MATH 509 on DES Department of Mathematics, Boise State University Spring 2012 MATH 509 on DES
MATH 509 on DES
Feistel Round Function for DES MATH 509 on DES
1977: DES is approved as a standard. 1 1 Designers: H Feistel, W Tuchman, D Coppersmith, A Konheim, E Grossman, B Notz, L Smith and B Tuckerman from IBM MATH 509 on DES
1977: DES is approved as a standard. 1 1992: Biham and Shamir reported the differential cryptanalysis. 1 Designers: H Feistel, W Tuchman, D Coppersmith, A Konheim, E Grossman, B Notz, L Smith and B Tuckerman from IBM MATH 509 on DES
1977: DES is approved as a standard. 1 1992: Biham and Shamir reported the differential cryptanalysis. 1994: The first linear cryptanalysis of DES is performed by Matsui. 1 Designers: H Feistel, W Tuchman, D Coppersmith, A Konheim, E Grossman, B Notz, L Smith and B Tuckerman from IBM MATH 509 on DES
1977: DES is approved as a standard. 1 1992: Biham and Shamir reported the differential cryptanalysis. 1994: The first linear cryptanalysis of DES is performed by Matsui. 1999: DES was reaffirmed for the fourth time with the use of Triple DES. 1 Designers: H Feistel, W Tuchman, D Coppersmith, A Konheim, E Grossman, B Notz, L Smith and B Tuckerman from IBM MATH 509 on DES
1977: DES is approved as a standard. 1 1992: Biham and Shamir reported the differential cryptanalysis. 1994: The first linear cryptanalysis of DES is performed by Matsui. 1999: DES was reaffirmed for the fourth time with the use of Triple DES. 2002: The Advanced Encryption Standard (AES) become a standard. 1 Designers: H Feistel, W Tuchman, D Coppersmith, A Konheim, E Grossman, B Notz, L Smith and B Tuckerman from IBM MATH 509 on DES
2 2 Eli Biham and Adi Shamir, of the Data Encryption Standard, (1993) MATH 509 on DES
3 3 Eli Biham and Adi Shamir, of the Data Encryption Standard, (1993) MATH 509 on DES
S-Box Design Criteria 1 bit input difference produces 2 bits output difference. Minimize the difference between the numbers of 1 s and 0 s when any input bit remains the same. 2 input difference bits mapped to 3 by the expansion function. S(X ) S(X 11 00)... MATH 509 on DES
4 4 Eli Biham and Adi Shamir, of the Data Encryption Standard, (1993) MATH 509 on DES
4 Don was wrong!... Ali Biham 4 Eli Biham and Adi Shamir, of the Data Encryption Standard, (1993) MATH 509 on DES
on 3-round B-DES IN CLASS NOTES MATH 509 on DES
on 4-round B-DES Suppose we have an access to a 4-round B-DES device. We know all the inner workings of the encryption algorithm, its standards, S-boxes, but we don t know the key. MATH 509 on DES
on 4-round B-DES Suppose we have an access to a 4-round B-DES device. We know all the inner workings of the encryption algorithm, its standards, S-boxes, but we don t know the key. Using the analysis for 3-rounds and the knowledge that certain plaintext differences occurs with a higher probability than other differences, we can discover the key. MATH 509 on DES
on 4-round B-DES Suppose we have an access to a 4-round B-DES device. We know all the inner workings of the encryption algorithm, its standards, S-boxes, but we don t know the key. Using the analysis for 3-rounds and the knowledge that certain plaintext differences occurs with a higher probability than other differences, we can discover the key. Note that there are 16 2 input pairs (L, L ) in the S-boxes. There are 16 input pairs (L, L ) with fixed XOR. MATH 509 on DES
on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: MATH 509 on DES
on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: There are 12 input pairs (a, a ) such that MATH 509 on DES
on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: There are 12 input pairs (a, a ) such that a a = 0011 and S 1 (a) S 1 (a ) = 011 The following is known about the difference distribution for the box S 2 in B-DES: MATH 509 on DES
on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: There are 12 input pairs (a, a ) such that a a = 0011 and S 1 (a) S 1 (a ) = 011 The following is known about the difference distribution for the box S 2 in B-DES: There are 8 input pairs (a, a ) such that MATH 509 on DES
on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: There are 12 input pairs (a, a ) such that a a = 0011 and S 1 (a) S 1 (a ) = 011 The following is known about the difference distribution for the box S 2 in B-DES: There are 8 input pairs (a, a ) such that a a = 1100 and S 2 (a) S 2 (a ) = 010 MATH 509 on DES
on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: There are 12 input pairs (a, a ) such that a a = 0011 and S 1 (a) S 1 (a ) = 011 The following is known about the difference distribution for the box S 2 in B-DES: There are 8 input pairs (a, a ) such that a a = 1100 and S 2 (a) S 2 (a ) = 010 Therefore, if the S-boxes are independent we have that MATH 509 on DES
on 4-round B-DES The following is known about the difference distribution for the box S 1 in B-DES: There are 12 input pairs (a, a ) such that a a = 0011 and S 1 (a) S 1 (a ) = 011 The following is known about the difference distribution for the box S 2 in B-DES: There are 8 input pairs (a, a ) such that a a = 1100 and S 2 (a) S 2 (a ) = 010 Therefore, if the S-boxes are independent we have that p[s 1 (a) S 1 (a ) = 011, S 2 (a) S 2 (a ) = 010] = 12 16 8 16 Question How can we use this weakness of the S-boxes? MATH 509 on DES
Step-by-Step on 4-round B-DES Step 1: Choose plaintext pairs L 0 R 0 and L 0 R 0 difference with an XOR R 0 = R 0 R 0 = 001100 and L 0 = L 0 L 0 = 011010 MATH 509 on DES
Step-by-Step on 4-round B-DES Step 1: Choose plaintext pairs L 0 R 0 and L 0 R 0 difference with an XOR R 0 = R 0 R 0 = 001100 and L 0 = L 0 L 0 = 011010 Step 2: Using the expansion function in B-DES compute E( R 0 ) = 00111100. MATH 509 on DES
Step-by-Step on 4-round B-DES Step 1: Choose plaintext pairs L 0 R 0 and L 0 R 0 difference with an XOR R 0 = R 0 R 0 = 001100 and L 0 = L 0 L 0 = 011010 Step 2: Using the expansion function in B-DES compute E( R 0 ) = 00111100. The input XOR for S 1 is R 1 0 R 0 1 = 0011 MATH 509 on DES
Step-by-Step on 4-round B-DES Step 1: Choose plaintext pairs L 0 R 0 and L 0 R 0 difference with an XOR R 0 = R 0 R 0 = 001100 and L 0 = L 0 L 0 = 011010 Step 2: Using the expansion function in B-DES compute E( R 0 ) = 00111100. The input XOR for S 1 is and the input XOR for S 2 is R 1 0 R 0 1 = 0011 R 2 0 R 0 2 = 0011 MATH 509 on DES
Step-by-Step on 4-round B-DES Note that in that case we have that R 1 = R 1 R 1 = MATH 509 on DES
Step-by-Step on 4-round B-DES Note that in that case we have that R 1 = R 1 R 1 = L 0 f (R 0, K 1 ) L 0 f (R 0, K 1 ) = MATH 509 on DES
Step-by-Step on 4-round B-DES Note that in that case we have that R 1 = R 1 R 1 = L 0 f (R 0, K 1 ) L 0 f (R 0, K 1 ) = L 0 S 1 (R 0 ) S 1 (R 0 ) = 011010 011010 = 000000 MATH 509 on DES
Step-by-Step on 4-round B-DES Note that in that case we have that R 1 = R 1 R 1 = L 0 f (R 0, K 1 ) L 0 f (R 0, K 1 ) = L 0 S 1 (R 0 ) S 1 (R 0 ) = 011010 011010 = 000000 i.e. R 1 = R 1. Also, note that the probability p[ L 1 R 1 = 001100000000 L 0 R 0 = 011010001100] = 3 8. MATH 509 on DES
Step-by-Step on 4-round B-DES Note that in that case we have that R 1 = R 1 R 1 = L 0 f (R 0, K 1 ) L 0 f (R 0, K 1 ) = L 0 S 1 (R 0 ) S 1 (R 0 ) = 011010 011010 = 000000 i.e. R 1 = R 1. Also, note that the probability p[ L 1 R 1 = 001100000000 L 0 R 0 = 011010001100] = 3 8. Step 2: Apply differential cryptanalysis on 3-round B-DES starting with the pair L 1 R 1 and L 1 R 1 where R 1 = R 1 and L 1 = 001100. MATH 509 on DES