Tag Info

Hot answers tagged

6

DES with 2 rounds is broken. It is trivial to find a way to get the key with much less work than for the full DES (and even that is broken). DES is a Feistel cipher, so we have two halves, the left and the right half. For every round, we do something with the one half and a subkey, and then XOR it with the other half. After that we switch both halves, ...


4

In the substitution step of a typical Substitution-Permutation Network (e.g. in AES SubBytes), the whole state is broken in parts and each part substituted. That's not the case in (the core of) a Feistel cipher, where at each step/round some sizable part of the state is bound to remain unchanged (in order that each step be reversible).


3

I know that all the subkeys $k_i$ are derived from the main key $K$, but how? However the cipher designer feel like. The Feistel design gives guidance as to how the block is processed (and in a way to make inverting the cipher easy), however it gives no guidance as to actually generate the subkeys. The designers can do anything they like, and still ...


3

You run the algorithm with two different plaintexts (whose difference is usually small – just a few bits, everything else being equal). Wherever these plaintexts lead to different inputs to an S-box (in any layer/round of the algorithm), we call this S-Box “active” (since the other S-boxes produce the same result for both plaintexts, they are called ...


3

Yes, it can; within the DES round function, two different 'right side' inputs can, after the sboxes, come up with the same value to xor into the 'left side'. This was a deliberate decision by the DES designers, who thought that this was an important property. I don't know their reasoning about why they thought it was important.


2

I understand that if a block cipher has $k$-bit keys and $n$-bit input/output blocks, then if $k>n$, we can expect one message-ciphertext pair to narrow us down (I think?) to $2^{k−n}$ possible keys, right? That is approximately correct (if the block cipher with the wrong key acts like a random permutation; this is generally a safe assumption); if ...


2

Feistel networks were broken in DES but not triple DES. Some final AES candidates not approved also used Feistel networks $2^{36}$ plain text attacks. Reduction of $2^{16}$ possible keys for single DES: $4^{48/6} = 4^{8} = 2^{16}$. First for a one round Feistel network: $R_0$ and $f (R_O, k_1) = R_1 \oplus L_0$, $k_1$ becomes known. For two round Fiestel: ...


1

First of all, you don't include a key; I'll assume that the sbox is the key. However, even with that assumption, it still doesn't meet the general expected requirements for a block cipher. In the decrypt direction, any one byte of the decrypted result depends only on 16 (!) bytes of the ciphertext block. This can be seen by considering the inverse of the ...


1

We really only need one plaintext-ciphertext pair, but the second can be used as a way to check candidate keys. Make a guess to the final subkey (ie guess all of them). Decrypt the final round of your ciphertext using your key. Store this result and the subkey you used. Repeat for all 2^16 candidates for the final subkey. Make a guess for the first three ...


1

why it should strictly be bijective instead of injective or surjective? Actually, it is injective and it is surjective; the term bijective just means that it satisfies both the properties of injectivity and surjectivity. Injective does not mean that there is a 'skip' (that's "not surjective"); instead, it states that no two different inputs give the ...


1

Xor can help find bits not yet known, whether most significant or least significant; and help the adversary find more information about both ciphertext and plaintext, especially if a table of potential plain texts or even keys is stored in conjunction with bitwise Xor. Some reading: ...


1

You're missing a component : a padding convention. Yes, if you're trying to reduce a block size, it will reduce the cipher strength. That's why the less-sized blocks are padded/filled to fit the exact size. What to do : pad or fill or both - that is a question. First you need to understand, that the more predictible the message, the less secure the ...


1

What happens with the output of the round function and the previous half block? Nearly every Feistel networks XOR them. What happens if you XOR any block with an all "0" block? You get the previous block. Example in binary notation with 8-bit blocks: $$ \text{0100 1100} \oplus \text{0000 0000} = \text{0100 1100}$$ So even with a million rounds the output ...


1

If each round function outputs all $0$'s then if $r$ is an even number you get back original string. If $r$ is an odd number you just swap the $(L_0, R_0)$ components of the input. XOR basically has no effect on the string. Just follow the proof given in this answer Luby-Rackoff theorem confusion



Only top voted, non community-wiki answers of a minimum length are eligible