Key Exhaustive Search Brute Force Attack 1 DESChallengeI

Key Exhaustive Search (Brute Force Attack) 1

DES-Challenge(I) RSA Data Security Inc’s protest against US’s export control(‘ 97) ◦ $10, 000(‘ 97) award ◦ Key search machine by Internet Loveland’s Rocker Verser ◦ 60. 1 Billion/1 day key search, succeeded in 18 quadrillion operations and 96 days ü 25% of Total 72 quadrillion (1 q=1015 =0. 1 kyung) ü 90 MHz, 16 MB Memory Pentium(700 Million/sec) ◦ http: //www. rsa. com/des/ 2

DES-Challenge(II, III) Distributed. Net + EFF ◦ 100, 000 PC on Network ◦ 56 hr EFF(Electronic Frontier Foundation) ◦ http: //www. eff. org/DESc racker ◦ Specific tools ◦ 22 hr 15 min ◦ 250, 000$ P. Kocher 3

COPACOBANA Cost-Optimized Parallel Code Breaker Machine by Univ. of Bochum, Germany and Kiel Commercially available 120 FPGA’s of type XILINX Spartan 3 -1000 run in parallel 10, 000$ of ¼ of EFF project 4

Other Block Ciphers 5

FEAL(I) P(64) K 8, K 9, K 10, K 11 L 0(32) K(64) R 0(32) f. K K 0 (K 0, K 1) f(R 0, K 0) f. K (K 2, K 3) L 7(32) R 7(32) K 7 f(R 7, K 7) f. K (K 14, K 15) R 8(32) L 8(32) K 12, K 13, K 14, K 15 C(64) Fast data Encipherment ALgorithm by A. Shimizu & S. Miyaguchi, NTT, Japan, ‘ 87 6

FEAL(II) f K function f (Ri, Kj)-function Kj(16 bit) k 0 S 0 S 1 a 0 a 1 a 2 a 3 r 0 S 1 (32 bit) k 1 a(32 bit) S 1 b 1 r 1 R i (32 bit) r 2 b 0 b 2 S 0 b (32 bit) b 3 S 1 r 3 f. K(a, b) Sd(X 1, X 2)=Rot 2((X 1+X 2+d) mod 256) where, d=0 or 1, X 1 and X 2 : 8 bit, Rot 2(Y) : 2 -bit left rotation of 8 -bit Y K 2(r-1) : Left half of f. K(a, b), K 2(r-1)+1 : right half of f. K(a, b) 7

FEAL(III) FEAL-n (Attack Method) Data Complexity Known Chosen Storage Complexity Processing Complexity FEAL-4 (LC) 5 - 30 Kb 6 min. FEAL-6 (LC) 100 - 100 Kb 40 min. FEAL-8 (LC) 224 10 min. FEAL-8 (DC) 27 pairs FEAL-16 (DC) 229 pairs 230 op. FEAL-24 (DC) 245 pairs 246 op. FEAL-32 (DC) 266 pairs 267 op. 280 Kb 2 min. 8

Lai’s Classification of “E/D-Similar” Iterated Ciphers (I) Involution Ciphers Only X In() Z(1) Z In() Z(2) In() Y Z(r) Key Schedule Algorithm To decrypt : Reverse the Key Schedule 9

Lai’s Classification of “E/D-Similar” Iterated Ciphers (II) Involution Ciphers and Involutary Permutations X In() PI Z(1) Z In() PI Z(2) PI In() Y Z(r) Key Schedule Algorithm To decrypt : Reverse the Key Schedule Ex) DES, FEAL, LOKI, etc. 10

Lai’s Classification of “E/D-Similar” Iterated Ciphers (III) * Group Ciphers Only X Y Z(1) Z Z(2) Z(r) Key Schedule Algorithm To decrypt : Reverse the Key Schedule and replace each subkey by its group inverse. 11

Lai’s Classification of “E/D-Similar” Iterated Ciphers (IV) (III) Group Ciphers and Involution Ciphers In() X ZA(1) Z ZB(1) In() ZA(2) ZB(2) In() ZA(r) ZB(r) Y ZA(r+1) Key Schedule Algorithm To decrypt : Reverse the Key Schedule and replace each A-key by its group inverse. Ex) PES (*) Never should be used … equivalent to one encipherment with Z(1) Z(2) … Z(r) 12

(IV) Group Ciphers, Involution Ciphers and Involutary Permutations such that PI(a b) = PI(a) PI(b) In() X ZA(1) Z ZB(1) PI In() PI ZA(2) ZB(2) In() ZA(r) ZB(r) Y ZA(r+1) Key Schedule Algorithm There is no PI in the last round. To decrypt : Reverse the Key Schedule and replace ZA(1) and ZA(r+1) by its group inverse and replace all other A-subkeys by the group inverses of their involutary permuted values [ PI(Z-1) = (PI(Z))-1]. Ex) IDEA 13

IDEA(I) X 1 X 2 (1) X 3 (1) Z 1 Z 2 X 4 (1) Z 3 Z 4 Z 5(1) Pt (64 bit) P=(X 1, X 2, X 3, X 4) Ct (64 bit) C=(Y 1, Y 2, Y 3, Y 4) Zi(r) (16 bit) : r -round key block round 1 : Xor : Mul. mod (216+1) Z 6(1) : Add. mod (216) : MA structure All lines : 16 bit round 2 -8 7 more rounds (9) Z 1 Z 2 Y 1 Y 2 (9) Z 3 Z 4 Y 3 Output Transformation Y 4 IDEA (International Data Encipherment Algorithm) 14

IDEA(II) Divide 128 -bit key into 52 16 -bit word (1) Divide 128 -bit into 8 blocks and use 6 blocks for round key (2) 25 -bit left rotate of 128 -bit (3) Repeat steps (1) and (2) till 8 -round 8 Round Key block for Encryption / Decryption Round 1 2 3 4 5 6 7 8 Output Encryption Key Block Decryption Key Block Z 1(1) Z 2(1)Z 3(1)Z 4(1)Z 5(1)Z 6(1) Z 1(2) Z 2(2)Z 3(2)Z 4(2)Z 5(2)Z 6(2) Z 1(3) Z 2(3)Z 3(3)Z 4(3)Z 5(3)Z 6(3) Z 1(4) Z 2(4)Z 3(4)Z 4(4)Z 5(4)Z 6(4) Z 1(5) Z 2(5)Z 3(5)Z 4(5)Z 5(5)Z 6(5) Z 1(6) Z 2(6)Z 3(6)Z 4(6)Z 5(6)Z 6(6) Z 1(7) Z 2(7)Z 3(7)Z 4(7)Z 5(7)Z 6(7) Z 1(8) Z 2(8)Z 3(8)Z 4(8)Z 5(8)Z 6(8) Z 1(9) Z 2(9)Z 3(9)Z 4(9) Z 1(9)-1 _Z 2(9) _Z 3(9)Z 4(9)-1 Z 5(8)Z 6(8) Z 1(8)-1 -Z 2(8) _Z 3(8)Z 4(8)-1 Z 5(7)Z 6(7) Z 1(7)-1 -Z 2(7) _Z 3(7)Z 4(7)-1 Z 5(6)Z 6(6) Z 1(6)-1 -Z 2(6) _Z 3(6)Z 4(6)-1 Z 5(5)Z 6(5) Z 1(5)-1 -Z 2(5) _Z 3(5)Z 4(5)-1 Z 5(4)Z 6(4) Z 1(4)-1 -Z 2(4) _Z 3(4)Z 4(4)-1 Z 5(3)Z 6(3) Z 1(3)-1 -Z 2(3) _Z 3(3)Z 4(3)-1 Z 5(2)Z 6(2) Z 1(2)-1 -Z 2(2) _Z 3(2)Z 4(2)-1 Z 5(1)Z 6(1) Z 1(1)-1 -Z 2(1) _Z 3(1)Z 4(1)-1 Zi(j)-1 : multiplicative inverse of Zi(j) mod (216+1), -Zi(j) : additive inverse of Zi(j) mod 216 15

RC-5(I) History on Ron’s Code ◦ ◦ ◦ RC-1: never published RC-2: 64 -bit block, 1987 RC-3: broken RC-4: stream cipher RC-6: 128 -bit block, AES-finalist, 1997 RC 5: 32/64/128 –bit block, 1994 ◦ Variables; w : word length (16, 32) r : number of round (0 -255) b : key byte (0 -255) Ex) RC 5 -32/12/16 : 100 Kb, 586 PC To prevent weak key, use magic constant (e, ) in key scheduling Ease for H/W & S/W Implementation 16

RC-5(II) A Encryption B S[0] S[1] A = A + S[0] B = B + S[1] for i=1 to r do A= (A B)<<B) + S[2*i] B= (B A)<<A) + S[2*i +1] - S[i] : Round Key 1 round << S[2*i] : XOR << << S[2 *i +1] A : Rotation : addition mod 2 w B 17

GOST Russia: GOvernment STandard 28147 -89 internal specification(unpublished) 64 -bit block cipher, 32 round 256 -bit main key & 512 -bit subkey No Key Scheduling Modify f-function of DES : 4 x 4 k-box 18

MISTY Matsui, Ichigawa, Sorimachi, Tokita, Yamagishi in Mitsubishi co. 64 -bit Block cipher, 128 -bit key, 8 Round Provable security against DC and LC By using recursive structure 30 Mb/s (HP 9735, PA 7150 -125 MHz) Known as KASUMI for 3 GPP group 19

Skipjack Classified 64 -bit block for replacing -> Internal structure published ‘ 98 80 -bit key, 32 round Used for Clipper Project with Key Escrow ECB, CBC, 64 bit OFB, {1/8/16/ 32} bit CFB 20

Blowfish(I) Bruce Schneier, et al. XOR, Addition for 32 bit CPU 64 bit block, 448 bit key, 8 x 32 S-box 16 round Takes long time for key scheduling 21

Blowfish(II) L(32) K 1 32 R(32) F 32 K 2 F 13 more rounds F(XL)=(((S 1 + S 2 mod 232) S 3, ) +S 4) mod 232 S 1, S 2, S 3, S 4 : 4 8 x 32 S-boxes K 16 F K 17 K 18 L 16(32) R 16(32) 22

SEED(I) (Korean Data Encryption Standard) ◦ 128 -bit symmetric block cipher ◦ developed by KISA, ETRI, ADD + a Reference ◦ KRypto. Gate (Korean c. RYPTOgraphers' GATEway) http: //www. cryptogate. com ◦ http: //dosan. skku. ac. kr/~sjkim/Kr. Standard. html 23

SEED(II) Introduction ◦ ◦ Symmetric Block Cipher Block size, key size : 128 -bit Feistel structure 16 round Design criteria ◦ Provide security proof ◦ Secure against DC, LC, Higher order DC, and Related key attack ◦ Faster than 3 -DES in software ◦ Use nonlinear function for round-key generation 24

SEED(III) F-function G-function 25

SEED(IV) F-function G-function 26

SEED(V) Round-key generation in pseudo-code Input 128 -bit key (A, B, C, D) Output round keys Ki, j 27

Others TEA (Tiny Encryption Algorithm) for RFID/USN, XTEA, XXTEA ARIA, Serpent, Baseking, BATON, BEAR&LION, C 2, Camellia, CAST-128, 256, CIPHERUNICORN, CMEA, Cobra, Coconut 98, Crypton, DEAL, E 2, FROG, G-DES, Hasty Pudding Cipher, Hierocrypt, MUITL 2, New Data Seal, SAFER-64, 128, SHACAL, Square, Xenon, etc…. 28

Summary of Block Ciphers Algorithm Year Country Pt/Ct Key Round DES 1977 USA 64 56 16 FEAL 1987 Japan 64 64 4, 8, 16, 32 GOST 1989 Russia 64 256 32 IDEA 1990 Swiss 64 128 8 LOKI 1991 Australia 64 64 16 SKIPJACK 1990 USA 64 80 32 MISTY 1996 Japan 64 128 >8 SEED 1998 Korea 128 16 29