2
$\begingroup$

Consider a simple ARX block cipher in which after each block is encrypted, the key is rotated and/or XORed by some variable value. Would this make the key any more secure, or just be a waste of time? Could it somehow make the key less secure?

For example, if the key is 0101 and after a block is encrypted the key is rotated left by the last 2 bits (in this case 01). So the key for the next block encrypted will be 1010.
Alternatively, the latter 2 bits are used to seed a pseudo-random number generator, and the key is XORed with the result.

Sorry if this is a dumb question, I am very new to cryptography as a whole, and this question came to mind while going over some resources for a course I will be taking this fall.

$\endgroup$
1
  • 1
    $\begingroup$ you usually have a LFSR generate some bits that modify the key. look at Feistel ciphers and then look at SIMON for a simple example $\endgroup$
    – b degnan
    Commented Jul 21, 2017 at 2:11

1 Answer 1

4
+50
$\begingroup$

Consider a simple ARX block cipher in which after each block is encrypted, the key is rotated and/or XORed by some variable value

It sounds like you are asking "What if we apply a key schedule at the mode of operation level?"

If the cipher is strong, then there should be no need to modify the key between invocations of the encryption function; The fact that the cipher is strong implies the adversary cannot obtain the key from plaintext-ciphertext pairs, so "more security" is not obtained by modifying the key in any deterministic way.

Could it somehow make the key less secure?

Yes, absolutely: Assume that your publicly-known deterministic key evolution function simply outputs all $0$, regardless of input; We might say that this is a pathological example, but it's really just an extreme case of "how biased is your function" - your function could produce outputs that are more easily guessed than the input to your function.

For example, if the key is 0101 and after a block is encrypted the key is rotated left by the last 2 bits (in this case 01). So the key for the next block encrypted will be 1010.

With this specific example, you stand to leak key bits by side channel information: The secret data dependent rotations can leak information about the operands to external observers. If an adversary can somehow cause the encryption method to be invoked at will, and they can observe timing information, then they can potentially use this to recover bits of the key.

Basically, more is not necessarily better when it comes to cryptography: You want to do exactly only what is required to accomplish the goal, and no more; Excess operations simply create more attack surfaces.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.