Hot answers tagged des
29
The initial and final permutation have no influence on security (they are unkeyed and can be undone by anybody). The usual explanation is that they make implementation easier in some contexts, namely a hardware circuit which receives data over a 8-bit bus: it can accumulate the bits into eight shift registers, which is more efficient (in terms of circuit ...
19
There is a good article from Coppersmith which explains it. Basically, the designers of DES had envisioned differential cryptanalysis (a good 15 years before differential cryptanalysis was rediscovered by Biham and Shamir, and published); they could measure how well DES could resist differential cryptanalysis for a given set of S-boxes.
So they generated a ...
14
Assume that 1 evaluation of {DES, AES} takes 10 operations, and we can perform $10^{15}$ operations per second. Trivially, that means we can evaluate $10^{14}$, or about $2^{46.5}$ {DES, AES} encryptions per second. This is a simplistic view: we are ignoring here the cost of testing whether we found the correct key, and the key schedule cost.
So on our ...
13
Before it was the standard, the NSA proposed some changes to the S-boxes and didn't explain them. The explanation (which turned out to be correct when differential cryptanalysis was "rediscovered" by the non-spy community) was that if you changed a single bit of the input, every bit of output should have a 50% chance of changing (this is called the "strict ...
12
Yes. DES is no longer considered an approved algorithm by NIST, and breaking a 56-bit key can be done quickly - in 1998 the EFF DES Cracker managed to break a DES key in 56 hours. The average time it required to break any DES key was 4½ days. You could use triple DES instead, which is still considered secure, but it's very slow (in software, even single DES ...
10
The initialization vector is a property of the mode of operation (aka "chaining mode"), not of the block cipher itself. A block cipher does only one thing, which is mapping blocks (block size depends on the cipher, 64-bit for DES, 128-bit for AES) unto other blocks. The chaining mode is what says how input data should be transformed into block values, and ...
9
"Considered insecure" does not mean "easily broken". Note that there is a terminology issue: there is a thing called "Triple-DES" or "3DES" which is, as far as the standard (FIPS 46-3) was putting it (until it was withdrawn), just a kind of DES.
The original DES, with its 56-bit key (namely 64 bits with 8 bits ignored), can be broken with not-so-expensive ...
9
Having taken The Design of Rijndael from the library just yesterday, I had a look on this problem, too. Fixee wrote in a comment:
However, my question is not so much about security implications, but rather
"how does omissions of MixColumns make the inverse cipher similar to the cipher?"
and "how does this help in implementing the cipher?"
The ...
9
Within the DES block cipher itself, the XOR operation is used at two different places:
On the input of S-boxes, XOR-ing 48 bits per round: 48 bits from a subkey (extracted from the 56-bit key), and 48 bits that are the output of expansion E. The 48-bit result forms the eight 6-bit inputs of the S-boxes.
On the output of S-boxes, XOR-ing 32 bits per round: ...
8
First of all, avalanche effect is a desirable effect: it means that a very small change in the inpout will lead to a very big change in the output. A security algorithm that doesn't provide this avalanche effect can lead to an easy statistical analysis: if the change of one bit from the input leads to the change of only one bit of the output, then it's easy ...
8
The main difference is that with two 56 bit keys the maximal security level is 112 bit, and thus an attack that has a cost of $2^{112}$ operations is no attack, whereas for three 56 bit keys the maximal security level is 168 bits, and an attack that has a cost of $2^{112}$ operations counts as an attack.
This means that two-key 3DES is still a bit weaker ...
7
There is a reasonably clear description in section 2 of Pascal Junod's thesis.
A linear approximation, which allows guessing 1 key bit
Linear cryptanalysis begins by finding a linear equation which holds with probability distinct from $1/2$. We are talking about linearity in $\mathbb{Z}_2$, i.e. we XOR bits together. The question is a XOR of some specific ...
6
I'm not going to look up the DES key schedule such, but the connection between your two sequences
$$( a_i ) = ( 1, 2, 4, 6, 8, 10, 12, 14, 15, 17, 19, 21, 23, 25, 27, 28 )$$
and
$$( b_i ) = ( 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1 )$$
is obvious: $b_i = a_i - a_{i - 1}$ (with $a_0$ taken to be 0).
That is, the second sequence gives the ...
6
Main drawbacks of DES are:
Small key space (56 bits).
Small blocks (64 bits).
Terrible performance in software, due to all the bit-juggling.
Relative weaknesses with regards to linear and differential cryptanalysis.
Changing any of these will imply heavy changes, not little tweaking. Doing that while maintaining or increasing security is no mere feat... ...
5
As for the salt, it is a two-character string chosen from the set of printable characters leading to an effective 12-bit entropy.
The fact that every eigth bit of the password is dropped is due to the DES itself: from the 64-bit key, only 56 bits are actually used, thereby dropping 8 of the bits of the key. So, you just input the 64-bit password as the ...
5
Well, the methods we use to take a block cipher (such as DES), and turn it into an actually useful function (say, to encrypt a large message) is called a mode of operation.
Such a mode of operation takes the message (generally of arbitrary length), and processes it (usually block by block), using the block cipher as a primitive.
There are a number of such ...
5
The question has morphed over time. I am answering the following.
So to be sure, with DES, only when you encrypt something twice with a weak key. You get the back the original plaintext?
That is correct as that is the definition of a DES weak key, a key for which encryption and decryption have the same effect.
So when using DES in OFB mode with a ...
4
Do you know anything at all about the key? If not, then what you have is a "Known plaintext attack" - you know the cyphertext is 16 05 78 B0 0A C2 78 7F and the plaintext is FF FF FF FF FF FF FF FF.
DES has some weaknesses, but it isn't that weak. A cypher that can be cracked with a mere 8 bytes of plaintext/cyphertext would be very weak indeed.
Can you ...
4
Yes, DES is considered too weak to use.
NIST publishes recommendations of what encryption schemes are "allowed". Civilian government agencies, and most companies, follow NIST guidelines for security. NIST Pub 800-131A has the list of approved encryption and hashing standards.
Only 3-key "triple DES" is still considered acceptable (see page 3 of ...
4
This is only a partial answer to the question, but still: The S-boxes where chosen to maximize confusion and to create an avalanche of change. For example, there were specific properties chosen to make the S-boxes resistant against differential cryptanalysis, by making sure that small differences between different inputs lead to larger differences in the ...
3
Let us denote by $x = x_5x_4x_3x_2x_1x_0$, where $x_i \in \{0, 1\}$ the input of a DES S-box and by $y = y_3y_2y_1y_0$, with $y_i \in \{0, 1\}$ its output. Basically, $\mathrm{NS}_5(16, 15) = 12$ means that for S-box #5, the relation $x_4 = y_3 \oplus y_2 \oplus y_1 \oplus y_0$, where $y = S_5(x)$, holds with probability $\frac{\mathrm{NS}_5(16, 5)}{64} = ...
3
A DES cracker just tries out keys until a matching key is found.
So, with Verilog, you design a circuit which includes:
a counter, which enumerates possible keys in a fixed order;
a DES encryption engine, which, given a plaintext block and a key, computes the corresponding ciphertext block;
a comparison engine, which compares the ciphertext block obtained ...
3
According to the Rijndael design document (top of page 7):
In order to make the cipher and its inverse more similar in structure, the linear mixing layer of the last round is different from the mixing layer in the other rounds. It can be shown that this does not improve or reduce the security of the cipher in any way. This is similar to the absence of ...
3
Something I wrote years ago to describe the IP and Inverse IP. With a copy of the FIPS Pub in hand you can see the correlation between registers and bits. Essentially the data is shifted in serially (for an interface smaller than 64 bits, in this case 8 bits wide) and used in a parallel fashion. In hardware and an 8 bit interface the IP and Inverse IP ...
3
3DES is a block cipher which processes "blocks" of 64 bits. A block cipher is not sufficient to encrypt a message, defined as a sequence of potentially many bytes. Hence the use of a mode of operation which organizes things; this may imply some padding, and an Initialization Vector.
TripleDESCryptoServiceProvider can do all that: you specify the key, the ...
3
Using the -k option, you can specify a password. Passwords are not really encryption keys, so OpenSSL uses a key derivation process to turn the password into an encryption key. It turns out by default OpenSSL uses a salt in that derivation process (which is why you see Salted in the output).
If the salt changes, the encryption key changes. If the encryption ...
2
Additionally to a mode of operation, as mentioned by poncho's answer, you will probably (depending of the mode of operation) need a padding mode, i.e. a function which converts bit-strings of arbitrary length (or usually only byte-strings of arbitrary length) to strings with length which are of a multiple of the block size.
Such a padding function is easily ...
2
You can look at the time taken by the 3 DES Challenges :
DES Challenge I - 140 days
DES Challenge II - 41 days
DES Challenge III - 56 hours
http://cs-exhibitions.uni-klu.ac.at/index.php?id=263
2
without doing your homework for you: did you check the open-source implementations of ISO 8583? is the answer somewhere in there?
DL-ISO-8583, in C
jPOS ISO-8583 Framework, in Java
j8583, also Java
PHP ISO-8583 Parser
Retrieved from wikipedia (strangely, the Spanish page, a good tip for finding more external references is changing the language tab)
2
Yes. See the other answers, but also note the risk issue. straight 56-bit DES is relatively easy to crack now, so the probability of a crack is greater; the marginal cost of using stronger encryptions, in hardware and computation, is near zero. Thus we can conclude with some rigor that DES is no longer a good choice.
Only top voted, non community-wiki answers of a minimum length are eligible
