3
$\begingroup$

Suppose that:

  • $MK \in \{0, 1\}^{n}$ and the main key of a block cipher.
  • $RK_{r} \in \{0, 1\}^{n}$ and is the $r$th round key.
  • $RC_{r} \in \{0, 1\}^{n}$ and is the $r$th round constant.
  • $RK_{r} = MK \oplus RC_{r}$

What's the security of this key schedule. I'm imagining that it is not very strong.

Improve this question
$\endgroup$
8
  • 1
    $\begingroup$ "security" in regards to what? You might be interested in the LED cipher $\endgroup$
    – Ella Rose
    Commented Oct 16, 2017 at 1:05
  • 3
    $\begingroup$ This makes no sense. $\endgroup$
    – fkraiem
    Commented Oct 16, 2017 at 1:25
  • $\begingroup$ Perhaps for the last line, you meant $RK_r = MK \oplus RC_r$? $\endgroup$
    – poncho
    Commented Oct 16, 2017 at 1:53
  • 2
    $\begingroup$ In any case, unless the key schedule does something exceedingly silly (e.g. set all round keys to constant values), it's impossible to talk about the security of a key schedule without specifying what cipher it is a part of. The above key schedule might cause the cipher to be quite weak; or it might be exactly the sort of thing the cipher needs to be secure. $\endgroup$
    – poncho
    Commented Oct 16, 2017 at 2:01
  • $\begingroup$ A key schedule has no security definition. Also, how is this used in a cipher, what are the definitions, etc.? From the little information there, I would say this is vulnerable to linear and differential cryptanalysis at least. $\endgroup$
    – tylo
    Commented Oct 16, 2017 at 14:04

2 Answers 2

Reset to default
4
$\begingroup$

This key schedule is Totally Linear. If two Master Keys $MK$1 and $MK$2 have a difference of d, all the round keys will have difference of d with probability of 1. This makes the cipher vulnerable to Related key Attack. But its hard to workout and comment without the knowledge of the cipher description that how badly such key-schedule effects the security of cipher

The PRINCE – A Low-latency Block Cipher for Pervasive Computing Applications have very simple key-schedule, and its designers say

for our cipher it holds that decryption for one key corresponds to encryption with a related key. This property we refer to as α-reflection

For more information about key-schedule requirements see "What are the requirements of a key schedule?"

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ "This makes the cipher vulnerable to Related key Attack"; only if the rest of the cipher structure has issues with related round keys (and hence there might not be any such vulnerability at all...) $\endgroup$
    – poncho
    Commented Oct 16, 2017 at 17:51
  • $\begingroup$ so its hard to workout or comment without the knowledge of cipher description that how badly such key-schedule effects the security of cipher :) $\endgroup$
    – crypt
    Commented Oct 16, 2017 at 18:35
2
$\begingroup$

The addition of round constants in key-scheduling is to remove self-simlarity. Related key attack (is not practical attack in real life other than academia) will remove the effect of round constants in the analysis ( both keys are xored with the same round constant).

Invariant subspace a attack exploits the weakness of constant addition to the master key. this is what happens in Midori cipher, a class of weak keys found by this approach.

it is important to choose round constant carefully to provide secure key scheduling of key and round constant.

For more details , I recommend to read the paper Proving Resistance against Invariant Attacks: How to Choose the Round Constants

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.