18
votes
Accepted
Why expand keys? Why not rather generate a longer key?
There are a few reasons for this. First, the goal of a cipher is to be as secure as possible with the smallest key size. The AES key schedule, although simple, is sufficient for expanding the key into ...
- 15.5k
13
votes
Accepted
Why do Feistel ciphers need round keys?
Iterated ciphers need variability between rounds to resist so callad Slide attacks. One common way to thwart this attack is with a key schedule generating different round keys for each round.
Slide ...
- 146
12
votes
Why do Feistel ciphers need round keys?
This is due to Luby and Rackoff's proof about Feistel networks. The proof assumes the PRFs are independent. See sections 4.5 and 5 of How to Construct Pseudorandom Permutations from Pseudorandom ...
- 32.4k
10
votes
Accepted
In AES Keyschedule : Infer all round keys and cipher key from last round key
For AES-128, it's easy (that is, so easy that there are hardware AES implementations that, in decrypt mode, just store the last round key, and derive all the other subkeys, including the first one, on ...
- 151k
8
votes
AES key expansion question
It looks like this key already has the requisite number of 32 bit words for 128 or 192 (since this is the key expansion for 6 columns or less) but how would you get that from a user's random length ...
- 151k
7
votes
Accepted
Security importance of Key Schedule in Block Cipher
If i use another Key schedule algorithm in AES, then security decreased or remain same?
This really requires a concrete proposal for an alternative key schedule in order to conclude whether or not it ...
- 19.9k
7
votes
AES key expansion question
What is the key object that needs to be accepted by this function?
An array of bytes.
how would you get that from a user's random length password?
The usual practice is using Password-Based Key ...
- 49.5k
6
votes
Why do Feistel ciphers need round keys?
It does not make sense to say that any fixed function $F$ "is a good PRF". A distribution on functions can, however, be pseudorandom (indistinguishable from the uniform distribution over the set of ...
- 126
6
votes
Accepted
AES key expansion for 192-bit
For 192 bit key(AES-192), there are 6 columns of 32 bit each i.e 4x6 Matrix. These 192bits of Master Key are shown as k0,k1...k5, i.e 6 words of 32 bit each.
(See page 44 of Book "The Design of ...
- 2,502
6
votes
Why didn't people redesign the key scheduling algorithm of DES to use longer keys instead of using 3-DES?
Same as the reason of why not switching to AES (or any other 80+ key bits algorithms available at the time).
Because we want to reuse whatever "hardware" (chip design) resources available to do the ...
- 9,810
5
votes
Accepted
Use large key size for RC4 to avoid RC4 bias
Will such a large key size possibly solve any of the bias of the initial bits of the key stream produced by RC4?
There is a bias in the RC4 output at small multiples of the key size; hence a 16 byte ...
- 151k
5
votes
Accepted
Difference with round keys and round constant in AES
Round keys are not the same as round constants. A round constant is always the same no matter what the key is. Round keys, however, are an expanded representation of the AES key being used.
For more ...
- 15.5k
5
votes
Security importance of Key Schedule in Block Cipher
A complementary answer to @Ella Rose's nice answer.
Let's say you are the designer. What exactly would you do without a key schedule? You must use the key bits in some way. Otherwise your block ...
- 23.7k
5
votes
Accepted
Why are multiple rounds with generated subkeys used?
It's true that a badly designed key schedule weakens the cipher.
However the main point is to "stretch" the randomness across all subkeys by using diffusion techniques, while using only $k$ bits of ...
- 23.7k
5
votes
AES key expansion question
It looks like this key already has the requisite number of 32 bit words for 128 or 192 (since this is the key expansion for 6 columns or less) but how would you get that from a user's random length ...
- 94.5k
4
votes
Security of key schedule that only XORs a key with constants
This key schedule is Totally Linear. If two Master Keys $MK$1 and $MK$2 have a difference of d, all the round keys will have difference of d with probability of 1. This makes the cipher vulnerable to ...
- 2,502
4
votes
Accepted
How many rounds of encryption is ideal?
How many rounds cannot really be answered as it depends on the design of a (block) cipher. As many as required to withstand attacks found by crypt-analysis, plus quite few more in case the attacks are ...
- 94.5k
4
votes
Accepted
How complex must round constants be to resist slide attacks?
It depends on the actual block cipher and is quite an open problem. For example, SCREAM, iSCREAM and Midori64 use such key schedule (i.e., its absense) with sparse round constants. They were broken ...
- 3,107
3
votes
Accepted
Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)
It is impossible for computationally bounded adversaries
What you are looking for is impossible in modern stream ciphers. If ever one finds to break a stream cipher in this way, you will see in the ...
- 49.5k
3
votes
Accepted
What happens at this part in the key schedule of a Speck...?
For example, in the key schedule in the link, the result of the binary addition is being XOR d with 0?
It's very simple: In the key schedule, the exclusive-or step after the addition is done with the ...
- 19.9k
3
votes
Accepted
TLS 1.3 key derivation and length of labels used (RFC 8446)
HKDF-Extract consists of a function that uses HMAC, which in itself relies on a hash. So what we need to do is to work backwards from that.
We'll assume SHA-256 with a 64 byte block size as SHA-512 ...
- 94.5k
2
votes
What is the role of the round counter in the key schedule of PRESENT?
to prevent self-similarity of key scheduling
The importance of constant addition (not only present cipher) appears in preventing key schedule-based attacks such as slide attack ,related key attacks ...
- 2,278
2
votes
Accepted
How should k2 be produced in the RC4A stream cipher (A modification of RC4)?
Do the two differing implementations in practice undermine RC4A's security claims by not using a PRBG/PRGA to produce k2?
I wouldn't think so. I get the impression that the authors just intend k2 to ...
- 15.7k
2
votes
Security of key schedule that only XORs a key with constants
The addition of round constants in key-scheduling is to remove self-simlarity. Related key attack (is not practical attack in real life other than academia) will remove the effect of round constants ...
- 2,278
2
votes
Crafting secure block ciphers that lack key expansion
The Even-Mansour construction gives you a block cipher from public, unkeyed permutations $P_1, \ldots, P_n$. It works like:
$$ x \mapsto \cdots P_2(P_1(x \oplus k_0) \oplus k_1) \cdots \oplus k_n $$...
- 14.5k
2
votes
Key scheduling for ISAAC
The author of ISAAC notes:
I provided no official seeding routine because I didn't feel competent to give one. Seeding a random number generator is essentially the same problem as encrypting the ...
- 3,333
1
vote
Accepted
mixing round functions and key schedules
Assuming the 2 algorithms play well together you would end up with a composite of the cryptographic properties of both algorithms - the key schedule would have the properties of ...
- 1,471
1
vote
Why didn't people redesign the key scheduling algorithm of DES to use longer keys instead of using 3-DES?
Just changing the key schedule would improve the security of DES only moderately (at least in the model where high data complexity below exhausting the codebook does not render an attack impractical). ...
- 594
1
vote
Why didn't people redesign the key scheduling algorithm of DES to use longer keys instead of using 3-DES?
The confidence that we have in the security of DES comes from years (decades) of cryptanalytic attempts and research. Any internal change would mean that we would have to re-analyze everything from ...
- 28.2k
1
vote
Difference between Key Scheduling and Key Generation?
Key generation is just a process
Anything is "just a process", executing any algorithm is "just a process". So lets ignore this part of the sentence as it doesn't make sense.
while key scheduling ...
- 94.5k
Only top scored, non community-wiki answers of a minimum length are eligible