# Tag Info

44

That value 0E329232EA6D0D73 was found by brute force. I would be surprised if there was a significantly better method: that would be tantamount to a cryptanalytic break of DES, very different from the few we know. A sketch of the brute force method (with details about parallelization omitted) goes: for each $K$ of 64 bits among the $2^{56}$ valid DES keys ...

11

Let's look at a picture of a generic feistel cipher Notice that no keying material is used during or after that final swap. So, we can conclude that the final swap does not impact security at all. So, why include it? It is so that all rounds will be identical. This could help with some implementations. That is all.

9

Parity of DES key bytes was introduced on request of US authorities during the design of DES in the late 1970s: it mitigates the risk of accidental key alteration; in particular, any all-zeros or all-ones byte of the key is rejected by the mandatory odd parity check, and any one-bit alteration is caught, which are advantages from a functionality ...

9

It's there to facilitate a simple implementation. As there is no key addition applied afterwards, the final swapping of the halves does not contribute towards security. The Feistel cipher entry on tutorialspoint explains: Decryption Process The process of decryption in Feistel cipher is almost similar. Instead of starting with a block of plaintext,...

7

They are there to check if the key was indeed correctly retrieved. It could for instance be that the key is a result of key decryption or key agreement. In that case, or simply during transmission, wrong keys are used. According to NIST FIPS 46-3: The 8 error detecting bits..." Or even better, Wikipedia states ANSI INCITS 92-1981), section 3.5: One ...

6

There is a very interesting paper that relates to this exact question (but you wouldn't guess it from the title). The paper is titled Efficient Dissection of Composite Problems, with Applications to Cryptanalysis, Knapsacks, and Combinatorial Search Problems. In Section 3, the paper considers the multiple encryption problem and gives novel attacks that are ...

5

Programming your own DES is usually a bad idea (unless as an exercise to understand the algorithm better), but OK. By definition the algorithm works with blocks of data that consist of 8 bytes (i.e. integers in the range 0..255), and the key is 7 of those bytes (or 8 with unused parity bits). What the data means (text or binary files like Office documents ...

5

It depends on the block cipher in question - specifically its key schedule. Knowing any round key of AES-128 would let you calculate the key, because the schedule is reversible. OTOH, e.g. TEA would retain secrecy of most of the key and might remain secure, because its round keys are small enough parts of the key. In the case of DES, it is weak enough to be ...

5

A block cipher mode is an algorithm used along with a block algorithm to encrypt arbitrary size plaintext, providing both confidentiality and authentication. A single block cipher operates only on a fixed block length. It is not alone enough to encrypt larger plaintexts. It functions as a blackbox in an encryption scheme (see Random Oracle Model). The are ...

5

It is of course possible to write DES or any block cipher as a system of non-linear equations involving the plaintext bits, the ciphertext bits, and the key bits, which hold with probability 1. In principle, cracking the cipher would then merely involve collecting enough linearly independent equations (e.g. from a couple different known plaintexts) and then ...

4

The DES operation (both encryption and decryption) ignores the lsbit of each byte of the key. That is, if you flip any of the lsbits within the key, the operation remains the same. That's what is happening in the keys you tried: the ASCII code for space is 0x20, while the ASCII code for ! is 0x21; they differ only in the lsbit. So, if the key has a byte ...

4

Each 56-bit key has a unique 8-bit parity value. For this reason there are only $2^{56}$ keys.

4

Triple DES is a block cipher. (Specifically, it's a variant of the old DES block cipher with better security, but several times lower performance.) You can use it to encrypt small blocks of data (64 bits = 8 bytes, for Triple DES), but what it's really useful for is as a building block for other cryptographic schemes, such as stream encryption or message ...

4

yes,it is possible because in meet in the middle attack on 3DES,see below with Complementation Property of DES in red arrow,you can search $2^{55}$ key space instead of $2^{56}$,and for green arrow,you have $DEC_{K2}(ENC_{K1}(M))$ that without key Complementation Property,you need $2^{112}$ operations but with key Complementation Property of left ENC and ...

4

Definitely a mistake. The text clearly contradicts itself. ... 2DES has an effective key length of 57. And later... There does not appear to be a meet-in-the-middle attack on 3DES2 however, so that its key length of 112 is also its effective key length. which clearly contradicts 2DES, although having the same effective key length as 3DES2 ...

4

The block cipher itself is used as a black box for any mode of operation. The internal design - including if the block cipher uses a Feistel network - is completely tranparent to the mode of operation. The only thing that matters for the mode of operation is the block size of the block cipher. This, together with any usage limitations, limits the ...

4

The S-Boxes are lossy. They map 6-bit inputs to 4-bit outputs, so for a given 4-bit output there are several possible inputs. Considering that there are 8 S-boxes, that's 16 bits of information lost per round, or 256 bits for all 16 rounds. It's much easier to exhaustively search the 56-bit keyspace than try to work backwards against that kind of information ...

3

Inside each round, DES has a permutation that is used for diffusion and is crucial for security. However, you rightly point out that the initial and final permutations on the block of input/output and on the key have no effect whatsoever on security. Formally, it's not difficult to show that if you have an attack on DES without these initial and final ...

3

No. For any key $k$ your ciphertext $c$ has a corresponding plaintext $p$ (since block ciphers are families of bijections). Hence, since you can't (in)validate plaintexts, you can't discard any possible key. Or, in other words: If someone claimed the right key was a certain $k$, you had absolutely no way to ever prove them wrong.

3

Every algorithm that can be modeled as a Boolean circuit can be homomorphically encrypted. DES/3DES can surely be modeled by a Boolean circuit. The question is if it is practical to use DES/3DES for homomorphic encryption. I don't think so.

3

Verilog is Turing complete, so you can implement any algorithm in Verilog, if you really want to.

3

Remember that the initial value is split into two halves, and each half is shifted independently. If all the bits in each half are either 0 or 1, then the key used for any cycle of the algorithm is the same for all the cycles of the algorithm. This can occur if the key is entirely 1s, entirely 0s, or if one half of the key is entirely 1s or the other half is ...

3

Differential cryptanalysis is a very powerful technique that permitted highly practical attacks on many ciphers that were not designed to resist it (e.g. FEAL-4). DES, as it turns out, was designed to be pretty resistant to it, which is why it requires an essentially impractical amount of chosen plaintexts to implement a differential attack on DES. ...

3

Anyone who begins to develop an attack on primitive XYZ is probably not aware beforehand of what the computational complexity of their attack will turn out to be. Then, the attack is developed and computational complexity becomes known. Just because DES isn't broken by the attack in question does not mean no other ciphers will be. And just because the ...

2

As for "how to build the substitution as hardware", it should be easy if you know any of the hardware description language (eg. VHDL or Verilog). Simply write the Sboxes of DES, then the synthesis software will handle the rest. You can also "synthesis" by hand, although that may take a lot of effect. Still, I'm not sure if this is what you are looking for. ...

2

First property says- If you consider a 6-bit Inpput Difference(Difference means XOR in case of DES).i.e 6-bit binary number which is the xor of two inputs(obviously both 6 bits).When you enter both of these inputs to Sbox and get two outputs each of 4 bits and xor the outputs what you get is called Output Difference. Total 64 inputs are possible hence 32 ...

2

If you take an Sbox and two different inputs $x_1,x_2$ (binary vectors of length 6) the exclusive or ("sum") of the two inputs is does not propagate to the output. So $$S(x_1)\oplus S(x_2) \neq S(x_1\oplus x_2)$$ in general. This means that there is no shortcut allowing one to predict outputs "bit by bit" and build efficient search tables, by just ...

2

Permutations IP and PC-1 are near-transpositions, and play no cryptographic role. IP-1 is simply IP reversed. The best theory about why they are here is: as a technical by-product of the 8-bit interface used by early DES ICs, translated into the same formalism as the rest when writing the DES standard. They make wiring of hardware implementations simple when ...

2

If you're talking about the S-DES developed by Professor Edward Schaefer of Santa Clara University, I can try to explain you the reason. The algorithm takes in input a 10-bit key (K) but, using a key generation algorithm, the plaintext is encrypted using two different subkeys (K1 and K2) that are generated by the algorithm. First, you should pass the 10-...

2

For the first part of the question regarding DES subkey generation, the reason there is a difference in the rotation amount is so that each subkey is different, and that all bits of the original key are used, and that there is a fairly equal probability that a bit will be in a subkey. The rotations occur on the equal sized 28-bit halves of the 56-bit ...

Only top voted, non community-wiki answers of a minimum length are eligible