![Page 1: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/1.jpg)
CS 4770: Cryptography
CS 6750: Cryptography and Communication Security
Alina Oprea
Associate Professor, CCIS
Northeastern University
February 5 2018
![Page 2: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/2.jpg)
Review
• Relation between PRF and PRG
– Construct PRF from PRG (GGM construction)
• Pseudorandom permutations
• Definitions of security for encryption
– CPA/CCA security
– Relations between definitions
• CPA-secure construction
– Security proof
– Reduction to PRF
2
![Page 3: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/3.jpg)
How to encrypt using PRF?
plaintext m
PRF Fk
ciphertext c
key k
random r
Fk (r)
⊕
𝑟, 𝐹𝑘 𝑟 ⊕𝑚
Enc
key k
Dec
PRF Fk Fk (r)
cr
Ciphertext
plaintext m ⊕
3
𝐹𝑘 𝑟 ⊕ 𝑐
![Page 4: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/4.jpg)
Proof of security - Intuition
plaintext m
PRF Fk
ciphertext c
key k
random r
Fk (r)
⊕
𝑟, 𝐹𝑘 𝑟 ⊕𝑚
Π
plaintext m
Random f
ciphertext c
key k
random r
f(r)
⊕
𝑟, 𝑓 𝑟 ⊕𝑚
Π’
4
![Page 5: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/5.jpg)
Proof of security - Intuition
Enc
𝑐 = (𝑟, 𝐹𝑘 𝑟 ⊕𝑚)
Π
𝑐 = (𝑟, 𝑓 𝑟 ⊕𝑚)Π’
Enc
Dec
𝑐 = (𝑟, s)𝑚 = 𝐹𝑘 𝑟 ⊕ 𝑠
Dec
𝑐 = (𝑟, s)𝑚 = 𝑓 𝑟 ⊕ 𝑠
1. Success of adversary to break Π and Π’ in CPA game is similar
2. Success of adversary to break Π’ in CPA game is negligible
Under the assumption that F is a PRF!
5
![Page 6: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/6.jpg)
Proof of security – step 2
2. Success of adversary to break Π’ in CPA game is negligible
• Let A be an adversary in CPA game for Π′ that makes q = q(n) queries
• For each query to Enc oracle 𝑚1, ⋯ ,𝑚𝑞, it gets back 𝑐𝑖 = (𝑟𝑖 , 𝑓 𝑟𝑖 ⊕𝑚𝑖)
• A picks 𝑚0, 𝑚1 and receives back 𝑐 = (𝑟, 𝑓 𝑟 ⊕𝑚𝑏)
For any adversary A that makes q(n) queries to Enc oracle:
Pr[ExpΠ′,𝐴CPA 𝑛 = 1] −
𝟏
𝟐𝒊𝒔 𝒏𝒆𝒈𝒍(𝒏)
7
![Page 7: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/7.jpg)
Proof of security – step 2
2. Success of adversary to break Π’ in CPA game is negligible
• Case 1 - r is not used to answer the q queries to
Enc : Pr[ExpΠ′,𝐴CPA 𝑛 = 1] =
𝟏
𝟐
• Case 2 - 𝑟 ∈ 𝑟1, ⋯ , 𝑟𝑞 : Pr[ExpΠ′,𝐴CPA 𝑛 = 1] = 1
– But Pr 𝑟 ∈ 𝑟1, ⋯ , 𝑟𝑞 ≤ σ𝑖 Pr[𝑟 = 𝑟𝑖] ≤ 𝑞(𝑛)/2𝑛
Pr[ExpΠ′,𝐴CPA 𝑛 = 1] ≤
𝟏
𝟐+𝒒(𝒏)
𝟐𝒏8
For any adversary A that makes q(n) queries to Enc oracle:
Pr[ExpΠ′,𝐴CPA 𝑛 = 1] −
𝟏
𝟐𝒊𝒔 𝒏𝒆𝒈𝒍(𝒏)
![Page 8: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/8.jpg)
Wrap up
2. Success of adversary to break Π’ in CPA game is negligible
For any adversary A that makes q(n) queries to Enc oracle:
Pr[ExpΠ′,𝐴CPA 𝑛 = 1] ≤
𝟏
𝟐+𝒒(𝒏)
𝟐𝒏
Pr[ExpΠ,𝐴CPA 𝑛 = 1] ≤
𝟏
𝟐+𝒒(𝒏)
𝟐𝒏+ negl(n)
1. Success of adversary to break Π and Π’ in CPA game is similar
Assume that F is secure PRF.For any adversary A that makes q(n) queries to Enc oracle:
|Pr[ExpΠ,𝐴CPA 𝑛 = 1] − Pr[ExpΠ′,𝐴
CPA 𝑛 = 1]| ≤ negl(n)
9
![Page 9: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/9.jpg)
Block ciphers: crypto work horse
E, D CT Block
n bits
PT Block
n bits
Key k bits
Canonical examples:
1. DES: n= 64 bits, k = 56 bits
2. AES: n=128 bits, k = 128, 192, 256 bits
10
![Page 10: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/10.jpg)
Block Ciphers Built by Iteration
R(k,m) is called a round function
for DES (n=48), for AES-128 (n=10)
key k
Key schedule
k1 k2 k3 kn
R(k
1,
)
R(k
2,
)
R(k
3,
)
R(k
n,
)
m c
11
![Page 11: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/11.jpg)
Design goals
• Block ciphers should behave like random permutations– The number of permutation for 𝑛-bit strings is (2𝑛)! ≈ 𝑛2𝑛
– Construct set of permutations with concise description (short key)
– Similar to security property of PRP
• Properties– Changing one bit of input should affect all bits of
output (good mixing)
• Two main design approaches– Substitution-Permutation Network– Feistel Network
12
![Page 12: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/12.jpg)
Substitution-Permutation Network
Key mixing
Substitution
Permutation
Round key
S-boxFixed permutation
Invertible
S boxes and mixing permutation are public 13
![Page 13: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/13.jpg)
Three rounds of SPN
Invertible if key
known
1. Key mixing2. S boxes3. Mixing
permutation4. Number of
rounds
14
![Page 14: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/14.jpg)
The avalanche effect• Changing a single bit of input in S box changes
at least 2 bits of output in S box
• The mixing permutations ensure that the output bits of any S box are used as input to multiple S boxes in the next round
15
![Page 15: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/15.jpg)
Feistel Networks
𝐿𝑖 = 𝑅𝑖−1𝑅𝑖 = 𝐿𝑖−1 ⊕ 𝑓𝑖(𝑅𝑖−1)
• Functions 𝑓𝑖 are public• Round key is derived from main key and secret• Advantage: 𝑓𝑖 not invertible!
Given functions f1, …, fd: {0,1}n ⟶ {0,1}n
Goal: build invertible function F: {0,1}2n ⟶ {0,1}2n
input output
Rd-1
Ld-1
Rd
Ld
R0
L0
n-b
itsn
-bits
R1
L1⊕
f1
R2
L2⊕
f2 ⋯⊕
fd
16
![Page 16: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/16.jpg)
Claim: for all f1, …, fd: {0,1}n ⟶ {0,1}n
Feistel network F: {0,1}2n ⟶ {0,1}2n is invertibleProof: construct inverse
Ri-1
Li-1
Ri
Li
⊕
fi
inverse Ri-1 = Li
Li-1 = fi(Li) ⨁ Ri
input output
Rd-1
Ld-1
Rd
Ld
R0
L0
n-b
itsn
-bits
R1
L1
⊕
f1
R2
L2
⊕
f2 ⋯
⊕
fd
17
![Page 17: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/17.jpg)
Claim: for all f1, …, fd: {0,1}n ⟶ {0,1}n
Feistel network F: {0,1}2n ⟶ {0,1}2n is invertibleProof: construct inverse
Ri-1
Li-1
Ri
Li
⊕
fi
inverse
input output
Rd-1
Ld-1
Rd
Ld
R0
L0
n-b
itsn
-bits
R1
L1
⊕
f1
R2
L2
⊕
f2 ⋯
⊕
fd
Ri
Li
Ri-1
Li-1
⊕
fi
18
![Page 18: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/18.jpg)
“Thm:” (Luby-Rackoff ‘85):
f: K × {0,1}n ⟶ {0,1}n a secure PRF
⇒ 3-round Feistel F: K3 × {0,1}2n ⟶ {0,1}2n
a secure PRP
R3
L3
R0
L0
input
R1
L1
⊕
fR2
L2
⊕
f
⊕
f
output
Key k1 Key k2 Key k3 Independent
19
![Page 19: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/19.jpg)
The Data Encryption Standard (DES)
• Early 1970s: Horst Feistel designs Lucifer at IBM
key-len = 128 bits ; block-len = 128 bits
• 1973: NBS asks for block cipher proposals. IBM submits variant of Lucifer.
• 1976: NBS adopts DES as a federal standard
key-len = 56 bits ; block-len = 64 bits
• 1997: DES broken by exhaustive search
• 2000: NIST adopts Rijndael as AES to replace DES
20
![Page 20: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/20.jpg)
DES: 16 round Feistel network
f1, …, f16: {0,1}32 ⟶ {0,1}32 , fi(x) = F( ki, x )
input
64
bit
s
output
64
bit
s
16 round Feistel network
IP IP-1
k
key expansion
k1 k2 k16⋯
To invert, use keys in reverse order
21
56 bits
48 bits
![Page 21: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/21.jpg)
The function F(ki, x)
S-box: function {0,1}6 ⟶ {0,1}4 , implemented as look-up table.
Key mixing
Substitution
Permutation
Substitution-Permutation
Network
22
![Page 22: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/22.jpg)
The S-boxes
Look up tableSi: {0,1}6 ⟶ {0,1}4
𝑥1𝑥2𝑥3𝑥4𝑥5𝑥6
𝑥1𝑥6
𝑥2𝑥3𝑥4𝑥5
Not invertible23
![Page 23: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/23.jpg)
Choosing the S-boxes and P-box
Choosing the S-boxes and P-box at random would result in an insecure block cipher (key recovery after ≈224 outputs) [BS’89]
Several rules used in choice of S and P boxes:
• No output bit should be close to a linear function of the input bits
• S-boxes are 4-to-1 maps (Exactly 4 inputs are mapped to each output)
• Each row in the table contains each 4-bit string exactly once
• Changing one bit of input to S box results in changing 2 bits of output
24
![Page 24: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/24.jpg)
DES challengemsg = “The unknown messages is: XXXX … “
CT = c1 c2 c3 c4
Goal: find k ∈ {0,1}56 s.t. DES(k, mi) = ci for i=1,2,3
1997: Internet search -- 3 months
1998: EFF machine (deep crack) -- 3 days (250K $)
1999: combined search -- 22 hours
2006: COPACOBANA (120 FPGAs) -- 7 days (10K $)
⇒ 56-bit ciphers should not be used !! (128-bit key ⇒ 272 days)
25
![Page 25: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/25.jpg)
Double DES
• Define 2E( (k1,k2), m) = E(k1 , E(k2 , m) )
• Find (𝑘1, 𝑘2) such that E(k1 , E(k2 , m) ) = C
• Equivalent to E(k2 , m) = D(k1 , m)
key length = 112 bits for DES
m E(k2,⋅) E(k1,⋅) c
26
Meet-in-the-middle attack
![Page 26: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/26.jpg)
Double DES
• Define 2E( (k1,k2), m) = E(k1 , E(k2 , m) )
Attack: M = (m1,…, mu) , C = (c1,…,cu)
• step 1: build table.
sort on 2nd column
key-len = 112 bits for DES
m E(k2,⋅) E(k1,⋅) c
k0 = 00…00k1 = 00…01k2 = 00…10
⋮kN = 11…11
E(k0 , M)E(k1 , M)E(k2 , M)
⋮E(kN , M)
256
entries
Time 256log(256)27
![Page 27: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/27.jpg)
Meet in the middle attack
Attack: M = (m1,…, mu) , C = (c1,…,cu)
• Step 1: build table.
• Step 2: for all k∈{0,1}56 do:
test if D(k, C) is in 2nd column.
if so then E(ki,M) = D(k,C) ⇒ (ki,k) = (k2,k1)
m E(k2,⋅) E(k1,⋅) c
k0 = 00…00k1 = 00…01k2 = 00…10
⋮kN = 11…11
E(k0 , M)E(k1 , M)E(k2 , M)
⋮E(kN , M)
28
![Page 28: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/28.jpg)
Meet in the middle attack
Time = 256log(256) + 256log(256) < 263 << 2112
Build table Search table
Space ≈ 256
m E(k2,⋅) E(k1,⋅) c
29
![Page 29: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/29.jpg)
Triple DES• Let E : K × M ⟶ M be a block cipher
• Define 3E: K3 × M ⟶ M as
3E( (k1,k2, k3), m) = E(k1 , D(k2 ,E(k3 , m) ) )
If k1 = k2 = k3 then 3E = DES!
For 3DES: key-size = 3×56 = 168 bits
3×slower than DES
(simple attack in time ≈ 2118 )
30
![Page 30: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/30.jpg)
The AES process
• 1997: NIST publishes request for proposal
• 1998: 15 submissions. Five claimed attacks.
• 1999: NIST chooses 5 finalists
• 2000: NIST chooses Rijndael as AES (designed in Belgium)
Key sizes: 128, 192, 256 bits.
Block size: 128 bits
31
![Page 31: CS 4770: Cryptography CS 6750: Cryptography and ... · The Data Encryption Standard (DES) •Early 1970s: Horst Feistel designs Lucifer at IBM key-len = 128 bits ; block-len = 128](https://reader033.vdocuments.mx/reader033/viewer/2022042917/5f59811ed798cc4bd80bc007/html5/thumbnails/31.jpg)
Acknowledgement
Some of the slides and slide contents are taken from http://www.crypto.edu.pl/Dziembowski/teachingand fall under the following:
©2012 by Stefan Dziembowski. Permission to make digital or hard copies of part or all of this material is currently granted without fee provided that copies are made only for personal or classroom use, are not distributed for profit or commercial advantage, and that new copies bear this notice and the full citation.
We have also used slides from Prof. Dan Boneh online cryptography course at
Stanford University:
http://crypto.stanford.edu/~dabo/courses/OnlineCrypto/
32