This is a Chapter from the Handbook of Applied Cryptography, by A. Menezes, P. van Oorschot, and S. Vanstone, CRC Press, 1996. For further information, see www.cacr.math.uwaterloo.ca/hac CRC Press has granted the following specific permissions for the electronic version of this book: Permission is granted to retrieve, print and store a single copy of this chapter for personal use. This permission does not extend to binding multiple chapters of the book, photocopying or producing copies for other than personal use of the person creating the copy, or making electronic copies available for retrieval by others without prior permission in writing from CRC Press. Except where over-ridden by the specific permission above, the standard copyright notice from CRC Press applies to this electronic version: Neither this book nor any part may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, microfilming, and recording, or by any information storage or retrieval system, without prior permission in writing from the publisher. The consent of CRC Press does not extend to copying for general distribution, for promotion, for creating new works, or for resale. Specific permission must be obtained in writing from CRC Press for such copying. c 1997 by CRC Press, Inc. Chapter 7 Block Ciphers Contents in Brief 7.1 Introduction and overview :::::::::::::::::::::223 7.2 Background and general concepts :::::::::::::::::224 7.3 Classical ciphers and historical development ::::::::::::237 7.4 DES :::::::::::::::::::::::::::::::::250 7.5 FEAL ::::::::::::::::::::::::::::::::259 7.6 IDEA ::::::::::::::::::::::::::::::::263 7.7 SAFER, RC5, and other block ciphers :::::::::::::::266 7.8 Notes and further references ::::::::::::::::::::271 7.1 Introduction and overview Symmetric-key block ciphers are the most prominent and important elements in many cryp- tographic systems. Individually, they provide con®dentiality. As a fundamental building block, their versatility allows construction of pseudorandom number generators, stream ci- phers, MACs, and hash functions. They may furthermore serve as a central component in message authentication techniques, data integrity mechanisms, entity authentication proto- cols, and (symmetric-key)digital signature schemes. This chapter examines symmetric-key block ciphers, including both general concepts and details of speci®c algorithms. Public- key block ciphers are discussed in Chapter 8. No block cipher is ideally suited for all applications, even one offering a high level of security. This is a result of inevitable tradeoffs required in practical applications, including those arising from, for example, speed requirements and memory limitations (e.g., code size, data size, cache memory), constraints imposed by implementation platforms (e.g., hardware, software, chipcards), and differing tolerances of applications to properties of var- ious modes of operation. In addition, ef®ciency must typically be traded off against security. Thus it is bene®cial to have a number of candidate ciphers from which to draw. Of the many block ciphers currently available, focus in this chapter is given to a sub- set of high pro®le and/or well-studied algorithms. While not guaranteed to be more secure than other published candidate ciphers (indeed, this status changes as new attacks become known), emphasis is given to those of greatest practical interest. Among these, DES is paramount; FEAL has received both serious commercial backing and a large amount of in- dependent cryptographic analysis; and IDEA (originally proposed as a DES replacement) is widely known and highly regarded. Other recently proposed ciphers of both high promise and high pro®le (in part due to the reputation of their designers) are SAFER and RC5. Ad- ditional ciphers are presented in less detail. 223 224 Ch. 7 Block Ciphers Chapter outline Basic background on block ciphers and algorithm-independent concepts are presented in §7.2, including modes of operation, multiple encryption, and exhaustive search techniques. Classical ciphers and cryptanalysis thereof are addressed in §7.3, including historical details on cipher machines. Modern block ciphers covered in chronological order are DES (§7.4), FEAL (§7.5), and IDEA (§7.6), followed by SAFER, RC5, and other ciphers in §7.7, col- lectively illustrating a wide range of modern block cipher design approaches. Further notes, including details on additional ciphers (e.g., Lucifer) and references for the chapter, may be found in §7.8. 7.2 Background and general concepts Introductory material on block ciphers is followed by subsections addressing modes of op- eration, and discussion of exhaustive key search attacks and multiple encryption. 7.2.1 Introduction to block ciphers Block ciphers can be either symmetric-key or public-key. The main focus of this chapter is symmetric-key block ciphers; public-key encryption is addressed in Chapter 8. (i) Block cipher de®nitions A block cipher is a function (see §1.3.1) which maps n-bit plaintext blocks to n-bit cipher- text blocks; n is called the blocklength. It may be viewed as a simple substitution cipher with large character size. The function is parameterized by a k-bit key K,1 taking values from a subset K (the key space)ofthesetofallk-bit vectors Vk. It is generally assumed that the key is chosen at random. Use of plaintext and ciphertext blocks of equal size avoids data expansion. To allow unique decryption, the encryption function must be one-to-one (i.e., invert- ible). For n-bit plaintext and ciphertext blocks and a ®xed key, the encryption function is a bijection, de®ning a permutation on n-bit vectors. Each key potentially de®nes a differ- ent bijection. The number of keys is |K|,andtheeffective key size is lg |K|; this equals the key length if all k-bit vectors are valid keys (K = Vk). If keys are equiprobable and each de®nes a different bijection, the entropy of the key space is also lg |K|. 7.1 De®nition An n-bit block cipher is a function E : Vn ×K→ Vn, such that for each key K ∈K, E(P; K) is an invertible mapping (the encryption function for K) from Vn to Vn, written EK (P ). The inverse mapping is the decryption function, denoted DK (C). C = EK (P ) denotes that ciphertext C results from encrypting plaintext P under K. Whereas block ciphers generally process plaintext in relatively large blocks (e.g., n ≥ 64), stream ciphers typically process smaller units (see Note 6.1); the distinction, however, is not de®nitive (see Remark 7.25). For plaintext messages exceeding one block in length, various modes of operation for block ciphers are used (see §7.2.2). The most general block cipher implements every possible substitution, as per De®ni- tion 7.2. To represent the key of such an n-bit (true) random block cipher would require 1This use of symbols k and K may differ from other chapters. c 1997 by CRC Press, Inc. Ð See accompanying notice at front of chapter. §7.2 Background and general concepts 225 lg(2n!) ≈ (n − 1:44)2n bits, or roughly 2n times the number of bits in a message block. This excessive bitsize makes (true) random ciphers impractical. Nonetheless, it is an ac- cepted design principle that the encryption function corresponding to a randomly selected key should appear to be a randomly chosen invertible function. 7.2 De®nition A(true) random cipher is an n-bit block cipher implementing all 2n! bijections on 2n elements. Each of the 2n! keys speci®es one such permutation. A block cipher whose block size n is too small may be vulnerable to attacks based on statistical analysis. One such attack involves simple frequency analysis of ciphertext blocks (see Note 7.74). This may be thwarted by appropriate use of modes of operation (e.g., Al- gorithm 7.13). Other such attacks are considered in Note 7.8. However, choosing too large a value for the blocksize n may create dif®culties as the complexity of implementation of many ciphers grows rapidly with block size. In practice, consequently, for larger n, easily- implementable functions are necessary which appear to be random (without knowledge of the key). An encryption function per De®nition 7.1 is a deterministic mapping. Each pairing of plaintext block P and key K maps to a unique ciphertext block. In contrast, in a randomized encryption technique (De®nition 7.3; see also Remark 8.22), each (P; K) pair is associated with a set C(P;K) of eligible ciphertext blocks; each time P is encrypted under K, an out- put R from a random source non-deterministically selects one of these eligible blocks. To ensure invertibility, for every ®xed key K, the subsets C(P;K) over all plaintexts P must be disjoint. Since the encryption function is essentially one-to-many involving an additional parameter R (cf. homophonic substitution, §7.3.2), the requirement for invertibility implies data expansion, which is a disadvantage of randomized encryption and is often unaccept- able. 7.3 De®nition A randomized encryption mapping is a function E from a plaintext space Vn to a ciphertext space Vm, m>n, drawing elements from a space of random numbers R = Vt. E is de®ned by E : Vn ×K×R→Vm, such that for each key K ∈Kand R ∈R, R E(P; K; R), also written EK (P ), maps P ∈ Vn to Vm; and an inverse (corresponding decryption) function exists, mapping Vm ×K→Vn. (ii) Practical security and complexity of attacks The objective of a block cipher is to provide con®dentiality. The corresponding objective of an adversary is to recover plaintext from ciphertext. A block cipher is totally broken if a key can be found, and partially broken if an adversary is able to recover part of the plaintext (but not the key) from ciphertext.