# Where is the proof of security of Diffie's cipher?

There is an apparently provably secure cipher that was proposed by Diffie, but enhanced by R.A. Rueppel. The scheme, which was mentioned in Applied Cryptography, works like this:

1. Measure the length of the plain-text, $n$.
2. Multiply it by $128$.
3. Generate this much ($128·n$ bytes of) real random data and split it out into 128 byte-arrays of length each equal to the plain-text. This can be thought as a two dimensional array:
1. One of the indices gives the sequence number ($0\dots 127$).
2. One of the indices gives the position in the sequence, $0 \dots n-1$.
4. Use a 128-bit key to choose which of these streams to XOR together. Each bit of the key corresponds to "yes/no" on whether to use particular sequence. All the selected sequences are XORed together to make a single keystream, $K$.
5. Compute $P \oplus K$ to give the cipher-text $C$.
6. Serialize the two dimensional array and append it to the cipher text.
7. Send the whole package to Bob, who can then decrypt by de-serializing the matrix and selecting the same rows.

Apparently, this scheme is completely secure. The attacker has to examine every possible combination of sequences ($2^{127}$ on average) in order to break the encryption scheme.

What is the proof of this? I can't find the paper that discusses this anywhere.

-

This looks totally weak. If you know 128 bits of known plaintext, you can infer the corresponding 128 bits of keystream. The keystream being the multiplication of the random matrix by the key (in the vector space $\mathbb{F}_2^{128}$), the key is then revealed through a basic matrix inversion.

-
Interesting, this may be completely wrong then. The algorithm is mentioned in Applied Cryptography. The original Diffie algorithm used 2^k strings, and the key just selected what string to use. The modification was to use a linear combination of just k strings - but the paper discussing the modification was unreferenced in the text. It said that the paper used a linear combination of the k strings and it was equally secure. I used XOR as the linear combination in my example. Perhaps this is the source of my mistake. –  Simon Johnson Nov 28 '11 at 17:36
Can something be perfectly secure and still vulnerable to a known-plaintext key recovery? –  Ethan Heilman Nov 28 '11 at 20:03
To me, the whole security of Diffie's cipher boils down to $K$ being transmitted over a separate, secret, and secure channel — like they nicely animated here. As soon as an attacker can intercept $K$, security is hosed… personally, I think there's not much difference to simply using the $K$ channel to transmit OTP instead of index positions of a (publicly known) dictionary. OTOH, it's 07:00am local time on Christmas day… so, I might be missing something. ;) –  e-sushi Dec 25 '13 at 6:13