How do I check if the output of my CFB TEA encryption algorithm is correct?

Question

I have an assignment question regarding the TEA cipher in CFB mode. After much difficulty and research, I managed to produce an 8-bit TEA / CFB encryption algorithm. My input is supposed to be a number in string format; for example; "12345678".

This is the result of the encryption

However, i do not have any way to check if the encrypted message is indeed correct.

I do understand a way to find out if it is correct is by programming a CFB mode decryption. Unfortunately, THE decryption of the ciphertext I generated is different from the initial plaintext.

Hence, I'm a little confused on whether is it my encryption that is incorrect or is my decryption that is incorrect.

Is there any way to verify if the encrypted message output is correct? Or is the CFB mode decryption method the only way to verify?

Answer 1

No, there are of course other methods of verifying your implementation.

Note that there are a few separate steps that can be distinguished:

1. the TEA block cipher;
2. the CFB mode (using the right number of bits to forward);
3. The encoding of the message and ciphertext.

First, test your block cipher (without CFB mode of operation) against any available test vectors. There seem to be a few available.

Second, test your CFB mode of encryption with a well known block cipher, e.g. DES, Triple-DES or blowfish (all come with 64 bit block size, just like TEA). You will need to establish key, IV and number of bits that are forwarded within CFB mode encryption (CFB-8 or CFB-64?).

Thirdly, test your encoding / decoding. You should treat the output of TEA as binary, not as text. For the input message you need a well described, canonical way of creating a message using numbers. Of course this encoding / decoding must be reversible. The codec should be tested separately first.

Finally, try and see if the combination of all three works as expected. If you cannot find text vectors directly then try and use a different implementation (and test that against text vectors first).

---

You could also use a third party implementation to create intermediate values, so you can verify the correctness of your implementation.

Here's a test vector created using Bouncy Castle (Java, v1.57) and, of course, hexadecimals to represent the bytes:

TEA in CFB-8 mode
K : 2c1003d83c3c3707a92a10f45a3bd72f
IV: 681574192889be9d
M : 3132333435363738
C : d2751754c6699453

This is the kind of representation you need to test. Note that the input message M consists of the ASCII encoding of the string "12345678". The 128 bit key and full 64 bit IV have been randomized.

Answer 2

I would recommend modularizing the implementation into these components:

1. A generic interface abstracting the concept of a block cipher.
2. A generic CFB mode implementation, that instead of hardcoding calls to the block cipher implementation does it indirectly through #1.
3. An implementation of the TEA block cipher that instantiates the interface in #1.
4. A dummy "identity" block cipher that instantiates #1 as well but instead of actually encrypting anything, just outputs the exact same inputs as provided.

Your testing strategy would then be to test:

• Your TEA block cipher implementation on its own.
• Your CFB implementation, but instantiated with the identity block cipher instead of TEA.

To verify your TEA implementation you really need to get some test vectors from some other implementation, like Maarten has provided. There's no shortcuts to this.

To construct a set of test cases for CFB on the identity cipher, we start with the equations for CFB mode:

$$ \begin{align} C_0 & = IV \\ C_1 &= E_k(C_0) \oplus P_1 \\ & \vdots \\ C_i &= E_k(C_{i-1}) \oplus P_i \\ \end{align} $$

And now we observe that since we're using an identity cipher, $E_k(m) = m$ for all $m$, therefore we can simplify these equations to:

$$ \begin{align} C_0 & = IV \\ C_1 &= C_0 \oplus P_1 \\ & \vdots \\ C_i &= C_{i-1} \oplus P_i \\ \end{align} $$

...and these conditions are easy to test for—you just write some example plaintexts, encrypt them with the dummy cipher, and check that each ciphertext block is the XOR of the corresponding plaintext block and previous ciphertext block. Basically, the identity block cipher trick allows you to test your CFB implementation's logic on its own without having to factor in what TEA does.