1
$\begingroup$

I'm looking for a symmetric encryption algorithm with specific characteristic. Having a key $k$ a message $m$ returns a ciphertext $c$, where $E_{k}[m] \rightarrow c$

  1. It should be hard to perform a KPA. I believe the diffusion concept makes it hard to perform such an attack?

  2. Yet I require that $k + x \rightarrow e$, $E_{e}[m] \rightarrow (c + x)$ where $+$ can be the sum operator in a finite field. I believe this will require to avoid the confusion concept?

Edit: From $E_{e}[m]$ I should be able to recover $c = E_{e}[m] - x$, or some other possible operation that can revert x.

Is there any algorithm with those characteristics? I do believe that a hash function can work for my use-case.

Improve this question
$\endgroup$
6
  • $\begingroup$ Out of curiosity: What goal are you actually trying to achieve? What do you want this kind of construction for? $\endgroup$
    – Ella Rose
    Commented Feb 14, 2019 at 20:58
  • $\begingroup$ If $E_{k + x}(m) = E_k(m) + x$, then $E_k(m) = E_0(m) + k$ for some fixed permutation $E_0(m) = \pi(m)$ independent of $k$. If an adversary knows $m$ (known-plaintext attack), then they can immediately recover $k$ from $c = E_k(m) = \pi(m) + k$ by computing $c - \pi(m)$. Thus, your requirements are contradictory: the homomorphism property of (2) implies KPA is trivial, contradicting (1). $\endgroup$
    – Squeamish Ossifrage
    Commented Feb 14, 2019 at 21:04
  • $\begingroup$ @SqueamishOssifrage That reads like an answer! $\endgroup$
    – Ella Rose
    Commented Feb 14, 2019 at 21:04
  • $\begingroup$ @SqueamishOssifrage Yes, almost like an answer, but I'm open to alternatives "other possible operation that can revert $x$". Maybe I should re-formulate to something like $c=E_{k+x}[m] \oplus f(x)$, in order to recover $c$ by knowing the result and $x$. $\endgroup$
    – shumy
    Commented Feb 15, 2019 at 10:01
  • $\begingroup$ If you might instead allow manipulation of the ciphertext to carry into the plaintext, then you might want homomorphic encryption $\endgroup$
    – Natanael
    Commented Feb 15, 2019 at 14:20

1 Answer 1

Reset to default
3
$\begingroup$

It should be hard to perform a KPA. I believe the diffusion concept makes it hard to perform such an attack?

Assuming the context of traditional symmetric encryption: confusion (combined with diffusion) is what makes this hard.

For simplicity, suppose we have a 4-bit message. Suppose the equations for each bit of ciphertext are: \begin{align} c_0 &= m_0 \oplus m_1 \oplus k_0\\ c_1 &= m_1 \oplus m_2 \oplus k_1\\ c_2 &= m_2 \oplus m_3 \oplus k_2\\ c_3 &= m_3 \oplus m_0 \oplus m_1 \oplus k_3 \end{align}

Recovering the bits $k_i$ is trivial when you know $m$:

\begin{align} k_0 &= c_0 \oplus m_0 \oplus m_1\\ k_1 &= c_1 \oplus m_1 \oplus m_2\\ k_2 &= c_2 \oplus m_2 \oplus m_3\\ k_3 &= c_3 \oplus m_3 \oplus m_0 \oplus m_1 \end{align}

Diffusion by itself is not generically sufficient to protect against known-plaintext attacks.

Yet I require that $k+x→e, E_e[m]→(c+x)$ where $+$ can be the sum operator in a finite field. I believe this will require to avoid the confusion concept?

This would no longer the realm of traditional symmetric encryption.

You'll be looking for some kind of homomorphic encryption. There might be some kind of lattice-based construction that offers this feature. If I recall correctly, Ajtai's hash function offers some kind of "key homomorphism", but I'm not sure that it works the way that you require.

I can't provide a more precise suggestion of a scheme. Maybe someone else can.

Improve this answer
$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.