Hot answers tagged

54

Well, yes and no. Triple DES using 3 different keys is still considered secure because there are no known attack which completely break its security to a point where it is feasible nowadays to crack it. The Triple DES algorithm provides around 112 bits of security against bruteforce attacks (when taking into account the meet-in-the-middle attack). For ...


47

That value 0E329232EA6D0D73 was found by brute force. I would be surprised if there was a significantly better method: that would be tantamount to a cryptanalytic break of DES, very different from the few we know. A sketch of the brute force method (with details about parallelization omitted) goes: for each $K$ of 64 bits among the $2^{56}$ valid DES keys ...


31

This is simply saying that if a cryptosystem has a functional composition that is $$ h_{k}(x) = f_{k_1}(g_{k_2}(x)) $$ then you can find a key for single encryption that works as the double encryption. For example: consider the permutation cipher where a permutation is a key. The permutations are forming a group, named permutation group, under the ...


29

No. Neuro-Cryptanalysis fails on serious ciphers, including DES and AES. Sebastien Dourlens's Neuro-differential cryptanalysis of DES (in sections 5.4.2 and 5.4.3 of his 1996 mémoire) learns an S-box. Applied to Unix crypt (section 5.4.4), it memorizes passwords/hash pairs (by a training requiring "from several days to several years") and then ...


18

Did you try Wikipedia? DES consists of 16 rounds of the form: $$L_{i+1} = R_{i}, \quad R_{i+1} = L_i \oplus F(R_i, K_i),$$ which are identical except for the round subkeys $K_i$. (The last round is slightly different, in that the half-blocks $L$ and $R$ are not swapped as they are after all other rounds, but that makes no cryptanalytic difference.) The ...


17

DES uses a 56-bit key (formally, a 64-bit key, out of which 8 bits are simply ignored), so it represents a family of exactly $2^{56}$ permutations(*). If you were to select a permutation at random among all the permutations of a space of 64-bit blocks, then there are $2^{64}!$ such permutations, a truly huge number, and you would need, on average, $\log 2^{...


15

They are there to check if the key was indeed correctly retrieved. It could for instance be that the key is a result of key decryption or key agreement. In that case, or simply during transmission, wrong keys are used. According to NIST FIPS 46-3: The 8 error detecting bits..." Or even better, Wikipedia states ANSI INCITS 92-1981), section 3.5: One ...


15

Parity of DES key bytes was introduced on request of US authorities during the design of DES in the late 1970s: it mitigates the risk of accidental key alteration; in particular, any all-zeros or all-ones byte of the key is rejected by the mandatory odd parity check, and any one-bit alteration is caught, which are advantages from a functionality perspective;...


15

What's asked requires choices not explicit in the question: 1. Character encoding into bytes The most common and recommendable convention nowadays is UTF-8, which encodes any character as a sequence of 1 to 4 bytes, including any ASCII character as 1 byte. For these, UTF-8 is compatible with many other earlier conventions that encode each character to a ...


14

Differential cryptanalysis works on differences. Linear cryptanalysis works on linearity. Neat, isn't it ? Instead of speaking of how they differ, it is easier to list their common features. Both kinds of attacks: Use a lot of known pairs plaintext/ciphertext (many input messages encrypted with the same key, and, for each of them, the attacker knows both ...


14

Decrypt the ciphertext with every possible key and store the result: $2^{56}$ decryptions. Now encrypt the (known) plaintext of the ciphertext with every possible key: $2^{56}$ encryptions. Now you have to check every entry, which is in both lists and try it with another plaintext-ciphertext pair. If you can successfully decrypt that, you are very likely to ...


14

I understand that all zeros or all ones would be weak for any cipher. This isn't actually true. For good cipher there are no weak keys. And certain ciphers, e.g. DES, have a list of weak keys. But I assume that there would many 'patterns' that would be detected (if that is the correct term) as weak. For example, 0x0505 ...05, 0x1010...01 and 0x0A0A...0A. ...


12

Good question and yes, it would appear that data is lost. And technically, something clearly must disappear as 6 don't go into 4. But consider the overall architecture of DES: Trace the flow of the left and right halves of an individual block of data. You'll see that the 2 full 32 bit words flow unimpeded down though the Feistel network. No information is ...


12

No, it will be insecure. There are two reasons; Due to the smaller key size 56-bit; DES was tested for brute-force attack since published. DES_CHALL, 96 days to find the CES challenge key in 1997. EFF DES cracker 56 hours to find the CDES challenge key in 1997. COPACOBANA, an FPGA hardware built for attacking by brute-force for DES, can successfully find ...


11

I add my whitebox AES implementation on GitHub in: C++ Java C++ version implements both Chow's (mixing bijections, input/output encodings, external encodings) and Karroumi's (dual AES in each column) whitebox AES scheme plus Billet's key recovery attack on both schemes. Java implements Chow's scheme only. PS: Due to low reputation I post links to schemes ...


11

Let's look at a picture of a generic feistel cipher Notice that no keying material is used during or after that final swap. So, we can conclude that the final swap does not impact security at all. So, why include it? It is so that all rounds will be identical. This could help with some implementations. That is all.


11

NIST just recently (11/27/2017) put out a bulletin that Triple-DES will be deprecated in the future, and will be disallowed in protocols like TLS and IPsec, with a future deprecation timeline to be released. NIST is urging vendors to transition TLS implementations to use AES as soon as possible. It will soon be removed from the set of FIPS approved ...


11

There is none. All cryptography involves the number 2, which is prime, whenever dealing with information in strings of bits—or in esoteric cases like ROT13, well, there's a prime number right there, 13, not to mention that 26, the size of the alphabet on which ROT13 works, is the product of primes 2 and 13.


11

One can still access the challenge rules from the archive.org Each contest is based on a specified cipher. A brief piece of printable ASCII text (containing byte values in hexadecimal notation from 0x20 to 0x7e) will be appended to the fixed 24-character string "The unknown message is:". The result will be padded and then encrypted with the associated ...


11

We use more complex encryption algorithms than XOR with a random or pseudo-random keystream for a number of reasons: In order to get a short secret key in symmetric encryption. XOR with a true random stream (One Time Pad) requires storing or/and transfering a secret keystream the size of the data to encipher, which is utterly impractical. Replacing the ...


11

First of all you should not use DES, it is not secure and, arguably, never has been secure as the key size of 56 bits is well below 128 bits. The strength of the key after analysis is even less than that. All block ciphers operate on blocks of binary input. For DES you'd have an input / output of 64 bit / 8 byte. However, using just DES is not secure; you ...


10

It is of course possible to write DES or any block cipher as a system of non-linear equations involving the plaintext bits, the ciphertext bits, and the key bits, which hold with probability 1. In principle, cracking the cipher would then merely involve collecting enough linearly independent equations (e.g. from a couple different known plaintexts) and then ...


10

A good source for this kind of questions is the book The Design of Rijndael by Joan Daemen and Vincent Rijmen. On page 35 they write about their choice for the used S-box $S_{RD}$: Design criteria for $S_{RD}$. We have applied the following design criteria for $S_{RD}$, appearing in order of importance: Non-linearity. a) Correlation. The maximum input-...


9

Well, one assumption you appear to be making is that, with 2DES, there will be approximately $2^{56}$ possible key matches. Actually, there are an expected $2^{48}$ possible key matches; here's why: Let us assume we're running the meet-in-the-middle attack on 2DES, and consider an arbitrary incorrect encryption trial (that is, we try an encryption key that ...


9

Efficiently - no. However, the best attack on DES - linear cryptanalysis - works with known plaintexts, and theoretically may work slightly faster than the brute force even for small amounts of data. Computing linear relations between plaintext $P$ and ciphertext $C$, an attacker is able to enumerate all keys according to their likelihood. The PhD thesis by ...


9

I think I got it: I'm going to show that after round i the result will be $\overline{L_i}$ and $\overline{R_i}$ when the input was $\overline{L_{i-1}}$ and $\overline{R_{i-1}}$ and using $\overline k$ as key. $L_i=R_{i-1} \implies \overline{L_i} = \overline{R_{i-1}}$ $\overline{R_i} = \overline{L_{i-1}} \oplus f(\overline{R_{i-1}}, \overline{k_i}) = \...


9

Re-using their design might be no good idea - there are cheaper designs for sure. This new DES cracker would just need to try every possible key - like the one of the EFF already did. DES was a big standard for encryption, so some people did build such machines, right? Of course did they: COPACOBANA is able to break DES in under 9 days and costs under 10,...


9

DES is slow in software because it was designed back in the early 70's even before the 8086 processor existed, and uses several bit oriented operations that are just not implemented efficiently in a processor with a word oriented instruction set. Its intended product was ASIC hardware designs, in which DES runs quickly. DES hardware processors are quite ...


9

It's there to facilitate a simple implementation. As there is no key addition applied afterwards, the final swapping of the halves does not contribute towards security. The Feistel cipher entry on tutorialspoint explains: Decryption Process The process of decryption in Feistel cipher is almost similar. Instead of starting with a block of plaintext, the ...


9

The wikipedia article @SEJPM links to is about as high level of an overview as you can really get. We can elaborate on some of the points. DES is weak against Brute force in this day and age. Actually, it was weak against brute force pretty much as soon as it was standardized. According to the wikipedia article, the cipher was standardized in 1977. Reading ...


Only top voted, non community-wiki answers of a minimum length are eligible