Lecture 3: Block Ciphers and the Data Encryption Standard ...

1 Lecture 3: Block Ciphers and the data EncryptionStandardLecture Notes on computer and Network Security by Avi Kak 26, 20213:43pm 2021 Avinash Kak, Purdue UniversityGoals: To introduce the notion of a Block cipher in the modern context. To talk about the infeasibility ofideal Block Ciphers To introduce the notion of theFeistel Cipher Structure To go overDES, the data Encryption Standard To illustrate important DES steps with Python and Perl codeCONTENTSS ection Block of the Encryption Key for the Ideal Block Feistel Structure for Block Description of Each Round in the10 Feistel in Ciphers Based on the Feistel : The data Encryption Round of Processing in S-Box for the Substitution Step in Each Substitution P-Box Permutation in the Feistel DES Key Schedule: Generating the Round Permutation of the Encryption that Generates the 48-Bit42 Round Key from the 56-Bit Makes DES a Strong Cipher (to the46 Extent It is a Strong Cipher) Problems482 computer and Network Security by Avi KakLecture 3 Back to IDEAL Block CIPHER In a modern Block cipher (but still using a classical encryptionmethod), we replace a Block ofNbits from the plaintext with ablock of N bits from the ciphertext.

2 This general idea isillustrated in Figure 1 for the case ofN= 4. (In general,though,Nis set to 64 or multiples thereof.) To understand Figure 1, note that there are 16 different possible4-bit patterns. We can represent each pattern by an integerbetween 0 and 15. So the bit pattern 0000 could be representedby the integer 0, the bit pattern 0001 by integer 1, and so bit pattern 1111 would be represented by the integer 15. In an ideal Block cipher, the relationship between the inputblocks and the output Block is completely random. But it mustbe invertible for decryption to work. Therefore, it has to beone-to-one, meaning that each input Block is mapped to aunique output Block . The mapping from the input bit blocks to the output bit blockscan also be construed as a mapping from theintegerscorresponding to the input bit blocks to theintegers3 computer and Network Security by Avi KakLecture 3corresponding to the output bit blocks.

3 The Encryption key for the ideal Block cipher is the codebookitself, meaning the table that shows the relationship betweenthe input blocks and the output blocks. Figure 1 depicts an ideal Block cipher that uses blocks of size Block of 4 bits in the plaintext is transformed into a blockof 4 ciphertext and Network Security by Avi KakLecture 3to 16 output integersRandom 1 1 mapping of 16 input integersPlaintext bit Block :bbbb0123 Ciphertext bit Block :cccc0123 Convert 4 incoming bits to one of 16 integersConvert integer to a 4 bit patternFigure 1:The ideal Block cipher when the Block size equals4 bits. (This figure is from Lecture 3 of Lecture Notes on computer andNetwork Security byAvi Kak)5 computer and Network Security by Avi KakLecture 3 Back to The Size of the Encryption Key for the IdealBlock Cipher Consider the case of 64-bit Block Encryption .

4 With a 64-bit Block , we can think of each possible input blockas one of 264integers and for each such integer we can specifyan output 64-bit Block . We can construct the codebook bydisplaying just the output blocks in the order of the integerscorresponding to the input blocks. Such a code book will be ofsize 64 264 1021. That implies that the Encryption key for the ideal Block cipherusing 64-bit blocks will be of size 1021. The size of the Encryption key would make the ideal blockcipher an impractical of the logistical issues relatedto the transmission, distribution, and storage of such large and Network Security by Avi KakLecture 3 Back to THE FEISTEL STRUCTURE FORBLOCK CIPHERSThe DES ( data Encryption Standard ) algorithm for encryptionand decryption, which is the main theme of this Lecture , is based onwhat is known as theFeistel Structure.

5 This section and the nexttwo subsections introduce this structure: Named after the IBM cryptographer Horst Feistel and firstimplemented in the Lucifer cipher by Horst Feistel and DonCoppersmith. A cryptographic system based on Feistel structure uses thesame basic algorithm for both Encryption and decryption. As shown in Figure 2, the Feistel structure consists of multiplerounds of processing of the plaintext, with each round consistingof asubstitutionstep followed by apermutationstep. The input Block to each round is divided into two halves that Ihave denotedLandRfor the left half and the right and Network Security by Avi KakLecture 3F(K,R)LRK1F(K,R)LRK2 KnF(K,R)LRCiphertext blockRoundRoundRoundRoundn21 Round KeysPlaintext Block (Divide into two halves, L and R)Figure 2:The Feistel Structure for symmetric key cryptog-raphy (This figure is from Lecture 3 of Lecture Notes on computer andNetwork Security by AviKak)8 computer and Network Security by Avi KakLecture 3 In each round, the right half of the Block ,R, goes throughunchanged.

6 But the left half,L, goes through an operation thatdepends onRand the Encryption key. The operation carriedout on the left halfLis referred to as theFeistel Function. The permutation step at the end of each round consists ofswapping the , theLfor the nextround would beRof the current round. AndRfor the nextround be the outputLof the current round. The next two subsection present important properties of theFeistel structure. As you will see, these properties are invariantto our choice for the Feistel Function. Besides DES, there exist several Block Ciphers today themost popular of these beingBlowfish,CAST-128, andKASUMI that are also based on the Feistel and Network Security by Avi KakLecture 3 Back to Mathematical Description of Each Round in theFeistel Structure LetLEiandREidenote the output half-blocks at the end oftheithround of processing.

7 The letter E denotes Encryption . In the Feistel structure, the relationship between the output oftheithround and the output of the previous round, that is, the(i 1)thround, is given byLEi=REi 1 REi=LEi 1 F(REi 1, Ki)where denotes the bitwiseEXCLUSIVE-ORoperation. ThesymbolFdenotes the operation that scrambles REi 1of theprevious round with what is shown as theround keyKiinFigure round keyKiis derived from the mainencryption key as will be explained later. Fis referred to as the Feistel function, after Horst and Network Security by Avi KakLecture 3 Assuming 16 rounds of processing (which is typical), the outputof the last round of processing is given byLE16=RE15RE16=LE15 F(RE15, K16)11 computer and Network Security by Avi KakLecture 3 Back to Decryption in Ciphers Based on the FeistelStructure As shown in Figure 3, the decryption algorithm is exactly thesame as the Encryption algorithm with the only difference thatthe round keys are used in the reverse order.

8 The output of each round during decryption is theinput to the corresponding round during Encryption except for the left-right switch between the twohalves. This property holds true regardless of thechoice of the Feistel functionF. To prove the above claim, letLDiandRDidenote the left halfand the right half of the output of theithround. That means that the output of the first decryption roundconsists ofLD1andRD1. So we can denote the input to thefirst decryption round byLD0andRD0. The relationshipbetween the two halves that are input to the first decryptionround and what is output by the Encryption algorithm is:LD0=RE1612 computer and Network Security by Avi KakLecture 3 Ciphertext blockPlaintext Block (Divide into two halves, L and R)Plaintext Block (Divide into two halves, L and R)K2K161 KRound16 Round2 Round1 EncryptionDecryptionF(K,R)LRCiphertext blockF(K,R)F(K,R)F(K,R)F(K,R)F(K,R)Round KeysLE16RE16LE15RE15LE1RE1LE0RE01516RD = LE1RD = LERD = LE11515160RD = LE00115161LD = RELD = RELD = RELD = RE160 Figure 3:When a Feistel structure is used, decryptionworks the same as Encryption .

9 (This figure is from Lecture 3 of LectureNotes on computer and Network Security by Avi Kak)13 computer and Network Security by Avi KakLecture 3RD0=LE16 We can write the following equations for the output of the firstdecryption roundLD1=RD0=LE16=RE15RD1=LD0 F(RD0, K16)=RE16 F(LE16, K16)= [LE15 F(RE15, K16)] F(RE15, K16)=LE15 This shows that, except for the left-right switch, the output ofthe first round of decryption is the same as the input to the laststage of the Encryption round since we haveLD1=RE15andRD1=LE15 The following equalities are used in the above thatA,B, andCare bit arrays.[A B] C=A [B C]A A= 0A 0 =A14 computer and Network Security by Avi KakLecture 3 The above result is independent of the precisenature of the Feistel functionF. That is, the output ofeach round during decryption is the input to the correspondinground during Encryption for every choice of the Feistel and Network Security by Avi KakLecture 3 Back to DES: THE data ENCRYPTIONSTANDARD Adopted by NIST in 1977.

10 Based on a cipher (Lucifer) developed earlier by IBM forLloyd s of London for cash transfer. DES uses the Feistel cipher structure with 16 rounds ofprocessing. DES uses a 56-bit Encryption key. (The key size was apparentlydictated by the memory and processing constraints imposed bya single-chip implementation of the algorithm for DES.) Thekey itself is specified with 8 bytes, but one bit of each byte isused as a parity check. DES Encryption was broken in 1999 by ElectronicsFrontiers Foundation (EFF, ).Thisresulted in NIST issuing a new directive that year that requiredorganizations to useTriple DES, that is, three consecutiveapplications ofDES. (That DES was found to be not as strongas originally believed also prompted NIST to initiate the16 computer and Network Security by Avi KakLecture 3development of new standards for data Encryption .)