Lecture13 BlockCipher

CSD451: Applied Cryptography
Modue4 - Lecture 1
Today’s Lecture
• Pseudorandom Functions
• Block cipher: Basic design ideas
• Feistel networks
• Data Encryption Standard (DES) Algorithm
Stream Cipher vs Block Cipher
Stream Cipher vs Block Cipher
Standards
Pseudorandom Function
Random Function
• Consider functions f: S → S
• Let S= {0, 1}
• Then possible functions are:
0 0 0 0 0 0 0 0
1 1 1 1 1 1 1 1
(i) (ii) (iii) (iv)

Random Function
• Let S= {0, 1}n and f: 𝐷 → 𝑅 where 𝐷 = R
Then possible function are:
n-bit f(0) f(1) f(2) ………… f(2n-2) f(2n--1)
000…000 n-bit n-bit n-bit …. n-bit n-bit n.2n- bit string

000…001
000…010
2n different 000…011
input ……
……
……
111…111
Random Function
n.2n- bit string.
• Let S= {0, 1}n and f: 𝐷 → 𝑅 where 𝐷 = R Total possible strings
𝒏
are: 𝟐𝒏.𝟐
Then possible function are:
n-bit f(0) f(1) f(2) ………… f(2n-2) f(2n-1)
000…000 n-bit n-bit n-bit …. n-bit n-bit F1

000…001 F2
000…010 F3
2n different 000…011
input ……
……
…… …. …. …. F
111…111
Random Function
• Let set Funcn = {all possible functions from n to n}
𝒏
• | Funcn | = 𝟐𝒏.𝟐
Keyed Functions
• We are interested to consider 2-input keyed function as defined below:
F: {0,1}* x {0,1}* → {0,1}*
• F is polynomial time computable with input its parameters
• Represented as Fk(x) = F(k, x) where k is the key
Keyed Functions
• We are interested to consider 2-input keyed function as defined below:
F: {0,1}* x {0,1}* → {0,1}*
• F is polynomial time computable with 2 input parameters
• Represented as Fk(x) = F(k, x) where k is the key
• For simplicity, assume |k|=|x| and |F(k, x)| = |k| = |x|.

• Choosing a uniform k ∈ {0, 1}n is equivalent to choosing the function
Fk: {0, 1}n → {0, 1}n
Pseudorandom Function
• ‘Looks like’ a random function.
• 2-input keyed function F is a pseudorandom function if Fk, for uniform
key k ∈ {0, 1}n, is indistinguishable from a uniform function f ∈ Funcn.
• For all polynomial time distinguisher D,

|Pr k  [D (.) = 1] -|Pr k  [D f(.) = 1] | ≤ 𝜖 (n)
• k ← {0, 1}n, |Fk|= 2k

PRF vs PRG
• PRF is stronger notation than PRG.

• If we have a PRF (say) F, we can construct a PRG (say) G.
• Example: G(k) = Fk (…) ||Fk(…)
- based on the expansion factor of G
Pseudorandom Permutation
• Let F be a length-preserving, keyed function as already discussed
• F is keyed-permutation if
• ∀ 𝑘, 𝐹𝑘 is one-one, onto (bijection)
• 𝐹𝑘 -1 is efficiently computable and 𝐹𝑘 -1(𝐹𝑘 (x)) = x.
• F is pseudorandom permutation if 𝐹𝑘, for uniform key k ∈ {0, 1}n is

indistinguishable from a uniform permutation f ∈ Permn (set of all
permutations of n-bit strings).
Block Ciphers
For n = 2
Block Ciphers
For n = 2
• A block cipher operates on a plaintext block of n bits to produce a ciphertext block of n bits. There are
2n possible different plaintext blocks and, for the encryption to be reversible each must produce a
unique ciphertext block. So if we limit ourselves to reversible mappings, the number of different
transformations is 2n!.
Block Ciphers
• Block ciphers are practical constructions of pseudorandom
permutations
F: {0, 1}n x {0, 1}m→ {0, 1}m
where n = key length

m = block length
Block Cipher: Primitive Operations
The common operation for confusion is substitution.
The common operation for diffusion is permutation.

Shannon’s Proposal: Product Cipher
Feistel Structure
Feistel Structure: Parameters
Feistel Structure: Parameters
Data Encryption Standard (DES)
The Feistel
Structure
The Feistel
Structure of
DES
The Feistel
Function f Structure of
for confusion
& diffusion DES
Initial and Final Permutation
The table indicates that input bit 58 is mapped to output position

1, input bit 50 is mapped to the second output position, and so on.
Initial and Final Permutation
Bit swaps of the initial permutation
Bit swaps of the final permutation

One round of DES encryption
Block diagram of
the f -function
Expansion Permutation: 32-bit to 48-bit
S-box
S-box
S-box
S-box
S-box
The permutation P within the f -function
Avalanche Effect
Key Scheduling
Algorithm
The 56-bit key is split into
two halves C0 and D0 and then
C1 and D1 and so on…
DES Encryption
DES Decryption
For any Feistel cipher,

decryption uses the same
algorithm as encryption, except
that the application of the
subkeys is reversed.
DES Decryption
For any Feistel cipher,

decryption uses the same
algorithm as encryption, except
that the application of the
subkeys is reversed.
• Decryption round 1 reverses encryption round 16, decryption

round 2 reverses encryption round 15, and so on.
DES Decryption
DES Decryption
DES Decryption
• The output values (L1d , R1d) of the first decryption round 1 represented in terms of the input values of the last
encryption round (L15,R15) .
Analysis on DES: Good Avalanche Effect

Lecture13 BlockCipher

Uploaded by

Copyright:

Available Formats

Lecture13 BlockCipher

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lecture13 BlockCipher

Uploaded by

Copyright:

Available Formats

CSD451: Applied Cryptography

(i) (ii) (iii) (iv)

000…000 n-bit n-bit n-bit …. n-bit n-bit n.2n- bit string

000…000 n-bit n-bit n-bit …. n-bit n-bit F1

• For simplicity, assume |k|=|x| and |F(k, x)| = |k| = |x|.

• For all polynomial time distinguisher D,

• k ← {0, 1}n, |Fk|= 2k

• PRF is stronger notation than PRG.

• F is pseudorandom permutation if 𝐹𝑘, for uniform key k ∈ {0, 1}n is

F: {0, 1}n x {0, 1}m→ {0, 1}m

where n = key length

The common operation for confusion is substitution.

The common operation for diffusion is permutation.

The table indicates that input bit 58 is mapped to output position

Bit swaps of the initial permutation

Bit swaps of the final permutation

For any Feistel cipher,

For any Feistel cipher,

• Decryption round 1 reverses encryption round 16, decryption

You might also like