# Tag Info

7

Did you try Wikipedia? DES consists of 16 rounds of the form: $$L_{i+1} = R_{i}, \quad R_{i+1} = L_i \oplus F(R_i, K_i),$$ which are identical except for the round subkeys $K_i$. (The last round is slightly different, in that the half-blocks $L$ and $R$ are not swapped as they are after all other rounds, but that makes no cryptanalytic difference.) The ...

6

Efficiently - no. However, the best attack on DES - linear cryptanalysis - works with known plaintexts, and theoretically may work slightly faster than the brute force even for small amounts of data. Computing linear relations between plaintext $P$ and ciphertext $C$, an attacker is able to enumerate all keys according to their likelihood. The PhD thesis by ...

5

Given a function $F: A \rightarrow B$ and functions $R_1, R_2, \dots, R_k:B \rightarrow A$, we can create a chain of length $k$ from a starting point $a_0$ to an end point $a_k$ using $a_i = R_i(F(a_{i-1}))$. A rainbow table for $(F, R_1, \dots, R_k, k)$ is a collection of chains with end points $(a_0, a_k)$ organized so that searching for chains ending at ...

4

You need to split up your key into eight 7 bit pieces, and put these 7 bits into a byte each. The parity is in the least significant bit on most platforms, so the 7 bits need to go into the most significant bits. Of course, as the key is probably in bytes, you need to shift and combine the values in the bytes to retrieve the 7 bits. It's possible the ...

3

No. This is known as a known-plaintext attack, and AFAIK no such attack is faster than bruteforce for DES. However, DES only uses a keyspace of $2^{56}$, so you could theoretically still bruteforce it.

3

If the plaintext format is indeed as you describe, then you're out of luck: the insertion of the newlines and the consequent shifting of the plaintext records is enough to disrupt any structure in the ciphertext. If the plaintext were longer, say, 8 records, then it could work, but with just 7 records there's no way to switch the first and last record ...

3

Each half of the key is 28 bits long, so there will be $2^{28}$ possible choices for each of them. In the first part of your attack, you start with the known block of plaintext and encrypt it for the first 8 rounds using each possible left half of the key. This gives you $2^{28}$ "half-encrypted" 64-bit blocks. This is less than the birthday bound, so ...

3

One simple approach is to truncate the output to 56 bits. I believe this was considered in Hellman's original paper on time-space tradeoffs. Sometimes people get all excited by rainbow tables (partly because it has a cool name, maybe) but forget about Hellman's original paper on the time-space attack. Hellman's paper is very much worth reading, especially ...

3

It seems to me you can do everything as when calculating a rainbow table for a hash function, except that choosing a good reduction function is very easy. For example, define a chain starting from $k$ as: $$c_k(0) = T(E_k(0))$$ $$c_k(i) = T(E_{c_k(i-1) \oplus i}(0)),$$ where $T$ truncates its input to 56 bits. Now you can create a rainbow table with $n$ ...

3

You have a ciphertext (or maybe multiple), a list of possible plaintexts, but no key. Therefore, your process would be Generate random decryption key Decrypt ciphertext with that key (base64 decode CT first) See if result appears in your list of possible plaintexts If it does, return that plaintext; otherwise goto 1 This is a basic brute force attack and ...

3

Actually, there's no known way (assuming practical amounts of computing power) to distinguish keying methods 1 and 2. You mention a "brute-force attack of complexity $O(2^{56})$ followed by a chosen plaintext attack of complexity $O(2^{57})$", there's no obvious way to frame an attack against either of the first two options in this matter; you can't do a ...

3

If we talk about key search attacks (rather than key compromise or/and side-channel attacks), the answer must be no, for the best known method is impractical. On the other hand there has been numerous successful key-recovery attacks against devices using TDES, including on some that try hard to avoid it. One example here, another there.

3

Actually, because of DESX works, the meet-in-the-middle attack can be optimized to take $2^{119}$ $DES$ (and no $DES^{-1}$ operations), and no additional storage. Here is how it works: let us assume that we have three known plaintext/ciphertext pairs $(P_1, C_1)$, $(P_2, C_2)$ and $(P_3, C_3)$. We know that: $$C_1 = K_2 \oplus DES( K, K_1 \oplus P_1 )$$ ...

2

As fgrieu already pointed out, using a OWF in the way you describe would make the key schedule not efficiently invertible (or even not invertible at all), meaning you would need more memory/chip space to store the user-input key in order to efficiently encrypt more than one block. In terms of other implications, if the key-state update function $e_n(\cdot)$ ...

2

Your Formulas are alright, but there is some additional information from the exercise/setup: The exercise states, that $F$ should be considered as a blackbox (otherwise you could use the internal stages of $F$, as poncho already suggested). However, as I understand it you can stil evaluate $F$ on any input of your choice. At this point, you can do a couple ...

2

Your problem is which part of the algorithm has to be transmitted (and you are missing an actual IV). Your encryption algorithm of using $TDEA(m)=E_{K_1}(D_{K_2}(E_{K_1}(m)))$ is fine for encrypting a single block, and it can be used in CBC. However, in CBC with a message of 4 blocks $m=(m_1,m_2,m_3,m_4)$, you calculate this: Choose random $iv$. ...

2

See the Wikipedia article on 3DES: http://en.wikipedia.org/wiki/Triple_DES#Algorithm First of all, you are only using 2 keys, so you may want to follow a hybrid technique like this: encrypted = eK1( dK2( plainText ) ) plainText = eK2( dK1( encrypted ) ) However, because I'm not familiar with the DES algorithm, I can't guarentee that this approach is even ...

2

After base64 decoding we get (hex) 5d f8 be 87 82 2b ea 5e f3 5c 23 fe 37 81 0f bd which has a size of two blocks. Of your small word-list, only marketing has so many letters that it needs two blocks: m a r k e t i n as the first, g 07 07 07 07 07 07 07 as the second (or another padding, but this is a common one), and so can correspond to this ciphertext. ...

2

According to the following link (Slide 5) and to what I studied last semester, http://www.ee.ic.ac.uk/pcheung/teaching/ee4_network_security/L02DESIDESAES.pdf During the final round (Round 16) before the inverse permutation, the left and right halves of the bits will be swapped then the inverse permutation will be applied.

2

This is known as the "key complementation" property of DES; I had thought that it actually predated Biham and Shamir's work. In any case, your questions: Does this hold for only that particular combination of s box or it will be same for any S-box combination It'd remain even if you change the sbox's arbitrarily. The reason for this is that it is not ...

2

Put another way, you can say that the key is whatever information the recipient possesses which allows him to decrypt the message, and which must be kept secret from everybody else. Thus, "algorithm" and "key" are not mutually exclusive: if knowledge of the algorithm allows one to decrypt a message, then the algorithm is the key.

2

Picking up what has been said in the comments: to simplify: symmetric ciphers are like mathematical operations with 2 operands and 1 result. There is The plaintext message $m$ and $k$ as the key and they result in the ciphertext $c$. In your example, the algorithm can be cut down to a addition and modulo: $c = (m + k) \mod k_{max}$ And of course there is ...

2

There are a couple of things going on: First of all, the DES key FF FF FF FF FF FF FF FF happens to be a "DES weak key"; by that, we mean that if you send a block through the cipher twice, it'll end up with the original value; that is: $$X = DES_{weak}( DES_{weak} ( X ))$$ You are obviously encrypting in CBC mode with a zero IV. So, let us look at what ...

2

It is not practically possible. There are several attacks that are slightly faster than bruteforcing $2^{112}$ key candidates, but this is only a small factor. In some sense, they are bruteforce-like, since they require $2^{113}$ smaller steps.

2

Yes, it would be more secure if they were used correctly. But as it would require a substantially different algorithm, you really would not be talking about DES anymore. Brute forcing usually scales exponentially with the size of the key. However, if the algorithm is substantially altered then it is required to analyze the algorithm again. Note that AES is ...

2

The key space for DES is far too small (56 bits). Therefore, any use of DES is not secure. It doesn't matter what mode you use. If the attacker has one plaintext, ciphertext pair, they can brute force the key space and recover the key in a feasible amount of time (24 hours using the cloud). But most importantly, how it could be made secure? Will change ...

2

That's an optimization for the attack. It would work without it, but slower. To do a Meet-in-the-middle attack, we need to encrypt a known plaintext with every possible key and save the resulting text (with the used key) in a list. Now we decrypt a known ciphertext with every possible key and look if we got the resulting text in our list. We want to know ...

1

I think this would effectively make your cipher a single round. Key mixing is usually an XOR operation of the round key on the current state. XORing all of the round keys at once is effectively only xoring a single key. If you have an $n\times n$ bit s-box $s(x)$ (e.g. Rijndael's sbox), then $s(s(x))$ is just another sbox which can be expressed as a lookup ...

1

Here is what I suspect is going on: The all-zero key in DES is a weak key; it has the property that encrypting a block twice will result in the original block; that is: $E_0(E_0(M)) = M$ for all blocks $M$. In PCBC, we encrypt a block $P_i$ by taking the previous plaintext blocks $P_{i-1}$ and the previous ciphertext block $C_{i-1}$, and computing the next ...

1

I think I got it: I'm going to show that after round i the result will be $\overline{L_i}$ and $\overline{R_i}$ when the input was $\overline{L_{i-1}}$ and $\overline{R_{i-1}}$ and using $\overline k$ as key. $L_i=R_{i-1} \implies \overline{L_i} = \overline{R_{i-1}}$ \$\overline{R_i} = \overline{L_{i-1}} \oplus f(\overline{R_{i-1}}, \overline{k_i}) = ...

Only top voted, non community-wiki answers of a minimum length are eligible