notes/docs/lectures/cryptography/04_data_encryption.md

Data Encryption Standard (DES)

Pseudorandom Permutations

• A pseudorandom permutation is a function that cannot be distinguished from a random permutation
• Maps a set of values \{0,1\}^n \times \{0,1\}^s \rightarrow \{0,1\}^n such that:
  • For any key, the function F is a bijection (1:1)
  • The key just changes the mapping
  • There is an efficient algorithm to calculate F(x) for all keys and all messages

Confusion: Obscure the relationship between plaintext, key and ciphertext

• Often achieved through substitution operations
  • Using lookup tables

Diffusion: Influence of each plaintext and key bit is distributed throughout the ciphertext

• Achieved via permutation
  • Swapping or otherwise mixing bits/bytes

Shannon called a cipher like this a product cipher

Feistel Network

• A Feistel network is one mechanism used to create block ciphers
• Developed by Horst Feistel while he worked at IBM
• Underpins DES, GOST, Blowfish, Twofish and numerous others.

• To decrypt, we run the encrypted bits through the network again

A Single Feistel Round

• During each round, only half of the block is encrypted

Very similar to a stream cipher.

Round i

Round i+1

Note - the last round does a final swap so the left and right are in the correct places.

Decrypting

Basically the xors cancel themselves out, the most important part is choosing a good function f

About Feistel Networks

• 1 or 2 rounds are not sufficient
• Luby and Rackoff show that if f is a cryptographically secure pseudorandom function then:
  • 3 rounds are sufficient to make a pseudorandom permutation
  • 4 rounds are sufficient to make a strong pseudorandom permutation
• Balanced Feistel networks
  • L and R are equal sizes
• Unbalanced Feistel networks
  • L and R can be different sizes
  • e.g. skipjack, OAEP

DES

1972: NIST put out a call for a US standard for encryption

1974: IBM propose DES

1976: NIST accepts an altered version of DES following consultation with NSA

• Feistel network with 64-bit block size
• 56-bit key
• The most studied cipher in history
  • Hasn’t been broken for over 46 years

This speeds up loading bits into registers

The F function

S_1, S_2.... are called s-boxes. These substitute 6-bit inputs with 4-bit outputs based on lookup tables. The lookup tables for each s-box are different.

Expansion

• Adds diffusion
• Increases from 32 to 48 bits to match the round key

Half the input bits are connected to two output positions

Substitution Boxes

• Add confusion
• The s-boxes map 6-bit inputs to 4-bit outputs
• There are 8 s-boxes in total, each is different

• This s-box is not random, very carefully designed
• s-boxes need to be highly non-linear: S(a) \oplus S(b) \neq S(a\oplus b)
• This prevents simple systems of linear equations such as we saw in LFSRs.
  • The formula needed to represent DES is too complicated
• Key design principles
  1. No output bit should be too close to a linear combination of input bits
  2. 1-bit change input should lead to at least 2-bits output
  3. If you only change the 4 middle bits, each output must occur exactly once
  4. If the first two bits are different but the last two are identical, the output must differ
  5. For any non-zero difference in input, no more than 8 of the 32 inputs exhibiting this difference should share the same output difference
     • We want to limit the number of predictable swaps
  6. A collision (zero difference) is only possible for 3 adjacent s-boxes

Permutation

• At the end of f() is a permutation
• This moves bits between s-boxes on the next round

• Blue showing how S_1 output bits are diffused

The Avalanche Effect

If you input all 0s, we will see a random cipher text

However, if we change one 0 to a 1, how does this affect the result?

• On average, if you change one (first) bit in R, one bit will change in the expansion
• Due to the way the s-boxes are set up, at least 2 of the 4 bits in the output will be different
• Now when the permutation happens, these two changes are spread to other s-boxes
• Now next round we’ll get 4 changes, then 8, then 16 …

For DES the worst case scenario when one bit is changed (with 5 rounds) is there will be an effect on every bit on the output.