1. Fall 2002CS 395: Computer Security1 Chapters 5-6: Contemporary Symmetric Ciphers Triple DES Blowfish AES

2. Fall 2002CS 395: Computer Security2 Again Special Thanks to Dr. Lawrie Brown at the Australian Defense Force Academy whose PowerPoint slides provided the basis for these slides.

3. Fall 2002CS 395: Computer Security3 Triple DES A replacement for DES was needed –theoretical attacks can break it –demonstrated exhaustive key search attacks AES is a new cipher alternative that didn’t exist at the time prior to this alternative was to use multiple encryption with DES implementations Triple-DES is the chosen form

4. Fall 2002CS 395: Computer Security4 Why Not Double DES? That is, why not just use C=E K1 [E K2 [P]]? –Proven that it’s NOT same as C=E K3 [P] Susceptible to Meet-in-the-Middle Attack –Described by Diffie & Hellman in 1977 –Based on observation that if C= E K2 [E K1 [P]], then X=E K1 [P]=D K2 [C]

5. Fall 2002CS 395: Computer Security5 Meet-in-the-Middle Attack Given a known plaintext-ciphertext pair, proceed as follows: –Encrypt P for all possible values of K1 –Store results in table and sort by value of X –Decrypt C for all possible values of K2 During each decryption, check table for match. If find one, test two keys against another known plaintext-ciphertext pair

6. Fall 2002CS 395: Computer Security6 Meet-in-the-Middle Attack Analysis: –For any given plaintext P, there are 2 64 possible ciphertexts produced by Double DES. –But Double DES effectively has 112 bit key, so there are 2 112 possible keys. –On average then, for a given plaintext, the number of different 112 bit keys that will produce a given ciphertext is 2 112 /2 64 =2 48 –Thus, first (P,C) pair will produce about 2 48 false alarms –Second (P,C) pair, however, reduces false alarm rate to 2 48-64 = 2 -16. So for two (P,C) pairs, the probability that correct key is determined is 1–2 16. Bottom line: a known plaintext attack will succeed against Double DES with an effort on order of 2 56, not much more than the 2 55 required to crack single DES

7. Fall 2002CS 395: Computer Security7 Triple-DES with Two-Keys Would think Triple DES must use 3 encryptions but can use 2 keys with E-D-E sequence –C = E K1 [D K2 [E K1 [P]]] –N.b. encrypt & decrypt equivalent in security –if K1=K2 then can work with single DES standardized in ANSI X9.17 & ISO8732 no current known practical attacks –Though some indications of potential attack strategies, so some use Triple DES with three keys –has been adopted by some Internet applications, eg PGP, S/MIME Three times slower than DES

8. Fall 2002CS 395: Computer Security8 Blowfish a symmetric block cipher designed by Bruce Schneier in 1993/94 characteristics –fast implementation on 32-bit CPUs (18 clock cycles per block) –compact in use of memory (less than 5K) –simple structure eases analysis/implementation –variable security by varying key size has been implemented in various products

9. Fall 20029 Blowfish Key Schedule uses a 32 to 448 bit key (1 to 14 32-bit words) Key used to generate –18 32-bit subkeys stored in K-array K j –four 8x32 S-boxes Each element of the S-box is a 32 bit word, so each S-box contains 256 32-bit words. Total of all S-boxes is 1024 32-bit words

10. Fall 2002CS 395: Computer Security10 Generating P-array and S-boxes Initialize P-array and S-boxes in order using bit of fractional part of Pi Perform bitwise XOR of P-array and K-array, reusing words from K- array as needed –Ex. For maximum key length (14 32 bit words):

11. Fall 2002CS 395: Computer Security11 Generating P-array and S-boxes Encrypt 64-bit block of zeros using current P and S arrays, replace P1 and P2 with output of the encryption Encrypt the output of previous step using current S and P arrays and replace P3 and P4 with the resulting ciphertext Continue this process to update all elements of P in order and then, in order, all elements of S, using at each step the output of the continuously changing Blowfish algorithm

12. Fall 2002CS 395: Computer Security12 Summary of Process

13. Fall 2002CS 395: Computer Security13 Note: Total of 521 executions of Blowfish required to produce final S and P arrays. –Thus Blowfish not good for applications in which secret key changes frequently –P and S arrays can be stored rather than derived from key each time Requires 4K of memory, so not appropriate for limited memory apps (I.e. smartcards)

14. Fall 2002CS 395: Computer Security14 Subscript corresponds to round

15. Fall 2002CS 395: Computer Security15 Single Blowfish Round Note difference between XOR and addition (mod 2 32 ) (also, they don’t commute)

16. Fall 2002CS 395: Computer Security16 Discussion key dependent S-boxes and subkeys, generated using cipher itself, makes analysis very difficult changing both halves in each round increases security provided key is large enough, brute-force key search is not practical, especially given the high key schedule cost

17. Fall 2002CS 395: Computer Security17 Advanced Encryption Standard (AES) clear a replacement for DES was needed –have theoretical attacks that can break it –have demonstrated exhaustive key search attacks can use Triple-DES – but slow with small blocks US NIST issued call for ciphers in 1997 15 candidates accepted in Jun 98 5 were shortlisted in Aug-99 Rijndael was selected as the AES in Oct-2000 issued as FIPS PUB 197 standard in Nov-2001

18. Fall 2002CS 395: Computer Security18 AES Requirements private key symmetric block cipher 128-bit data, 128/192/256-bit keys stronger & faster than Triple-DES active life of 20-30 years (+ archival use) provide full specification & design details both C & Java implementations NIST have released all submissions & unclassified analyses

19. Fall 2002CS 395: Computer Security19 AES Evaluation Criteria initial criteria: –security – effort to practically cryptanalyze –cost – computational –algorithm & implementation characteristics final criteria –general security –software & hardware implementation ease –implementation attacks –flexibility (in en/decrypt, keying, other factors)

20. Fall 2002CS 395: Computer Security20 AES Shortlist after testing and evaluation, shortlist in Aug-99: –MARS (IBM) - complex, fast, high security margin –RC6 (USA) - v. simple, v. fast, low security margin –Rijndael (Belgium) - clean, fast, good security margin –Serpent (Euro) - slow, clean, v. high security margin –Twofish (USA) - complex, v. fast, high security margin then subject to further analysis & comment saw contrast between algorithms with –few complex rounds verses many simple rounds –which refined existing ciphers verses new proposals

21. Fall 2002CS 395: Computer Security21 The AES Cipher - Rijndael designed by Rijmen-Daemen in Belgium has 128/192/256 bit keys, 128 bit data an iterative rather than feistel cipher –treats data in 4 groups of 4 bytes –operates an entire block in every round designed to be: –resistant against known attacks –speed and code compactness on many CPUs –design simplicity

22. Fall 2002CS 395: Computer Security22 Rijndael processes data as 4 groups of 4 bytes (state) has 9/11/13 rounds in which state undergoes: –byte substitution (1 S-box used on every byte) –shift rows (permute bytes between groups/columns) –mix columns (subs using matrix multipy of groups) –add round key (XOR state with key material) initial XOR key material & incomplete last round all operations can be combined into XOR and table lookups - hence very fast & efficient

23. Fall 2002CS 395: Computer Security23 Rijndael

24. Fall 2002CS 395: Computer Security24 Byte Substitution a simple substitution of each byte uses one table of 16x16 bytes containing a permutation of all 256 8-bit values each byte of state is replaced by byte in row (left 4-bits) & column (right 4-bits) –eg. byte {95} is replaced by row 9 col 5 byte –which is the value {2A} S-box is constructed using a defined transformation of the values in GF(2 8 ) designed to be resistant to all known attacks

25. Fall 2002CS 395: Computer Security25 Shift Rows a circular byte shift in each each –1 st row is unchanged –2 nd row does 1 byte circular shift to left –3rd row does 2 byte circular shift to left –4th row does 3 byte circular shift to left decrypt does shifts to right since state is processed by columns, this step permutes bytes between the columns

26. Fall 2002CS 395: Computer Security26 Mix Columns each column is processed separately each byte is replaced by a value dependent on all 4 bytes in the column effectively a matrix multiplication in GF(2 8 ) using prime poly m(x) =x 8 +x 4 +x 3 +x+1

27. Fall 2002CS 395: Computer Security27 Add Round Key XOR state with 128-bits of the round key again processed by column (though effectively a series of byte operations) inverse for decryption is identical since XOR is own inverse, just with correct round key designed to be as simple as possible

28. Fall 2002CS 395: Computer Security28 AES Round

29. Fall 2002CS 395: Computer Security29 AES Key Expansion takes 128-bit (16-byte) key and expands into array of 44/52/60 32-bit words start by copying key into first 4 words then loop creating words that depend on values in previous & 4 places back –in 3 of 4 cases just XOR these together –every 4 th has S-box + rotate + XOR constant of previous before XOR together designed to resist known attacks

30. Fall 2002CS 395: Computer Security30 AES Decryption AES decryption is not identical to encryption since steps done in reverse but can define an equivalent inverse cipher with steps as for encryption –but using inverses of each step –with a different key schedule works since result is unchanged when –swap byte substitution & shift rows –swap mix columns & add (tweaked) round key

31. Fall 2002CS 395: Computer Security31 Implementation Aspects can efficiently implement on 8-bit CPU –byte substitution works on bytes using a table of 256 entries –shift rows is simple byte shifting –add round key works on byte XORs –mix columns requires matrix multiply in GF(2 8 ) which works on byte values, can be simplified to use a table lookup

32. Fall 2002CS 395: Computer Security32 Implementation Aspects can efficiently implement on 32-bit CPU –redefine steps to use 32-bit words –can precompute 4 tables of 256-words –then each column in each round can be computed using 4 table lookups + 4 XORs –at a cost of 16Kb to store tables designers believe this very efficient implementation was a key factor in its selection as the AES cipher

33. Fall 2002CS 395: Computer Security33 What To Take From All This…(I.e. Characteristics of Advanced Block Ciphers Variable Key Length –Strength is typically proportional to key length. Variable key length allows speed, strength tradeoff Mixed Operators –Use of one or more arithmetic or boolean operator complicates cryptanalysis, especially if operators are not distributive or associative Data-dependent Rotation –Instead of S-boxes, use rotations that depend on the data –Rotation dependence on data (rather than on subkeys) makes recovery of subkeys much more difficult

34. Fall 2002CS 395: Computer Security34 Characteristics of Advanced Block Ciphers Key-dependent S-boxes –Instead of fixed S-boxes, have contents depend on the key –Yields highly non-linear results and provides better protection from modern cryptanalysis techniques Lengthy key-scheduling algorithm –Generation of subkey takes much longer than single encryption or decryption, so effort of brute force attack is greatly magnified

35. Fall 2002CS 395: Computer Security35 Characteristics of Advanced Block Ciphers Variable plaintext/ciphertext block length –Longer block means greater cryptographic strength –Variable block length allows tailoring to specific apps Variable number of rounds –More rounds generally means more security (all other things being equal) –More rounds also means longer to encrypt/decrypt Operations on both halves of data each round –Performing simple operation on other half of data in Feistel cipher increases strength with minimal increase in execution time

36. Fall 2002CS 395: Computer Security36 Characteristics of Advanced Block Ciphers Variable function F –Using a different function from round to round can increase difficulty of cryptanalysis Key-dependent rotation –A rotation can be used than depends on key rather than on data