CS CS 683 683 - Security y and Privacy Fa Fall 2019 In - - PowerPoint PPT Presentation

CS CS 683 683 - Security y and Privacy Fa Fall 2019

In Instructor

• r: Ka

Karim El Elde defrawy

Un University ty of

• f Sa

San Francisco

http://www.cs.usfca.edu/~keldefrawy/teaching/f all2019/cs683/cs683_main.htm

1

Lectures 3 and 4

Encryption

Suggested Readings:

• Chs 3 & 4 in KPS (recommended)
• Ch 3 in Stinson (optional)

2

3

The word cryptography comes from the Greek words κρυπτός (hidden or secret) and γράφειν (writing). So historically cryptography has been the “art of secret writing.” Most

• f

cryptography is currently well grounded in mathematics and it can be debated whether there’s still an “art” aspect to it.

Cr Cryptography

3

Hi Histor

• rical (P

(Primiti tive) ) Ciphers

• Shift (e.g., Caesar): Enc

k (x) = x+k mod 26

• Affine: Enc

k1,k2 (x) = k1 *x + k2 mod 26

• Substitution: Enc

perm (x) = perm(x)

• Vigenere: Enc

K (x) = ( X[0]+K[0], X[1]+K[1], … )

• Vernam: One-Time Pad (OTP)

4

Som Some Hi Histor

• ry: Caesar’s Cipher

Homo Hominem Lupus! Krpr Krplqhp Oxsxv!

5

Sh Shift t (Caesar) Cipher

Example:

W E W I L L M E E T A T M I D N I G H T 22 4 22 8 11 11 12 4 4 19 19 12 8 3 13 8 6 7 19 7 15 7 19 22 22 23 15 15 4 11 4 23 19 14 24 19 17 18 4 H P H T W W X P P E L E X T O Y T R S E

K = 11

• How many keys are there?
• How many trials are needed to find the key?

6

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0.02 0.04 0.06 0.08 0.1 0.12 0.14 0.082 0.015 0.028 0.043 0.127 0.022 0.02 0.061 0.07 0.002 0.008 0.04 0.024 0.067 0.075 0.019 0.001 0.06 0.063 0.091 0.028 0.01 0.023 0.001 0.02 0.001

Pr Probability of Occurrence of Lette ters in English

7

8

• A cryptosystem has (at least) five ingredients:

– Plaintext – Secret Key – Ciphertext – Encryption Algorithm – Decryption Algorithm

• Security usually depends on the secrecy of the

key, not the secrecy of the algorithms

Enc Encryp yption n Princ ncipl ples

9

Cr Cryp ypto Ba Basi sics

10

Average Ti Time Required fo for Exha Exhaus ustive Ke Key Sear earch (f (for Bru Brute Fo Force Atta ttacks) )

Key Size (bits) Number of Alternative Keys Time required at 106 Decryption/µs 32 232 = 4.3 x 109 2.15 milliseconds 56 256 = 7.2 x 1016 10 hours 128 2128 = 3.4 x 1038 5.4 x 1018 years 168 2168 = 3.7 x 1050 5.9 x 1030 years

11

Ty Types of Attainable Security

• Perfect, unconditional or “information theoretic”: the security

is evident free of any (computational/hardness) assumptions

• Reducible or “provable”: security can be shown to be based on

some common (often unproven) assumptions, e.g., the conjectured difficulty of factoring large integers

• Ad hoc: the security seems good often -> “snake oil”…

Take a look at:

http://www.ciphersbyritter.com/GLOSSARY.HTM

12

Co Comp mputational Se Securi rity

• Encryption scheme is computationally secure if

– Cost of breaking it (via brute force) exceeds the value of the encrypted information; or – Time required to break it exceeds useful lifetime of the encrypted information

• Most modern schemes we will see are considered computationally

secure

– Usually rely on very large key-space, impregnable to brute force

• Most advanced schemes rely on lack of knowledge of effective

algorithms for certain hard problems, not on a proven inexistence

• f such algorithms (reducible security)!

– Such as: factoring, discrete logarithms, etc.

Decryption Examples

13

Caesar Cipher Examples

• Decode this ciphertext:

WKH TXLFN EURZQ IRA MXPSV RYHU WKH ODCB GRJ

• Decode this ciphertext:

PELCGBTENCUL VF ABG NF RNFL NF VG ZNL FRRZ

15

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0.02 0.04 0.06 0.08 0.1 0.12 0.14 0.082 0.015 0.028 0.043 0.127 0.022 0.02 0.061 0.07 0.002 0.008 0.04 0.024 0.067 0.075 0.019 0.001 0.06 0.063 0.091 0.028 0.01 0.023 0.001 0.02 0.001

Pr Probability of Occurrence of Lette ters in English

14

Caesar Cipher Examples

• Decode this ciphertext:

WKH TXLFN EURZQ IRA MXPSV RYHU WKH ODCB GRJ

• Decoded plaintext (shift = 3):

THE QUICK BROWN FOX JUMPS OVER THE LAZY DOG

• Decode this ciphertext:

PELCGBTENCUL VF ABG NF RNFL NF VG ZNL FRRZ

• Decoded plaintext (shift = 13):

CRYPTOGRAPHY IS NOT AS EASY AS IT MAY SEEM

16

Caesar Cipher Tool

• https://learncryptography.com/tools/caesar-cipher

17

18

Cr Cryp yptosystems ms

Classified along three dimensions:

• 1. Type of operations used for transforming plaintext into

ciphertext

• Binary arithmetic: shifts, XORs, ANDs, etc.
• Typical for conventional (or symmetric) encryption
• Integer arithmetic
• Typical for public key (or asymmetric) encryption
• 2. Number of keys used
• Symmetric or conventional (single key used)
• Asymmetric or public key (2 keys: 1 to encrypt, 1 to decrypt)
• 3. How plaintext is processed:
• One bit at a time
• A string of any length
• A block of bits

Co Conventional (S (Symme ymmetri ric) ) Cr Cryp yptography

• Alice and Bob share a key KAB which they somehow agree

upon (how?)

• key distribution / key management problem
• ciphertext is roughly as long as plaintext
• examples: Substitution, Vernam OTP, DES, AES

plaintext ciphertext

K AB

encryption algorithm decryption algorithm

K AB

plaintext m K (m)

AB

K (m)

AB

m = K (

)

AB

19

Us Uses es of Conven entio tional al Cryptograp aphy

• Message Transmission (confidentiality):
• Communication over insecure channels
• Secure Storage: crypt on Unix
• Strong Authentication: proving knowledge of a secret

without revealing it:

• See next slide
• Eve can obtain chosen <plaintext, ciphertext> pair
• Challenge should be chosen from a large pool
• Integrity Checking: fixed-length checksum for message via

secret key cryptography

• Send MAC along with the message MAC=H(m,K)

20

Ch Challenge-Re Response Authentication Ex Exampl ple

21

K AB

challenge

K AB

ra KAB(ra)

challenge reply

rb KAB(rb)

challenge challenge reply

22

Co Conventional Cr Cryp yptography

Ø Advantages

l high data throughput l relatively short key size l primitives to construct various cryptographic

mechanisms

Ø Disadvantages

l key must remain secret at both ends l key must be distributed securely and efficiently l relatively short key lifetime

• Asymmetric Cryptography
• Invented in 1974-1978 (Diffie-Hellman and Rivest-Shamir-Adleman)
• Two keys: private (SK), public (PK)
• Encryption: with public key;
• Decryption: with private key
• Digital Signatures: Signing by private key; Verification by public key. i.e.,

“encrypt” message digest/hash -- h(m) -- with private key

• Authorship (authentication)
• Integrity: Similar to MAC
• Non-repudiation: cannot do with secret key cryptography
• Much slower (~1000x) than conventional cryptography
• Often used together with conventional cryptography, e.g., to encrypt session keys

23

Pu Public Key Crypto tography

24

Ge Genesis is of

• f P

Public Ke Key Cryptography: Dif Diffie ie- Hellm Hellman an Paper aper

Pu Public Key Crypto tography

25

plaintext message, m ciphertext encryption algorithm decryption algorithm

Bob’s public key

plaintext message PK (m)

B

PK

B

Bob’s private key

SK

B

m = SK (PK (m))

B B

Us Uses es of Public lic Key Cryptograp aphy

• Data Transmission (confidentiality):
• Alice encrypts ma using PKB, Bob decrypts it to obtain ma using

SKb.

• Secure Storage: encrypt with own public key, later

decrypt with own private key

• Authentication:
• No need to store secrets, only need public keys.
• Secret key cryptography: need to share secret key for every

person one communicates with

• Digital Signatures (authentication, integrity, non-

repudiation)

26

27

Ø Advantages

l only the private key must be kept secret l relatively long life time of the key l more security services l relatively efficient digital signatures mechanisms

Ø Disadvantages

l low data throughput l much larger key sizes l distribution/revocation of public keys l security based on conjectured hardness of certain

computational problems

Pu Public Key Crypto tography

28

Ø Public Key

l Encryption, signatures (esp., non-repudiation) and key

management

Ø Conventional

l Encryption and some data integrity applications

Ø Key Sizes

l Keys in public key crypto must be larger (e.g., 2048 bits for RSA)

than those in conventional crypto (e.g., 112 bits for 3-DES or 256

bits for AES)

• most attacks on “good” conventional cryptosystems are exhaustive key

search (brute force)

• public key cryptosystems are subject to “short-cut” attacks (e.g.,

factoring large numbers in RSA)

Co Comp mpari riso son Su Summa mmary

“M “Moder dern” n” Block Cipher phers Da Data E a Encr cryptio ion S Stan andar ard ( (DE DES)

Generic Example of Block k Encryp yption

30

Fe Feistel Ci Cipher St Stru ructure

• Virtually all conventional block encryption algorithms,

including DES, have a structure first described by Horst Feistel of IBM in 1973

• Specific realization of a Feistel Network depends on the

choice of the following parameters and features:

31

Fe Feistel Ci Cipher St Stru ructure

• Block Size: larger block sizes mean greater security
• Key Size: larger key size means greater security
• Number of Rounds: multiple rounds offer increasing

security

• Subkey Generation Algorithm: greater complexity will

lead to greater difficulty of cryptanalysis

• Fast Software En/De-cryption: speed of execution of

the algorithm becomes a concern

32

33

Cl Classi ssic Fe Feistel Ne Network

“Round Keys” are generated from

• riginal key via

subkey generation algorithm

Bl Block k Ci Ciphers

34

• Originated with early 1970's IBM effort to develop

banking security systems

• First result was Lucifer, most common variant has 128-

bit key and block size

• Was not secure in any of its variants
• Called a Feistel or product cipher
• F()-function is a simple transformation, does not have

to be reversible

• Each step is called a round; the more rounds, the

greater the security (to a point)

• Most famous example of this design is DES

Co Conventional Enc Encryp yption St Standard

• Data Encryption Standard (DES)
• Was most widely used encryption

method (AES has taken over by now)

• Block cipher (in native ECB mode)
• Plaintext processed in 64-bit blocks
• Key is 56 bits

35

• 64 bit input block
• 64 bit output block
• 16 rounds
• 64 (effective 56) bit key
• Key schedule computed at startup
• Aimed at bulk data
• > 16 rounds does not help
• > 56 bit key does not help
• Other S-boxes usually hurt …

Da Data a Enc Encryp yption St Standard (DES) S)

36

37

Ba Basi sic St Stru ructure of

• f DE

DES

Enc Encryp yption vs vs De Decr cryptio ion in in DE DES

38

64 Bit Plaintext Initial Permutation 32 Bit L0 32 Bit R0 F(R0,K1) + 32 Bit L1 32 Bit R1 32 Bit L15 32 Bit R15 F(R15,K16) + 32 Bit L16 32 Bit R16 Final Permutation 64 Bit Ciphertext

Encryption Process

DE DES S System

64 Bit Key Permutation Choice 1 56 Bit Key 28 Bit C0 28 Bit D0 Left Shift Right Shift C1 D1 Building Blocks Permuted Choice 2 K1(48 bits) C16 D16 Permuted Choice 2

Key Schedule

K16(48 bits)

39

Li-1 32 bits Ri-1 32 bits

S-Box Substitution choses 32 bits

P-box Permutation Li 32 bits Ri 32 bits 56 bits Key Permuted Choice 48 bits

Func Functio tion n F

Expansion (E) Permutation 48 bits

40

41

DE DES S Substit itutio ion B Boxes O Operatio ion

41

42

Op Operation Tables s of f DES (I (IP, , IP-1, , E E and P)

42

43 43

44 44

Br Breaki king DES S (Cr (Cryp yptanalysi sis) s)

DES Key size = 56 bits

• Brute force = 255 attempts on avg
• Differential cryptanalysis è 247 chosen plaintexts
• Linear cryptanalysis è 247 known plaintexts
• Longer than 56 bit keys do not make it any stronger
• More than 16 rounds do not make it any stronger
• DES Key Problems:
• Weak keys (all 0s, all 1s, a few others)
• Key size = 56 bits = 8 * 7-bit ASCII
• Alphanumeric-only password converted to uppercase

8 * ~5-bit chars = 40 bits

45

Br Breaki king DES S (Cr (Cryp yptanalysi sis) s)

Differential Cryptanalysis

• Looks for correlations in F()-function input and output

Linear Cryptanalysis

• Looks for correlations between key and cipher input and
• utput

Related-key Cryptanalysis

• Looks for correlations between key changes and cipher

input/output Differential cryptanalysis discovered in 1990; virtually all block ciphers from before that time are vulnerable... ... except DES. IBM (and the NSA) knew about it 15 years earlier

46

Mo Modes of Operation (n (not just for DES, , for any y block k cipher)

…

ENCRYPTION

… … …

P1 P2 Pi Pi+1 Pn-1 Pn C1 C2 Ci Ci+1 Cn-1 Cn

http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation

47

"Na Native” ” EC ECB Mode

Electronic Code-Book (ECB) Mode

• Input to encryption algorithm is current plaintext block:

Ci = E ( K, Pi ) Pi = D ( K, Ci )

• Duplicate plaintext blocks (patterns) visible in ciphertext
• What if Alice encrypts one word per plaintext block?
• Ciphertext block rearrangement is possible
• To detect it, need explicit block numbering in plaintext
• Parallel encryption and decryption (random access)
• Error in one ciphertext block è one-block loss
• One-block loss in ciphertext?

48

CBC CBC Mo Mode

Cipher-Block Chaining (CBC) Mode

• Input to encryption algorithm is the XOR of current plaintext block and

preceding ciphertext block:

Ci = E ( K, Pi XOR Ci-1 ) C0=IV Pi = D ( K, Ci ) XOR Ci-1

• Duplicate plaintext blocks (patterns) NOT exposed
• Block rearrangement is detectable
• No parallel encryption
• How about parallel decryption?
• Error in one ciphertext block è two-block loss
• One-block ciphertext loss?

49

50

OF OFB B Mode

Output Feedback (OFB) Mode

• Key-stream is produced by repeated encryption of Vo:

Ci = E ( K, Vi-1 ) XOR Pi V0=IV Pi = E ( K, Vi-1 ) XOR Ci

• Duplicate plaintext blocks (patterns) NOT exposed
• Block rearrangement is detectable
• Key-stream is independent of plaintext
• How does that affect speed of encryption? Parallelism?
• Bit error in one ciphertext block è one-bit error in plaintext
• One-block ciphertext loss è big mess J
• Can encrypt less than block size

51

CF CFB B Mo Mode

Cipher Feedback (CFB) Mode

• Key-stream is produced by re-encryption of preceding ciphertext -- Ci-1:

Ci = Pi XOR E (K, Ci-1) C0=IV Pi = E ( K, Ci-1 ) XOR Ci

• Duplicate plaintext blocks (patterns) NOT exposed
• Block rearrangement is detectable
• Key-stream is dependent on plaintext
• How does that affect speed of encryption? Parallelism?
• Bit error in one ciphertext block è one-bit + one-block loss in plaintext
• Adversary can still selectively flip/change bits
• One-block ciphertext loss è 1-extra-block loss
• Can encrypt less than block size

52

CTR TR Mode

Counter (CTR) Mode

• Key-stream is produced by encryption increasing counter:

Ci = E ( K, CTRi ) XOR Pi CTRi = CTRi-1 + 1 Pi = E ( K, CTRi ) XOR Ci

• Duplicate plaintext blocks (patterns) NOT exposed, unless?
• Block rearrangement is detectable
• Key-stream is independent of plaintext
• Parallel encryption and decryption (random access)
• Bit error in one ciphertext block è one-bit error in plaintext
• One-block ciphertext loss è big mess
• Can encrypt less than block size

53

MA MAC C Mo Mode

Message Authentication Code (MAC) Mode

• Encryption is the same as in CBC mode, but, ciphertext is NOT sent!

Ci = E ( K, Pi XOR Ci-1 ) C0=IV What is sent or stored: P1, . . ., Pn, Cn = MAC Receiver recomputes Cn with K and compares

• Any change in plaintext results in unpredictable changes in MAC

54

Ho How w to str treng engthen then DES: th the e cas ase e of double le DES

• 2DES: C = DES ( K1, DES ( K2, P ) )
• Seems to be hard to break by “brute force”, approx. 2111 trials
• Assume Eve is trying to break 2DES and has a single (P,C) pair

Meet-in-the-middle (or Rendesvouz) ATTACK:

I. For each possible K’i (where 0 < i < 256) 1. Compute C’i= DES ( K’i , P ) 2. Store: [ K’i, C’i ] in table T (sorted by C’i) II. For each possible K”i (where 0 < i < 256) 1. Compute C”i = DES-1 ( K”i , C ) 2. Lookup C”i in T ç not expensive! 3. If lookup succeeds, output: K1=K’i, K2=K”i TOTAL COST: O(256) operations + O(256) storage

55

DE DES V Var arian iants

• 3-DES (Triple DES)
• C = E(K1, D(K2, E(K1,P) ) ) à 112 effective key bits
• C = E(K3, D(K2, E(K1,P) ) ) à 168 effective key bits
• DESx
• C= K3 XOR E(K2, (K1 XOR P) ) à seems like 184 key bits
• Effective key bits à approx. 118
• 2-DES:
• C = E(K2,E(K1, P)) à rendezvous (meet-in-the-middle attack)
• Another simple variation:
• C = K1 XOR E(K1’, P) à weak!

NOTE: The same variants can be constructed out of any cipher

56

DE DES V Var arian iants

Why does 3-DES (or generally n-DES) work? Because, as a function, DES is not a group…

A “group” is an algebraic structure. One of its properties is that, taking any 2 elements of the group (a,b) and applying an operator F() yields another element c in the group. Suppose: C = DES(K1,DES(K2,P)) There is no K, such that: for each possible plaintext P, DES(K,P) = C

57

DE DES S Summar ary

• Permutation/substitution block cipher
• 64-bit data blocks
• 56-bit keys (8 parity bits)
• 16 rounds (shifts, XORs)
• Key schedule
• S-box selection secret …
• DES “aging”
• 2-DES: rendezvous attack
• 3-DES: 112-bit security
• DESx : 118-bit security

58

Skipjack

• Classified algorithm originally designed for the NSA-

sponsored Clipper chip

• Declassified in 1998
• 32 rounds, breakable with 31 rounds
• 80 bit key, inadequate for long-term security

GOST

• GOST 28147, Russian answer to DES
• 32 rounds, 256 bit key
• Incompletely specified

Ot Other Ol Old Sy Symmetric Ci Ciphers

59

• IDEA (X. ILai, J. Massey, ETH)
• Developed as PES (proposed encryption standard),
• Adapted to resist differential cryptanalysis
• Gained popularity via PGP, 128 bit key
• Patented (Ascom CH)
• Blowfish (B. Schneier, Counterpane)
• Optimized for high-speed execution on 32-bit processors
• 448 bit key, relatively slow key setup
• Fast for bulk data on most PCs/laptops
• Easy to implement, runs in ca. 5K of memory

Ot Other Sy Symmetric Ci Ciphers

60

• RC4 (Ron’s Cipher #4) Stream Cipher:
• Optimized for fast software implementation
• Character streaming (not bit)
• 8-bit output
• Former trade secret of RSADSI,
• Reverse-engineered and posted to the net in 1994:
• 2048-bit key
• Used in many products until about 1999-2000

Ot Other Sy Symmetric Ci Ciphers

61

x=y=0; while( length-- ) { /* state[0-255] contains key bytes */ sx = state[ ++x & 0xFF ]; y += sx & 0xFF; sy = state[ y ]; state[ y ] = sx; state[ x ] = sy; *data++ ^= state[ ( sx+sy ) & 0xFF ]; } Takes about a minute to implement from memory

Ot Other Sy Symmetric Ci Ciphers (R (RC4 C4)

62

Ot Other Sy Symmetric Ci Ciphers

• RC5 (Ron’s Cipher #5)
• Suitable for hardware and software
• Fast, simple
• Adaptable to processors of different word lengths
• Variable number of rounds
• Variable-length key (0-256 bytes)
• Very low memory requirements
• High security (no effective attacks, yet…)
• Data-dependent rotations

63

Ot Other Sy Symmetric Ci Ciphers

• RC5 single round pseudocode:

64

Adv Advanc nced d Enc Encryp yption n Standa ndard d (AE (AES): ): Th The Ri Rijndael Bl Block k Ci Cipher

65

• National Institute of Science and Technology (NIST) regulates

standardization in the US

• By mid-90s, DES was an aging standard that no longer met the needs for

strong commercial-grade encryption

• Triple-DES: Endorsed by NIST as a “de facto” standard
• But … slow in software and large footprint (code size)
• Advanced Encryption Standard (AES)
• Finalized in 2001
• Goal is to define the Federal Information Processing Standard (FIPS) by

selecting a new encryption algorithm suitable for encrypting (non-classified non-military) government documents

• Candidate algorithms must be:
• Symmetric-key ciphers supporting 128, 192, and 256 bit keys
• Royalty-Free
• Unclassified (i.e., public domain)
• Available for worldwide export

In Intr troduc ductio tion n and and His History

66

In Intr troduc ductio tion n and and His History

• AES Round-3 Finalist Algorithms:
• MARS
• Candidate offering from IBM Research
• RC6
• By Ron Rivest of MIT & RSA Labs, creator of the widely used

RC4/RC5 algorithm and “R” in RSA

• Twofish
• From Counterpane Internet Security, Inc. (MN)
• Serpent
• by Ross Anderson (UK), Eli Biham (ISR) and Lars Knudsen (NO)
• Rijndael
• by Joan Daemen and Vincent Rijmen (B)

67

The Winner: Rijndael

• Joan Daemen (of Proton World International) and Vincent Rijmen (of

Katholieke Universiteit Leuven).

• Pronounced “Rhine-doll”
• Allows only 128, 192, and 256-bit key sizes (unlike other candidates)
• Variable input block length: 128, 192, or 256 bits. All nine

combinations of key-block length possible.

• A block is the smallest data size the algorithm will encrypt
• Vast speed improvement over DES in both hw and sw

implementations

• 8,416 bytes/sec on a 20MHz 8051
• 8.8 Mbytes/sec on a 200MHz Pentium Pro

Ri Rijndael

68

P

r1

Key

r2 Rn-1 rn r3

C

Rn-2 k1 k2 Kn-1 kn k3 Kn-2

K KE Key Expansion Round Keys Encryption Rounds r1 … rn

• Key is expanded to a set of n round keys
• Input block P put thru n rounds, each with a distinct round sub-key.
• Strength of algorithm relies on difficulty of obtaining intermediate results (or

state) of round i from round i+1 without the round key.

Ri Rijndael

69

Ri Rijndael

Detailed view of round n

• Each round performs the following operations:
• Non-linear Layer: No linear relationship between the input and output of a round
• Linear Mixing Layer: Guarantees high diffusion over multiple rounds
• Very small correlation between bytes of the round input and the bytes of the
• utput
• Key Addition Layer: Bytes of the input are simply XOR’ed with the expanded round

key

ByteSub ShiftRow MixColumn AddRoundKey

Kn

Result from round n-1 Pass to round n+1 70

Ri Rijndael

• Three layers provide strength against known types of

cryptographic attacks: Rijndael provides “full diffusion” after

• nly two rounds
• Immune to:
• Linear and differential cryptanalysis
• Related-key attacks
• Square attack
• Interpolation attacks
• Weak keys
• Rijndael has been “shown” secure:
• No key recovery attacks faster than exhaustive search exist
• No known symmetry properties in the round mapping
• No weak keys identified
• No related-key attacks: No two keys have a high number of expanded

round keys in common

71

Ri Rijndael: : By ByteSub

Each byte at the input of a round undergoes a non-linear byte substitution according to the following transform: Substitution (“S”)-box

72

Ri Rijndael: : Sh ShiftRow

Depending on the block length, each “row” of the block is cyclically shifted according to the above table

73

Ri Rijndael: : Mi MixCo Column mn

Each column is multiplied by a fixed polynomial C(x) = ’03’*X3 + ’01’*X2 + ’01’*X + ’02’ This corresponds to matrix multiplication b(x) = c(x) Ä a(x):

Not XOR

74

Ri Rijndael: : Key Expansion and Addition

Each word is simply XOR’ed with the expanded round key

KeyExpansion(int* Key[4*Nk], int* EKey[Nb*(Nr+1)]) { for(i = 0; i < Nk; i++) EKey[i] = (Key[4*i],Key[4*i+1],Key[4*i+2],Key[4*i+3]); for(i = Nk; i < Nb * (Nr + 1); i++) { temp = EKey[i - 1]; if (i % Nk == 0) temp = SubByte(RotByte(temp)) ^ Rcon[i / Nk]; EKey[i] = EKey[i - Nk] ^ temp; } }

Key Expansion algorithm:

75

Ri Rijndael: : Imp mpleme mentations

• Well-suited for software implementations on 8-bit processors

(important for “Smart Cards”)

• Atomic operations focus on bytes and nibbles, not 32- or 64-bit integers
• Layers such as ByteSub can be efficiently implemented using small tables

in ROM (e.g., < 256 bytes).

• No special instructions are required to speed up operation, e.g., barrel

rotates

• For 32-bit implementations:
• An entire round can be implemented via a fast table lookup routine on

machines with 32-bit or higher word lengths

• Considerable parallelism exists in the algorithm
• Each layer of Rijndael operates in a parallel manner on the bytes of the round

state, all four component transforms act on individual parts of the block

• Although the Key expansion is complicated and cannot benefit much from

parallelism, it only needs to be performed once until the two parties switch keys.

76

Ri Rijndael: : Imp mpleme mentations

• Hardware Implementations
• Rijndael performs very well in software, but there are cases when better

performance is required (e.g., server and VPN applications).

• Multiple S-Box engines, round-key XORs, and byte shifts can all be

implemented efficiently in hardware when absolute speed is required

• Small amount of hardware can vastly speed up 8-bit implementations
• Inverse Cipher
• Except for the non-linear ByteSub step, each part of Rijndael has a

straightforward inverse and the operations simply need to be undone in the reverse order.

• However, Rijndael was specially written so that the same code that

encrypts a block can also decrypt the same block simply by changing certain tables and polynomials for each layer. The rest of the operation remains identical.

77

Conclusions and Th The Future

• Rijndael is an extremely fast, state-of-the-art, highly

secure algorithm

• Amenable to efficient implementation in both hw

and sw; requires no special instructions to obtain good performance on any computing platform

• Triple-DES, still highly secure and supported by NIST,

is expected to be common for the foreseeable future.

78

Re Reminder: : Wo World’s Bes est t Cip ipher er!

79

On One-Ti Time Pad (OTP TP)

For each character:

0 1 1 1 0 0 1 0 1 1 0

pad

(key)

1 0 1 1 0 1 0 1 1 0 0

ciphertext

(encrypted msg)

Å

1 1 0 0 0 1 1 1 0 1 0

msg

(plaintext)

80

On One-Ti Time Pad (cont.)

• Symmetric
• Pad is selected at random
• Pad is as long as plaintext
• Perfectly secure, but ...
• One time only:

so sending the pad is just as hard as sending the msg

81