# Tag Info

10

The main difference is that with two 56 bit keys the maximal security level is 112 bit, and thus an attack that has a cost of $2^{112}$ operations is no attack, whereas for three 56 bit keys the maximal security level is 168 bits, and an attack that has a cost of $2^{112}$ operations counts as an attack. This means that two-key 3DES is still a bit weaker ...

9

Within the DES block cipher itself, the XOR operation is used at two different places: On the input of S-boxes, XOR-ing 48 bits per round: 48 bits from a subkey (extracted from the 56-bit key), and 48 bits that are the output of expansion E. The 48-bit result forms the eight 6-bit inputs of the S-boxes. On the output of S-boxes, XOR-ing 32 bits per round: ...

7

Differential cryptanalysis works on differences. Linear cryptanalysis works on linearity. Neat, isn't it ? Instead of speaking of how they differ, it is easier to list their common features. Both kinds of attacks: Use a lot of known pairs plaintext/ciphertext (many input messages encrypted with the same key, and, for each of them, the attacker knows both ...

7

Main drawbacks of DES are: Small key space (56 bits). Small blocks (64 bits). Terrible performance in software, due to all the bit-juggling. Relative weaknesses with regards to linear and differential cryptanalysis. Changing any of these will imply heavy changes, not little tweaking. Doing that while maintaining or increasing security is no mere feat... ...

6

I'm not going to look up the DES key schedule such, but the connection between your two sequences $$( a_i ) = ( 1, 2, 4, 6, 8, 10, 12, 14, 15, 17, 19, 21, 23, 25, 27, 28 )$$ and $$( b_i ) = ( 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1 )$$ is obvious: $b_i = a_i - a_{i - 1}$ (with $a_0$ taken to be 0). That is, the second sequence gives the ...

5

The question has morphed over time. I am answering the following. So to be sure, with DES, only when you encrypt something twice with a weak key. You get the back the original plaintext? That is correct as that is the definition of a DES weak key, a key for which encryption and decryption have the same effect. So when using DES in OFB mode with a ...

5

From Schneier's description of DES in Chapter 12 of Applied Cryptography (12.3): “DES with any number of rounds fewer than 16 could be broken with a known-plaintext attack more efficiently than by a brute-force attack.” This explains the "Why not less than 16". As for the "why not more than 16", that is a tradeoff for speed of execution (more rounds = less ...

5

Yes, an adversary can definitely decrypt a DES message, given sufficient funding. Fifteen years ago, in 1998, the EFF built a DES cracker (nicknamed Deep Crack) that can recover a DES key in a day. Today, anyone with the money can purchase a commercially available DES cracker named COPACOBANA. For RC2, I'm not aware of any practical attacks. (You still ...

4

Using the -k option, you can specify a password. Passwords are not really encryption keys, so OpenSSL uses a key derivation process to turn the password into an encryption key. It turns out by default OpenSSL uses a salt in that derivation process (which is why you see Salted in the output). If the salt changes, the encryption key changes. If the encryption ...

4

Well, one assumption you appear to be making is that, with 2DES, there will be approximately $2^{56}$ possible key matches. Actually, there are an expected $2^{48}$ possible key matches; here's why: Let us assume we're running the meet-in-the-middle attack on 2DES, and consider an arbitrary incorrect encryption trial (that is, we try an encryption key that ...

4

In "Applied Cryptography" — Chapter 12, , Bruce Schneier writes: The final permutation is the inverse of the initial permutation and is described in Table 12.8. Note that the left and right halves are not exchanged after the last round of DES; instead the concatenated block $R$16$L$16 is used as the input to the final permutation. There’s nothing going ...

4

To answer your last question first, Triple DES does not need a longer key because it has more rounds than plain DES — rather, Triple DES needs more rounds than plain DES because it has a longer key (and because it aims to offer a security level appropriate for that key length). To be more specific, plain DES only has a 56-bit key, meaning that it can ...

3

The de-facto answer to any question about increasing the AES rounds is that as yet there doesn't appear to be any need, and any time you do so involves implementing at least some of it in custom code, which is inherently risky. As far as running AES twice goes, have a look at Meet in the Middle (MITM) attacks. I don't know how relevant these will be to your ...

3

We are talking about attacking double-DES here, which encrypts a 64-bit block $P$ with two 56-bit keys $K_1,K_2$ as $C = E_{K_2}(E_{K_1}(P))$. As noted by Diffie and Hellman already in late 70s, to attack it with a one or two plaintexts as follows. Suppose we know that $P_0$ is encrypted to $C_0$, then for all possible $K_1$ compute $E_{K_1}(P)$ (partial ...

3

In contrast to asymmetric schemes (notably RSA and El Gamal) which require some sort of computation to generate the key, the only constraint one has when selecting a key for DES or AES (or 3DES) is to make it look indistinguishible from a random stream. That said both El Gamal and RSA require some randomness in key generation, but that phase does not depend ...

3

Modes of operation are generally supposed to be independent of the underlying block cipher. They generally have a proof of security showing that the security of a system using said mode reduces to the security of the block cipher. However some modes, such as CTR, don't work well with block ciphers of short length (aka, old ciphers) and can leak information. ...

2

Adding my 2 cents, I would like to point out that many published methods for white-box cryptography have been broken. This includes… white-box AES white-box DES … which have been crypto-analyzed and are known to be insecure ever since. On the other hand, as long as you just plan to study implementation to learn about the techniques and not plan to ...

2

Yes. For DES, it looks like the composition $T_i\circ T_j^{-1}\circ T_k$ is normally not a $T_l$ with another key $l$. I do not have a proof of this fact. So DES is not a pure system, and otherwise triple-DES would not more secure than DES itself. In a comment, fgrieu linked a proof for a weaker fact, that DES is not a group (by Campbell and Wiener). ...

2

DES is based on a Feistel construction - while the one-way function used is.. well.. one-way, you don't need to reverse it at all to "decrypt" (otherwise you are correct we would have a problem). Look at this diagram, specifically the decryption one: As you can see, even though one half of the ciphertext is passed through the one-way function, there's ...

2

No, they aren't a group. Justification: We know that the subgroup generated by DES is very large. If (any of the variants of) 3DES formed a closed group, then the subgroup generated by 3DES would be no larger than $2^{168}$. We know the latter is not the case. Therefore, the former is not the case, either. Also, for the EDE variants of 3DES, it is easy ...

2

The attacker splits the range of $2^{56}$ keys for the first DES into $2^{17}$ ranges of size $2^{39}$. He will then run $2^{17}$ times the following meet-in-the-middle attack, once for each range: For all the keys in the range, the attacker computes the first DES on the known plaintext, yielding $2^{39}$ 64-bit words, for a total size of $2^{45}$ bits. ...

1

We don't prove schemes like AES and DES secure. Instead, cryptanalysts try very hard to find attacks against the scheme. If, after much effort, no attack is found, we may with some justification consider the scheme secure. The statement that a scheme is secure usually takes the form "any adversary that breaks the scheme with this much advantage must use at ...

1

Only ciphers where the key is at least as long as the message have been proven secure (such as the one time pad, or the Luby-Rackoff cipher used in a certain way). AES is conjectured to be 'computationally secure', but until someone proves that $P \neq NP$ and that there are one-way functions it is conceivable that nothing is computationally secure. The ...

1

A linear transformation in a block cipher is also considered an substitution, just not a non linear one. When they talk about active s-boxes, they are talking about not specifically about the nonlinear s-box, but a level of input being substituted with a different output. Combining these across multiple rounds results in what they call 'active' s-boxes. ...

1

A quick follow up, there is a problem with using DES in OFB mode when you are not using the full feedback register. The generated keystream will become cyclic with on average a period of the order $2^{32}$ instead of $2^{64}$. See (R.R. Jueneman, “Analysis of certain aspects of Output Feedback Mode,” Advances in Cryptology, Proceedings Crypto’82, D. ...

Only top voted, non community-wiki answers of a minimum length are eligible