Symmetric Ciphers

Module-3
Topics to be discussed
 Block Ciphers

 Encryption standards - DES, AES

 Pseudorandom Number Generation,

 Stream Ciphers

 Public-Key Cryptography – RSA

2 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Stream Ciphers
 Call the plaintext stream P, the ciphertext stream C, and the key
stream K.

3 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Block Ciphers
 In a block cipher, a group of plaintext symbols of size m (m > 1) are
encrypted together creating a group of ciphertext of the same size.
 A single key is used to encrypt the whole block even if the key is
made of multiple values.

4 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Block vs Stream Ciphers
 Block ciphers process messages in blocks, each of which is then
en/decrypted
 Like a substitution on very big characters
 64-bits or more
 Stream ciphers process messages a bit or byte at a time when
en/decrypting
 many current ciphers are block ciphers
 better analyzed
 broader range of applications

5 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Block vs Stream Ciphers

6 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Modern Block Ciphers
 A symmetric-key modern block cipher encrypts an
n-bit block of plaintext or decrypts an n-bit block of ciphertext.
 The encryption or decryption algorithm uses a k-bit key.

7 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Modern Block Ciphers
 How many padding bits must be added to a message of 100
characters if 8-bit ASCII is used for encoding and the block cipher
accepts blocks of 64 bits?
Solution:
 Encoding 100 characters using 8-bit ASCII results in an 800-bit
message.
 The plaintext must be divisible by 64.
 If | M | and |Pad| are the length of the message and the length of the
padding,

8 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Modern Block Ciphers
Substitution or Transposition:
 A modern block cipher can be designed to act as a substitution
cipher or a transposition cipher.
 In either case the number of n-bit possible plaintext or ciphertext is
2n, because each of the n-bit in a block will be ‘0’ or ‘1’

To be resistant to exhaustive-search attack,

a modern block cipher needs to be
designed as a substitution cipher.

9 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Modern Block Ciphers
 Suppose that we have a block cipher where n = 64. If there are 10
number of 1’s in the ciphertext, how many trial-and-error tests does
Eve need to do to recover the plaintext from the intercepted
ciphertext in each of the following cases?
 a. The cipher is designed as a substitution cipher.
 b. The cipher is designed as a transposition cipher.
Solution
 In the first case, Eve has no idea how many 1’s are in the plaintext. Eve
needs to try all possible 264 64-bit blocks to find one that makes sense.
 In the second case, Eve knows that there are exactly 10 1’s in the plaintext.
Eve can launch an exhaustive-search attack using only those 64-bit blocks
that have exactly 10 1’s.

10 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Permutation Group
 The set is the set of all permutations, and
 The operation is composition: applying one permutation after
another
 Composition (o) of permutation

11 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Permutation Group
 Operation table for permutation group

 Identity: (1, 2, 3)
 Inverse can be found from the table
 Commutativity property is not satisfied

12 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Permutation Group
 A set of permutations with the composition operation is a group

 This implies that using two permutations one after another cannot
strengthen the security of a cipher
 Because we can always find another permutation that can do the
same job because of the closure property

13 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Block Ciphers as Permutation Groups
 Is a modern block cipher a group?
Full-Size Key Transposition Block Ciphers
 In a full-size key transposition cipher We need to have n! possible
keys, so the key should have log2 n! bits.
Example:
 Show the model and the set of permutation tables for a 3-bit block
transposition cipher where the block size is 3 bits.
Solution:
 The set of permutation tables has 3! = 6 elements
 The key should be log26 = 3 bits long

14 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Block Ciphers as Permutation Groups

15 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Block Ciphers as Permutation Groups
Full-Size Key Substitution Block Ciphers
 A full-size key substitution cipher does not transpose bits; it
substitutes bits.
 We can model the substitution cipher as a permutation if we can
decode the input and encode the output.
 Decoding: Transforming n-bit integer into a 2n bit integer with only a
single ‘1’ and 2n-1 ‘0’.
 Encoding: Its reverse of decoding
 The cipher will be modelled as a permutation of 2n! objects

16 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Block Ciphers as Permutation Groups
 Show the model and the set of permutation tables for a 3-bit block
substitution cipher.
 The key is also much longer, log240,320 = 16 bits. (8! = 40,320)

17 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Block Ciphers as Permutation Groups

A full-size key n-bit transposition cipher or a

substitution block cipher can be modeled
as a permutation, but their key sizes are different:
 Transposition: the key is (log2n!) bits long.
 Substitution: the key is (log2(2n)!) bits long.

A partial-key cipher is a group under the composition

operation if it is a subgroup
of the corresponding full-size key cipher.

18 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Components of a Modern Block Cipher
 Modern block ciphers normally are keyed substitution ciphers.
 In which the key allows only partial mappings from the possible
inputs to the possible outputs.
 Modern block ciphers are made up of combination of transposition
units (P or D boxes), substitution units (S-Boxes) and other units

P-Boxes
 A P-box (permutation box) parallels the traditional transposition
cipher for characters.
 It transposes bits.
 P-boxes are generally keyless.

19 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

P-box

20 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Straight P-box
Straight P-Box
 A straight P-Box has n inputs and n outputs as a permutation.
 There are n! possible mappings
 Example: 6 possible mappings of a 3 × 3 P-box.

21 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Straight P-box
Straight P-Box
 When n = 64

22 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Straight P-Box
 Design an 8 × 8 permutation table for a straight P-box that moves
the two middle bits (bits 4 and 5) in the input word to the two ends
(bits 1 and 8) in the output words. Relative positions of other bits
should not be changed.
Solution:
 We need a straight P-box with the table [4 1 2 3 6 7 8 5].
 The relative positions of input bits 1, 2, 3, 6, 7, and 8 have not been
changed,
 But the first output takes the fourth input and the eighth output
takes the fifth input.

23 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Compression P-Box
 A compression P-box is a P-box with n inputs and m outputs where
m < n.

 Example of a 32 × 24 permutation table

24 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Expansion P-Box

 An expansion P-box is a P-box with n inputs and m outputs where

m > n.
 Example of a 12 × 16 permutation table

25 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

P-Box
 Invertibility

A straight P-box is invertible, but compression and

expansion P-boxes are not.

26 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

P-Box
 Compression and expansion P-boxes are non-invertible

27 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

S-Box

 An S-box (substitution box) can be thought of as a miniature

substitution cipher.

An S-box is an m × n substitution unit, where m and n

are not necessarily the same.

28 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Linear Vs Non-Linear S Boxes
 In a S-Box with n inputs and m outputs.

 Let the inputs be x1, x2, x3,…, xn

 Let the outputs be y1, y2, y3,…, ym
 The relationship between input and outputs can be expressed as,
y1 = f1(x1, x2, x3,…, xn)
y2 = f2(x1, x2, x3,…, xn)
ym = fm(x1, x2, x3,…, xn)

29 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Linear Vs Non-Linear S Boxes
 In linear S-Box the relationship can be expressed as,

 In non-linear S-Box don’t have the above relation for every output.
 The S-Box will have ‘and’ terms like, x1x4, x3x7

30 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Linear Vs Non-Linear S Boxes
Example:
 Linear S-box with three inputs and two outputs that has

 The S-box is linear because a1,1 = a1,2 = a1,3 = a2,1 = 1 and

a2,2 = a2,3 = 0.
 The relationship can be represented by matrices, as shown below:

31 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Linear Vs Non-Linear S Boxes
Example
 In an S-box with three inputs and two outputs, we have

 where multiplication and addition is in GF(2).

 The S-box is nonlinear because there is no linear relationship
between the inputs and the outputs.

32 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

S-Box
Example:
 The following table defines the input/output relationship for an S-box
of size 3 × 2.
 The leftmost bit of the input defines the row; the two rightmost bits
of the input define the column.
 The two output bits are values on the cross section of the selected
row and column.

Mapping: 010  01, 101  00

33 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT
S-Box

Inevitability
 In S-Box the relationship between inputs and outputs are defined by
a table or a mathematical expression.
 An S-box may or may not be invertible
 In an invertible S-box, the number of input bits should be the same
as the number of output bits

34 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

S-Box
Example:
 For example, if the input to the left box is 001, the output is 101.
 The input 101 in the right table creates the output 001, which shows
that the two tables are inverses of each other.

35 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Exclusive-Or in Block Ciphers
 An important component in most block ciphers is the exclusive-or
operation.

36 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Exclusive-Or in Block Ciphers
 Addition and subtraction operations in the GF(2n) field are
performed by a single operation called the exclusive-or (XOR).
 The five properties of the exclusive-or operation in the GF(2n) field
makes this operation a very interesting component for use in a block
cipher:
 closure,
 associativity,
 commutativity,
 existence of identity, and
 existence of inverse.

37 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Exclusive-Or in Block Ciphers
 Inevitability of the exclusive-or operation

38 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Circular Shift
 Another component found in some modern block ciphers is the
circular shift operation.

 Circular shifting an 8-bit word to the left or right

39 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Swap
 The swap operation is a special case of the circular shift operation
where k = n/2

 Swap operation on an 8-bit word

40 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Split and Combine
 Two other operations found in some block ciphers are split and
combine.

 Split and combine operations on an 8-bit word

41 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Product Ciphers
 Shannon introduced the concept of a product cipher
 A product cipher is a complex cipher combining substitution,
permutation, and other components discussed in previous sections

 Product cipher have two important properties:

 Diffusion
 Confusion

42 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Product Ciphers

Diffusion
 The idea of diffusion is to hide the relationship between the
ciphertext and the plaintext.

Confusion
 The idea of confusion is to hide the relationship between the
ciphertext and the key.

43 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Product Ciphers
Rounds
 Diffusion and confusion can be achieved using iterated product
ciphers where each iteration is a combination of S-boxes, P-boxes,
and other components.

44 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

A product cipher made of two rounds

45 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Diffusion and confusion in a block cipher

46 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Two Classes of Product Ciphers
 Modern block ciphers are all product ciphers, but they are divided
into two classes

Feistel ciphers
 Ciphers that have both invertible and non-invertible components
Non-Feistel ciphers
 Ciphers that have only invertible components

47 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Feistel Ciphers
 Feistel designed a very intelligent and interesting cipher that has
been used for decades.

 A Feistel cipher can have three types of components:

 Self-invertible,
 Invertible,
 Noninvertible.

48 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Feistel Ciphers
Feistel structure(basic)
 Mixer : combining of a non-invertible function f and XOR
 XOR can cancel the non-invertible function during decryption (self-
invertible)

49 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Feistel Ciphers

 Encryption: C1 = P1 𝑓(𝐾)
 Decryption:P2 = 𝐶2 𝑓 𝐾 = 𝐶1 𝑓 𝐾 = P1 𝑓(𝐾) 𝑓(𝐾)
= 𝑃1 000, … 0 = 𝑃1

50 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Feistel Ciphers
Example:
 The plaintext and ciphertext are each 4 bits long and the key is 3 bits
long.
 Assume that the function takes the first and third bits of the key,
interprets these two bits as a decimal number, squares the number,
and interprets the result as a 4-bit binary pattern.
 Consider the original plaintext is 0111 and the key is 101.
 The function extracts the first and third bits to get 11 in binary or 3
in decimal.The result of squaring is 9, which is 1001 in binary.

51 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Feistel Ciphers
Improvement of the previous Feistel design
 We can make mixer more complex by adding keyless components
(parts of the plaintext or ciphertext)
 The input to ‘f’ must be exactly the same in encryption and
decryption

52 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Feistel Ciphers

 Assume that L3=L2 and R3=R2

 R4=R3=R2=R1
 L4 = L3 f R3, K = L2 f R2, K = L1 f(R1, K) f(R1, K) = L1

53 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Final design of a Feistel cipher with two rounds

54 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Feistel Ciphers
 Let us see if L6=L1 and R6=R1, assuming that L4=L3 and R4=R3

We first prove for middle text:

 L5 = R 4 f L4, K2 = R3 f R2, K2 = L2 f(R2, K2) f(R2, K2) = L2
 R 5 = L4 = L3 = R 2

Proof for Plain text:

 L 6 = R5 f L5, K1 = R2 f L2, K1 = L1 f(R1, K1) f(R1, K1) = L1
 R 6 = L5 = L2 = R1

55 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT

Non-Feistel Ciphers

 A non-Feistel cipher uses only invertible components.

 A component in the encryption cipher has the corresponding
component in the decryption cipher

56 Dr. R.K.Mugelan, Asst. Prof. (Sr), SENSE, VIT