notes/docs/lectures/cryptography/07_aes.md

Advanced Encryption Standard (AES)

• AES superseded DES as a standard in 2002

  

• Uses rounds of 4 layers and a final round of 3

• Bytes are represented as a 4x4 block called the state

Sub-Bytes - similar to s-boxes in DES

Shift Rows - diffusion and permutation round

First row doesn’t move, second row is shifted to the left by 1, the third row is shifted two places to the left etc

Then, when the columns are mixed, this means the overall diffusion is extremely good

The last round doesn’t have a mix column step as it's reversible and wouldn’t add additional security.

S-Box

• The AES s-box is based around the multiplicative inverse of 8-bit values in GF(2^8)
• This is a strongly non-linear mapping

A_i \cdot A_i^{-1} \equiv 1 \space (mod \space P(x)) \\
B'_i = \begin{cases}
0 \quad\quad\quad i=0 \\
A_i^{-1} \quad\space\space\space i > 0
\end{cases}

• Note: 0 maps to 0
• The inverses B'_i then undergo an affine transformation to produce the final s-box
• This destroys any remaining mathematical structure

Remember an affine transformation is a multiplication and addition by two constants (think of the affine cipher)

S-box Properties

• The s-box is simply described, and is bijective, an invertible 1:1 mapping
• It has no fixed points
  • i.e. no A_i for which S(A_i) = A_i
• No inverse fixed points
  • i.e. no A_i for which S(A_i) \oplus A_i = FF
• Minimisation of the largest non-trivial correlation between linear combinations of input bits and linear combinations of output bits
  • 0 is a non-trivial combination
• Minimisation of the largest non-trivial value in the EXOR table
  • This stops differential cryptanalysis

AES Diffusion

Diffusion in AES consists of two layers:

1. Shift rows
2. Mix columns

Shift rows simply moves bytes around the block

Mix Columns

• Performs a linear mixing of bytes within each column
• All the input bytes in a column influence all the output bytes

• Multiplying by 01 does not change the result

When multiplying by x, there’s a shortcut we can implement. We can set the equation equal to 0, and xor by x^4 - x^3 - x - 1

Key Schedule

• The first round key used is just the key
• We then take W[3] and put it through the g function which just permutes it
  • g takes the word, shifts it one to the right and then passes it through the s-boxes
  • We then xor it with RC[i] which is just a constant value to ensure something changes
    • Like for example if we had a bit stream of all 0s

Implementation

1. All additions and subtractions are xor

2. Multiplying by 01 has no effect

3. Multiplying by 02 (which is x) is simply a left shift followed by modular reduction

   • Left shift multiplies by x

   • If the original x^7 bit was set, then we must xor with 0x1B

   • Example:

     // xtime
     if ((a & 0x80) > 0) {
     	a = (a << 1) ^ 0x1b;
     } else {
     	a <<= 1;
     }
     

4. Multiplying by 03 (x+1) is simply xtime(a) ^ a

• Inverse multiplications are by 09, 11, 13, 14. These require either a more general function or lookup tables

• Consider the sum:

  • Product:

    
    a = x^6 + x^4 + x^2 + 1 \\
    b = x^7 + x^4 + x^2 + x \\
    \therefore a\cdot b = a\cdot x^7 + a\cdot x^4 + a\cdot x^2 + a\cdot x
    

  • Repeated multiplication:

    
    a\curvearrowright a\cdot x \curvearrowright a\cdot x^2 \curvearrowright a\cdot x^3 \curvearrowright a\cdot x^4 \curvearrowright a\cdot x^5 
    

  • Here in a\cdot b, a is just being multiplied by various powers of x. This can be easily calculated by repeatedly multiplying a by x.

• AES is very fast in software and pretty fast in hardware

• CPU instructions in AES-NI make AES much faster

• Much of the algorithm can be converted into a series of lookup tables

  • Trade-off between speed and space

• There are numerous cache-timing and other attacks possible

  • Implementation must be constant time
  • CPU instructions help mitigate this

• In general AES is much harder to implement safely than ChaCha20