# Tag Info

52

Well, yes and no. Triple DES using 3 different keys is still considered secure because there are no known attack which completely break its security to a point where it is feasible nowadays to crack it. The Triple DES algorithm provides around 112 bits of security against bruteforce attacks (when taking into account the meet-in-the-middle attack). For ...

47

That value 0E329232EA6D0D73 was found by brute force. I would be surprised if there was a significantly better method: that would be tantamount to a cryptanalytic break of DES, very different from the few we know. A sketch of the brute force method (with details about parallelization omitted) goes: for each $K$ of 64 bits among the $2^{56}$ valid DES keys ...

34

The main difference is that with two 56 bit keys the maximal security level is 112 bit, and thus an attack that has a cost of $2^{112}$ operations is no attack, whereas for three 56 bit keys the maximal security level is 168 bits, and an attack that has a cost of $2^{112}$ operations counts as an attack. This means that two-key 3DES is still a bit weaker ...

29

This is simply saying that if a cryptosystem has a functional composition that is $$h_{k}(x) = f_{k_1}(g_{k_2}(x))$$ then you can find a key for single encryption that works as the double encryption. For example: consider the permutation cipher where a permutation is a key. The permutations are forming a group, named permutation group, under the ...

26

No. Neuro-Cryptanalysis fails on serious ciphers, including DES and AES. Sebastien Dourlens's Neuro-differential cryptanalysis of DES (in sections 5.4.2 and 5.4.3 of his 1996 mémoire) learns an S-box. Applied to Unix crypt (section 5.4.4), it memorizes passwords/hash pairs (by a training requiring "from several days to several years") and then merely ...

17

Did you try Wikipedia? DES consists of 16 rounds of the form: $$L_{i+1} = R_{i}, \quad R_{i+1} = L_i \oplus F(R_i, K_i),$$ which are identical except for the round subkeys $K_i$. (The last round is slightly different, in that the half-blocks $L$ and $R$ are not swapped as they are after all other rounds, but that makes no cryptanalytic difference.) The ...

17

DES uses a 56-bit key (formally, a 64-bit key, out of which 8 bits are simply ignored), so it represents a family of exactly $2^{56}$ permutations(*). If you were to select a permutation at random among all the permutations of a space of 64-bit blocks, then there are $2^{64}!$ such permutations, a truly huge number, and you would need, on average, $\log 2^{... 15 Parity of DES key bytes was introduced on request of US authorities during the design of DES in the late 1970s: it mitigates the risk of accidental key alteration; in particular, any all-zeros or all-ones byte of the key is rejected by the mandatory odd parity check, and any one-bit alteration is caught, which are advantages from a functionality perspective;... 14 Differential cryptanalysis works on differences. Linear cryptanalysis works on linearity. Neat, isn't it ? Instead of speaking of how they differ, it is easier to list their common features. Both kinds of attacks: Use a lot of known pairs plaintext/ciphertext (many input messages encrypted with the same key, and, for each of them, the attacker knows both ... 14 Decrypt the ciphertext with every possible key and store the result:$2^{56}$decryptions. Now encrypt the (known) plaintext of the ciphertext with every possible key:$2^{56}$encryptions. Now you have to check every entry, which is in both lists and try it with another plaintext-ciphertext pair. If you can successfully decrypt that, you are very likely to ... 14 They are there to check if the key was indeed correctly retrieved. It could for instance be that the key is a result of key decryption or key agreement. In that case, or simply during transmission, wrong keys are used. According to NIST FIPS 46-3: The 8 error detecting bits..." Or even better, Wikipedia states ANSI INCITS 92-1981), section 3.5: One ... 14 I understand that all zeros or all ones would be weak for any cipher. This isn't actually true. For good cipher there are no weak keys. And certain ciphers, e.g. DES, have a list of weak keys. But I assume that there would many 'patterns' that would be detected (if that is the correct term) as weak. For example, 0x0505 ...05, 0x1010...01 and 0x0A0A...0A. ... 11 I add my whitebox AES implementation on GitHub in: C++ Java C++ version implements both Chow's (mixing bijections, input/output encodings, external encodings) and Karroumi's (dual AES in each column) whitebox AES scheme plus Billet's key recovery attack on both schemes. Java implements Chow's scheme only. PS: Due to low reputation I post links to schemes ... 11 Let's look at a picture of a generic feistel cipher Notice that no keying material is used during or after that final swap. So, we can conclude that the final swap does not impact security at all. So, why include it? It is so that all rounds will be identical. This could help with some implementations. That is all. 11 There is none. All cryptography involves the number 2, which is prime, whenever dealing with information in strings of bits—or in esoteric cases like ROT13, well, there's a prime number right there, 13, not to mention that 26, the size of the alphabet on which ROT13 works, is the product of primes 2 and 13. 11 One can still access the challenge rules from the archive.org Each contest is based on a specified cipher. A brief piece of printable ASCII text (containing byte values in hexadecimal notation from 0x20 to 0x7e) will be appended to the fixed 24-character string "The unknown message is:". The result will be padded and then encrypted with the associated ... 11 We use more complex encryption algorithms than XOR with a random or pseudo-random keystream for a number of reasons: In order to get a short secret key in symmetric encryption. XOR with a true random stream (One Time Pad) requires storing or/and transfering a secret keystream the size of the data to encipher, which is utterly impractical. Replacing the ... 10 A good source for this kind of questions is the book The Design of Rijndael by Joan Daemen and Vincent Rijmen. On page 35 they write about their choice for the used S-box$S_{RD}$: Design criteria for$S_{RD}$. We have applied the following design criteria for$S_{RD}$, appearing in order of importance: Non-linearity. a) Correlation. The maximum input-... 10 NIST just recently (11/27/2017) put out a bulletin that Triple-DES will be deprecated in the future, and will be disallowed in protocols like TLS and IPsec, with a future deprecation timeline to be released. NIST is urging vendors to transition TLS implementations to use AES as soon as possible. It will soon be removed from the set of FIPS approved ... 10 No, it will be insecure. There are two reasons; Due to the smaller key size 56-bit; DES was tested for brute-force attack since published. DES_CHALL, 96 days to find the CES challenge key in 1997. EFF DES cracker 56 hours to find the CDES challenge key in 1997. COPACOBANA, an FPGA hardware built for attacking by brute-force for DES, can successfully find ... 9 Within the DES block cipher itself, the XOR operation is used at two different places: On the input of S-boxes, XOR-ing 48 bits per round: 48 bits from a subkey (extracted from the 56-bit key), and 48 bits that are the output of expansion E. The 48-bit result forms the eight 6-bit inputs of the S-boxes. On the output of S-boxes, XOR-ing 32 bits per round: ... 9 Well, one assumption you appear to be making is that, with 2DES, there will be approximately$2^{56}$possible key matches. Actually, there are an expected$2^{48}$possible key matches; here's why: Let us assume we're running the meet-in-the-middle attack on 2DES, and consider an arbitrary incorrect encryption trial (that is, we try an encryption key that ... 9 Efficiently - no. However, the best attack on DES - linear cryptanalysis - works with known plaintexts, and theoretically may work slightly faster than the brute force even for small amounts of data. Computing linear relations between plaintext$P$and ciphertext$C$, an attacker is able to enumerate all keys according to their likelihood. The PhD thesis by ... 9 Re-using their design might be no good idea - there are cheaper designs for sure. This new DES cracker would just need to try every possible key - like the one of the EFF already did. DES was a big standard for encryption, so some people did build such machines, right? Of course did they: COPACOBANA is able to break DES in under 9 days and costs under 10,... 9 It's there to facilitate a simple implementation. As there is no key addition applied afterwards, the final swapping of the halves does not contribute towards security. The Feistel cipher entry on tutorialspoint explains: Decryption Process The process of decryption in Feistel cipher is almost similar. Instead of starting with a block of plaintext, the ... 9 The wikipedia article @SEJPM links to is about as high level of an overview as you can really get. We can elaborate on some of the points. DES is weak against Brute force in this day and age. Actually, it was weak against brute force pretty much as soon as it was standardized. According to the wikipedia article, the cipher was standardized in 1977. Reading ... 9 According to Introduction to Modern Cryptography by Katz and Lindell, in the section titled Security of DES on page 218 in the second edition. After almost 30 years of intensive study, the best known practical attack on DES is still an exhaustive search through its key space... Unfortunately, the 56-bit key length of DES is short enough that an exhaustive ... 9 I answer in hopefully didactic order. What does the author mean by the intermediate texts exactly? The intermediate texts after$n$rounds are the 64-bit quantities$L_n\mathbin\|R_n$, numbering these per the specification of DES.$L_n$and$R_n\$ are the halves. Why after the eighth round of encryption the two halves must be equal? I do not know if ...

8

You run the algorithm with two different plaintexts (whose difference is usually small – just a few bits, everything else being equal). Wherever these plaintexts lead to different inputs to an S-box (in any layer/round of the algorithm), we call this S-Box “active” (since the other S-boxes produce the same result for both plaintexts, they are called “...

Only top voted, non community-wiki answers of a minimum length are eligible