Tag Info

Hot answers tagged

7

Differential cryptanalysis works on differences. Linear cryptanalysis works on linearity. Neat, isn't it ? Instead of speaking of how they differ, it is easier to list their common features. Both kinds of attacks: Use a lot of known pairs plaintext/ciphertext (many input messages encrypted with the same key, and, for each of them, the attacker knows both ...


6

Efficiently - no. However, the best attack on DES - linear cryptanalysis - works with known plaintexts, and theoretically may work slightly faster than the brute force even for small amounts of data. Computing linear relations between plaintext $P$ and ciphertext $C$, an attacker is able to enumerate all keys according to their likelihood. The PhD thesis by ...


5

Did you try Wikipedia? DES consists of 16 rounds of the form: $$L_{i+1} = R_{i}, \quad R_{i+1} = L_i \oplus F(R_i, K_i),$$ which are identical except for the round subkeys $K_i$. (The last round is slightly different, in that the half-blocks $L$ and $R$ are not swapped as they are after all other rounds, but that makes no cryptanalytic difference.) The ...


5

Yes, an adversary can definitely decrypt a DES message, given sufficient funding. Fifteen years ago, in 1998, the EFF built a DES cracker (nicknamed Deep Crack) that can recover a DES key in a day. Today, anyone with the money can purchase a commercially available DES cracker named COPACOBANA. For RC2, I'm not aware of any practical attacks. (You still ...


5

From Schneier's description of DES in Chapter 12 of Applied Cryptography (12.3): “DES with any number of rounds fewer than 16 could be broken with a known-plaintext attack more efficiently than by a brute-force attack.” This explains the "Why not less than 16". As for the "why not more than 16", that is a tradeoff for speed of execution (more rounds = less ...


4

Well, one assumption you appear to be making is that, with 2DES, there will be approximately $2^{56}$ possible key matches. Actually, there are an expected $2^{48}$ possible key matches; here's why: Let us assume we're running the meet-in-the-middle attack on 2DES, and consider an arbitrary incorrect encryption trial (that is, we try an encryption key that ...


4

In "Applied Cryptography" — Chapter 12, , Bruce Schneier writes: The final permutation is the inverse of the initial permutation and is described in Table 12.8. Note that the left and right halves are not exchanged after the last round of DES; instead the concatenated block $R$16$L$16 is used as the input to the final permutation. There’s nothing going ...


4

Using the -k option, you can specify a password. Passwords are not really encryption keys, so OpenSSL uses a key derivation process to turn the password into an encryption key. It turns out by default OpenSSL uses a salt in that derivation process (which is why you see Salted in the output). If the salt changes, the encryption key changes. If the encryption ...


4

To answer your last question first, Triple DES does not need a longer key because it has more rounds than plain DES — rather, Triple DES needs more rounds than plain DES because it has a longer key (and because it aims to offer a security level appropriate for that key length). To be more specific, plain DES only has a 56-bit key, meaning that it can ...


3

We are talking about attacking double-DES here, which encrypts a 64-bit block $P$ with two 56-bit keys $K_1,K_2$ as $C = E_{K_2}(E_{K_1}(P))$. As noted by Diffie and Hellman already in late 70s, to attack it with a one or two plaintexts as follows. Suppose we know that $P_0$ is encrypted to $C_0$, then for all possible $K_1$ compute $E_{K_1}(P)$ (partial ...


3

Each half of the key is 28 bits long, so there will be $2^{28}$ possible choices for each of them. In the first part of your attack, you start with the known block of plaintext and encrypt it for the first 8 rounds using each possible left half of the key. This gives you $2^{28}$ "half-encrypted" 64-bit blocks. This is less than the birthday bound, so ...


3

In contrast to asymmetric schemes (notably RSA and El Gamal) which require some sort of computation to generate the key, the only constraint one has when selecting a key for DES or AES (or 3DES) is to make it look indistinguishible from a random stream. That said both El Gamal and RSA require some randomness in key generation, but that phase does not depend ...


3

Modes of operation are generally supposed to be independent of the underlying block cipher. They generally have a proof of security showing that the security of a system using said mode reduces to the security of the block cipher. However some modes, such as CTR, don't work well with block ciphers of short length (aka, old ciphers) and can leak information. ...


3

The de-facto answer to any question about increasing the AES rounds is that as yet there doesn't appear to be any need, and any time you do so involves implementing at least some of it in custom code, which is inherently risky. As far as running AES twice goes, have a look at Meet in the Middle (MITM) attacks. I don't know how relevant these will be to your ...


3

Yes, you can reasonably expect that these will provide equivalent security, if you choose all keys uniformly and independently at random. The decryption operation is basically the same as the encryption operation, so it would be extremely surprising if there was any significant difference in security among these. (Of course, if you don't generate the keys ...


3

Actually, there's no known way (assuming practical amounts of computing power) to distinguish keying methods 1 and 2. You mention a "brute-force attack of complexity $O(2^{56})$ followed by a chosen plaintext attack of complexity $O(2^{57})$", there's no obvious way to frame an attack against either of the first two options in this matter; you can't do a ...


2

DES is based on a Feistel construction - while the one-way function used is.. well.. one-way, you don't need to reverse it at all to "decrypt" (otherwise you are correct we would have a problem). Look at this diagram, specifically the decryption one: As you can see, even though one half of the ciphertext is passed through the one-way function, there's ...


2

No, they aren't a group. Justification: We know that the subgroup generated by DES is very large. If (any of the variants of) 3DES formed a closed group, then the subgroup generated by 3DES would be no larger than $2^{168}$. We know the latter is not the case. Therefore, the former is not the case, either. Also, for the EDE variants of 3DES, it is easy ...


2

Short answer: (Probably) yes. Long answer: DES is a Feistel cipher, and therefore encryption and decryption are almost the same process. The only difference is the reverse order of the subkeys. There are theoretical attacks on DES, which might have to be adjusted if you use reverse order of subkeys for encryption. If these attacks target the subkeys ...


2

Adding my 2 cents, I would like to point out that many published methods for white-box cryptography have been broken. This includes… white-box AES white-box DES … which have been crypto-analyzed and are known to be insecure ever since. On the other hand, as long as you just plan to study implementation to learn about the techniques and not plan to ...


2

It is not practically possible. There are several attacks that are slightly faster than bruteforcing $2^{112}$ key candidates, but this is only a small factor. In some sense, they are bruteforce-like, since they require $2^{113}$ smaller steps.


2

If we talk about key search attacks (rather than key compromise or/and side-channel attacks), the answer must be no, for the best known method is impractical. On the other hand there has been numerous successful key-recovery attacks against devices using TDES, including on some that try hard to avoid it. One example here, another there.


2

As fgrieu already pointed out, using a OWF in the way you describe would make the key schedule not efficiently invertible (or even not invertible at all), meaning you would need more memory/chip space to store the user-input key in order to efficiently encrypt more than one block. In terms of other implications, if the key-state update function $e_n(\cdot)$ ...


2

The attacker splits the range of $2^{56}$ keys for the first DES into $2^{17}$ ranges of size $2^{39}$. He will then run $2^{17}$ times the following meet-in-the-middle attack, once for each range: For all the keys in the range, the attacker computes the first DES on the known plaintext, yielding $2^{39}$ 64-bit words, for a total size of $2^{45}$ bits. ...


2

Your Formulas are alright, but there is some additional information from the exercise/setup: The exercise states, that $F$ should be considered as a blackbox (otherwise you could use the internal stages of $F$, as poncho already suggested). However, as I understand it you can stil evaluate $F$ on any input of your choice. At this point, you can do a couple ...


1

Pure, raw DES has a key length of 56 bits, which makes it trivially vulnerable to a brute-force attack. Just try all $2^{56}$ possible keys to decrypt the message and stop when you find an English message. On average, this will happen after $2^{55}$ trial decryptions. See the Brute Force Attack section on the DES Wikipedia page for more information on how ...


1

Yes, you can, but it's insecure. DES has a different key schedule for each round to avoid linearity and meet-in-the-middle attacks. Also you reduce the strenght of your cipher since not all encryption round embed the whole key. Be aware that you need to swap left part and right part of your data material after each round otherwise it's going to be terribly ...


1

Brute force is feasible as codesinchaos points out. That said there is more to it than that. First you'll need some way to tell whether or not decryption was successful. For example, you may look for english language text upon decryption. Automating this will be essential as you don't want to manually look at every decryption to decide whether or not you ...


1

CD CD is collectively referring to the C and D Registers. Their use and operation while simultaneous is independent. C and D are concatenated together to specify PC2. Permuted Choice 2 PC2 is a selection permutation. You might notice that the first 24 bits of the selected Key are from the C Register (CD(1 to 28)) and the second 24 bits are from the D ...


1

We don't prove schemes like AES and DES secure. Instead, cryptanalysts try very hard to find attacks against the scheme. If, after much effort, no attack is found, we may with some justification consider the scheme secure. The statement that a scheme is secure usually takes the form "any adversary that breaks the scheme with this much advantage must use at ...



Only top voted, non community-wiki answers of a minimum length are eligible