I heard that DES is technically “broken” because of attacks involving large amounts of known plaintext. These attacks are obviously academic and highly complicated, so for some intuition I was hoping that somebody could explain (for example) how much plaintext is required to determine the key in a generic/simple Feistel scheme with mangler function very simply linear in the key and so on?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
Feistel networks were broken in DES but not triple DES. Some final AES candidates not approved also used Feistel networks $2^{36}$ plain text attacks. Reduction of $2^{16}$ possible keys for single DES: $4^{48/6} = 4^{8} = 2^{16}$.
First for a one round Feistel network: $R_0$ and $f (R_O, k_1) = R_1 \oplus L_0$, $k_1$ becomes known.
For two round Fiestel: Use the same method twice: $$(R_0, f(R_0,l_1)=L_2 \oplus L_0) \ (L_2,f(L_2,K_2)= R_2 \oplus R_0)$$
A nice reference would be CryptoLecture 04 (PDF) from Daniel Boneh's crypto course on Coursera.
-
$\begingroup$ Two good references icg.isy.liu.se/courses/tsit03/forelasningar/cryptolecture04.pdf Daniel Boneh's crypto course on Coursera – $\endgroup$ Commented Dec 25, 2014 at 18:07