I was practicing some python programming and I decided to implement a simple DES encryption function, so i decided to take some shortcuts so instead of DES expansion boxes and s-Boxes i just used a simple keyed SHA3 hash function the input is: 32-bit right side + key(any length I want but I used 128-bit) The first 32-bit of hash are xor-ed with left side to produce ciphertext. So now ignoring that i designed my own crypto and the fact that I used a very simple key schedule function. what are the security advantages of using this hash function instead of normal one (taking in mind that it takes 128-bit key which is greater than 56-bit key of Normal DES), and how it will differ if I used SHA2 (would SHA2 susceptibility to length extension attacks affect the security). lastly what are the advantages of using this method.
-
$\begingroup$ "I used a very simple key schedule" is an understatement: the round function is the same across all rounds. The question practically boils down to: how does the security of DES compare to that of a 16-round Feistel cipher with the same PRF (determined by a 128-bit key) with 32-bit input and output at each round? $\endgroup$– fgrieu ♦Commented Nov 13, 2020 at 14:27
-
$\begingroup$ @fgrieu, Thanks fgrieu this is exactly what I mean, I just wanted to be more clear explaining my question. $\endgroup$– KMGCommented Nov 13, 2020 at 15:00
-
$\begingroup$ The question of the security of a 16-round 64-bit-block symmetric Feistel cipher with the same PRF is interesting (read: I didn't now, had to think about it). Is there a reason you did not use $\text{SHA3}(\text{right}\mathbin\|\text{key}\mathbin\|\text{round})$ which would be a pure Feistel cipher with ample enough rounds to be safe? $\endgroup$– fgrieu ♦Commented Nov 13, 2020 at 15:46
-
$\begingroup$ Simple? DES key schedule is already simple. Just wondering how you fit the SHA3 to near to the DES on small devices. What are the requirements of a key schedule?. No low cost $\endgroup$– kelalakaCommented Nov 13, 2020 at 15:58
-
$\begingroup$ @kelalaka,@fgrieu The key schedule algorithm I use is just right rotating(no permuatation) but My question doesn't depend actually on key schedule. Think of it like that 16 round keys(no matter how I get them) are used to post append the right side of message which will enter the SHA3 function then hash will encrypt left side, So how secure is this approach(and what's it advantages) and how it will differ if I used SHA2 instead. After all the code i wrote is just a proof of concept so I'm interested in the big picture here. $\endgroup$– KMGCommented Nov 13, 2020 at 16:17
1 Answer
The question as initially asked essentially considers a 64-bit symmetric Feistel cipher with 16 rounds, a large (128-bit) key, a near-ideal round function, but the same function and key at each round. A slide attack allows at least a distinguisher, I think with in the order of $2^{31}$ queries to an encryption oracle. With some more, it might be possible to construct plaintext/ciphertext pairs that where not queried. This is an interesting exercise. That makes the security lower than that of DES from several standpoints.
If there is a good key schedule (e.g. if the round counter is appended to the input of the hash), then we are back to a Feistel network, which given the block size and ample rounds is extremely secure. I very much doubt there's an attack better than brute force of the 128-bit key. Security is way above that of DES (but performance in native code is much lower).
With a key schedule based on rotation as in comment, things depend on the rotation count. But if it's by an odd number of bits, nothing disastrous will happen for overwhelmingly most key values.
If there was a security difference between SHA-2 and SHA-3, that would imply a break of one of these (against a random oracle model for constant input length). On top of that it would be with the attacked hash embedded in a setup extremely hostile to attacks. I discount that.
