8
votes
Accepted
Linear Approximation Table of S-Box for SPN
In Howard Heys' tutorial, the S-box $S$ maps 4 bits to 4 bits. It is defined by the following lookup table:
...
- 136
8
votes
Why is AES not a Feistel cipher?
The simple answer is "Because its an SPN cipher".
What is difference between Feistel and SPN?
SPN operates on whole data in one round, where as Feistel divides data into N parts where N>=2 , then ...
- 2,397
6
votes
Accepted
What is the diffrence between Feistel networks and SPN?
In a Feistel networks (from the German IBM cryptographer Horst Feistel), the input is divided into two blocks ($L_0$ and $R_0$) which interact with each other. Main example is DES.
basic construction:...
- 9,969
6
votes
modified substitution permutation networks
Your construction is completely insecure: a single known plaintext / ciphertext block pair is sufficient to decrypt all blocks encrypted with the same key.
Specifically, let me write your block ...
- 45.9k
5
votes
Accepted
Substitution-permutation network visualizer
You might be interested in TikZ for Cryptographers:
PGF/TikZ is a tandem of languages for producing vector graphics from a geometric/algebraic description. PGF is a lower-level language, while TikZ ...
- 19.5k
4
votes
Accepted
modified substitution permutation networks
So, the mixing of the $n$ keys is at most as secure as having a uniformly distributed single key. If your key randomness is not strong, doing this kind of mixing can make the key distribution nearer ...
- 21.2k
4
votes
DES/AES invertibility
DES is a Feistel cipher where the round function doesn't need to be invertible. Therefore, when designing a Feistel cipher you will have invertible and non-invertible S-box options.
In contrast, AES ...
- 47.6k
4
votes
Substitution-permutation network visualizer
I know of no software that lets you visualize an arbitrary SPN network; however, many of us on the semiconductor side of things have their verification tools output visualizations based on the bit ...
- 4,625
4
votes
Accepted
What does this notation means $\mathbb{F}_{2^{-}}$?
You've been confused by the placement of the "-".
It's not $\mathbb F_{2^-}$ (Latex: $\mathbb F_{2^-}$), this does not exist. What was actually meant is $\mathbb ...
- 45.7k
3
votes
Using a round function intended for an SP network in a Feistel network?
There is only one requirement for a Feistel round function and that is a good diffusion and confusion. It is not required for the round function to be invertible in a Feistel network. You can use (as ...
- 9,969
3
votes
Accepted
Attacking a one-round SPN
If we're talking about Katz and Lindell, it might be worth investing in a newer edition. My (third) edition section 7.2.1 on page 225 reads:
A better attack is possible by noting that individual bits ...
- 21.9k
3
votes
16-bit entry in a S-Box of a SPN block cipher: Would it have the same speed/performance than a 8-bit entry?
Firstly note that a $2^{16}$-long look up table of 16-bit=2-byte entries takes up 131,072 bytes of space.
Your question is very architecture dependent. For speedy encryption you would want the S-...
- 21.9k
3
votes
Accepted
Is it possible to use words of bits as entries in S-Boxes bigger than 4/8 bits and achive similar security/speed in SPN block ciphers?
There's an ambiguity in the term S-box as to whether it means a general look-up table or specifically a bijective substitution function. I've seen both uses.
If we mean a general look-up table, then ...
- 21.9k
2
votes
Differential analysis of SPN
I would disagree with the answer by @kodlu. In classic differential cryptanalysis, we don't pay "probability" for the last rounds, but rather we pay for the enumeration of the involved key ...
- 3,057
2
votes
Definition Problem for toy SPN
Definition 3.1 : Let $\pi_S:\{0,1\}^m\rightarrow \{0,1\}^n$ be a S-box. Consider an (ordered) pair of bitstrings of length $m$, say $(x,x^*)$. We say that input XOR of the S-box is $x\oplus x^*$ and ...
- 21.2k
1
vote
Accepted
How round constants are chosen in a block cipher?
The constants used in block cipher, much like ones used in many other symmetric cryptographic algorithms, depend on what the algorithm needs in terms of security. For block ciphers, the most common ...
- 2,971
1
vote
Substitution-Permutation Network (SPN) Example
The question is read as;
We have Substitution–Permutation Network (SPN)
a block cipher with block size $lm$
Round key addition with $K^r$
$\pi_s$ is the diffusion part and it is S-box of input-output ...
- 47.6k
1
vote
Is the order of applying transformations in SP cryptosystems significant?
It depends on the cryptosystem if the order of transformations matters to security.
In the example of DES, we can't quite exchange S and P as considered in the question. That's because the input of S ...
- 138k
1
vote
Is the order of applying transformations in SP cryptosystems significant?
Let call the Substitution by $S$ and Permutation by $P$ in the Substitution Permutation Network (SPN). Let consider an SPN block cipher with $4$ rounds where $K$ represents the $\oplus$ round key.
...
- 47.6k
1
vote
Differential analysis of SPN
The reason $R=n-1$ (or $R=1,$ applied to the decryption mapping) is used is the following. All the individual differential approximations as well as the differential trail which is chosen over the $R$ ...
- 21.2k
1
vote
Construction of key recovery attack in O(2^(n/2))
Well, you said that this was a "practice problem"; hence you're supposed to learn from it, so I won't give you the answer.
I will give you a hint: you have $E_k(M) = \Pi(M \oplus K) \oplus K$...
- 145k
1
vote
Can we design a block cipher based on SP-network without loss of E/D similarity theoretically?
Actually, to deal with the conflict between the inverse SBOX and E/D similarity, we can just expand the original SP network into something like "$S$->$P$->(entangled with key)->$P^{-1}$-&...
- 145
1
vote
substitution-permutation network construction
Assuming your key mixing layer uses XOR:
$M \oplus K_0 \oplus K_1 \oplus ... K_r$
$K_0 \oplus K_1 \oplus ... K_r$ effectively compresses into one, single key
Equivalent to $M ^ K$ in terms of ...
- 19.5k
Only top scored, non community-wiki answers of a minimum length are eligible