Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 2 down vote favorite

Is there a name for the property of a cryptographic algorithm that the operations for encryption and decryption are identical, i.e.

$E_k(x) = D_k(x)$ and accordingly $E_k(E_k(x)) = x$?

An example for this would be most stream ciphers; are there any other, possibly block ciphers, with that property?

It seems like a good thing to avoid in a cipher design (otherwise, any encryption oracle would automatically become a decryption oracle); is there a name for the absence of that property as a security feature?

share|improve this question
1  
This is not worth an answer, but the closest mathematical term I can think of would be an involution. I am not sure if there is a cryptographic term for primitives which satisfy this property. – Thomas Feb 9 at 15:02
1  
What you consider a weakness can also become a strenght in some contexts. For example, embedded designs have very strict space requirements : having a encryption algorithm that is its own inverse is then something really valuable. Even in software it can be thought of as a good idea : less code means easier maintainability. Anyways I would say that while you're not wrong, if you can avoid it, do not give an encryption oracle to your adversary in the first place ! – Alexandre Yamajako Feb 9 at 15:40
1  
Actually, many synchronous stream ciphers work just that way – they generate a key stream, which is then XOR-ed with a ciphertext. XORing with the same keystream again gives the plaintext. This usually is not a problem, as an encryption oracle should not let you chose the initialization vector (i.e. offset in the key stream), and the same IV should not be used twice. – Paŭlo Ebermann♦ Feb 10 at 22:33

2 Answers

up vote 2 down vote

A cryptographic algorithm where the operations for encryption and decryption are identical is called a reciprocal cipher. As dfaranha mentioned, this is mathematically an involution.

Most mechanical cipher machines use a reciprocal cipher, so it wouldn't need a seperate "encode mode" and "decode mode".

Some of the more famous reciprocal ciphers are:

  • The Enigma machine was a reciprocal cipher machine
  • ROT13
  • Beaufort cipher
  • Kama-sutra ciphers
  • XOR-based stream ciphers
  • One Time Pads (both XOR and Beaufort cipher versions)

Many modern single-block ciphers are built with a Feistel network structure that, in each round, cascades a reciprocal permutation P ("swap the left and right half of the block") and a keyed reciprocal substitution cipher S, to build a non-reciprocal bijective encryption function E(x) == P(S(X)) != D(X) = S(P(X). It is widely believed that practically any non-linear function can give adequate security if it is iterated over enough rounds. While the overall cipher is not reciprocal, the parts that are reciprocal allow such ciphers to share parts between the encryption and decryption, so implementations use significantly less space (less code or less hard-wired ASIC area) than they would if they implemented encryption and decryption completely independently.

There are variants of the one-time pad that are not reciprocal (for example, using the Vigenère algorithm), but they are no more secure.

share|improve this answer
up vote 1 down vote

I believe the closest term for what you describe is "involutional cipher". The encryption operation would not be strictly identical to the decryption operation, but the only difference would be the order in which the key schedule is applied:

http://www.iacr.org/archive/fse2003/28870048/28870048.pdf

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.