9/06 Cryptography Block Ciphers after DES Anita Jones CS451 Information Security Copyright(C) Anita Jones

9/06 What’s next -- after DES? zWhat’s the alternative, now that the 56 bit key is broken? ztriple DES zan entirely new cipher

9/06 Triple DES zput multiple DES units in parallel, i.e. z C = E K3 (E K2 (E K1 (p))) zit’s stronger & there is no K4 such that C = E K4 (p) ! zwhy triple? ….. to avoid the “meet in the middle” attack

9/06 Meet in the middle attack zassume two adjacent block ciphers (e.g. double DES) z C = E K2 (E K1 (p)) zbut z X= E K1 (p) = D K2 (C) zso given a known pair, [p, C] yencrypt p with 2 56 keys & decrypt C with 2 56 keys ycompare to find match; double check yif OK, then you have the two keys

9/06 So, ……….triple DES z………..it is not susceptible to the “meet in the middle” attack z… because there is no “middle”

9/06 What’s REALLY next zyou can view Triple DES as a ‘holding action” zwhat is really the next cipher?

9/06 New cipher designs to replace DES zInternational Data Encryption Algorithm yfrom Swiss Fed.l Institute of Technology (1990) ysymmetric block cipher; 128 bit key yencrypts 64 bit blocks yuses three operations in contrast to DES and XOR xbitwise exclusive OR xaddition of integer modulo 2 16 xmultiplication of integers modulo

9/06 New alternatives zBlowfish ysymmetric block cipher -- Bruce Schneier (93) ycan run in less than 5K of memory yvariable key length (32 bits up to 448 bits) yuses 2 primitive operations: xaddition (mod 2 32 ) & bitwise exclusive OR yop.ns performed on both halves each round yboth subkeys and S-boxes are produced by repeated applications of Blowfish itself

9/06 More new alternatives zRC5 -- symmetric, Ron Rivest (95) zTwofish -- based on Blowfish zCAST-128 (97)

9/06 Characteristics zModern symmetric block ciphers: ybased on Feistel block cipher structure yvariable key length yuse multiple operators (provides nonlinearity as alternative to S-boxes); all but Triple DES use ‘em ydata (not key)-dependent rotation in rounds yvariable function F – different in different rounds yoperate on both data halves in each round

9/06 Cipher Block Chaining zXOR current plaintext block and the preceding cipher-text block (using same key) zDeals with repetitive plain-text

9/06 1.Int’l Data Encryption Alg.m (IDEA) za cipher from Louvain University in Europe, designed by Xuejia Lia and James Massey z64-bit iterative block cipher with 128-bit key zrelies on three incompatible types of arithmetic operations on 16-bit words zpatented in US and Europe zno linear cryptanalytic attacks on IDEA, and there are no known algebraic weaknesses in IDEA, i.e. known practical attacks to date

9/06 2. U.S. Adv.d Encryption Standard (AES) zAES is successor to (U.S.-selected) DES zofficially adopted for US government work, but often voluntarily adopted by private sector yNote: influences hardware development zwinning cipher was Rijndael (pronounced Rhine-doll) yBelgian designers: Joan Daemen & Vincent Rijmen zadopted by NIST in November, 2001