Skip to main content
Fix typo. Ossifrages do not make typos. Ossifrages are embarrassed.
Source Link
Squeamish Ossifrage
  • 49.5k
  • 3
  • 118
  • 227
  1. Are dual ciphers just as secure? Yes.

    The definition is:

    Two ciphers $E$ and $E'$ are called dual ciphers if they are isomorphic, i.e., if there exist invertible transformations $f(\cdot)$, $g(\cdot)$, $h(\cdot)$ such that $$\forall P, K \quad f(E_K(P)) = E'_{g(K)}(h(P)).$$

    Note that $f$, $g$, and $h$ are independent of the key and plaintext. If you had a random algorithm $\mathcal A(F)$ that can distinguish $P \mapsto E_K(P)$ from $P \mapsto U$ for uniform random $K$ and $U$ with some probability $p$, then the algorithm $\mathcal A'(F) = \mathcal A(P \mapsto f^{-1}(F(P)))$ distinguishes $P \mapsto f(E_K(P))$ from $P \mapsto U$ for uniform random $K$ and $U$ iwthwith the same probability $p$ and negligible additional cost, to evaluate $f^{-1}$.

  2. The ciphers $E = \operatorname{AES}$ and $E' = \operatorname{AES}$ are trivially self-dual with $f(C) = C$, $g(K) = K$, and $h(P) = P$ for all $C, K, P$. Proof is left as an exercise for the reader. (Hint: It's trivial.)

  3. Using a different representation for $\operatorname{GF}(2^8)$ in each round wouldn't substantively change the cipher. The algebraic structure would remain identical, but you would have a different S-box in each round.

    This would probably only make the crypto more expensive for the legitimate users without imposing any real hurdles on attackers—in fact, it would likely make the attacker's job easier by making implementations more likely to be vulnerable to timing side channel attacks.

  4. Now you need to define a pseudorandom generator of irreducible degree-8 polynomials over $\mathbb Z/2\mathbb Z$, and somehow make it independent of everything else in the cipher that uses the same key. If you're lucky, that might make it harder to attack, at high cost to a cipher that's already painfully slow in software—and probably even make it significantly costlier in hardware.

    However, your job, as an aspiring cryptographer, is not to flail around proposing tweaks that might turn out to add security if you're lucky. Your job is to demonstrate that the changes thwart all existing techniques for cryptanalysis more thoroughly than the simpler approach taken by AES.

    Consider starting with smaller, simpler tweaks to AES. There's an entire book on the design and implementation of Rijndael by the authors, in addition to stacks of literature. What small tweaks to the design space documented in it can you break or prove resistant to existing cryptanalysis techniques?

    As poncho noted in a comment, the easiest way to make AES stronger is to add more rounds. If your tweak expands the security margin, is its expansion of the security margin greater than that of just adding more rounds? Is it cheaper than just adding more rounds?

  1. Are dual ciphers just as secure? Yes.

    The definition is:

    Two ciphers $E$ and $E'$ are called dual ciphers if they are isomorphic, i.e., if there exist invertible transformations $f(\cdot)$, $g(\cdot)$, $h(\cdot)$ such that $$\forall P, K \quad f(E_K(P)) = E'_{g(K)}(h(P)).$$

    Note that $f$, $g$, and $h$ are independent of the key and plaintext. If you had a random algorithm $\mathcal A(F)$ that can distinguish $P \mapsto E_K(P)$ from $P \mapsto U$ for uniform random $K$ and $U$ with some probability $p$, then the algorithm $\mathcal A'(F) = \mathcal A(P \mapsto f^{-1}(F(P)))$ distinguishes $P \mapsto f(E_K(P))$ from $P \mapsto U$ for uniform random $K$ and $U$ iwth the same probability $p$ and negligible additional cost, to evaluate $f^{-1}$.

  2. The ciphers $E = \operatorname{AES}$ and $E' = \operatorname{AES}$ are trivially self-dual with $f(C) = C$, $g(K) = K$, and $h(P) = P$ for all $C, K, P$. Proof is left as an exercise for the reader. (Hint: It's trivial.)

  3. Using a different representation for $\operatorname{GF}(2^8)$ in each round wouldn't substantively change the cipher. The algebraic structure would remain identical, but you would have a different S-box in each round.

    This would probably only make the crypto more expensive for the legitimate users without imposing any real hurdles on attackers—in fact, it would likely make the attacker's job easier by making implementations more likely to be vulnerable to timing side channel attacks.

  4. Now you need to define a pseudorandom generator of irreducible degree-8 polynomials over $\mathbb Z/2\mathbb Z$, and somehow make it independent of everything else in the cipher that uses the same key. If you're lucky, that might make it harder to attack, at high cost to a cipher that's already painfully slow in software—and probably even make it significantly costlier in hardware.

    However, your job, as an aspiring cryptographer, is not to flail around proposing tweaks that might turn out to add security if you're lucky. Your job is to demonstrate that the changes thwart all existing techniques for cryptanalysis more thoroughly than the simpler approach taken by AES.

    Consider starting with smaller, simpler tweaks to AES. There's an entire book on the design and implementation of Rijndael by the authors, in addition to stacks of literature. What small tweaks to the design space documented in it can you break or prove resistant to existing cryptanalysis techniques?

    As poncho noted in a comment, the easiest way to make AES stronger is to add more rounds. If your tweak expands the security margin, is its expansion of the security margin greater than that of just adding more rounds? Is it cheaper than just adding more rounds?

  1. Are dual ciphers just as secure? Yes.

    The definition is:

    Two ciphers $E$ and $E'$ are called dual ciphers if they are isomorphic, i.e., if there exist invertible transformations $f(\cdot)$, $g(\cdot)$, $h(\cdot)$ such that $$\forall P, K \quad f(E_K(P)) = E'_{g(K)}(h(P)).$$

    Note that $f$, $g$, and $h$ are independent of the key and plaintext. If you had a random algorithm $\mathcal A(F)$ that can distinguish $P \mapsto E_K(P)$ from $P \mapsto U$ for uniform random $K$ and $U$ with some probability $p$, then the algorithm $\mathcal A'(F) = \mathcal A(P \mapsto f^{-1}(F(P)))$ distinguishes $P \mapsto f(E_K(P))$ from $P \mapsto U$ for uniform random $K$ and $U$ with the same probability $p$ and negligible additional cost, to evaluate $f^{-1}$.

  2. The ciphers $E = \operatorname{AES}$ and $E' = \operatorname{AES}$ are trivially self-dual with $f(C) = C$, $g(K) = K$, and $h(P) = P$ for all $C, K, P$. Proof is left as an exercise for the reader. (Hint: It's trivial.)

  3. Using a different representation for $\operatorname{GF}(2^8)$ in each round wouldn't substantively change the cipher. The algebraic structure would remain identical, but you would have a different S-box in each round.

    This would probably only make the crypto more expensive for the legitimate users without imposing any real hurdles on attackers—in fact, it would likely make the attacker's job easier by making implementations more likely to be vulnerable to timing side channel attacks.

  4. Now you need to define a pseudorandom generator of irreducible degree-8 polynomials over $\mathbb Z/2\mathbb Z$, and somehow make it independent of everything else in the cipher that uses the same key. If you're lucky, that might make it harder to attack, at high cost to a cipher that's already painfully slow in software—and probably even make it significantly costlier in hardware.

    However, your job, as an aspiring cryptographer, is not to flail around proposing tweaks that might turn out to add security if you're lucky. Your job is to demonstrate that the changes thwart all existing techniques for cryptanalysis more thoroughly than the simpler approach taken by AES.

    Consider starting with smaller, simpler tweaks to AES. There's an entire book on the design and implementation of Rijndael by the authors, in addition to stacks of literature. What small tweaks to the design space documented in it can you break or prove resistant to existing cryptanalysis techniques?

    As poncho noted in a comment, the easiest way to make AES stronger is to add more rounds. If your tweak expands the security margin, is its expansion of the security margin greater than that of just adding more rounds? Is it cheaper than just adding more rounds?

Bounty Ended with 50 reputation awarded by Red Book 1
Source Link
Squeamish Ossifrage
  • 49.5k
  • 3
  • 118
  • 227

  1. Are dual ciphers just as secure? Yes.

    The definition is:

    Two ciphers $E$ and $E'$ are called dual ciphers if they are isomorphic, i.e., if there exist invertible transformations $f(\cdot)$, $g(\cdot)$, $h(\cdot)$ such that $$\forall P, K \quad f(E_K(P)) = E'_{g(K)}(h(P)).$$

    Note that $f$, $g$, and $h$ are independent of the key and plaintext. If you had a random algorithm $\mathcal A(F)$ that can distinguish $P \mapsto E_K(P)$ from $P \mapsto U$ for uniform random $K$ and $U$ with some probability $p$, then the algorithm $\mathcal A'(F) = \mathcal A(P \mapsto f^{-1}(F(P)))$ distinguishes $P \mapsto f(E_K(P))$ from $P \mapsto U$ for uniform random $K$ and $U$ iwth the same probability $p$ and negligible additional cost, to evaluate $f^{-1}$.

  2. The ciphers $E = \operatorname{AES}$ and $E' = \operatorname{AES}$ are trivially self-dual with $f(C) = C$, $g(K) = K$, and $h(P) = P$ for all $C, K, P$. Proof is left as an exercise for the reader. (Hint: It's trivial.)

  3. Using a different representation for $\operatorname{GF}(2^8)$ in each round wouldn't substantively change the cipher. The algebraic structure would remain identical, but you would have a different S-box in each round.

    This would probably only make the crypto more expensive for the legitimate users without imposing any real hurdles on attackers—in fact, it would likely make the attacker's job easier by making implementations more likely to be vulnerable to timing side channel attacks.

  4. Now you need to define a pseudorandom generator of irreducible degree-8 polynomials over $\mathbb Z/2\mathbb Z$, and somehow make it independent of everything else in the cipher that uses the same key. If you're lucky, that might make it harder to attack, at high cost to a cipher that's already painfully slow in software—and probably even make it significantly costlier in hardware.

    However, your job, as an aspiring cryptographer, is not to flail around proposing tweaks that might turn out to add security if you're lucky. Your job is to demonstrate that the changes thwart all existing techniques for cryptanalysis more thoroughly than the simpler approach taken by AES.

    Consider starting with smaller, simpler tweaks to AES. There's an entire book on the design and implementation of Rijndael by the authors, in addition to stacks of literature. What small tweaks to the design space documented in it can you break or prove resistant to existing cryptanalysis techniques?

    As poncho noted in a comment, the easiest way to make AES stronger is to add more rounds. If your tweak expands the security margin, is its expansion of the security margin greater than that of just adding more rounds? Is it cheaper than just adding more rounds?