Suppose that:

  • $MK \in \{0, 1\}^{n}$ and the main key of a block cipher.
  • $RK_{r} \in \{0, 1\}^{n}$ and is the $r$th round key.
  • $RC_{r} \in \{0, 1\}^{n}$ and is the $r$th round constant.
  • $RK_{r} = MK \oplus RC_{r}$

What's the security of this key schedule. I'm imagining that it is not very strong.

  • $\begingroup$ "security" in regards to what? You might be interested in the LED cipher $\endgroup$ – Ella Rose Oct 16 '17 at 1:05
  • 3
    $\begingroup$ This makes no sense. $\endgroup$ – fkraiem Oct 16 '17 at 1:25
  • $\begingroup$ Perhaps for the last line, you meant $RK_r = MK \oplus RC_r$? $\endgroup$ – poncho Oct 16 '17 at 1:53
  • 2
    $\begingroup$ In any case, unless the key schedule does something exceedingly silly (e.g. set all round keys to constant values), it's impossible to talk about the security of a key schedule without specifying what cipher it is a part of. The above key schedule might cause the cipher to be quite weak; or it might be exactly the sort of thing the cipher needs to be secure. $\endgroup$ – poncho Oct 16 '17 at 2:01
  • $\begingroup$ A key schedule has no security definition. Also, how is this used in a cipher, what are the definitions, etc.? From the little information there, I would say this is vulnerable to linear and differential cryptanalysis at least. $\endgroup$ – tylo Oct 16 '17 at 14:04

This key schedule is Totally Linear. If two Master Keys $MK$1 and $MK$2 have a difference of d, all the round keys will have difference of d with probability of 1. This makes the cipher vulnerable to Related key Attack. But its hard to workout and comment without the knowledge of the cipher description that how badly such key-schedule effects the security of cipher

The PRINCE – A Low-latency Block Cipher for Pervasive Computing Applications have very simple key-schedule, and its designers say

for our cipher it holds that decryption for one key corresponds to encryption with a related key. This property we refer to as α-reflection

For more information about key-schedule requirements see "What are the requirements of a key schedule?"

  • $\begingroup$ "This makes the cipher vulnerable to Related key Attack"; only if the rest of the cipher structure has issues with related round keys (and hence there might not be any such vulnerability at all...) $\endgroup$ – poncho Oct 16 '17 at 17:51
  • $\begingroup$ so its hard to workout or comment without the knowledge of cipher description that how badly such key-schedule effects the security of cipher :) $\endgroup$ – khan Oct 16 '17 at 18:35

The addition of round constants in key-scheduling is to remove self-simlarity. Related key attack (is not practical attack in real life other than academia) will remove the effect of round constants in the analysis ( both keys are xored with the same round constant).

Invariant subspace a attack exploits the weakness of constant addition to the master key. this is what happens in Midori cipher, a class of weak keys found by this approach.

it is important to choose round constant carefully to provide secure key scheduling of key and round constant.

For more details , I recommend to read the paper Proving Resistance against Invariant Attacks: How to Choose the Round Constants


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.