4
$\begingroup$

I'm curious about the design of the P_BOX of DES. I found a paper on this topic, but it dates back to 1989. This means the effect of p-box values of the cipher immunity against Differential Cryptanalysis and linear cryptanalyisis is not mentioned since they were Publicly discovered during the 90's (According to Bruce Schneier's book "Applied cryptography , the NSA and IBM knew about the attack since the 70s). I tried to look online, but it seemed to me that unlike the S-boxes which have considerable amount of literature, there are no good resources on the p_boxes.

The placement of the p_box in the Feistel function is shown here: enter image description here

The permutation itself is shown here:
enter image description here

Previously on Crypto.SE, we explored the roles of the initial and final permutations and how they impact security. What about the permutation in the Feistel function? What impact (if any) does it have on security?

Improve this question
$\endgroup$
2
  • 2
    $\begingroup$ Straight up reference requests are off-topic on this site. I edited your question to make it more on-topic. If I changed your original intent, please let me know or feel free to edit yourself. $\endgroup$
    – mikeazo
    Commented Dec 18, 2014 at 12:42
  • 1
    $\begingroup$ In ON THE DESIGN OF PERMUTATION P IN DES TYPE CRYPTOSYSTEMS You'll find reference to D. W. Davies, "Some Regular Properties of the Data Encryption Standard", also hinted in D.W. Davies book "Security for Computer Networks", 2nd, Hamiltonian cycles in the DES, P. 66. Also note other than E Perm bleed over the only way C key bits affect S Boxes 5-8 or D key bits affect S Boxes 1-4 outputs is through the P Permutation and successive rounds. $\endgroup$
    – user1430
    Commented Dec 18, 2014 at 19:21

1 Answer 1

Reset to default
3
$\begingroup$

Note: you should also take into consideration the Expansion table, as it glues together with the Pbox.

The simplest thing you would like to want from a Pbox is to provide a good diffusion on the inter-sbox level. That is, a single sbox should have an effect on many sboxes in the next round. This is not sufficient, for example you could have some indepent groups of sboxes. So you need to see how many rounds are needed to prodive full diffusion, for each of the sboxes.

For example, PBoxes which make some independent groups of sboes, do not provide full diffusion at all and are considered unsecure. Also, consider Pbox which matches sboxes like $(2, 3, 4, 5, 6, 7, 1)$ (e.g. 1 shift left). You need at least 7 rounds to provide full diffusion.

For DES I think 2 rounds are enough for full diffusion, so that is at least acceptable.

Of course I described the very basic property of the PBoxes, which is not sufficient to say that a PBox is secure for a cipher. For another example, you can consider weak sboxes, for example if 2 sboxes are weak. Some PBoxes may resist it, some PBoxes may make the cipher much more weaker.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.