Block Ciphers

Chester Rebeiro
IIT Madras

CR STINSON : chapters 3
 Block Cipher

KE KD

Alice untrusted communication link Bob

E D
#%AR3Xf34^$ Attack at Dawn!!
message encryption (ciphertext) decryption
Attack at Dawn!!

Encryption key is the same as the decryption key (KE = KD)

CR 2
 Block Cipher : Encryption
Key Length
Secret Key
Plaintext Ciphertext

Block Cipher
(Encryption)

Block Length
A block cipher encryption algorithm encrypts n bits of plaintext at a time
May need to pad the plaintext if necessary
y = ek(x)
CR 3
 Block Cipher : Decryption
Key Length

Secret Key
Ciphertext Plaintext

Block Cipher
(Decryption)

Block Length

A block cipher decryption algorithm recovers the plaintext from the ciphertext.
x = dk(y)

CR 4
 Inside the Block Cipher
PlaintextBlock
(an iterative cipher)
Key Whitening

Round 1 key1

Round 2 key2

Round 3 key3

Round n keyn
Ciphertext Block

Each round has the same endomorphic cryptosystem, which takes a key and
produces an intermediate ouput
Size of the key is huge much larger than the block size.
CR 5
 Inside the Block Cipher
(the key schedule) Secret Key
PlaintextBlock

Key Whitening

Round 1 Round Key 1

Round 2 Round Key 2

Key Expansion
Round 3 Round Key 3

Round n Round Key n

Ciphertext Block

A single secret key of fixed size used to generate round keys for each round

CR 6
 Inside the Round Function
Round Input

Add Round key : Add Round Key

Mixing operation between the round input
and the round key.
typically, an ex-or operation Confusion Layer
Confusion layer :
Makes the relationship between round Diffusion Layer
input and output complex.
An attacker cannot determine the round key even
after knowing large number of input-output pairs. Round Output
Diffusion layer :
dissipate the round input.
Avalanche effect : A single bit change in the round input should cause
huge changes in the output.
Makes it difficult for the attacker to pick out some bits over the others
(think Hill cipher)

CR 7
 Achieving Confusion and Diffusion
(Substitution-Permutation Networks)
Confusion achieved by small substitution functions
Diffusion achieved by diffusion functions
Permutations
Linear Transformations

CR 8
 Diffusion with Permutations

Spreads the output of one s-box to other s-boxes

Thus causing a diffusion.
A single bit change in one input (before S1 for instance) affects four inputs of the next
round

Bit wise permutations efficient in hardware but not in

software implementations

CR 9
 Permutation Layer Types 0 1 2 3 23

straight (24x24)
0th bit of input goes
to 1st bit of output 0123 23
1st bit of input goes
to 15th bit of output 012 11

expansion (12x24)

0123 23
compression (24x12) 012 23

CR 012 11 10
 Permutation Layer (more variants)
Common permutation operations which are used in block
ciphers
circular shift
Circular shift input N bits to right (or left)
swap
Special case of circular shift with shift = N/2

CR 11
 Diffusion with Linear Transformation
Linear combination of the inputs (can be done byte wise;
more software friendly, as no bit manipulations needed)
x1 y1
x2 y2 Example.
* x3 = y3 The AES mix column operation
x4 y4

How to choose the linear transformation in the Permutation

layer?
Need to have good diffusion properties
Should have Maximum Branch Number
BranchNumber = MIN ( a 0 ) (W ( a) + W ( F (a ))

CR 12
 Branch Number
BranchNumber = MIN ( a 0 ) (W (a) + W ( F (a ))

Byte Vector : Number of non-zero input bytes

W(a) : Byte vector of input (i.e. non-zero bytes in a)
W(F(a)) : Byte vector of output (i.e. non-zero bytes in the output)
x1 y1
x2 y2 Example.
* x3 = y3 The AES mix column operation
x4 y4

example: AES mix column matrix has a branch number of 5

1 non-zero byte in input causes all 4 bytes of output to change
2 non-zero byte in input causes at-least 3 bytes of output to change (and so on)

CR 13
 Substitution Layer
(Sbox)
A lot of the block ciphers security rests with this.
Replaces its input with another

As with the permutation layer, can be

straight sbox (mxm)
expansion sbox (mxn, m<n)
compression sbox (mxn, m>n)

CR 14
 Sboxes
In an s-box each output bit can be
represented as a function of its input bits
y1 = f1 ( x1 , x2 , x3 , L , xm )
x1 x2 x3 x4 xm y2 = f 2 ( x1 , x2 , x3 ,L , xm )
y3 = f 3 ( x1 , x2 , x3 , L , xm )
sbox
M M M M M
yn = f n ( x1 , x2 , x3 ,L , xm )
y1 y2 y3 y4 yn
The functions have to be non-linear.
Linear functions are easily reversed.

CR 15
 S-boxes are Non-linear
transformations x1 x2 x3 x4 xm

sbox

y1 y2 y3 y4 yn

CR 16
 example : Simplified DES SBox
a b c d

S0 y = S 0( x )
q || r = S 0[a || d ][b || c]

q r

Non-linear equations for S0

CR http://mercury.webster.edu/aleshunas/COSC%205130/G-SDES.pdf 17
 Why Non-linearity?
x1 x2 x3 x4 xm
We want to make it difficult for reversing an s-box:
i.e. determine x from y sbox

y1 y2 y3 y4 yn
Solving linear equations can be done in polynomial time
Solving non-linear equation is NP hard

Note the difference with the permutation layer, which is a linear layer. The main purpose of
the permutation layer is to provide diffusion and not to confuse!

CR 18
 ex-or (An Important Operation)
Used considerably for key addition

CR 19
 Block Cipher Design Techniques
Substitution-Permutation Networks (SPN)
AES, PRESENT, SHARK
Feistel Ciphers
DES, CLEFIA, SERPENT, RC5, and many more

CR 20
 A Four Round SPN Block Cipher
An SPN block cipher contains repeating
rounds of
Key addition
Add randomization
Substitution
A non-linear layer
Diffusion
A linear layer for spreading
The repeating randomization, non-
linear and linear layers makes it
difficult to cryptanalyse
Used in ciphers such as
AES (Advanced Encryption Standard)
PRESENT (The Light weight block cipher standard)

SPN: Substitution Permutation Network

CR 21
 Diffusion in the SPN

A single bit of plaintext gets

diffused to all bits of the
ciphertext.
If a single bit in the plaintext is
flipped
Each bit of the ciphertext will flip
with probability 1/2
In other words, half the bits of the
ciphertext will flip.
If, even a single bit of the key is
wrong, half the bits of the
ciphertext is flipped

CR 22
 Decryption
Is the reverse process
Start with the ciphertext and do all
operations in the reverse order
The round keys are applied in the reverse
order
Permutation layer should be inverse
Substitution (S-boxes) should be inverse
This also means that the inverse of the s-box
should exist

CR 23
 Feistel Ciphers
A popular technique for designing block ciphers
Examples: DES, RC5, CLEFIA,
Does not require invertible substitution and permutation
layers
round input split
into two parts Li-1 Ri-1 Encryption
Li-1 and Ri-1
Li = Ri
F Ki-1 Ri = Li F ( Ri 1 , K i 1 )
Decryption
Ri 1 = Li
Li 1 = Ri F ( Li 1 , K i 1 )
round output Li Ri

CR 24
 What does F contain?
contains : key mixing, substitution, permutation
A single round of DES

32 bit 32 bit

Li-1 Ri-1

Ki-1

Li Ri

the sboxes (S1 to S8) are 6x4 they are not invertible
CR 25
 plaintext
L1 R1
3 round Fiestel cipher
F
Iterative
L2 R2

L3 R3

L4 R4
CR ciphertext 26
 Linear Cryptanalysis

CR 27
 Non-linearity in S-boxes
In the 1970s, cryptographers took a lot of care in
designing s-boxes x x x x xm
1 2 3 4
each output bit of the s-box was the
output of a complex non-linear function
sbox
of the input bits. Like this
y1 y2 y3 y4 yn
also, the value of each output bit was un-biased
i.e. Pr[ y = 0] = Pr[ y = 1] = 1 2
i i for 1 i n

This meant that it was difficult to infer anything about x

from an output bit

However.
CR 28
 Linear Approximations
they overlooked about linear combinations of the s-box
output which turned out to be biased...such as
Pr[ y1 x1 x5 x7 = 0] << 1 or low probability of occurrence
2
Pr[ y1 x1 x5 x7 = 1] >> 1 high probability of occurrence
2

This bias was exploited by Mitsuru Matsui in 1993 to attack

DES. The attack was known as linear cryptanalysis
it is a known plaintext attack
required 243 known plaintext-ciphertext pairs to break DES

background needed for the understanding the attack

CR 29
 Bias
(A measure of deviation from uniform randomness)
Consider discrete independent random variables over {0,1}

Let thus for i=1,2,3,.

Due to independence, the joint probability is obtained by simply

multiplying. Thus for i j,

Consider discrete random variables where i j

CR 30
 Bias
Define bias of Xi as

Some properties of the bias

1

2 3

Pr[ X i X j = 0] = Pr[ X i = 0] Pr[ X j = 0] + Pr[ X i = 1] Pr[ X j = 1]

4 1 1 1 1 1
= + i + j + i j = + 2 i j
2 2 2 2 2

If the bias is 0 then Xi can take values of 0 or 1 with equal

probability
The further the bias is from 0 (ie. close to 1/2) then Xi takes 0 with
higher (or lower) probability
The bias is therefore a measure of the randomness

CR 31
 Linear Approximations of an s-box
How to construct?

X1 X2 X3 X4

sbox

Y1 Y2 Y3 Y4

Represent the s-box in binary

as in the following table

CR 32
 Linear Approximations of an s-box
Consider a linear combination of inputs and ouputs
For example X 1 X 4 Y2 and fill in the truth table

1
0
1 #1s = 8
1
0
#0s = 8
0
0 p = Pr[ X 1 X 4 Y2 = 0] = 1 / 2
1
1
1 = p =0
0 2
0
1
0
0
1 unbiased
1

CR 33
 Linear Approximations of an s-box
Consider a linear combination of inputs and ouputs
for example X 1 X 2 X 3 Y2 and fill in the truth table

1
1
0 #1s = 10
1
1
#0s = 6
0
0 p = Pr[ X 1 X 2 X 3 Y2 = 0] = 3 / 8
0 1 1
1 = p = = 0.125
1 2 8
1
1
1
0
1
0 biased

CR 34
 Linear Approximations of an s-box
Consider another example X 3 X 4 Y1 Y4 and fill in the truth table

1
1
0 #1s = 14
1
0
#0s = 2
1
1 p = Pr[ X 3 X 4 Y1 Y4 = 0] = 1 / 8
1
1 3
1 = p = = .375
1 2 8
1
1
1
1
1 Highly biased
1

CR 35
 Linear Approximation Tables
NL (a, b) 8
( a, b) =
16

X 3 X 4 Y1 Y4

X 1 X 4 Y2

X 1 X 2 X 3 Y2

Linear Approximation Table

(captures number of 0s in the truth table)
CR 36
 What does the linear x3 x4

approximations mean
X 3 X 4 Y1 Y4
y1 y4
If we do the following
while(large number of times){
generate a random plaintext
z = ex-or(x3,x4,y1,y4)
}

The probability that z takes the

value 0 is 1/8

How do we use this fact to attack

the block cipher?

CR 37
 Piling-up Lemma
Consider two linear combinations of random variables
X A = X1 X 2 X 3 having bias A
X B = X4 X5 X6 having bias B
What is the bias of X A X B ?
The resulta nt bias AB can be computed by the Pilingup Lemma

Proof by Mathematical Induction

CR 38
 The General Attack
Scheme
1. Use piling up lemma to identify linear trails
in the cipher, which have high bias.
Compute the bias till the pen-ultimate round
2. To determine k = (K5,5 --- K5,8)do the
following
a. Guess the value of k (16 possibilities)
b. Compute S-1(k ^ ci) for each ciphertext
(we get a distribution)
c. Determine if the bias matches the
theoretical estimates.

CR 39
 Applying Piling-up Lemma
for the cipher
a = 1011, b = 0100, N L = 12,
= 1/ 4
Find paths which are highly
biased

a = 0100, b = 0101, N L = 4,
= 1 / 4

a = 0100, b = 0101, N L = 4,
= 1 / 4

CR 40
CR 41
 From the cipher

Thus,

Now,, the key part is a constant (either 0 or 1)

Thus, bias of
is either +1/32 or -1/32 depending on the key bits

CR 42
 The Linear Cryptanalysis Attack
The attacker needs
A large number of plaintext-ciphertext pairs
We denote each pair by (x,y) x: plaintext, y:
ciphertext
For the Toy cipher above (approx 8000)
For a cipher like DES 248
all plaintexts are encrypted with the same key
The attack
5
1. Guess k <52>and k < 4> (256 possibilities)
4
2. For each y<52> and y<4>> compute v<2>and v<4>>
5 4

3. Then compute inv-sbox(v<42>) and inv-sbox(v<44> )

to obtain u<42>and u<44>
4. Now compute v<44>
v<42>
k<52> k<54>

y<52> y<54>
If the key guess is correct, the bias of z must be 1/32
(i.e. z must be 0 (or 1) with probability 1/2 1/32)
If the key guess is wrong, the bias of z must be 0
(i.e. z must be 0 (or 1) with probability 1/2)
CR 43
 The Linear Cryptanalysis Attack
The plaintext-ciphertext pair array Inverse s-box
Number of the ptext-ctext pairs
This is the guessed key which varies from 0
to 255.

For a key guess, Count counts how often

z=0. For the correct key guess, count
should be highest

For each plaintext-ciphertext pair

Compute u<42> and u<44>

Increment count if z=0

Determine most probable key byte of the256

possible keys
The correct key should have max count value
Wrong keys should have count value
CR approximately T/2 44
 Differential Cryptanalysis

CR 45
 Differential Cryptanalysis
Attributed to Eli Biham and Adi Shamir in
CRYPTO90
Althought, the idea was known in the 1970s by
IBM (and the NSA)
In IBM, this used to be known as T-attack or Tickle
attack
Differential cryptanalysis is a chosen plaintext
attack
It requires 247 chosen plaintexts to break DES

CR 46
 Differentials
If we have two Boolean linear equations such as
A = a b k1 k 2 B = c d k1 k 2
Then, the differential is their ex-or
A B = a b c d
Note that the common terms are cancelled out

CR 47
 Differentials of an s-box
x1 x2 x3 x4
Let x and x* be the inputs to an s-box
Let y and y* be the corresponding outputs sbox
Differential Input : x' = x x *

Differential Output : y ' = y y * y 1 y2 y3 y4

If x is (1011)2 :

CR 48
 Differentials of an s-box
If x is (1011)2 :

Note the non-uniformity.. This non-uniformity

Is used in differential cryptanalysis

CR 49
 Differential Distribution Table
of the
S-box output difference
s-box
box input difference

Probability that output difference

S-box

Is b given that input difference is a

This is known as the

Propagation Ratio

Counts the number of times input difference is x

and output difference of the s-box is y

CR 50
 Differential trails in a
cipher
First note that the differential output y does not
depend on the secret key
Choose a set of consecutive s-boxes so that
differences propagate with high propagation ratio.
This is the differential trail.

Assuming independence between the s-boxes in the

trail, propagation ratio for the trail is the product of
individual propagation ratios.

This means that, if the input difference is (0000 1011 0000

0000) then the probability that the output difference is (0000
CR 0101 0101 0000) is 27/1024
51
 The Differential Cryptanalysis
Attack
v<44>
The attacker needs
A large number of chosen plaintext-ciphertext pairs
encrypted with the same key v<42> v<44>

The attack k<52> k<54>

1. Guess k<52> and k<54> (256 possibilities)

4 4 y<52>
2. Compute v<2> and v<4> for each plaintext ciphertext y<54>
using the guessed key
3. Compute the difference between the inv-sbox(v<42> )
4
and inv-sbox(v<4> )
4. Test if the required differential is obtained.

If the key guess is correct, the correct differential will be

obtained with a probability of 27/1024
If the key guess is wrong, the differential will be obtained
with a probability which is much lower (1/256)

CR 52
 The Differential Cryptanalysis Algorithm
Function inputs are the plaintext-ciphertext
Differentials, T is the number of them, and the
Co Inverse of the targeted s-box

The guessed key (L1, L2) : is of 256 values

For each differential, do an initial filtering, and

then compute u4<2> and u4<4> . If these result in
the targeted differential 0110, 0110, then increment
The count for the corresponding key guess

The values of (L1, L2) which has the maximum count

Implies, that it is the case where the targeted
Differential appears most often. This (L1, L2) is the
likely key.

CR 53
 DES
(Data Encryption Standard)

CR 54
 History of DES
Standardized in 1977 by FIPS , as the standard for
data encryption
Based on a Feistel cipher called Lucifer
(Lucifer is a Feistel cipher developed by IBM in the
early 70s)
NSA made some minor (supposedly controversial)
modifications to the Lucifer algorithm
Reduced the key size from 64 bits to 56 bits
Modifications to the s-boxes

CR 55
 DES Specification
Block Size : 64 bits
Key size : 56 bits (+8 parity bits)
Structure : Fiestel
Rounds : 16
Algorithm specifies :
encryption / decryption algorithm
key expansion algorithm

CR 56
 32 32
DES Initial and Final Permutation

Plaintext subjected to an Initial permutation (IP)

initially
After 16 rounds, there is a final permutation (FP)
before the ciphertext is generated

neither operation has any cryptographic significance.

Used to facilitate loading of blocks in and out of 1970s
eight bit computer

32 32
CR 57
 IP and FP
Initial Permutation (IP)

The first bit of the o/p is taken from the 58th input bit

Final Permutation (FP = IP-1)

This is the inverse of IP

CR 58
 32 32
DES F Function (E and Key mixing)
E is the expansion block. The 32
bit input is expanded to 48 bits
by duplicating some of the bits 32

key mixing with subkey, 48 48

32

32

Expansion Function

CR 59
 DES F Function (S-boxes)

32

48 48

S1 to S8 are compression s-boxes.

Each s-box takes 6 input bits and
outputs 4 bits. 32

32
S1

CR 60
 DES F Function (Permutation)

32

48 48

32

32

Permutation Layer

CR 61
 DES Key Expansion
64 bits input
Rotate left
Of which 8 are discarded
(or used for parity)
No non-linear components

PC1

PC2 Select 48 out of the 56 bits

CR 62
 DES Decryption
Same as encryption algorithm, with subkeys applied
in reverse order

CR 63
 DES Weak Keys
In a DES weak key, all the subkeys are
the same
Thus DESWK(DESWK(x)) = x
(WK is a weak key)
DES weak keys are as follows
56 bit DES weak keys
0000000 0000000
FFFFFFF FFFFFFF
0000000 FFFFFFF
FFFFFFF 0000000

CR 64
 DES Semi weak keys
SK1 SK1
Semi-weak keys have the
following properties
They appear in pairs: (SK1 and
SK1)
DESSK1(DESSK1(x)) = x
Each semi-weak key has only
two sub keys.

CR 65
 DES Semi weak key pairs

CR 66
 Objections to DES
Key size matters
Brute Force Attacks due to the small key size
S-box secrecy
During the initial years, the rationale for the DES s-
box was kept secret ( to increase security).
Mathematical attacks :
Differential Cryptanalysis
Linear Cryptanalysis

CR 67
 DES Cracker
Specialized ASICs for DES
bruteforce
Could determine the secret key
in less than a day

. Need to increase key length!!

CR 68
 DES Composition
Key size can be increased by composition
C = DESK1(DESK2(P))
2 DES
K1 K2 keysize = 2*56=112 bits

P DES DES C

DES does not form a group under composition.

i.e. It is not possible to obtain
DESK1(DESK2(P)) = DESK3(P) for some key K3

CR 69
 Meet in the Middle Attack
against 2-DES
K1 K2
P DES
Q DES C

Attacker collects a pair of (P,C)

1. For P, compute QK1* = DESK1*(P) for every possible value of K1*.
Record the corresponding QK1*
2. For C, compute QK2* = DES-1K2* (C) for every possible value of K2*.
Record the corresponding QK2*
3. Find all K1* and K2* such that QK1* = QK2*
4. If Multiple such K1* and K2* are found, then repeat with another
pair of (P,C)
Complexity of this attack is 256+256 = 257

CR 70
 3-DES
K1 K2 K1

P DES
Q
DES-1 DES C
encrypt decrypt encrypt
112 bit security as in 2-DES
Encrypt Decrypt Encrypt
K1 K2 K1 (two 56 bit keys)
Why EDE and not EEE?
Compatibility with the classical DES if K1 = K2
Used extensively as a stopgap arrangement until a new cipher standard
(AES) was established
Drawbacks of 3-DES:
Sluggish in software
Could only encrypt 64 bit blocks at a time

CR 71
 How to choose a good s-box?

CR 72
 Criteria for a good s-box
Completeness
Balance
Non-linearity
Propagation criteria
Good XOR profile
High Algebraic Degree

CR 73
 Sboxes
In an s-box each output bit can be
represented as a Boolean function of its input
bits y = f ( x , x , x ,L, x )
1 1 1 2 3 m
x1 x2 x3 x4 xm y2 = f 2 ( x1 , x2 , x3 ,L , xm )
y3 = f 3 ( x1 , x2 , x3 , L , xm )
sbox
M M M M M
yn = f n ( x1 , x2 , x3 ,L , xm )
y1 y2 y3 y4 yn
The functions have to be non-linear.
Linear functions are easily reversed.

CR 74
 Boolean Functions
A Boolean function is a mapping from {0,1}m {0,1}
Algebraic Normal Form representation of a Boolean
function
A Boolean function on m-inputs can be represented with
sum (XOR +) of products (AND .) form:

y = a0 a1 x1 a2 x2 a3 x1 x2
where ai is either 0 or 1.

Affine Form: if all the AND terms have coefficients 0

Linear form : Affine form and a0 = 0

CR 75
 Truth Tables
f : y = x1 x2 x1 x2
Consider a Boolean function f : {0,1}m {0,1}
The following Binary sequence is the truth table of f
( f ( ), f ( ), f ( ),L, f ( ))
0 1 2 2m 1
X1 X2 Y
0 0 0
where are m bit numbers and i i unless i = j
0 1 1
1 0 1
The truth table is therefore (0,1,1,1)
1 1 1

CR 76
 Balanced Boolean Functions
A Boolean function is said to be balanced its truth table has equal number
of 0s and 1s.
S-box equations should be balanced (i.e. 0 and 1 have an equal probability
of occurrence)

f : y = x1 x2 x1 x2 g : y = x1 x2
X1 X2 Y X1 X2 Y

Balanced Function
Unbalanced function

0 0 0 0 0 0
0 1 1 0 1 1
1 0 1 1 0 1
1 1 1 1 1 0

CR 77
 Distance Between functions
Let f and g be two Boolean functions
Let be the truth table for f and the truth table for g

HD( , ) is the Hamming distance between the two sequences

X1 X2 Y1 Y2 f : y1 = x1 x2 x1 x2
0 0 0 0 g : y2 = x1 x2
0 1 0 1
1 0 1 1 HD( , ) = 2
1 1 1 0

CR 78
 Nonlinearity of a Boolean Function
The non-linearity of a Boolean function is the minimum distance between
the function and the set of all affine functions.
Strengthens against linear cryptanalysis

y1 = x1 x2 x1 x2 X1 X2 Y1 Y2 Y3 Y4 Y5
y2 = 0 0 0 0 0 0 0 0
y3 = x1 0 1 1 0 0 1 1
y 4 = x2 1 0 1 0 1 0 1
y5 = x1 x2 1 1 1 0 1 1 0
3
Nonlinearity : N f = MIN gAffine (HD( f , g ) ) 1
1
Nonlinearity of y1 : N y1 = 1
1

CR 79
 On the Non-linearity of Boolean
Functions
HD of any two linear functions is 2n-1
HD between linear functions and a non-linear
function is < 2n-1
Let = # ( f = g ) # ( f g )
= 2n # ( f g ) # ( f g )
= 2 n 2# ( f g )
1
HD( f , g ) = # ( f g ) = 2 n 1
2

CR 80
 Bent Functions
Bent functions are non-linear Boolean
functions which have maximum non-linearity
n
1
The non-linearity of a Bent function is 2 2
n 1 2

They satisfy SAC but are not balanced

Example : f(x) = x1x2 + x3x4

CR 81
 Walsh Hadamand Matrix
A compact combinatorial representation of all affine functions
Each row of the WH matrix forms the truth table of all affine
functions with N variables can be represented by the matrix

N 1 N 1
H ( 2 ) H ( 2 )
H (2 ) =
N
N 1 N 1
H (2 ) complement ( H (2 ))
0 0 0
H (21 ) =
0 1 x1
0 0 0 0 0
0 1 0 1 x2
H (2 ) =
2
x1
0 0 1 1
0 1 1 0 x2 ^ x1
CR 82
 Affine Transformations
and Non-linearity
If a Boolean function is balanced, then an affine
transformation does not affect its non-linearity

f ( x) is a balanced Boolean function, then f ( xB A) is also balanced

x = ( x1 , x2 , x3 ,..., xn )
B is a n n binary invertible matrix
A is an n bit vector
The nonlinearity of f ( x) = nonlinearity of f ( xB A)

CR 83
 Strict Avalanche Criteria (SAC)
For a function (f) to satisfy SAC,
f ( x) f ( x ) must be balanced, for any with HW ( ) = 1
Also called propagation criteria of order 1
Higher order SAC,
Propagation criteria of order > 1
When input changes in more than 1 bit

Show that
y = x1 x2 x3 does not satisfy SAC
z = x1 x2 x3 x4 satisfies SAC

Note that z is a Bent function

CR 84
 How to make a Boolean function
satisfy SAC
Let f (x) be a Boolean function of order n
Let A be an nxn non-singular Boolean matrix
If r is a row in the matrix A and f ( x) f ( x r )
is balanced then g ( x) = f ( xA) satisfies SAC

f = x1 x2 x3
Example :
1 0 0
A = 0 1 0
verify this?
1 1 1
then g ( x) = f ( xA) satisfies SAC
CR 85
 Completeness
More a criteria for the complete cipher (SP)
Given s-boxes with a fixed mapping,
P-layer needs to be fixed and rounds need to be
fixed such that ciphertext is a complex function of
every plaintext input

CR 86
 XOR Profile
The difference distribution table of the s-box
must contain small variations

CR 87
 Modes of Operation

CR 88
 What are Modes of Operation?
Block cipher algorithms only encrypt a single block of message
A mode of operation describes how to repeatedly apply a
cipher's single-block operation to securely transform amounts
of data larger than a block
Modes of Operation
Electronic code book mode (ECB Mode)
Cipher feedback mode (CFB Mode)
Cipher block chaining mode (CBC mode)
Output feedback mode (OFB mode)
Counter mode

CR 89
 ECB Mode
p0 p1 p2 p3 p4

eK eK eK eK eK

c0 c1 c2 c3 c4

Every block in the message is encrypted independently with the same key
Drawback 1 : If pi = pj (i j) then ci = cj
Encryption should protect against known plaintext attacks (since the attacker could
guess parts of the message.. Like stereotype beginnings)
Drawback 2 : An interceptor may alter the order of the blocks during
transmission
Not recommended for encryption of more than one block

CR 90
 CBC Mode
p0 p1 p2 p3 p4

IV

eK eK eK eK eK

c0 c1 c2 c3 c4

Cipher Block Chaining

Advantage 1 : Encryption dependent on a previous the ciphertext of a previous
block, therefore
ci cj (i j) even if pi = pj
Advantage 2: Intruder cannot alter the order of the blocks during transmission
If an error is present in one received block (say ci)
Then ci and ci+1 will not be decrypted correctly
All remaining blocks will be correctly decrypted

CR 91
 CBC Mode Decryption
p0 p1 p2 p3 p4

IV

eK eK eK eK eK

c0 c1 c2 c3 c4

c0 c1 c2 c3 c4

dK dK dK dK dK

IV

p0 p1 p2 p3 p4
CR 92
 CFB (Cipher feedback Mode)
register
IV
Can transform a block cipher into a stream cipher.
i.e. Each block encrypted with a different key eK

Uses a shift register that is initialized with an IV

message stream
(8 bits at a time) ciphertext stream
(8 bits transmitted at a time)

Encryption Scheme

CR 93
 CFB - Error Propagation
register

Uses a shift register that is initialized with an IV eK

Previous ciphertext block fed into shift register

Ciphertext stream
(8 bits at a time) Plaintext stream
(8 bits decrypted at a time)

Decryption Scheme

CR 94
 Output Feedback Mode (OFB)
shift reg
Very similar to CFB but feedback
taken from output of ek
eK
An error in one byte of the
ciphertexts affects only one
decryption message stream
(8 bits at a time) ciphertext stream
(8 bits transmitted at a time)

Encryption Scheme
(Decryption scheme is similar)

CR 95
 Counter Mode
counter counter+1 counter+2 counter+3 counter+4

eK eK eK eK eK
p0 p1 p2 p3 p4

c0 c1 c2 c3 c4

A randomly initialized counter is incremented with every encryption

Can be parallelized
Ie. Multiple encryption engines can simultaneously run
As with OFB, an error in a single ciphertext block affects only one
decrypted plaintext

CR 96
 The Advanced Encryption Standard
(AES)

CR 97
 Advanced Encryption Standard (AES)
NISTs standard for block cipher since October 2000.
Key No. of
Length rounds
AES-128 16 bytes 10
AES-192 24bytes 12
AES-256 32bytes 14
SPN network with each round having
Randomness Layer: Round key addition
Confusion Layer : Byte Substitution
Diffusion Layer : Shift row and Mix column
(the last round does not have mix column step)

CR 98
 Mathematical Background

Finite Fields

CR 99
 The AES State Representation
16 byte plaintext
a b c d e f g h i j k l mn o p

a e i m A E I M
b f j n B F J N
AES
c g k o C G K O
d h l p DH L P
16 byte ciphertext

16 bytes arranged in a 4x4 matrix of bytes

CR 100
 AES-128 Encryption
Plaintext
Block
Secret Key

XOR key

4 Operations Byte Substitution

Byte Substitution
Loop 10 times

Shift Rows
Mix Columns Shift Rows
Add Round Key
Mix Columns RK1
RK2
(except for the last round) RK3
Ciphertext
Block Add Round Key RK10
Key Expansion

CR 101
 AES-128 Encryption
Plaintext
Block
Secret Key

XOR key

confusion Byte Substitution

Loop 10 times

Shift Rows
diffusion
Mix Columns RK1
RK2
(except for the last round) RK3
Ciphertext
Block Add Round Key RK10
Key Expansion

CR 102
 AES Operations
All AES operations are performed in the field GF(28).

The fields irreducible polynomial is

x8 + x4 + x3 + x + 1

in binary notation (1 0001 1011)2

in hex notation (11B)16

CR 103
 Byte Substitution
Makes a non-linear substitution for every byte in the 4x4
matrix
Sbox
a e i m A E I M
b ff j n B FF J N
c g k o C G K O
d h l p D H L P
Affine Transformation
b7 1 1 1 1 1 0 0 0 a7 0
b 0 1 1 1 1 1 0 0 a 6 1
6
Affine( A1 ) if A( ) 0 b5 0

0 1 1 1 1 1 0 a5 1

Sbox( A) = b4 = 0 0 0 1 1 1 1 1 a4 0
Affine(0) if A( ) = 0 b3 1 0 0 0 1 1 1

1 a3 0

b2 1 1 0 0 0 1 1 1 a2 0
b 1 1 1 0 0 0 1 1 a1 1
1
b0 1 1 1 1 0 0 0 1 a 0 1

CR 104
 AES S-box Design Rationale
Affine( A1 ) if A( ) 0
Sbox( A) =
Affine(0) if A( ) = 0

This s-box construction was proposed by Kaiser Nyberg in

1993
Steps:
1. Inverse in GF(28)
Provides high degrees of non-linearity
Known to have good resistance against differential and linear
cryptanalysis
2. Affine transformation
ensures no fixed points : i.e. Fixed points : S(x) = x
Complicates Algebraic attacks

CR 105
 S-box Encryption Table
Use a table to do the byte substitution
eg. Sbox[42] = 2c

CR 106
 Shift Rows
a e i m a e i m
b f j n f j n b a a
c g k o k o c g b f
d h l p p d h l c k
d p
e e
ShiftRows f j
Leave the First row untouched g o
Left Rotate (2nd Row by 8 bits) h d
Left Rotate (3rd Row by 16 bits) i i
Left Rotate (4th Row by 24 bits)
j n
Along with MixColumns provides high
diffusion k c
Bits flip in at-least 25 s-boxes after 4 rounds l h
m m
n b
o g
p l
CR 107
 Mix Columns
The 4x4 matrix is multiplied with the matrix
2 3 1 1 a e i m
1 2 3 1 b f j n Note that multiplications are in

1 1 2 3 c g k o GF(28) field

3 1 1 2 d h l p

E = 2e + 3 f + g + h
F = e + 2 f + 3g + h
G = e + f + 2 g + 3h
H = 3e + f + g + 2 h
a e i m A EE I M
b f j n B FF J N
c k o C G K O
g G
d l p D H L P
h H
CR 108
 Mix Columns Rationale
Why use this matrix? 2 3 1 1
1 2 3 1
It is an MDS matrix (Maximum
Distance Separable codes) 1 1 2 3

3 1 1 2
If the input of a column changes then all
outputs change
This maximizes the branch number
For AES, the branch number is 5
Values [2,3,1,1], are the smallest which
result in MDS matrix that is also
circulant
Has an inverse in the AES field
CR 109
 AES Operations
(Add Round Key)

a e i m k0 k4 k8 k12 a +k0 e+k4 i+k8 m+k12

b f j n k1 k5 k9 k13 b+k1 f+k5 j+k9 n+k13
c g k o k2 k6 k10 k14 c+k2 g+k6 k+k10 o+k14
d h l p k3 k7 k11 k15 d+k3 h+k7 l+k11 p+k15

Addition here is addition in GF(28), which is

the ex-or operation

CR 110
 AES-128 Decryption
Ciphertext Block

Secret Key

XOR RK10

Inverse Byte Substitution

Loop 10 times

Inverse Shift Rows

RK9
Add Round Key RK8
Plaintext
Block RK1
Inverse Mix Columns key
(except for the last round) Key Expansion

CR 111
 Inverse S-box
Simply the AES s-box run in reverse
As with the s-box operation, a lookup table can be
used

CR 112
 Inverse Shift Rows
a a
a e i m a e i m f b
f j n b b f j n k c
k o c g c g k o p d
p d h l d h l p e e
j f
o g
ShiftRows d h
Leave the First row untouched i i
n j
Right Rotate (2nd Row by 8 bits)
c k
Right Rotate (3rd Row by 16 bits) h l
Right Rotate (4th Row by 24 bits) m m
b n
g o
l p
CR 113
 Inverse Mix Column
E = Ee + Bf + Dg + 9h
F = 9e + Ef + Bg + Dh
G = De + 9 f + Eg + Dh
H = Be + Df + 9g + Eh

A EE I M a e i m
B FF J N b f j n
C G K O c k o
G g
D H L P d l p
H h
The 4x4 matrix is multiplied with the matrix
E B D 9
9 E B D

D 9 E B

B D 9 E
The hardware implementation can be done in a similar way as mix
columns

CR 114
 AES Key Schedule
How to expand the secret key
Design Criteria Secret Key
o Efficient
o Non-symmetric : Ensured by round constants
o Efficient diffusion properties of secret key into round keys
o It should exhibit enough non-linearity to prohibit the full
determination of differences in the expanded key from cipher
key differences only .

RK1
RK2
RK3

RK10
Key Expansion

CR 115
 AES Key Schedule
K0,0 K0,1 K0,2 K0,3

K0,4 K0,5 K0,6 K0,7

secret rotword
K0,8 K0,9 K0,10 K0,11
key
K0,12 K0,13 K0,14 K0,15

round
constant S-box
xor operation

K1,0 K1,1 K1,2 K1,3

1st round K1,4 K1,5 K1,6 K1,7
key K1,8 K1,9 K1,10 K1,11 2i-1
K1,12 K1,13 K1,14 K1,15 0
0
0
CR 116
 Implementation Aspects of AES

CR 117
 Software Implementations
of AES Encryption
S-box implemented as a lookup-table (256 bytes)
Shift rows combined with Mix columns
Multiplication with MDS matrix easily achieved
x2, done by left shift. If there is an overflow an ex-or with
0x1B is needed
x3 = x2 + x

CR 118
 AES on 32 bit Systems
Byte Substitution
AES state bi , j = S (ai , j ) for i, j {0,1,2,3}
a0 , 0 a0,1 a0, 2 a0,3
Shift Rows
a a1,1 a1, 2 a1,3
1, 0 (c1 = c2 = c3 = 1 are cyclic shifts)
a2 , 0 a2,1 a2 , 2 a2 , 3 c0, j b0, j

a3,0 a3,1 a3, 2 a3,3 c b
1, j = 1,C1 j
c2, j b2,C 2 j
Mix Columns
3, j 3,C 3 j
c b
Combining Operations

Add Round Key

ei , j = d i , j ki , j for i, j {0,1,2,3}

CR 119
 T Tables
Combining Operations

Define 4 T-Tables

One Round of AES using T-Tables

CR 120
 OpenSSL Implementation of AES
(with T-tables)

CR 121
 Last Round of AES
Uses a
different table (Te4)

CR 122
 AES NI
Accelerating AES on modern Intel and AMD
processors with dedicated instructions

CR 123
 Compact Implementations
of AES
How should the S-box be implemented?
Look up table (256 bytes)
This may be too large for some devices
Finding the inverse (using Itoh-Tsujii or the extended
Euclidean algorithm) and then affine transformation
Again expensive (too big!!!)
Third alternative
Use composite fields

CR 124
 Composite Fields
(refer Math. Background)

CR 125
 Composite Fields for AES
The AES Field is GF(28)/x8+x4+x3+x+1
Has order 256
Many composite fields for AES exists
GF(24)2
Requires two irreducible polynomials
One has the form x4 + .... , where coefficients are in GF(2)
The second has the form x2 + ax + b, where a, b are in GF(24)
GF((22)2)2
Requires three irreducible polynomials
First of the form x2 + a1x + b1, where a1, b1 in GF(2)
Second has the form x2 + a2x + b2, where a2, b2 in GF(22)
Third has the form x2 + a3x + b3, where a3, b3 in GF(22)2

CR 126
 Mapping between GF(28) and
Composite Fields
FindMap(){
Initilize MAP[0] = 0 and REVMAP[0] = 0
Find a primitive root of field GF (28 )
Find a primitive root of field GF (2 4 ) 2
' = 1; ' = 1
For i = 1 to 255
' = ' (Multiplication in the field GF(28 ))
'= ' (Multiplication in the field GF(24 ) 2
MAP[ ' ] = '
REVMAP[ ' ] = '
return MAP and REVMAP
}

CR
https://drive.google.com/file/d/0BwxUBZXYoUKCTEJmNUozMl9xM3M/edit?usp=sharing 127
 Implementing the AES S-box in
Composite Fields

Inverse in
Reverse Affine
x Map Composite Field Map Transform Sbox(x)
eg. In GF((24)2)

CR 128
 S-box Based on Composite Fields
-box Approach

Gate Count for composite Sbox# Performance of S-boxes on FPGA*

XOR NAND NOR Total Gates in terms S-box No. of Critical Gate
of NAND Approach Slices Path Count
(using std cell lib)

80 34 6 180 Lookup 64 11.9ns 1128

table based
Composite 30 18.3ns 312
Field based
# D. Canright, A Very Compact S-box for AES, CHES-2005
* Simulation Results using Xilinx ISE
CR
 Overhead of Composite Field s-boxes

Composite field s-boxes require mapping and

reverse mapping to and from the composite
fields in each round
An alternate approach is to convert all other
round operations into composite field
operations.
This would require just one mapping and one
reverse mapping for the entire encryption
Operations Add Round Key and Shift Rows are not
altered.
Mix Columns will need to be re-implemented
CR
 Attacks on AES

CR 131
 Differential and Linear Properties of
AES
Differential Cryptanalysis
No 4 round differential trail > 1/2150 and no 8 round
differential trail > 1/2300 exists.
Linear Cryptanalysis
No 4 round bias > 1/275 and no 8 round bias > 1/2150 exists

AES can easily resist differential and linear cryptanalysis

CR 132
 Attack on 4 Rounds of AES
Plaintext
Block
Secret Key

XOR key

4 Operations Byte Substitution

Byte Substitution
Loop 4 times

Shift Rows
Mix Columns Shift Rows
Add Round Key
Mix Columns RK1
RK2
(except for the last round) RK3
Ciphertext
Block Add Round Key RK4
Key Expansion

CR 133
 Square Attack
(known by the AES designers)
Works for 4 round of AES
Can be extended up to 6 rounds
Consider 256 plaintext blocks having the following properties
1. byte 0 is different for in all cases (i.e. pi,0 pj,0), for i, j = 0 to 255 and i j
2. bytes 1 to 15 are the same (i.e. pi,k = pj,k), for i, j = 0 to 255 and 1 k 15

0
1
2
256 3
plaintext
blocks

Active Byte
all different FF

CR values
134
 Square Attack
Consider 256 plaintext blocks having the following properties
1. byte 0 is different in all cases (i.e. pi,0 pj,0), for i, j = 0 to 255 and i j
2. bytes 1 to 15 are the same (i.e. pi,k = pj,k), for i, j = 0 to 255 and 1 k 15
Active byte

0
Two properties
1

255
2
i =0
pi ,k = 0
3
For some k; 1 k 15
The state is balanced

255
FF i =0
pi ,0 = 0

CR 135
 Active byte property
Square Attack
255
i =0
pi , 0 = 0
(Propagation in 3 rounds)
Add Whitening Round 1
Key Subs Bytes Shift Rows Mix Columns Add Round Key

Round 2
Sub Bytes Shift Rows Mix Columns Add Round Key

Round 3 255
= (2a + 3b + c + d )
Sub Bytes Shift Rows Mix Columns i =0
255 255 255 255
= 2 a + 3b + c + d
i =0 i =0 i =0 i =0

= 0+0+0+0 = 0

CR Balanced retained
136
 Active byte property
Square Attack
255
i =0
pi , 0 = 0
(Propagation in 3 rounds)
Add Whitening Round 1
Key Subs Bytes Shift Rows Mix Columns Add Round Key

Round 2
Sub Bytes Shift Rows Mix Columns Add Round Key

Round 3
Sub Bytes Shift Rows Mix Columns Add Round Key
s3,i (0 i 15)

This property does not hold after Sub Bytes in the 4th Round
CR 137
 A 4 round square attack
Round 3
Sub Bytes Shift Rows Mix Columns Add Round Key

Round 4
Sub Bytes Shift Rows Mix Columns Add Round Key

ciphertext

(ci ki ) for 0 i 3

S 1 ( E (c0 k0 ) B(c1 k1 ) D(c2 k 2 ) 9(c3 k3 ))

CR 138
 4 round square attack
(A chosen plaintext attack)

1. Choose 256 plaintexts with one active byte

2. Perform 4 round encryption for each plaintext
3. For each potential key (k0 || k1 || k 2 || k3 ) do the following,
a. Compute s3 ,0 corresponding to each ci (there are 256 such ci )
call them s (0)
3,0
, s (1)
3,0
, s (2)
3,0
, L s (255)
3,0

255
b. compute s (i)
3,0
i =0

If this is 0, then guessed (k0 || k1 || k 2 || k3 ) may be correct

If not, guessed key is incorrect

CR 139
 Why square attack may lead to an
incorrect key
255
If the key guess is wrong, s (i) may still be 0.
3,0
255 i =0

This is because s evaluated to one of {0, 1, 2, 3, .,

3,0
(i)

i =0
255} with equal probability
255

get 3,0 = 0 for

(i)
Thus with probability 2-8, we may s
i =0
the
wrong key.

CR 140
 Extending beyond 4 rounds
Read how the square attack can be extended to
5 rounds and 6 rounds.

CR math.boisestate.edu/~liljanab/Math509Spring10/AES-security.pdf
141
 Related Key Attacks on AES
(theoretical attacks on full AES)
By Alex Biryukov and Dmitry Khovratovich (2009)
Strong assumption : the attacker forces the victim to choose
keys of particular form.
Determine how key differences affect the cipher text
difference

CR 142
 Tracing key differences

CR 143