0
$\begingroup$

As an 17-year old highschool student with some interests into cryptography I developed following block cipher:

Let $H$ be an irreversible hash function with the block length $L$, which also is the block and key length. (I used SHA-256 for my example implementation below).

$O$ is the original key while $K$ is the expanded (and mutated) key.

First, the key is expanded to the length of the plain text $P$ using following scheme:

$K_0=H(O)$

$K_n=H(H(K_0,n) \oplus O)$ ($K_0,n$ should be the n'th byte of $K_0$)

Next, the ciphertext $C$ is set to $P$ and following modification of the feistel round is being run 64 times, please note that $C_0$ are the first 64 bits of an block, $C_1$ the second 64 bit, etc.

$C_2 = C_2 \oplus ((C_3 \oplus K_3) \lll 41)$

$C_1 = C_1 \oplus ((C_2 \oplus K_2) \lll 29)$

$C_0 = C_0 \oplus ((C_1 \oplus K_1) \lll 13)$

$C_3 = C_3 \oplus ((C_0 \oplus K_0) \lll 5)$

After each round, the key mutates by $K_n = H(K_n \oplus O)$, this key mutation is not shown in the graph below.

Graph without key mutation

To decrypt, you'll just have to calculate the round keys and apply the rules above in reversed order. Functional java code can be found here.

Sadly, I'm not able to perform an any "modern" cryptoanalysis due to lack of mathematical knowledge, but here are some thoughts on my cipher:

  • You shouldn't be able to get $O$ unless you are able to break $H$.

  • Since key expansion and mutation make use of $O$, you shouldn't be able to predict another round key given you already have one and don't know $O$.

  • An attack vector could be predicting $H$ outcome even without knowing it's input.

I hope you have more idea's when it comes to attacking this algorithm and / or are able to perform known cryptoanalysis.

Thanks in advance

// Edit: Updated algorithm and added graph

Improve this question
$\endgroup$
9
  • 3
    $\begingroup$ Convince yourself that each round is such that any output bit is the XOR of some public fixed input and key bits. Extend that to the block cipher. Show how you obtain the plaintext for any desired ciphertext from the ciphertext for 256 well-chosen plaintexts. Remark: non-linearity is a must in any block cipher. $\endgroup$
    – fgrieu ♦
    May 21, 2017 at 20:37
  • $\begingroup$ Send two plaintext through whose ^ == 0x1, now ^ the the two cipher texts. Do this again with two different plaintext whose ^ == 0x1. You will see that the cipher texts have the same ^ as the first set. This idea is called 'differential cryptanalysis' and is powerful against many block ciphers. Start your study with Biham's great book cs.bilkent.edu.tr/~selcuk/teaching/cs519/Biham-DC.pdf $\endgroup$
    – Matthew Fisher
    May 22, 2017 at 5:02
  • $\begingroup$ The cipher has ver bad diffusion, if i change one bit in plaintext, at max i will get 4 bits changed, rest all bits of ciphertext will be similar. This helps us in applying differential CA. Since cipher consists of a very simple operation i.e Xor the round key and circular shift, Interpolation attack can also be applied which needs a few plaintext-ciphertext pairs to find round keys. see here for interpolation attack. en.wikipedia.org/wiki/Interpolation_attack $\endgroup$
    – crypt
    May 22, 2017 at 7:40
  • $\begingroup$ @Raza But since the round function is run 64 times and the sub-block are circular shifted with a period lenght of 31, one bit can change up to 31 * 4 = 124 bits. Also, you shouldn't be able to do a full key recovery since K is build upon hashing O, which doesn't makes the encryption stronger unless longer messages than the attacked ones are sent. $\endgroup$
    – VincBreaker
    May 22, 2017 at 10:39
  • $\begingroup$ you mean have have 64 rounds, and in each round you are processing the block 3 times with k0,k1,k2? it will be nice if you can draw a diagram of the cipher in terms of Feistel Cipher with F function. $\endgroup$
    – crypt
    May 22, 2017 at 10:59

1 Answer 1

Reset to default
4
$\begingroup$

As pointed out in the comments, your encryption process is linear (mod 2). So this cipher is very weak, all you need is linear algebra.

See, for example, the question answered here

Improve this answer
$\endgroup$
2
  • $\begingroup$ @Raza FYI: your edit to this answer didn't really make sense so I reverted your edit. (You only added a single line going [2]: https://i.stack.imgur.com/nsx0z.png, but didn't embed the image or anything and the comment to your edit describing what you edited and why merely says Removed the figure which makes even less sense.) $\endgroup$
    – e-sushi
    May 22, 2017 at 18:38
  • $\begingroup$ the answer was edited by a mistake, i have made a comment about it to the questioner about my understanding of the cipher ibb.co/g2tZna $\endgroup$
    – crypt
    May 22, 2017 at 19:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.