Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [key-schedule]

A key schedule is an algorithm that expands a relatively short master key to a relatively large expanded key for later use in an encryption and decryption algorithm.

14
votes
3answers
2k views

Why do Feistel ciphers need round keys?

Looking at the design for Feistel ciphers, they use a list of round keys which are generated from the main key using the key schedule of the associated block cipher. Some block ciphers need this as to ...
12
votes
1answer
2k views

What are the requirements of a key schedule?

In the first block cipher I designed I used a CSPRNG to generate the round keys. The purpose was to at least have a chance of creating a (hopefully!) secure cipher on the first try (but please don't ...
10
votes
2answers
2k views

How secure is the AES master key if Round Keys are found

If an attacker finds some round key of AES256, is it possible to find the master key? How safe is the master key if an attackers finds multiple round keys?
9
votes
2answers
4k views

AES Inverse Key Schedule

I have a 128-bit input-block and the corresponding cipher-block given. Additionally I have the last round-key given. Is it now possible to get (calculate) the associated cipher-key? I already ...
8
votes
1answer
332 views

Why are multiple rounds with generated subkeys used?

In AES-128, 10 rounds are used with subkeys generated from the 128-bit key. In DES, 48-bit subkeys are generated from a 56-bit key. This seems to be common in symmetric encryption. I ask this because ...
8
votes
0answers
327 views

Is the key schedule of Serpent a circle?

The creation of the prekeys for Serpent works by XORing some previous values with a counter and a fixed value. Every word is 32 bits big and 4 words form a round key (after applying a S-Box, but this ...
7
votes
1answer
101 views

How complex must round constants be to resist slide attacks?

A key schedule that generates round keys by XORing a round constant with the key is linear and can be vulnerable to related key attacks, but let's ignore that for now. Constants are necessary to avoid ...
5
votes
1answer
161 views

Why do block ciphers use key schedules instead of round constants? (Even-Mansour)

Let's take AES as an example. What would be wrong with just having a 256 bit key that you XOR into your input and then XOR into your output? No key expansion at all. I believe it's even known as the ...
5
votes
1answer
129 views

Implications of identical round keys in AES (Rijndael)

When reading up on the Rijndael key schedule, I learned that the master key itself is used as a round key directly before the key schedule generates additional round keys. When a 256-bit key is used, ...
5
votes
0answers
100 views

search of patterns in key schedules

I am developing a new key schedule, and there is this article (Enhanced Key Expansion for AES-256 by Using Even-Odd Method) where the authors also propose a new algorithm and one of the objectives is ...
4
votes
1answer
2k views

In AES Keyschedule : Infer all round keys and cipher key from last round key

I am given the last round key in AES and I want to infer all round keys and the first round key which is the cipherkey. Can anyone provide an algorithm to do that?
4
votes
1answer
308 views

a doubt in Rijndael's key expansion sizes

I've often heard/read that AES key sizes 256 & 192 would be weaker than 128 or not stronger as expected from the size increase, but I've never seen a proof. How does one proof the strength of a ...
4
votes
1answer
326 views

Block Cipher Without Key Schedule?

I'm designing a cryptography assignment for a college security course, and one of the problems is to perform a simple meet-in-the-middle attack on a 2-round, 2-key cipher. Since we want this to be a ...
4
votes
1answer
71 views

Security of randomized data dependant key schedules?

An example to demonstrate the point with two Feistel networks: Cipher A: \begin{align} roundkey = hash(key || counter)\\ roundkey = hash(key || roundkey)\\ left = left\oplus hash(roundkey || right)\\...
4
votes
1answer
497 views

More rounds after AES related key attack?

In his blog Schneier discusses that there is a new related key attack on 10 rounds of AES-256 "Another attack can break a 10 round version of AES-256 in 245 time, but it uses a stronger type of ...
4
votes
1answer
915 views

Entropy test for AES Key Schedule

According to the article "Lest We Remember: Cold Boot Attacks on Encryption Keys" there is a quick and dirty entropy test that can help to find possible AES Key Schedules in memory dumps. Although ...
3
votes
2answers
318 views

Security importance of Key Schedule in Block Cipher

For example block cipher AES-128, Key size is 128bit and it is used to make a 10 round key which is total 320bit. Question 1. If i use another Key schedule algorithm in AES, then security decreased ...
3
votes
1answer
311 views

Does the key schedule function need to be a one-way function?

For some key schedule $e_n(e_{n-1}(k))$ (where $e_{n-1}(k)$ is the result of the previous round) , does $e$ need to be a one-way function? In the case of DES or Rijndael the key schedule doesn't ...
3
votes
1answer
110 views

S-AES RC[i] Generation. Can someone explain how to generate the RC[i]s for these two problems I have?

I don't know exactly how to find the RC[ 1 ] of 80, or the RC[2] of 30. Can someone explain how to find them? Here is a picture of the problem I am having with two questions.
3
votes
0answers
43 views

Is uneven DES keybit use exploitable?

Question: Is there any cryptanalytic leverage to be had from the fact that some of the 56 "raw" keybits of DES are used more & less often than others? Observation: over the course of the 16 ...
3
votes
0answers
122 views

Optimizing the AES key schedule when round keys cannot be cached

I have an implementation of AES which can cache at most a 256-bit value between encryptions. Currently, the master key is cached and the key schedule is re-computed for each and every block. Is there ...
3
votes
0answers
614 views

How can I find or reverse engineer the whitening in an AES algorithm?

I am working with this black box cryptography scheme. I know the plain text, cipher text, and everything else except how they whiten the data (or key?). Everything is 128 bit, 16 bytes. I have two ...
2
votes
2answers
140 views

Security of key schedule that only XORs a key with constants

Suppose that: $MK \in \{0, 1\}^{n}$ and the main key of a block cipher. $RK_{r} \in \{0, 1\}^{n}$ and is the $r$th round key. $RC_{r} \in \{0, 1\}^{n}$ and is the $r$th round constant. $RK_{r} = MK \...
2
votes
1answer
1k views

Compression in key generation of DES algorithm

Does anyone have a pseudo-code or an algorithm or even a diagram of the compression (pc2) of the DES algorithm? I can't find a relation between the bits that are dropped, even when I do it manually ...
2
votes
1answer
394 views

Rotation table for 8 round DES

I'm trying to implement DES from scratch using the NIST paper and the Wikipedia article on DES. I got 16 round DES done, but I can't seem to get 8 round DES working. I figure it's because I got the ...
1
vote
1answer
427 views

Weak key schedule IDEA [closed]

Why was such a weak key schedule chosen for IDEA? The key schedule of IDEA works like this: Divide the key (128 bit) into 8 round keys, each 16 bit long. This are the first 8 "round" keys (6 keys per ...
1
vote
1answer
55 views

Difference with round keys and round constant in AES

I am confused with round keys and round constant in AES. Are they the same? Can someone explain it to me?
1
vote
1answer
155 views

How should k2 be produced in the RC4A stream cipher (A modification of RC4)?

RC4A is a slight modification of the simple RC4 stream cipher designed to strengthen it against a number of attacks. Here's that paper. However in the paper, the second key ...
1
vote
1answer
101 views

Is there a reference that prove that the AES Key Schedule generate random looking round keys?

Starting from uniformly random generated AES master key, is there a reference that prove that an specific roundkey can be considered as uniformly random generated as well ?
1
vote
1answer
164 views

Using round constants to thwart slide attacks

I'm partly unclear as to how the use of round constants in an iterated cipher makes it immune to slide attacks. I mean, I can see how it does from one perspective, but if the solution to slide attacks ...
1
vote
2answers
244 views

Camellia Key Schedule

Camellia is a widely used International standard now. Its Key Schedule seems to be too simple as compared other famous Ciphers like Twofish and CAST-256. What are the per-requisites for the key-...
1
vote
0answers
54 views

Difference in the key schedule of AES for decryption given different orders of operation

As per the Stallings book, the normal decryption of AES has different sequence of transformations [method 1 below], which leads to two separate software or firmware modules and that is undesirable. ...
1
vote
0answers
49 views

Programming Interface: Preparing Key Schedule for Both Encryption and Decryption

Quick question (01): what is the uniform interface for a symmetric block cipher? Is it $(f:k \to k', enc_{k'}:c \to p, dec_{k'}:p \to c)$ or $(f:k \to k_e, g:k \to k_d, enc_{k_e}:c \to p, dec_{k_d}:...
1
vote
0answers
105 views

Attack on Cipher with Highly Related RoundKeys

Consider a variation of AES with modified Key-Schedule and following observation on the Key Schedule. If there exist a relation d between two Master keys, the key schedule is so weak that all sub-...
1
vote
0answers
143 views

Triple DES: Does knowing the plaintext limit my keyspace for brute force?

My goal is to try and decrypt a single 8 byte block of a Triple DES encrypted data block and in doing so discovering the 8 byte keys that were used. This is mostly an academic exercise but could ...
1
vote
0answers
26 views

Why do we need key scheduling? [duplicate]

I've seen papers saying toy ciphers can be improved with powerful key scheduling, but was wondering if there is evidence they are needed in reasonable ciphers? for instance AES. Is there any ...
0
votes
1answer
3k views

AES key expansion for 192-bit

In AES-192 key expansion there are 12 rounds and 52 keys. I am not sure why 52 keys are derived since each block consist of 4 rows and 6 columns (192 bit keys). So if the block is 4 x 4 then we ...
0
votes
1answer
339 views

How many rounds of encryption is ideal?

I am a newbie to the cryptography world. I am working on a custom algorithm that encrypts the data multiple times and results in a cipher text. It uses a different key in each round to encrypt it. I ...
0
votes
1answer
122 views

What happens at this part in the key schedule of a Speck…?

I am trying to figure out the process behind the Speck block cipher. I understand how XOR works (Exclusive-or) when you take 2 strings of bits and you want to XOR them together. However, in the key ...
0
votes
1answer
145 views

What is the role of the round counter in the key schedule of PRESENT?

Currently I am working on PRESENT block cipher implementation (Hardware) and I am unable to understand the role of round counter in key scheduling part of cipher. Can some share some insight on round ...
0
votes
1answer
336 views

What are the subsequent inputs to the DES key schedule after round 1?

I've just been studying the DES crypto algorithm as presented by Christof Paar in his book entitled, Understanding Cryptography as well as his lecture. There is a diagram on page 68 of the text where ...
0
votes
1answer
41 views

Crafting secure block ciphers that lack key expansion

There was some article published by on the IACR's website that outlined a block cipher that only used the "master" key and no round keys. I can't recall the cipher's name, not that it matters, nor do ...
0
votes
0answers
75 views

How secure would AES be with all round keys equal? [duplicate]

In effect the same 128 bit key is XORed at every round and before and after as whitening. Would it be 2^128? What are the dangers of such a naive key schedule and does AES suffer from them? Edit: ...
0
votes
0answers
23 views

Amount of key expansion rounds in AES [duplicate]

I am currently in the process of learning how AES actually works and that works great as of now but when it comes to the Rijndael's key schedule I have a question. From what I have read, I have to ...