3
$\begingroup$

I'm a noob with very fragmental knowledge of basic crypto. So please excuse me if this question is really stupid.

If I understand everything correctly, there are two basic schemes for ciphers: a stream cipher, where every byte is encrypted by itself, and a block cipher, where some fixed length block of bytes is encrypted.

In a stream cipher encrypted bytes are in the same order as message bytes; in a block cipher bytes are mixed inside of a block but order of blocks stays the same.

So my question is: are there any kind of "superblock" ciphers where order of blocks in the ciphertext is different from plaintext? Does it even make sense to do this? Or there is no point because block ciphers are already secure enough?

Obviously such a 'superblock' cipher will not be suitable for any kind of streaming applicatons but may be for something like disk encryption?

$\endgroup$
  • 1
    $\begingroup$ What you are saying is basically "what if we had block ciphers with much larger blocks?", right? Tweakable block cipher modes exist that effectively transform a PRP into one for a wider block and these are mostly being developed for disk encryption. $\endgroup$ – Thomas M. DuBuisson Mar 24 '17 at 23:53
  • 1
    $\begingroup$ @ThomasM.DuBuisson: They might also be asking about pseudorandomly shuffling the order of the (wide) blocks on the disk. I don't know if any common disk encryption software actually does that, but it would seem like a sensible thing to do, at least for SSDs. Trying to do it on a traditional magnetic disk drive would probably be horrible for performance because of seek latency, though. $\endgroup$ – Ilmari Karonen Mar 25 '17 at 0:51
  • $\begingroup$ @IlmariKaronen yeah, I meant shuffling the blocks. $\endgroup$ – Amomum Mar 26 '17 at 17:39
3
$\begingroup$

There is already enough transposition in usual block ciphers to provide enough security. You could add a simple transposition cipher on top of a block cipher but there is little reason to do so.

It would be pretty easy to perform time based side channel on the cipher is it is spread across a disk or SSD. So that would already bring down the added security.

There may also be horrible performance decreases on certain media, as already mentioned in the comments.


Basically I don't see how such a scheme would add much security, and the implications of performing the transposition are too severe.

So yeah, I guess that block ciphers + common disk encryption schemes are already "secure enough" if there is such a thing.


Besides all that, if the block cipher gets broken, don't you think it would be relatively easy to put the blocks in the right position again?

Axapaxa also makes good observation on how this won't protect single block messages.

$\endgroup$
  • 2
    $\begingroup$ Its clear it wouldn't improve security on one-block messages (and a lot of messages are those), and thats enough to claim such cipher to be broken. So there is a lot of work for none of gain. Also, you might want to indicate that this isn't property of block cipher but mode of operation. $\endgroup$ – axapaxa Mar 25 '17 at 1:08
  • $\begingroup$ I'm not so convinced that it would be completely useless. One of the well known issues with typical disk encryption schemes is that an attacker who can obtain two or more snapshots of the encrypted disk at different times can tell which disk blocks have changed between the snapshots, and may be able to infer something about the content on the disk and/or the user's access patterns based on this information. While pseudorandomly shuffling the disk blocks would not completely eliminate this leak, it would at least mitigate it somewhat. $\endgroup$ – Ilmari Karonen Mar 26 '17 at 18:51
  • $\begingroup$ @IlmariKaronen And how would shuffling mitigate that risk? Do you reshuffle all blocks? If you reshuffle just two of them then I don't see the advantage. $\endgroup$ – Maarten Bodewes Mar 26 '17 at 19:59
  • $\begingroup$ Applying a key-dependent permutation (even a static, unchanging one) to the block indices would hide the order of the blocks. Thus, an attacker with two snapshots would not be able to tell that e.g. "the first 8 blocks and the 172 consecutive blocks at offset 153864 have changed", but only that "some 180 blocks have changed". Of course, with more snapshots, one could still determine which blocks tend to change together. Still, all I was trying to claim is that there are some scenarios where shuffling the blocks could deny an attacker some information that they'd otherwise have. $\endgroup$ – Ilmari Karonen Mar 26 '17 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.