Hot answers tagged

43

The initial and final permutation have no influence on security (they are unkeyed and can be undone by anybody). The usual explanation is that they make implementation easier in some contexts, namely a hardware circuit which receives data over a 8-bit bus: it can accumulate the bits into eight shift registers, which is more efficient (in terms of circuit ...


27

The main difference is that with two 56 bit keys the maximal security level is 112 bit, and thus an attack that has a cost of $2^{112}$ operations is no attack, whereas for three 56 bit keys the maximal security level is 168 bits, and an attack that has a cost of $2^{112}$ operations counts as an attack. This means that two-key 3DES is still a bit weaker ...


26

There is a good article from Coppersmith which explains it. Basically, the designers of DES had envisioned differential cryptanalysis (a good 15 years before differential cryptanalysis was rediscovered by Biham and Shamir, and published); they could measure how well DES could resist differential cryptanalysis for a given set of S-boxes. So they generated a ...


25

Assume that 1 evaluation of {DES, AES} takes 10 operations, and we can perform $10^{15}$ operations per second. Trivially, that means we can evaluate $10^{14}$, or about $2^{46.5}$ {DES, AES} encryptions per second. This is a simplistic view: we are ignoring here the cost of testing whether we found the correct key, and the key schedule cost. So on our ...


24

Well, the standard answer is to preserve compatibility with DES; a hardware circuit that implemented 3DES (with EDE) could also be used to do DES as well (by, say, making all three subkeys the same). Now, there is one slight problem with this straightforward argument; 3DES (EEE, that is, with three encrypt operations) would have this property as well; if we ...


20

Before it was the standard, the NSA proposed some changes to the S-boxes and didn't explain them. The explanation (which turned out to be correct when differential cryptanalysis was "rediscovered" by the non-spy community) was that if you changed a single bit of the input, every bit of output should have a 50% chance of changing (this is called the "strict ...


15

Yes. DES is no longer considered an approved algorithm by NIST, and breaking a 56-bit key can be done quickly - in 1998 the EFF DES Cracker managed to break a DES key in 56 hours. The average time it required to break any DES key was 4½ days. You could use triple DES instead, which is still considered secure, but it's very slow (in software, even single DES ...


15

The initialization vector is a property of the mode of operation (aka "chaining mode"), not of the block cipher itself. A block cipher does only one thing, which is mapping blocks (block size depends on the cipher, 64-bit for DES, 128-bit for AES) unto other blocks. The chaining mode is what says how input data should be transformed into block values, and ...


13

There is a reasonably clear description in section 2 of Pascal Junod's thesis. A linear approximation, which allows guessing 1 key bit Linear cryptanalysis begins by finding a linear equation which holds with probability distinct from $1/2$. We are talking about linearity in $\mathbb{Z}_2$, i.e. we XOR bits together. The question is a XOR of some specific ...


13

Did you try Wikipedia? DES consists of 16 rounds of the form: $$L_{i+1} = R_{i}, \quad R_{i+1} = L_i \oplus F(R_i, K_i),$$ which are identical except for the round subkeys $K_i$. (The last round is slightly different, in that the half-blocks $L$ and $R$ are not swapped as they are after all other rounds, but that makes no cryptanalytic difference.) The ...


13

Decrypt the ciphertext with every possible key and store the result: $2^{56}$ decryptions. Now encrypt the (known) plaintext of the ciphertext with every possible key: $2^{56}$ encryptions. Now you have to check every entry, which is in both lists and try it with another plaintext-ciphertext pair. If you can successfully decrypt that, you are very likely to ...


12

First of all, the avalanche effect is a desirable effect: it means that a very small change in the input will lead to a very big change in the output. A security algorithm that doesn't provide this avalanche effect can lead to an easy statistical analysis: if the change of one bit from the input leads to the change of only one bit of the output, then it's ...


12

Having taken The Design of Rijndael from the library just yesterday, I had a look on this problem, too. Fixee wrote in a comment: However, my question is not so much about security implications, but rather "how does omissions of MixColumns make the inverse cipher similar to the cipher?" and "how does this help in implementing the cipher?" The ...


11

Let's look at a picture of a generic feistel cipher Notice that no keying material is used during or after that final swap. So, we can conclude that the final swap does not impact security at all. So, why include it? It is so that all rounds will be identical. This could help with some implementations. That is all.


10

"Considered insecure" does not mean "easily broken". Note that there is a terminology issue: there is a thing called "Triple-DES" or "3DES" which is, as far as the standard (FIPS 46-3) was putting it (until it was withdrawn), just a kind of DES. The original DES, with its 56-bit key (namely 64 bits with 8 bits ignored), can be broken with not-so-expensive ...


10

Differential cryptanalysis works on differences. Linear cryptanalysis works on linearity. Neat, isn't it ? Instead of speaking of how they differ, it is easier to list their common features. Both kinds of attacks: Use a lot of known pairs plaintext/ciphertext (many input messages encrypted with the same key, and, for each of them, the attacker knows both ...


9

Within the DES block cipher itself, the XOR operation is used at two different places: On the input of S-boxes, XOR-ing 48 bits per round: 48 bits from a subkey (extracted from the 56-bit key), and 48 bits that are the output of expansion E. The 48-bit result forms the eight 6-bit inputs of the S-boxes. On the output of S-boxes, XOR-ing 32 bits per round: ...


9

Re-using their design might be no good idea - there are cheaper designs for sure. This new DES cracker would just need to try every possible key - like the one of the EFF already did. DES was a big standard for encryption, so some people did build such machines, right? Of course did they: COPACOBANA is able to break DES in under 9 days and costs under 10,...


9

Parity of DES key bytes was introduced on request of US authorities during the design of DES in the late 1970s: it mitigates the risk of accidental key alteration; in particular, any all-zeros or all-ones byte of the key is rejected by the mandatory odd parity check, and any one-bit alteration is caught, which are advantages from a functionality ...


8

From Schneier's description of DES in Chapter 12 of Applied Cryptography (12.3): DES with any number of rounds fewer than 16 could be broken with a known-plaintext attack more efficiently than by a brute-force attack. This explains the "Why not less than 16". As for the "why not more than 16", that is a tradeoff for speed of execution (more rounds = ...


8

Efficiently - no. However, the best attack on DES - linear cryptanalysis - works with known plaintexts, and theoretically may work slightly faster than the brute force even for small amounts of data. Computing linear relations between plaintext $P$ and ciphertext $C$, an attacker is able to enumerate all keys according to their likelihood. The PhD thesis by ...


8

It's there to facilitate a simple implementation. As there is no key addition applied afterwards, the final swapping of the halves does not contribute towards security. The Feistel cipher entry on tutorialspoint explains: Decryption Process The process of decryption in Feistel cipher is almost similar. Instead of starting with a block of plaintext,...


7

The DES standard (FIPS 46-3) is actually a rather straightforward description of DES. It tells with precision and detail where each bit goes. It is a specification for implementers (who can be thought as "computer specialists" but anybody who wants to learn about DES should be able to understand that specification). What FIPS 46-3 does not tell is why DES ...


7

According to the Rijndael design document (top of page 7): In order to make the cipher and its inverse more similar in structure, the linear mixing layer of the last round is different from the mixing layer in the other rounds. It can be shown that this does not improve or reduce the security of the cipher in any way. This is similar to the absence of ...


7

Well, the methods we use to take a block cipher (such as DES), and turn it into an actually useful function (say, to encrypt a large message) is called a mode of operation. Such a mode of operation takes the message (generally of arbitrary length), and processes it (usually block by block), using the block cipher as a primitive. There are a number of such ...


7

Yes, DES is considered too weak to use. NIST publishes recommendations of what encryption schemes are "allowed". Civilian government agencies, and most companies, follow NIST guidelines for security. NIST Pub 800-131A has the list of approved encryption and hashing standards. Only 3-key "triple DES" is still considered acceptable (see page 3 of 800-...


7

Our Professor, Christof Paar, sat together on lunch a few years ago with one of the main designers of DES. He said that for getting it as specification, they had to build a piece of hardware which encrypts via DES. Shortly before finishing the project, they discovered that their wiring into the box was somewhat intermingled. Building such hardware stuff was ...


7

I add my whitebox AES implementation on GitHub in: C++ Java C++ version implements both Chow's (mixing bijections, input/output encodings, external encodings) and Karroumi's (dual AES in each column) whitebox AES scheme plus Billet's key recovery attack on both schemes. Java implements Chow's scheme only. PS: Due to low reputation I post links to ...


7

The original article rightfully neglects the cost of DES computations (there are less than $2^{90}$) and everything except memory accesses to its Table 1 and Table 2. I go one step further: considering that Table 1 is initialized only once and then read-only, it could be in ROM, and I neglect all except the accesses to Table 2. The attack requires an ...


7

Main drawbacks of DES are: Small key space (56 bits). Small blocks (64 bits). Terrible performance in software, due to all the bit-juggling. Relative weaknesses with regards to linear and differential cryptanalysis. Changing any of these will imply heavy changes, not little tweaking. Doing that while maintaining or increasing security is no mere feat... ...



Only top voted, non community-wiki answers of a minimum length are eligible