0
$\begingroup$

I got specific problem with round function in my symmetric cipher. It works on $128$-bit blocks. Every round got two $128$-bit keys. Block is xored with $k_{1}$ on the beggining of the round. Then it goes into round function (which is using the same $k_{1}$ and $k_{2}$ keys, both $128$-bit long). And then it is xored with $k_{2}$ in the end.

Problem is with round function. Let's asssume that it transom every $128$-bit block into $128$-bit block indistinguishable from random, if you don't have $k_{1}$ and $k_{2}$. But there is one exception. All zeros block is always encrypted into all zeros block (with every key). So only xoring makes it different from all zeros block before it goes into round function.

If we will consider let's say $10$ rounds - is it secure cipher? Is it possible to broke it because of that problem with all zeros block?

EDIT:

I clarified my question, specifically when xoring is performed:

$INPUT \oplus k_{1}$ $\to$ $F_{roundfunction}$ $\to$ $OUTPUT \oplus k_{2}$

Improve this question
$\endgroup$
6
  • 1
    $\begingroup$ Round function is never "perfect" - otherwise we wouldn't need more than 1 round. Zero going to zero is not a problem. For example in the NORX permutation, you have this property (well it's not a block cipher but the idea is the same). It is also strange that you use $k_1$ and $k_2$ inside your transformation as well - it can easily be keyless, like in all usual block ciphers. $\endgroup$
    – Fractalice
    Commented Sep 3, 2020 at 13:14
  • $\begingroup$ Round function is never "perfect - of course, mein is not either. But I made that assumption to make more easy and clear to investigating that problem with all zeros blocks. I don't understand why it is strange to use $k_{1}$ and $k_{2}$? It is just key whitening, what's more it is helpful to avoid problem with all zeros blocks (if I'm right) and it can help to avoid some kind of attacks in my round functions (but this is separate topic). $\endgroup$
    – Tom
    Commented Sep 3, 2020 at 14:24
  • $\begingroup$ Note: "Block is xored with $k_1$ on the beggining and with $k_2$ in the end of the round": that's equivalent to xor with $k_1\oplus k_2$. Thus we can remove the xor after each round except the last round, adjust the constants, and get an equivalent cipher that might be easier to analyse. $\endgroup$
    – fgrieu ♦
    Commented Sep 3, 2020 at 16:27
  • 1
    $\begingroup$ Hint: compute the probability that an adversary, not knowing any of the constants, and making chosen plaintext or chosen ciphertext queries, can trigger the special case where one round function has input and outputs zero. Is that immediately worrying? Also: by what fraction does the stated condition reduce the number of possible round functions? $\endgroup$
    – fgrieu ♦
    Commented Sep 3, 2020 at 16:46
  • $\begingroup$ "that's equivalent to xor with $k_{1} \oplus k_{2}$" - no, because round function $f$ will give us completely different output if use plaintext $p$ and compute $f(p)$ and something completely different for $f(k_{1} \oplus p)$. $\endgroup$
    – Tom
    Commented Sep 3, 2020 at 18:57

1 Answer 1

Reset to default
1
$\begingroup$

If an all-zeroes block creates all-zeroes for every key that's definitely an issue. It's not necessarily likely to be serious, but could leak data about the plaintext and does not qualify as a secure block cipher.

However, the solution is fairly simple... simply XOR one of k1 or k2 with a constant value to turn your all-zero block into something that'll produce a better result. Personally I'd XOR with the current round number in each round because that'll prevent your algorithm from accidentally ending up with another input that produces the same issue.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.