Member Dr. James O. Webb, Ph.D., Committee Member December 17, 2018 © Daniel Stephen Hawthorne, 2018 1 Abstract The advanced encryption standard (AES) is the premier symmetric key cryptosystem in use today. Given its prevalence, the security provided by AES is of utmost importance. Technology is advancing at an incredible rate, in both capability and popularity, much faster than its rate of advancement in the late 1990s when AES was selected as the replacement standard for DES. Although the literature surrounding AES is robust, most studies fall into either theoretical or practical yet infeasible.
    [Show full text]
  • Public Key Cryptography And
    PublicPublic KeyKey CryptographyCryptography andand RSARSA Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/ Washington University in St. Louis CSE571S ©2011 Raj Jain 9-1 OverviewOverview 1. Public Key Encryption 2. Symmetric vs. Public-Key 3. RSA Public Key Encryption 4. RSA Key Construction 5. Optimizing Private Key Operations 6. RSA Security These slides are based partly on Lawrie Brown’s slides supplied with William Stallings’s book “Cryptography and Network Security: Principles and Practice,” 5th Ed, 2011. Washington University in St. Louis CSE571S ©2011 Raj Jain 9-2 PublicPublic KeyKey EncryptionEncryption Invented in 1975 by Diffie and Hellman at Stanford Encrypted_Message = Encrypt(Key1, Message) Message = Decrypt(Key2, Encrypted_Message) Key1 Key2 Text Ciphertext Text Keys are interchangeable: Key2 Key1 Text Ciphertext Text One key is made public while the other is kept private Sender knows only public key of the receiver Asymmetric Washington University in St. Louis CSE571S ©2011 Raj Jain 9-3 PublicPublic KeyKey EncryptionEncryption ExampleExample Rivest, Shamir, and Adleman at MIT RSA: Encrypted_Message = m3 mod 187 Message = Encrypted_Message107 mod 187 Key1 = <3,187>, Key2 = <107,187> Message = 5 Encrypted Message = 53 = 125 Message = 125107 mod 187 = 5 = 125(64+32+8+2+1) mod 187 = {(12564 mod 187)(12532 mod 187)... (1252 mod 187)(125 mod 187)} mod 187 Washington University in
    [Show full text]
  • The Data Encryption Standard (DES) – History
    Chair for Network Architectures and Services Department of Informatics TU München – Prof. Carle Network Security Chapter 2 Basics 2.1 Symmetric Cryptography • Overview of Cryptographic Algorithms • Attacking Cryptographic Algorithms • Historical Approaches • Foundations of Modern Cryptography • Modes of Encryption • Data Encryption Standard (DES) • Advanced Encryption Standard (AES) Cryptographic algorithms: outline Cryptographic Algorithms Symmetric Asymmetric Cryptographic Overview En- / Decryption En- / Decryption Hash Functions Modes of Cryptanalysis Background MDC’s / MACs Operation Properties DES RSA MD-5 AES Diffie-Hellman SHA-1 RC4 ElGamal CBC-MAC Network Security, WS 2010/11, Chapter 2.1 2 Basic Terms: Plaintext and Ciphertext Plaintext P The original readable content of a message (or data). P_netsec = „This is network security“ Ciphertext C The encrypted version of the plaintext. C_netsec = „Ff iThtIiDjlyHLPRFxvowf“ encrypt key k1 C P key k2 decrypt In case of symmetric cryptography, k1 = k2. Network Security, WS 2010/11, Chapter 2.1 3 Basic Terms: Block cipher and Stream cipher Block cipher A cipher that encrypts / decrypts inputs of length n to outputs of length n given the corresponding key k. • n is block length Most modern symmetric ciphers are block ciphers, e.g. AES, DES, Twofish, … Stream cipher A symmetric cipher that generats a random bitstream, called key stream, from the symmetric key k. Ciphertext = key stream XOR plaintext Network Security, WS 2010/11, Chapter 2.1 4 Cryptographic algorithms: overview
    [Show full text]
  • Seed Maturity in White Fir and Red Fir. Pacific Southwest Forest and Range Exp
    PACIFIC SOUTHWEST Forest and Range FOREST SERVICE U. S. DEPARTMENT OF AGRICULTURE P.O. BOX 245, BERKELEY, CALIFORNIA 94701 Experiment Station USDA FOREST SERVICE RESEARCH PAPER PSW-99 /1974 CONTENTS Page Summary ................................................... 1 Introduction ................................................. 3 Methods .................................................... 3 Testing Fresh Seeds ....................................... 3 Testing Stratified Seeds .................................... 3 Seedling Vigor Tests ...................................... 4 Artificial Ripening Trial ................................... 4 Other Observations ........................................ 4 Results and Discussion ....................................... 5 Cone Specific Gravity ..................................... 5 Seed Germination, byCollection Date ....................... 5 Seed GerminationandCone Specific Gravity ................ 7 Red Fir Seedling Vigor .................................... 9 ArtificialRipening of White Fir Seeds ....................... 9 OtherMaturity Indices ..................................... 9 Application ................................................. 10 Literature Cited.............................................. 12 THE AUTHOR WILLIAM W. OLIVER is doing silvicultural research on Sierra Nevada conifer types with headquarters at Redding, California. He earned a B.S. degree (1956) in forestry from the University of New Hampshire, and an M.F. degree (1960) from the University of Michigan. A native of
    [Show full text]
  • Block Ciphers and the Data Encryption Standard
    Lecture 3: Block Ciphers and the Data Encryption Standard Lecture Notes on “Computer and Network Security” by Avi Kak ([email protected]) January 26, 2021 3:43pm ©2021 Avinash Kak, Purdue University Goals: To introduce the notion of a block cipher in the modern context. To talk about the infeasibility of ideal block ciphers To introduce the notion of the Feistel Cipher Structure To go over DES, the Data Encryption Standard To illustrate important DES steps with Python and Perl code CONTENTS Section Title Page 3.1 Ideal Block Cipher 3 3.1.1 Size of the Encryption Key for the Ideal Block Cipher 6 3.2 The Feistel Structure for Block Ciphers 7 3.2.1 Mathematical Description of Each Round in the 10 Feistel Structure 3.2.2 Decryption in Ciphers Based on the Feistel Structure 12 3.3 DES: The Data Encryption Standard 16 3.3.1 One Round of Processing in DES 18 3.3.2 The S-Box for the Substitution Step in Each Round 22 3.3.3 The Substitution Tables 26 3.3.4 The P-Box Permutation in the Feistel Function 33 3.3.5 The DES Key Schedule: Generating the Round Keys 35 3.3.6 Initial Permutation of the Encryption Key 38 3.3.7 Contraction-Permutation that Generates the 48-Bit 42 Round Key from the 56-Bit Key 3.4 What Makes DES a Strong Cipher (to the 46 Extent It is a Strong Cipher) 3.5 Homework Problems 48 2 Computer and Network Security by Avi Kak Lecture 3 Back to TOC 3.1 IDEAL BLOCK CIPHER In a modern block cipher (but still using a classical encryption method), we replace a block of N bits from the plaintext with a block of N bits from the ciphertext.
    [Show full text]
  • CS 255: Intro to Cryptography 1 Introduction 2 End-To-End
    Programming Assignment 2 Winter 2021 CS 255: Intro to Cryptography Prof. Dan Boneh Due Monday, March 1st, 11:59pm 1 Introduction In this assignment, you are tasked with implementing a secure and efficient end-to-end encrypted chat client using the Double Ratchet Algorithm, a popular session setup protocol that powers real- world chat systems such as Signal and WhatsApp. As an additional challenge, assume you live in a country with government surveillance. Thereby, all messages sent are required to include the session key encrypted with a fixed public key issued by the government. In your implementation, you will make use of various cryptographic primitives we have discussed in class—notably, key exchange, public key encryption, digital signatures, and authenticated encryption. Because it is ill-advised to implement your own primitives in cryptography, you should use an established library: in this case, the Stanford Javascript Crypto Library (SJCL). We will provide starter code that contains a basic template, which you will be able to fill in to satisfy the functionality and security properties described below. 2 End-to-end Encrypted Chat Client 2.1 Implementation Details Your chat client will use the Double Ratchet Algorithm to provide end-to-end encrypted commu- nications with other clients. To evaluate your messaging client, we will check that two or more instances of your implementation it can communicate with each other properly. We feel that it is best to understand the Double Ratchet Algorithm straight from the source, so we ask that you read Sections 1, 2, and 3 of Signal’s published specification here: https://signal.
    [Show full text]
  • FIPS 140-2 Non-Proprietary Security Policy Oracle Linux 7 NSS
    FIPS 140-2 Non-Proprietary Security Policy Oracle Linux 7 NSS Cryptographic Module FIPS 140-2 Level 1 Validation Software Version: R7-4.0.0 Date: January 22nd, 2020 Document Version 2.3 © Oracle Corporation This document may be reproduced whole and intact including the Copyright notice. Title: Oracle Linux 7 NSS Cryptographic Module Security Policy Date: January 22nd, 2020 Author: Oracle Security Evaluations – Global Product Security Contributing Authors: Oracle Linux Engineering Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA 94065 U.S.A. Worldwide Inquiries: Phone: +1.650.506.7000 Fax: +1.650.506.7200 oracle.com Copyright © 2020, Oracle and/or its affiliates. All rights reserved. This document is provided for information purposes only and the contents hereof are subject to change without notice. This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose. Oracle specifically disclaim any liability with respect to this document and no contractual obligations are formed either directly or indirectly by this document. This document may reproduced or distributed whole and intact including this copyright notice. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Oracle Linux 7 NSS Cryptographic Module Security Policy i TABLE OF CONTENTS Section Title
    [Show full text]
  • Miss in the Middle
    Miss in the middle By: Gal Leonard Keret Miss in the Middle Attacks on IDEA, Khufu and Khafre • Written by: – Prof. Eli Biham. – Prof. Alex Biryukov. – Prof. Adi Shamir. Introduction • So far we used traditional differential which predict and detect statistical events of highest possible probability. Introduction • A new approach is to search for events with probability one, whose condition cannot be met together (events that never happen). Impossible Differential • Random permutation: 휎 푀0 = 푎푛푦 퐶 표푓 푠푖푧푒 푀0. • Cipher (not perfect): 퐸 푀0 = 푠표푚푒 퐶 표푓 푠푖푧푒 푀0. • Events (푚 ↛ 푐) that never happen distinguish a cipher from a random permutation. Impossible Differential • Impossible events (푚 ↛ 푐) can help performing key elimination. • All the keys that lead to impossibility are obviously wrong. • This way we can filter wrong key guesses and leaving the correct key. Enigma – for example • Some of the attacks on Enigma were based on the observation that letters can not be encrypted to themselves. 퐸푛푖푔푚푎(푀0) ≠ 푀0 In General • (푀0, 퐶1) is a pair. If 푀0 푀0 → 퐶1. • 푀 ↛ 퐶 . 0 0 Some rounds For any key • ∀ 푘푒푦| 퐶1 → 퐶0 ↛ is an impossible key. Cannot lead to 퐶0. Some rounds Find each keys Decrypt 퐶1back to 퐶0. IDEA • International Data Encryption Algorithm. • First described in 1991. • Block cipher. • Symmetric. • Key sizes: 128 bits. • Block sizes: 64 bits. ⊕ - XOR. ⊞ - Addition modulo 216 ⊙ - Multiplication modulo 216+1 Encryption security • Combination of different mathematical groups. • Creation of "incompatibility“: ∗ • 푍216+1 → 푍216 ∗ • 푍216 → 푍216+1 ∗ ∗ Remark: 푍216+1 doesn’t contain 0 like 푍216 , so in 푍216+1 0 will be converted to 216 since 0 ≡ 216(푚표푑 216).
    [Show full text]
  • Choosing Key Sizes for Cryptography
    information security technical report 15 (2010) 21e27 available at www.sciencedirect.com www.compseconline.com/publications/prodinf.htm Choosing key sizes for cryptography Alexander W. Dent Information Security Group, University Of London, Royal Holloway, UK abstract After making the decision to use public-key cryptography, an organisation still has to make many important decisions before a practical system can be implemented. One of the more difficult challenges is to decide the length of the keys which are to be used within the system: longer keys provide more security but mean that the cryptographic operation will take more time to complete. The most common solution is to take advice from information security standards. This article will investigate the methodology that is used produce these standards and their meaning for an organisation who wishes to implement public-key cryptography. ª 2010 Elsevier Ltd. All rights reserved. 1. Introduction being compromised by an attacker). It also typically means a slower scheme. Most symmetric cryptographic schemes do The power of public-key cryptography is undeniable. It is not allow the use of keys of different lengths. If a designer astounding in its simplicity and its ability to provide solutions wishes to offer a symmetric scheme which provides different to many seemingly insurmountable organisational problems. security levels depending on the key size, then the designer However, the use of public-key cryptography in practice is has to construct distinct variants of a central design which rarely as simple as the concept first appears. First one has to make use of different pre-specified key lengths.
    [Show full text]
  • Report on the AES Candidates
    Rep ort on the AES Candidates 1 2 1 3 Olivier Baudron , Henri Gilb ert , Louis Granb oulan , Helena Handschuh , 4 1 5 1 Antoine Joux , Phong Nguyen ,Fabrice Noilhan ,David Pointcheval , 1 1 1 1 Thomas Pornin , Guillaume Poupard , Jacques Stern , and Serge Vaudenay 1 Ecole Normale Sup erieure { CNRS 2 France Telecom 3 Gemplus { ENST 4 SCSSI 5 Universit e d'Orsay { LRI Contact e-mail: [email protected] Abstract This do cument rep orts the activities of the AES working group organized at the Ecole Normale Sup erieure. Several candidates are evaluated. In particular we outline some weaknesses in the designs of some candidates. We mainly discuss selection criteria b etween the can- didates, and make case-by-case comments. We nally recommend the selection of Mars, RC6, Serp ent, ... and DFC. As the rep ort is b eing nalized, we also added some new preliminary cryptanalysis on RC6 and Crypton in the App endix which are not considered in the main b o dy of the rep ort. Designing the encryption standard of the rst twentyyears of the twenty rst century is a challenging task: we need to predict p ossible future technologies, and wehavetotake unknown future attacks in account. Following the AES pro cess initiated by NIST, we organized an op en working group at the Ecole Normale Sup erieure. This group met two hours a week to review the AES candidates. The present do cument rep orts its results. Another task of this group was to up date the DFC candidate submitted by CNRS [16, 17] and to answer questions which had b een omitted in previous 1 rep orts on DFC.
    [Show full text]
  • Development of the Advanced Encryption Standard
    Volume 126, Article No. 126024 (2021) https://doi.org/10.6028/jres.126.024 Journal of Research of the National Institute of Standards and Technology Development of the Advanced Encryption Standard Miles E. Smid Formerly: Computer Security Division, National Institute of Standards and Technology, Gaithersburg, MD 20899, USA [email protected] Strong cryptographic algorithms are essential for the protection of stored and transmitted data throughout the world. This publication discusses the development of Federal Information Processing Standards Publication (FIPS) 197, which specifies a cryptographic algorithm known as the Advanced Encryption Standard (AES). The AES was the result of a cooperative multiyear effort involving the U.S. government, industry, and the academic community. Several difficult problems that had to be resolved during the standard’s development are discussed, and the eventual solutions are presented. The author writes from his viewpoint as former leader of the Security Technology Group and later as acting director of the Computer Security Division at the National Institute of Standards and Technology, where he was responsible for the AES development. Key words: Advanced Encryption Standard (AES); consensus process; cryptography; Data Encryption Standard (DES); security requirements, SKIPJACK. Accepted: June 18, 2021 Published: August 16, 2021; Current Version: August 23, 2021 This article was sponsored by James Foti, Computer Security Division, Information Technology Laboratory, National Institute of Standards and Technology (NIST). The views expressed represent those of the author and not necessarily those of NIST. https://doi.org/10.6028/jres.126.024 1. Introduction In the late 1990s, the National Institute of Standards and Technology (NIST) was about to decide if it was going to specify a new cryptographic algorithm standard for the protection of U.S.
    [Show full text]