# Tag Info

6

DES with 2 rounds is broken. It is trivial to find a way to get the key with much less work than for the full DES (and even that is broken). DES is a Feistel cipher, so we have two halves, the left and the right half. For every round, we do something with the one half and a subkey, and then XOR it with the other half. After that we switch both halves, ...

4

A family of functions F is a pairwise independent permutation if: Each member of the family is itself a permutation, and For any fixed $A$, $B$ (with $A \ne B$, and both from the input set of the permutation), and $f$ is a random member from the family $F$, then the pair $f(A), f(B)$ is equidistributed over all distinct pairs from the output range of the ...

4

In the substitution step of a typical Substitution-Permutation Network (e.g. in AES SubBytes), the whole state is broken in parts and each part substituted. That's not the case in (the core of) a Feistel cipher, where at each step/round some sizable part of the state is bound to remain unchanged (in order that each step be reversible).

3

The text quoted in the question: States that in any (finite commutative) field $(A,+,\cdot)$, the distribution of the permutations $f_{(a,b)}$ defined by $f_{(a,b)}(x)=a\cdot x+b$, where $(a,b)$ is uniformly distributed on $A^*\times A$, is pair-wise independent, per the definition now given in the question. Observes that because $GF(2^n)$ is such a field, ...

3

Yes, it can; within the DES round function, two different 'right side' inputs can, after the sboxes, come up with the same value to xor into the 'left side'. This was a deliberate decision by the DES designers, who thought that this was an important property. I don't know their reasoning about why they thought it was important.

3

Yes. This is called format-preserving encryption. The most flexible algorithm is FFX, which uses a Feistel network with AES-based round-functions, but performs addition modulo $m$. For certain values of $m$, the range of the round function is extended in order to limit statistical biases to negligible values. When $m$ is very small, this approach isn't ...

2

I understand that if a block cipher has $k$-bit keys and $n$-bit input/output blocks, then if $k>n$, we can expect one message-ciphertext pair to narrow us down (I think?) to $2^{k−n}$ possible keys, right? That is approximately correct (if the block cipher with the wrong key acts like a random permutation; this is generally a safe assumption); if ...

2

Feistel networks were broken in DES but not triple DES. Some final AES candidates not approved also used Feistel networks $2^{36}$ plain text attacks. Reduction of $2^{16}$ possible keys for single DES: $4^{48/6} = 4^{8} = 2^{16}$. First for a one round Feistel network: $R_0$ and $f (R_O, k_1) = R_1 \oplus L_0$, $k_1$ becomes known. For two round Fiestel: ...

2

I know that all the subkeys $k_i$ are derived from the main key $K$, but how? However the cipher designer feel like. The Feistel design gives guidance as to how the block is processed (and in a way to make inverting the cipher easy), however it gives no guidance as to actually generate the subkeys. The designers can do anything they like, and still ...

1

First of all, you don't include a key; I'll assume that the sbox is the key. However, even with that assumption, it still doesn't meet the general expected requirements for a block cipher. In the decrypt direction, any one byte of the decrypted result depends only on 16 (!) bytes of the ciphertext block. This can be seen by considering the inverse of the ...

1

You run the algorithm with two different plaintexts (whose difference is usually small, just a few bits, everything else being equal). Whereever these plaintexts lead to different inputs to an S-box (in any layer/round of the algorithm), we call this S-Box active (since the other S-boxes produce the same result for both plaintexts, they are called "passive" ...

1

Xor can help find bits not yet known, whether most significant or least significant; and help the adversary find more information about both ciphertext and plaintext, especially if a table of potential plain texts or even keys is stored in conjunction with bitwise Xor. Some reading: ...

1

You're missing a component : a padding convention. Yes, if you're trying to reduce a block size, it will reduce the cipher strength. That's why the less-sized blocks are padded/filled to fit the exact size. What to do : pad or fill or both - that is a question. First you need to understand, that the more predictible the message, the less secure the ...

1

What happens with the output of the round function and the previous half block? Nearly every Feistel networks XOR them. What happens if you XOR any block with an all "0" block? You get the previous block. Example in binary notation with 8-bit blocks: $$\text{0100 1100} \oplus \text{0000 0000} = \text{0100 1100}$$ So even with a million rounds the output ...

1

If each round function outputs all $0$'s then if $r$ is an even number you get back original string. If $r$ is an odd number you just swap the $(L_0, R_0)$ components of the input. XOR basically has no effect on the string. Just follow the proof given in this answer Luby-Rackoff theorem confusion

Only top voted, non community-wiki answers of a minimum length are eligible