-2
$\begingroup$

I'm a Master's Degree student and researching about AES-128 encryption. My Advisor asked me a question about necessity of iterative rounds in AES. he asked:"why we couldn't encrypt a 128-bit plaintext with a 128-bit key by doing simple XOR operation on it? it have 2^128 key space and hard to attack.Why we should perform iterative rounds?" can anyone explain it for me by references?

$\endgroup$
  • 3
    $\begingroup$ Block ciphers are meant to encrypt very long plaintexts, not just 128 bits. $\endgroup$ – mikeazo Feb 21 '18 at 1:20
  • $\begingroup$ So when the round key is inserted into the state what operation is used? $\endgroup$ – Q-Club Feb 21 '18 at 4:32
2
$\begingroup$

This is actually two questions, so its interesting that your advisor questioned it in this way.

The simple 128-bit XOR operation is what is known as a One Time Use Pad. The cryptographic behavior of this is very well understood. Some of its behaviors are desirable, some are not. For example, they suffer from malleability if the attacker already knows the plaintext.

The question of why we use multiple rounds instead of one big round is a very different one. We use multiple rounds because the construction of cyphers from small repeated rounds is well understood. The security of it is easier to analyze. For example, we can construct them in a way such that, in the event of an attack, there's a good chance that increasing the number of rounds solves the attack. If we had one big algorithm, the probability that one failure may destroy the entire algorithm seems to go up. I say seems to, because you can't prove such things with statistics, but the cryptographic community has found that, in general, its a rule that works.

$\endgroup$
  • 1
    $\begingroup$ On the first question, a reason "why we couldn't encrypt a 128-bit plaintext with a 128-bit key by doing simple XOR operation on it" is that the key could trivially be found form a single plaintext/ciphertext pair, then allowing to perform any other encryption/decryption, against the security model of the block cipher. Nice explanation for the second. $\endgroup$ – fgrieu Feb 21 '18 at 9:18
2
$\begingroup$

Cort Ammon makes good points. There is also another reason that rounds are required, to do with resources.

AES is essentially a substitution /permutation network with a block width of 128 bits. It's technically impossible to make direct like for like substitutions of a 128 bit variable. You'd need ~10^40 bytes of RAM (2^128*16) to hold a look up table. So AES does it in the SubBytes component using 8 bits at a time. To make this effective with the old confusion and diffusion adage, these substituted bits need to be permuted over the whole block width and the other 15 bytes. That's what ShiftRows and MixColumns does. But it takes more than one iteration.

If you look at the The Design of Rijndael, section 3.5, the bits can be fully diffused with just 2 rounds. These two iterations effectively create a 128 bit wide S box. The other 8 - 12 rounds add resistance to analysis.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.