Questions tagged [key-schedule]
A key schedule is an algorithm that expands a relatively short master key to a relatively large expanded key for later use in an encryption and decryption algorithm.
64
questions
3
votes
1
answer
31
views
Size of subkey array in Blowfish
I'm writing a school paper about Blowfish encryption, and couldn't seem to find out if the size of the subkey array for Blowfish changes based on the length of the key. I would assume that it doesn't ...
- 33
2
votes
0
answers
33
views
Do symmetric and skew symmetric key schedules have any known weaknesses?
A symmetric key schedule is a key schedule of the form $(k_1,\dots,k_{n-1},k_n,k_{n-1},\dots,k_1)$ or of the form $(k_1,\dots,k_{n-1},k_n,k_n,k_{n-1},\dots,k_1)$. A skew symmetric key schedule is a ...
- 1,215
11
votes
1
answer
2k
views
Why expand keys? Why not rather generate a longer key?
AES-128 takes a 128-bit key (four 32-bit words), and expands it to a 352-bit key schedule (11 words). Speck48/72 takes a 72-bit key (three 24-bit words), and expands it to a 528-bit key schedule (22 ...
- 203
2
votes
3
answers
1k
views
AES key expansion question
I'm reading about the key expansion for AES but I can't seem to find the answer to this question yet. The book refers to a cipher key and the expanded key (or key schedule). This is the algorithm from ...
- 39
2
votes
0
answers
90
views
How much information is required to specify a new variant of AES beyond the key length and the number of rounds?
Three different versions of the Advanced Encryption Standard (AES) have been standardized, which use keys of bit length 128, 192, and 256 respectively. They also use different numbers of rounds: 10, ...
- 163
1
vote
1
answer
62
views
Statistical Cryptanalysis. Would one "reverse" weak key schedule algorithms or peel off each one of internal rounds?
The context is iterated ciphers.
Regarding Differential and Linear Cryptanalysis, the methods seem to make a cryptanalyst able to do an educated guess on a partial subkey (e.g. bits from the last ...
2
votes
0
answers
174
views
Reconstructing the AES-192 key out of the last roundkey
Lets assume we know the last-round key of AES.
For AES-128, the whole key can be reconstructed using the last-round key since every WORD in the key schedule is based on the previous 128-bit entry.
For ...
- 41
0
votes
0
answers
29
views
How do I preform the inverse key expansion of aes decryption? [duplicate]
I’m working on an aes encryption and decryption project in 8086 assembly!
I managed to code an encryption algorithm and it worked perfectly.
No I’m working on the decryption algorithm.
I’ve managed to ...
1
vote
1
answer
380
views
Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)
When you know the Salsa20's keystream, how do you know the next keystream?
In other words, can I infer the next keystream when I don't know the Key and IV of Salsa20, but the keystream is ...
- 13
1
vote
1
answer
62
views
mixing round functions and key schedules
what is the security of an encryption algorithm that takes the key schedule of algorithm X and the round function of algorithm Y?
should it need a new security proof? or it relies on X and Y's ...
- 105
0
votes
0
answers
30
views
How big could be nothing-up-my-sleeve numbers to initialize key schedule?
Is it fine if algoritm will have $32$ 128-bit numbers that will be nothing-up-my-sleeve numbers to initialize key schedule?
As I know from wikipedia the Hasty Pudding Cipher was criticized for its ...
- 1,181
1
vote
1
answer
66
views
Key scheduling for ISAAC
Does ISAAC use key scheduling? I do not know programming.
Is it safe if ISAAC derives subkeys using ISAAC itself?
- 33
5
votes
1
answer
216
views
Use large key size for RC4 to avoid RC4 bias
I saw a question on StackOverflow where RC4 was initialized by a 1024 bit key (with 2048 the maximum key size, if I'm not mistaken).
Will such a large key size possibly solve any of the bias of the ...
- 90.2k
0
votes
3
answers
202
views
Why didn't people redesign the key scheduling algorithm of DES to use longer keys instead of using 3-DES?
To overcome short key length of DES, Triple DES was devised. What would go wrong or why didn't people redesign the key scheduling algorithm to use longer keys?
- 161
1
vote
1
answer
413
views
Difference between Key Scheduling and Key Generation?
I am a little bit confused in the terms i.e Key Scheduling and Key Generation. What is the actual difference between these two terms? According to Wikipedia, the terms are described as:
Key ...
0
votes
0
answers
60
views
Is there a two-way key-stretching function which is infinite?
Only for hobby I made some ciphers, it is not my intention to use them in the real world but I am trying to compare them with existing ciphers.
An important function of my ciphers is a key stretching ...
- 1
1
vote
0
answers
52
views
Are slide attacks effective if the primitive is sandwiched? And key schedule vs. Even-Mansour
Suppose you have a cryptographic permutation consisting of identical rounds, that makes it vulnerable to a slide attack. But if you sandwich it between two XORs of key material. Is it still vulnerable?...
user71538
2
votes
1
answer
205
views
AES key schedule. Does it use a KDF to generate the round keys?
So for each round in AES a different key is used, and as I saw the keys are created form a master key.
My question is how these round keys are generated.
Are they created via a Key Derivation ...
- 47
2
votes
1
answer
372
views
Difference with round keys and round constant in AES
I am confused with round keys and round constant in AES. Are they the same? Can someone explain it to me?
- 23
1
vote
0
answers
158
views
Difference in the key schedule of AES for decryption given different orders of operation
As per the Stallings book, the normal decryption of AES has different sequence of transformations [method 1 below], which leads to two separate software or firmware modules and that is undesirable.
...
- 163
8
votes
1
answer
205
views
How complex must round constants be to resist slide attacks?
A key schedule that generates round keys by XORing a round constant with the key is linear and can be vulnerable to related key attacks, but let's ignore that for now. Constants are necessary to avoid ...
- 14.9k
3
votes
0
answers
62
views
Is uneven DES keybit use exploitable?
Question: Is there any cryptanalytic leverage to be had from the fact
that some of the 56 "raw" keybits of DES are used more & less often than others?
Observation: over the course of the 16 ...
- 106
3
votes
1
answer
747
views
S-AES RC[i] Generation. Can someone explain how to generate the RC[i]s for these two problems I have?
I don't know exactly how to find the RC[ 1 ] of 80, or the RC[2] of 30.
Can someone explain how to find them?
Here is a picture of the problem I am having with two questions.
user63974
0
votes
0
answers
160
views
How secure would AES be with all round keys equal? [duplicate]
In effect the same 128 bit key is XORed at every round and before and after as whitening.
Would it be 2^128?
What are the dangers of such a naive key schedule and does AES suffer from them?
Edit: ...
user63354
0
votes
1
answer
856
views
How many rounds of encryption is ideal?
I am a newbie to the cryptography world. I am working on a custom algorithm that encrypts the data multiple times and results in a cipher text. It uses a different key in each round to encrypt it. I ...
- 31
0
votes
1
answer
298
views
What happens at this part in the key schedule of a Speck...?
I am trying to figure out the process behind the Speck block cipher.
I understand how XOR works (Exclusive-or) when you take 2 strings of bits and you want to XOR them together.
However, in the key ...
5
votes
1
answer
378
views
Why do block ciphers use key schedules instead of round constants? (Even-Mansour)
Let's take AES as an example. What would be wrong with just having a 256 bit key that you XOR into your input and then XOR into your output? No key expansion at all.
I believe it's even known as the ...
- 51
3
votes
0
answers
192
views
Optimizing the AES key schedule when round keys cannot be cached
I have an implementation of AES which can cache at most a 256-bit value between encryptions. Currently, the master key is cached and the key schedule is re-computed for each and every block. Is there ...
- 14.9k
5
votes
1
answer
163
views
Implications of identical round keys in AES (Rijndael)
When reading up on the Rijndael key schedule, I learned that the master key itself is used as a round key directly before the key schedule generates additional round keys. When a 256-bit key is used, ...
- 14.9k
1
vote
0
answers
66
views
Programming Interface: Preparing Key Schedule for Both Encryption and Decryption
Quick question (01): what is the uniform interface for a symmetric block cipher? Is it
$(f:k \to k', enc_{k'}:c \to p, dec_{k'}:p \to c)$ or
$(f:k \to k_e, g:k \to k_d, enc_{k_e}:c \to p, dec_{k_d}:...
- 8,283
0
votes
1
answer
498
views
What are the subsequent inputs to the DES key schedule after round 1?
I've just been studying the DES crypto algorithm as presented by Christof Paar in his book entitled, Understanding Cryptography as well as his lecture. There is a diagram on page 68 of the text where ...
- 165
1
vote
1
answer
287
views
Using round constants to thwart slide attacks
I'm partly unclear as to how the use of round constants in an iterated cipher makes it immune to slide attacks. I mean, I can see how it does from one perspective, but if the solution to slide attacks ...
- 3,487
1
vote
1
answer
242
views
How should k2 be produced in the RC4A stream cipher (A modification of RC4)?
RC4A is a slight modification of the simple RC4 stream cipher designed to strengthen it against a number of attacks. Here's that paper.
However in the paper, the second key ...
- 292
3
votes
2
answers
194
views
Security of key schedule that only XORs a key with constants
Suppose that:
$MK \in \{0, 1\}^{n}$ and the main key of a block cipher.
$RK_{r} \in \{0, 1\}^{n}$ and is the $r$th round key.
$RC_{r} \in \{0, 1\}^{n}$ and is the $r$th round constant.
$RK_{r} = MK \...
- 3,487
0
votes
1
answer
72
views
Crafting secure block ciphers that lack key expansion
There was some article published by on the IACR's website that outlined a block cipher that only used the "master" key and no round keys. I can't recall the cipher's name, not that it matters, nor do ...
- 3,487
1
vote
1
answer
7k
views
AES key expansion for 192-bit
In AES-192 key expansion there are 12 rounds and 52 keys.
I am not sure why 52 keys are derived since each block consist of 4 rows and 6 columns (192 bit keys).
So if the block is 4 x 4 then we ...
- 113
0
votes
1
answer
262
views
What is the role of the round counter in the key schedule of PRESENT?
Currently I am working on PRESENT block cipher implementation (Hardware) and I am unable to understand the role of round counter in key scheduling part of cipher.
Can some share some insight on round ...
1
vote
0
answers
133
views
Attack on Cipher with Highly Related RoundKeys
Consider a variation of AES with modified Key-Schedule and following observation on the Key Schedule.
If there exists a relation d between two Master keys, the key schedule is so weak that all sub-...
- 2,377
6
votes
1
answer
3k
views
In AES Keyschedule : Infer all round keys and cipher key from last round key
I am given the last round key in AES and I want to infer all round keys and the first round key which is the cipherkey.
Can anyone provide an algorithm to do that?
- 163
1
vote
0
answers
252
views
Triple DES: Does knowing the plaintext limit my keyspace for brute force?
My goal is to try and decrypt a single 8 byte block of a Triple DES encrypted data block and in doing so discovering the 8 byte keys that were used. This is mostly an academic exercise but could ...
- 111
15
votes
3
answers
3k
views
Why do Feistel ciphers need round keys?
Looking at the design for Feistel ciphers, they use a list of round keys which are generated from the main key using the key schedule of the associated block cipher. Some block ciphers need this as to ...
- 2,369
0
votes
0
answers
44
views
Amount of key expansion rounds in AES [duplicate]
I am currently in the process of learning how AES actually works and that works great as of now but when it comes to the Rijndael's key schedule I have a question. From what I have read, I have to ...
user48297
1
vote
0
answers
35
views
Why do we need key scheduling? [duplicate]
I've seen papers saying toy ciphers can be improved with powerful key scheduling, but was wondering if there is evidence they are needed in reasonable ciphers? for instance AES. Is there any ...
- 11.6k
7
votes
2
answers
713
views
Security importance of Key Schedule in Block Cipher
For example block cipher AES-128, Key size is 128bit and it is used to make a 10 round key which is total 320bit.
Question 1. If i use another Key schedule algorithm in AES, then security decreased ...
8
votes
1
answer
492
views
Why are multiple rounds with generated subkeys used?
In AES-128, 10 rounds are used with subkeys generated from the 128-bit key. In DES, 48-bit subkeys are generated from a 56-bit key. This seems to be common in symmetric encryption.
I ask this because ...
- 183
3
votes
0
answers
1k
views
How can I find or reverse engineer the whitening in an AES algorithm?
I am working with this black box cryptography scheme.
I know the plain text, cipher text, and everything else except how they whiten the data (or key?). Everything is 128 bit, 16 bytes.
I have two ...
- 31
2
votes
2
answers
421
views
Camellia Key Schedule
Camellia is widely used, an international standard now. Its key schedule seems to be too simple compared to other famous ciphers like Twofish and CAST-256. What are the prerequisites for the key ...
- 2,377
4
votes
1
answer
92
views
Security of randomized data dependant key schedules?
An example to demonstrate the point with two Feistel networks:
Cipher A:
\begin{align}
roundkey = hash(key || counter)\\
roundkey = hash(key || roundkey)\\
left = left\oplus hash(roundkey || right)\\...
- 19.4k
13
votes
1
answer
3k
views
What are the requirements of a key schedule?
In the first block cipher I designed I used a CSPRNG to generate the round keys. The purpose was to at least have a chance of creating a (hopefully!) secure cipher on the first try (but please don't ...
- 4,763
3
votes
1
answer
3k
views
Compression in key generation of DES algorithm
Does anyone have a pseudo-code or an algorithm or even a diagram of the compression (pc2) of the DES algorithm?
I can't find a relation between the bits that are dropped, even when I do it manually ...
- 55