DOCSLIB.ORG

Building Efficient MDS Matrices

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Building Efficient MDS Matrices Perfect Diffusion Primitives for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Perfect Diffusion Primitives for Block Ciphers Vaudenay Preliminaries – Diffusion / Confusion Building Efficient MDS Matrices MDS Matrices ... Multipermutation ... and their Implementation Pascal Junod and Serge Vaudenay 32/64-bit Architectures 8-bit Architectures Bi-Regular Arrays Our Results Definition Some New Constructions (4; 4)-Multipermutation ÉCOLE POLYTECHNIQUE (8; 8)-Multipermutation FÉDÉRALE DE LAUSANNE Concluding Remarks Selected Areas in Cryptography '04 University of Waterloo (Canada), August 9, 2004 Perfect Diffusion Primitives Outline of this talk for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Vaudenay Preliminaries Diffusion / Confusion MDS Matrices ... Multipermutation ... and their Implementation I Preliminaries 32/64-bit Architectures 8-bit Architectures I MDS Matrices ... Bi-Regular Arrays Our Results I ... and their Implementation Definition I Some New Constructions Bi-Regular Arrays (4; 4)-Multipermutation (8; 8)-Multipermutation I Some New Constructions Concluding Remarks Perfect Diffusion Primitives Back to Shannon for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Vaudenay Preliminaries I Notions of confusion and diffusion introduced by Diffusion / Confusion MDS Matrices ... Shannon in “Communication Theory of Secrecy Multipermutation Systems” (1949) ... and their Implementation 32/64-bit Architectures I Confusion: “The method of confusion is to make the 8-bit Architectures Bi-Regular Arrays relation between the simple statistics of EK (:) and the Our Results simple description of K a very complex and involved Definition Some New Constructions one.” (4; 4)-Multipermutation I Diffusion: “In the method of diffusion the statistical (8; 8)-Multipermutation Concluding Remarks structure of M which leads to its redudancy is dissipated into long range statistics – i.e., into statistical structure involving long combinations of letters in the cryptogram.” Perfect Diffusion Primitives Confusion for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Vaudenay Preliminaries Diffusion / Confusion MDS Matrices ... Multipermutation I ... and their Implementation Notion of confusion nowadays related to the ones of 32/64-bit Architectures 8-bit Architectures I S-Box Bi-Regular Arrays I non-linearity Our Results I Boolean functions Definition Some New Constructions I algebraic attacks (4; 4)-Multipermutation (8; 8)-Multipermutation I Plenty of academic papers on this subject ! Concluding Remarks Perfect Diffusion Primitives Diffusion : Historical Perspectives for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Vaudenay I Less studied in a rigorous (mathematical) way until mid Preliminaries Diffusion / Confusion of 90’s MDS Matrices ... Multipermutation I Schnorr-Vaudenay (FSE’93 / EUROCRYPT’94) : ... and their Implementation introduction of the concept of multipermutation 32/64-bit Architectures 8-bit Architectures I Vaudenay (FSE’95) : a linear multipermutation is Bi-Regular Arrays Our Results equivalent to an MDS code Definition I Some New Constructions Daemen (PhD thesis, 1995): Wide-Trail Strategy (4; 4)-Multipermutation I (Choose “good” S-boxes) (8; 8)-Multipermutation I “Design the round transformation in such a way that only Concluding Remarks trails with many S-boxes occur.” I Rijmen, Daemen, Preneel, Bossalaers, De Win (FSE’96): design of SHARK whose diffusion layer is based on MDS codes Perfect Diffusion Primitives Multipermutation Nowadays for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Vaudenay Preliminaries Diffusion / Confusion MDS Matrices ... Multipermutation I Very few MDS codes are known ... and their Implementation I 32/64-bit Architectures Seldom used in practice 8-bit Architectures I Bi-Regular Arrays Widely spread building block in symmetric schemes Our Results Definition I Non-linear multipermutation: CS-Cipher Some New Constructions I (4; 4)-Multipermutation Linear multipermutation (MDS matrices): AES, (8; 8)-Multipermutation Camellia, Twofish, Khazad, FOX, and many, many Concluding Remarks others ! Perfect Diffusion Primitives In this Talk for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Vaudenay Preliminaries Diffusion / Confusion MDS Matrices ... Multipermutation ... and their Implementation I 32/64-bit Architectures Interested in “efficient” linear multipermutations 8-bit Architectures I Bi-Regular Arrays Brief recall about MDS matrices and their properties Our Results Definition I Definition of what we mean by “efficient” Some New Constructions I (4; 4)-Multipermutation New propositions (8; 8)-Multipermutation Concluding Remarks Perfect Diffusion Primitives Multipermutation: a De®nition for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Vaudenay Preliminaries Diffusion / Confusion MDS Matrices ... Multipermutation ... and their Implementation 32/64-bit Architectures De®nition (Multipermutation) 8-bit Architectures p q A diffusion function f from K to K is a multipermutation if Bi-Regular Arrays Our Results for any x1; : : : ; xp 2 K and any integer r with 1 ≤ r ≤ p, Definition modifying r input values on f (x1; : : : ; xp) results in modifying Some New Constructions (4; 4)-Multipermutation at least q − r + 1 output values. (8; 8)-Multipermutation Concluding Remarks Perfect Diffusion Primitives Multipermutation: Another De®nition for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Vaudenay Preliminaries Diffusion / Confusion MDS Matrices ... Multipermutation I De®nition (Multipermutation) ... and their Implementation p q 32/64-bit Architectures A diffusion function f from K to K is a 8-bit Architectures multipermutation if the set of all words consisting of Bi-Regular Arrays Our Results x1; : : : ; xp concatenated with f (x1; : : : ; xp) is a code of Definition p (#K) words of length p + q with minimal distance Some New Constructions (4; 4)-Multipermutation q + 1. (8; 8)-Multipermutation Concluding Remarks I Matches the Singleton bound (hence the link to MDS codes) Perfect Diffusion Primitives Multipermutation: Example for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Vaudenay I Representation of the finite field GF(28) : polynomials Preliminaries Diffusion / Confusion of degree at most seven with coefficients in GF(2) MDS Matrices ... modulo the irreducible polynomial Multipermutation ... and their Implementation 32/64-bit Architectures p(ξ) = ξ8 + ξ7 + ξ6 + ξ5 + ξ4 + ξ3 + 1 8-bit Architectures Bi-Regular Arrays Our Results I Addition: XOR Definition I Multiplication: usual multiplication of polynomials Some New Constructions (4; 4)-Multipermutation modulo p(ξ) (8; 8)-Multipermutation I Consider the following multipermutation on GF(28)2: Concluding Remarks x y 1 ξ x µ : 1 7! 1 = × 1 x2 y2 1 1 x2 Perfect Diffusion Primitives Why is it a Multipermutation ? for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge I Because µ is invertible : Vaudenay − Preliminaries 1 7 5 3 7 5 3 1 ξ ξ + ξ + ξ ξ + ξ + ξ + 1 Diffusion / Confusion = 7 5 3 7 5 3 MDS Matrices ... 1 1 ξ + ξ + ξ ξ + ξ + ξ Multipermutation ... and their Implementation I Because, when fixing x to a constant c, both y and y 32/64-bit Architectures 1 1 2 8-bit Architectures are permutations of x2 : Bi-Regular Arrays Our Results Definition y1 = c ⊕ (ξ · x2) Some New Constructions (4; 4)-Multipermutation y2 = c ⊕ x2 (8; 8)-Multipermutation Concluding Remarks I Because, when fixing x2 to a constant c, both y1 and y2 are permutations of x1 : y1 = x1 ⊕ (ξ · c) y2 = x1 ⊕ c Perfect Diffusion Primitives Why is it a Multipermutation (2)? for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Vaudenay Preliminaries Diffusion / Confusion MDS Matrices ... Multipermutation ... and their Implementation 32/64-bit Architectures 8-bit Architectures I Bi-Regular Arrays Because det(µ) =6 0 and every sub-determinant of µ is Our Results different of 0. Definition Some New Constructions (4; 4)-Multipermutation (8; 8)-Multipermutation Concluding Remarks Perfect Diffusion Primitives 32/64-bit Architectures for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Vaudenay Preliminaries Diffusion / Confusion MDS Matrices ... Multipermutation ... and their Implementation 32/64-bit Architectures 8-bit Architectures Bi-Regular Arrays Our Results Definition Some New Constructions (4; 4)-Multipermutation (8; 8)-Multipermutation Concluding Remarks I Lot of fast memory (L1 cache) I Table lookups + XORs: y1 1 ξ = x1 × ⊕ x2 × y2 1 1 Perfect Diffusion Primitives 8-bit Architectures for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Vaudenay Preliminaries Diffusion / Confusion MDS Matrices ... Multipermutation ... and their Implementation 32/64-bit Architectures 8-bit Architectures Bi-Regular Arrays Our Results Definition Some New Constructions (4; 4)-Multipermutation I Less memory at disposal ! complete precomputation (8; 8)-Multipermutation is impossible! Concluding Remarks I The matrix elements value matters ! I Multiplications by 1 are “free” operations I Possible to precompute the operation “multiplication by a constant c” Perfect Diffusion Primitives Our strategy for Block Ciphers – Building Efficient MDS Matrices Pascal Junod and Serge Vaudenay Preliminaries Diffusion / Confusion I MDS Matrices ... Maximize the number of 1’s in the matrix. Multipermutation I Minimize the number of different
Load more

Recommended publications
  • Chapter 3 – Block Ciphers and the Data Encryption Standard
    Chapter 3 –Block Ciphers and the Data Cryptography and Network Encryption Standard Security All the afternoon Mungo had been working on Stern's Chapter 3 code, principally with the aid of the latest messages which he had copied down at the Nevin Square drop. Stern was very confident. He must be well aware London Central knew about that drop. It was obvious Fifth Edition that they didn't care how often Mungo read their messages, so confident were they in the by William Stallings impenetrability of the code. —Talking to Strange Men, Ruth Rendell Lecture slides by Lawrie Brown Modern Block Ciphers Block vs Stream Ciphers now look at modern block ciphers • block ciphers process messages in blocks, each one of the most widely used types of of which is then en/decrypted cryptographic algorithms • like a substitution on very big characters provide secrecy /hii/authentication services – 64‐bits or more focus on DES (Data Encryption Standard) • stream ciphers process messages a bit or byte at a time when en/decrypting to illustrate block cipher design principles • many current ciphers are block ciphers – better analysed – broader range of applications Block vs Stream Ciphers Block Cipher Principles • most symmetric block ciphers are based on a Feistel Cipher Structure • needed since must be able to decrypt ciphertext to recover messages efficiently • bloc k cihiphers lklook like an extremely large substitution • would need table of 264 entries for a 64‐bit block • instead create from smaller building blocks • using idea of a product cipher 1 Claude
    [Show full text]
  • Feistel Like Construction of Involutory Binary Matrices with High Branch Number
    Feistel Like Construction of Involutory Binary Matrices With High Branch Number Adnan Baysal1,2, Mustafa C¸oban3, and Mehmet Ozen¨ 3 1TUB¨ ITAK_ - BILGEM,_ PK 74, 41470, Gebze, Kocaeli, Turkey, [email protected] 2Kocaeli University, Department of Computer Engineering, Faculty of Engineering, Institute of Science, 41380, Umuttepe, Kocaeli, Turkey 3Sakarya University, Faculty of Arts and Sciences, Department of Mathematics, Sakarya, Turkey, [email protected], [email protected] August 4, 2016 Abstract In this paper, we propose a generic method to construct involutory binary matrices from a three round Feistel scheme with a linear round function. We prove bounds on the maximum achievable branch number (BN) and the number of fixed points of our construction. We also define two families of efficiently implementable round functions to be used in our method. The usage of these families in the proposed method produces matrices achieving the proven bounds on branch numbers and fixed points. Moreover, we show that BN of the transpose matrix is the same with the original matrix for the function families we defined. Some of the generated matrices are Maximum Distance Binary Linear (MDBL), i.e. matrices with the highest achievable BN. The number of fixed points of the generated matrices are close to the expected value for a random involution. Generated matrices are especially suitable for utilising in bitslice block ciphers and hash functions. They can be implemented efficiently in many platforms, from low cost CPUs to dedicated hardware. Keywords: Diffusion layer, bitslice cipher, hash function, involution, MDBL matrices, Fixed points. 1 Introduction Modern block ciphers and hash functions use two basic layers iteratively to provide security: confusion and diffusion.
    [Show full text]
  • Block Ciphers
    Block Ciphers Chester Rebeiro IIT Madras CR STINSON : chapters 3 Block Cipher KE KD untrusted communication link Alice E D Bob #%AR3Xf34^$ “Attack at Dawn!!” message encryption (ciphertext) decryption “Attack at Dawn!!” Encryption key is the same as the decryption key (KE = K D) CR 2 Block Cipher : Encryption Key Length Secret Key Plaintext Ciphertext Block Cipher (Encryption) Block Length • A block cipher encryption algorithm encrypts n bits of plaintext at a time • May need to pad the plaintext if necessary • y = ek(x) CR 3 Block Cipher : Decryption Key Length Secret Key Ciphertext Plaintext Block Cipher (Decryption) Block Length • A block cipher decryption algorithm recovers the plaintext from the ciphertext. • x = dk(y) CR 4 Inside the Block Cipher PlaintextBlock (an iterative cipher) Key Whitening Round 1 key1 Round 2 key2 Round 3 key3 Round n keyn Ciphertext Block • Each round has the same endomorphic cryptosystem, which takes a key and produces an intermediate ouput • Size of the key is huge… much larger than the block size. CR 5 Inside the Block Cipher (the key schedule) PlaintextBlock Secret Key Key Whitening Round 1 Round Key 1 Round 2 Round Key 2 Round 3 Round Key 3 Key Expansion Expansion Key Key Round n Round Key n Ciphertext Block • A single secret key of fixed size used to generate ‘round keys’ for each round CR 6 Inside the Round Function Round Input • Add Round key : Add Round Key Mixing operation between the round input and the round key. typically, an ex-or operation Confusion Layer • Confusion layer : Makes the relationship between round Diffusion Layer input and output complex.
    [Show full text]
  • Lecture Four
    Lecture Four Today’s Topics . Historic Symmetric ciphers . Modern symmetric ciphers . DES, AES . Asymmetric ciphers . RSA . Next class: Protocols Example Ciphers . Shift cipher: each plaintext characters is replaced by a character k to the right. (When k=3, it’s a Caesar cipher). “Watch out for Brutus!” => “Jngpu bhg sbe Oehghf!” . Only 25 choices! Not hard to break by brute force. Substitution Cipher: each character in plaintext is replaced by a corresponding character of ciphertext. E.g., cryptograms in newspapers. plaintext code: a b c d e f g h i f k l m n o p q r s t u v w x y z ciphertext code: m n b v c x z a s d f g h j k l p o i u y t r e w q . 26! Possible pairs. Is is really that hard to break? Substitution ciphers . The Caesar cipher has a small key space, but doesn’t create a statistical independence between the plaintext and the ciphertext. The best ciphers allow no statistical attacks, thereby forcing a brute force, exhaustive search; all the security lies with the key space. As cryptographic algorithms matured, the statistical independence between the plaintext and cipher text increased. Ciphers . The caesar cipher, hill cipher, and playfair cipher all work with a single alphabet for doing substitutions . They are monoalphabetic substitutions. A more complex (and more robust) alternative is to use different substitution mappings on various portions of the plaintext. Polyalphabetic substitutions. More ciphers . Vigenère cipher: each character of plaintext is encrypted with a different a cipher key.
    [Show full text]
  • VHDL Implementation of Twofish Algorithm
    VHDL Implementation of Twofish Algorithm Purnima Gehlot Richa Sharma S. R. Biradar Mody Institute of Mody Institute of Mody Institute of Technology Technology Technology and Science and Science and Science Laxmangarh, Sikar Laxmangarh, Sikar Laxmangarh, Sikar Rajasthan,India Rajasthan,India Rajasthan,India [email protected] [email protected] [email protected] which consists of two modules of function g, one MDS i.e. maximum ABSTRACT distance separable matrix,a PHT i.e. pseudo hadamard transform and Every day hundreds and thousands of people interact electronically, two adders of 32-bit for one round. To increase the complexity of the whether it is through emails, e-commerce, etc. through internet. For algorithm we can perform Endian function over the input bit stream. sending sensitive messages over the internet, we need security. In this Different modules of twofish algorithms are: paper a security algorithms, Twofish (Symmetric key cryptographic algorithm) [1] has been explained. All the important modules of 2.1 ENDIAN FUNCTION Twofish algorithm, which are Function F and g, MDS, PHT, are implemented on Xilinx – 6.1 xst software and there delay calculations Endian Function is a transformation of the input data. It is used as an interface between the input data provided to the circuit and the rest has been done on FPGA families which are Spartan2, Spartan2E and of the cipher. It can be used with all the key-sizes [5]. Here 128-bit VirtexE. input is divided into 16 bytes from byte0 to byte15 and are rearranged to get the output of 128-bit. Keywords Twofish, MDS, PHT, symmetric key, Function F and g.
    [Show full text]
  • Confusion and Diffusion
    Confusion and Diffusion Ref: William Stallings, Cryptography and Network Security, 3rd Edition, Prentice Hall, 2003 Confusion and Diffusion 1 Statistics and Plaintext • Suppose the frequency distribution of plaintext in a human-readable message in some language is known. • Or suppose there are known words or phrases that are used in the plaintext message. • A cryptanalysist can use this information to break a cryptographic algorithm. Confusion and Diffusion 2 Changing Statistics • Claude Shannon suggested that to complicate statistical attacks, the cryptographer could dissipate the statistical structure of the plaintext in the long range statistics of the ciphertext. • Shannon called this process diffusion . Confusion and Diffusion 3 Changing Statistics (p.2) • Diffusion can be accomplished by having many plaintext characters affect each ciphertext character. • An example of diffusion is the encryption of a message M=m 1,m 2,... using a an averaging: y n= ∑i=1,k mn+i (mod26). Confusion and Diffusion 4 Changing Statistics (p.3) • In binary block ciphers, such as the Data Encryption Standard (DES), diffusion can be accomplished using permutations on data, and then applying a function to the permutation to produce ciphertext. Confusion and Diffusion 5 Complex Use of a Key • Diffusion complicates the statistics of the ciphertext, and makes it difficult to discover the key of the encryption process. • The process of confusion , makes the use of the key so complex, that even when an attacker knows the statistics, it is still difficult to deduce the key. Confusion and Diffusion 6 Complex Use of a Key(p.2) • Confusion can be accomplished by using a complex substitution algorithm.
    [Show full text]
  • The Whirlpool Secure Hash Function
    Cryptologia, 30:55–67, 2006 Copyright Taylor & Francis Group, LLC ISSN: 0161-1194 print DOI: 10.1080/01611190500380090 The Whirlpool Secure Hash Function WILLIAM STALLINGS Abstract In this paper, we describe Whirlpool, which is a block-cipher-based secure hash function. Whirlpool produces a hash code of 512 bits for an input message of maximum length less than 2256 bits. The underlying block cipher, based on the Advanced Encryption Standard (AES), takes a 512-bit key and oper- ates on 512-bit blocks of plaintext. Whirlpool has been endorsed by NESSIE (New European Schemes for Signatures, Integrity, and Encryption), which is a European Union-sponsored effort to put forward a portfolio of strong crypto- graphic primitives of various types. Keywords advanced encryption standard, block cipher, hash function, sym- metric cipher, Whirlpool Introduction In this paper, we examine the hash function Whirlpool [1]. Whirlpool was developed by Vincent Rijmen, a Belgian who is co-inventor of Rijndael, adopted as the Advanced Encryption Standard (AES); and by Paulo Barreto, a Brazilian crypto- grapher. Whirlpool is one of only two hash functions endorsed by NESSIE (New European Schemes for Signatures, Integrity, and Encryption) [13].1 The NESSIE project is a European Union-sponsored effort to put forward a portfolio of strong cryptographic primitives of various types, including block ciphers, symmetric ciphers, hash functions, and message authentication codes. Background An essential element of most digital signature and message authentication schemes is a hash function. A hash function accepts a variable-size message M as input and pro- duces a fixed-size hash code HðMÞ, sometimes called a message digest, as output.
    [Show full text]
  • What You Should Know for the Final Exam
    MATC16 Cryptography and Coding Theory G´abor Pete University of Toronto Scarborough What you should know for the final exam Principles and goals of cryptography: Kerckhoff’s principle. Shannon’s confusion and diffusion. Possible attack situations (cipher- text only, chosen plaintext, etc.). Possible goals of attacker, and the corresponding tasks of cryptography (confidentiality, data integrity, authentication, non-repudiation). [Chap- ter 1, plus page 38 and http://en.wikipedia.org/wiki/Confusion_and_diffusion for diffusion & confusion.] Classical cryptosystems: Number theory basics: infinitely many primes exist, basics of modular arithmetic, extended Euclidean algorithm, solving ax+by = d, inverting numbers and matrices (mod n). [Sections 3.1-3 and 3.8.] Shift and affine ciphers. Their ciphertext only and known plaintext attacks. Composition of two affine ciphers is again an affine cipher. [Sections 2.1-2.] Substitution ciphers in general. [Section 2.4] Vigen`ere cipher. Known plaintext attack. Ciphertext only: finding the key length, then frequency analysis. [Section 2.3.] Hill cipher. Known plaintext attack. [Section 2.7.] One-time pad. LFSR sequences. Known plaintext attack, finding the recursion. [Sections 2.9 and 11.] Basics of Enigma. [Section 2.12, up to middle of page 53.] The DES: Feistel systems, simplified and real DES (without the exact expansion functions and S-boxes and permutations, of course), how decryption works in these DES versions. How the extra parity check bits in the real DES key ensure error detection. How confusion and diffusion are fulfilled in DES. [Sections 4.1-2 and 4.4.] Double and Triple DES. Meet-in-the-middle attack. (I mentioned here that one can organize the two lists of length n and find a match between them in almost linear time (n log n) instead of the naive approach that would give only n2, and hence would ruin the attack completely.
    [Show full text]
  • A Lightweight Encryption Algorithm for Secure Internet of Things
    Pre-Print Version, Original article is available at (IJACSA) International Journal of Advanced Computer Science and Applications, Vol. 8, No. 1, 2017 SIT: A Lightweight Encryption Algorithm for Secure Internet of Things Muhammad Usman∗, Irfan Ahmedy, M. Imran Aslamy, Shujaat Khan∗ and Usman Ali Shahy ∗Faculty of Engineering Science and Technology (FEST), Iqra University, Defence View, Karachi-75500, Pakistan. Email: fmusman, [email protected] yDepartment of Electronic Engineering, NED University of Engineering and Technology, University Road, Karachi 75270, Pakistan. Email: firfans, [email protected], [email protected] Abstract—The Internet of Things (IoT) being a promising and apply analytics to share the most valuable data with the technology of the future is expected to connect billions of devices. applications. The IoT is taking the conventional internet, sensor The increased number of communication is expected to generate network and mobile network to another level as every thing mountains of data and the security of data can be a threat. The will be connected to the internet. A matter of concern that must devices in the architecture are essentially smaller in size and be kept under consideration is to ensure the issues related to low powered. Conventional encryption algorithms are generally confidentiality, data integrity and authenticity that will emerge computationally expensive due to their complexity and requires many rounds to encrypt, essentially wasting the constrained on account of security and privacy [4]. energy of the gadgets. Less complex algorithm, however, may compromise the desired integrity. In this paper we propose a A. Applications of IoT: lightweight encryption algorithm named as Secure IoT (SIT).
    [Show full text]
  • Stream and Block Ciphers
    Symmetric Cryptography Block Ciphers and Stream Ciphers Stream Ciphers K Seeded by a key K the stream cipher Stream ⃗z generates a random bit-stream z. Cipher A stream of plain-text bits p is XORed with the pseudo-random stream to obtain the cipher text stream c ⃗c=⃗p⊕⃗z and ⃗p=⃗c⊕⃗z ⃗c cipher text ⃗p plain text The same stream generator (using the same seed) ⃗z key stream used for both encryption and decryption Stream Ciphers K →¯zk ¯c=¯p⊕¯z k ¯ci=¯pi ⊕¯z k ¯c j=¯p j ⊕¯zk Attacker has access to ¯ci and ¯c j ¯ci⊕¯c j=(¯pi⊕¯zk )⊕(¯p j⊕¯z k)=¯pi⊕ ¯p j ● XORing two cipher-texts encrypted using the same seed results in XOR of corresponding plain-texts ● Redundancy in plain-text structure can be easily used to determine both plain- texts ● And hence, the key stream ● Never reuse seed? ● Impractical ● Extend seed using an initial value (IV) which can be sent in the clear ● Never reuse IV Block Ciphers ● C=E(P,K) ● P=D(C,K) ● E() and D() are algorithms ● P is a block of “plain text” (m bits) ● C is the corresponding “cipher text” (also m bits) ● K is the secret key (k bits long) ● (k,m) block cipher – k-bit keysize, m-bit blocksize ● (m+k)-bit input, m-bit output Desired Properties ● The most efficient attack should be the brute-force attack (complexity depends only on key length) ● Knowledge of any number of plain-cipher text pairs, still does not reveal any information regarding any bit of the key.
    [Show full text]
  • Applied Cryptography and Data Security
    Lecture Notes APPLIED CRYPTOGRAPHY AND DATA SECURITY (version 2.5 | January 2005) Prof. Christof Paar Chair for Communication Security Department of Electrical Engineering and Information Sciences Ruhr-Universit¨at Bochum Germany www.crypto.rub.de Table of Contents 1 Introduction to Cryptography and Data Security 2 1.1 Literature Recommendations . 3 1.2 Overview on the Field of Cryptology . 4 1.3 Symmetric Cryptosystems . 5 1.3.1 Basics . 5 1.3.2 A Motivating Example: The Substitution Cipher . 7 1.3.3 How Many Key Bits Are Enough? . 9 1.4 Cryptanalysis . 10 1.4.1 Rules of the Game . 10 1.4.2 Attacks against Crypto Algorithms . 11 1.5 Some Number Theory . 12 1.6 Simple Blockciphers . 17 1.6.1 Shift Cipher . 18 1.6.2 Affine Cipher . 20 1.7 Lessons Learned | Introduction . 21 2 Stream Ciphers 22 2.1 Introduction . 22 2.2 Some Remarks on Random Number Generators . 26 2.3 General Thoughts on Security, One-Time Pad and Practical Stream Ciphers 27 2.4 Synchronous Stream Ciphers . 31 i 2.4.1 Linear Feedback Shift Registers (LFSR) . 31 2.4.2 Clock Controlled Shift Registers . 34 2.5 Known Plaintext Attack Against Single LFSRs . 35 2.6 Lessons Learned | Stream Ciphers . 37 3 Data Encryption Standard (DES) 38 3.1 Confusion and Diffusion . 38 3.2 Introduction to DES . 40 3.2.1 Overview . 41 3.2.2 Permutations . 42 3.2.3 Core Iteration / f-Function . 43 3.2.4 Key Schedule . 45 3.3 Decryption . 47 3.4 Implementation . 50 3.4.1 Hardware .
    [Show full text]
  • Lightweight Diffusion Layer from the Kth Root of the MDS Matrix
    Lightweight Diffusion Layer from the kth root of the MDS Matrix Souvik Kolay1, Debdeep Mukhopadhyay1 1Dept. of Computer Science and Engineering Indian Institute of Technology Kharagpur, India fsouvik1809,[email protected] Abstract. The Maximum Distance Separable (MDS) mapping, used in cryptog- raphy deploys complex Galois field multiplications, which consume lots of area in hardware, making it a costly primitive for lightweight cryptography. Recently in lightweight hash function: PHOTON, a matrix denoted as ‘Serial’, which re- quired less area for multiplication, has been multiplied 4 times to achieve a lightweight MDS mapping. But no efficient method has been proposed so far to synthesize such a serial matrix or to find the required number of repetitive multiplications needed to be performed for a given MDS mapping. In this pa- per, first we provide an generic algorithm to find out a low-cost matrix, which can be multiplied k times to obtain a given MDS mapping. Further, we optimize the algorithm for using in cryptography and show an explicit case study on the MDS mapping of the hash function PHOTON to obtain the ‘Serial’. The work also presents quite a few results which may be interesting for lightweight imple- mentation. Keywords: MDS Matrix, kth Root of a Matrix, Lightweight Diffusion Layer 1 Introduction With several resource constrained devices requiring support for cryptographic algo- rithms, the need for lightweight cryptography is imperative. Several block ciphers, like Kasumi[19], mCrypton[24], HIGHT[20], DESL and DESXL[23], CLEFIA[34], Present[8], Puffin[11], MIBS[22], KATAN[9], Klein[14], TWINE[36], LED[16], Pic- colo [33] etc and hash functions like PHOTON[33], SPONGENT[7], Quark [3] etc.
    [Show full text]