Modern Block Ciphers

A symmetric-key modern block cipher encrypts an n-bit block of plaintext or decrypts an n-bit block of ciphertext. The
encryption or decryption algorithm uses a k-bit key. The decryption algorithm must be the inverse of the encryption
algorithm, and both operations must use the same secret key so that Bob can retrieve the message sent by Alice.
If the message has fewer than n bits, padding must be
added to make it an n-bit block; if the message has more
than n bits, it should be divided into n-bit blocks and the
appropriate padding must be added to the last block if
necessary. The common values for n are 64, 128, 256, or
512 bits.

Example.
How many padding bits must be added to a message of 100
characters if 8-bit ASCII is used for encoding and the block cipher accepts blocks of 64 bits? [Ans. 32]

Substitution or Transposition
A modern block cipher can be designed to act as a substitution cipher or a transposition cipher. This is the same idea as
is used in traditional ciphers, except that the symbols to be substituted or transposed are bits instead of characters. If the
cipher is designed as a substitution cipher, a 1-bit or a 0-bit in the plaintext can be replaced by either a 0 or a 1. This
means that the plaintext and the ciphertext can have a different number of 1’s.
For example, a 64-bit plaintext block of 12 0’s and 52 1’s can be encrypted to a ciphertext of 34 0’s and 30 1’s. If the
cipher is designed as a transposition cipher, the bits are only reordered (transposed); there is the same number of 1’s in
the plaintext and in the ciphertext. In either case, the number of n-bit possible plaintexts or ciphertexts is 2 n, because
each of the n bits in the block can have one of the two values, 0 or 1.
Modern block ciphers are designed as substitution ciphers because the inherent characteristics of transposition
(preserving the number of 1’s or 0’s) makes the cipher vulnerable to exhaustive-search attacks.

Components of a Modern Block Cipher

Modern block ciphers normally are keyed substitution ciphers in which the key allows only partial mappings from the
possible inputs to the possible outputs. However, modern block ciphers normally are not designed as a single unit. To
provide the required properties of a modern block cipher, such as diffusion and confusion, a modern block cipher is
made of a combination of transposition units (called P-boxes), substitution units (called S-boxes), and some other units.

P-Boxes
A P-box (permutation box) parallels the traditional transposition cipher for characters. It transposes bits. We can find
three types of P-boxes in modern block ciphers: straight P-boxes, expansion P-boxes, and compression P-boxes.

Straight P-Boxes
A straight P-Box with n inputs and n outputs is a permutation. There are n! possible mappings. Although a P-box can
use a key to define one of the n! mappings, P-boxes are normally keyless, which means that the mapping is
predetermined. If the P-box is implemented in hardware, it is prewired; if it is implemented in software, a permutation
table shows the rule of mapping.

Compression P-Boxes
A compression P-box is a P-box with n inputs and m outputs where m < n. Some of the inputs are blocked and do not
reach the output. The compression P-boxes used in modern block ciphers normally are keyless with a permutation table
showing the rule for transposing bits. We need to know that a permutation table for a compression P-box has m entries,
but the content of each entry is from 1 to n with some missing values (those inputs that are blocked).
Expansion P-Boxes
An expansion P-box is a P-box with n inputs and m outputs where m > n. Some of the inputs are connected to more
than one input. The expansion P-boxes used in modern block ciphers normally are keyless, where a permutation table
shows the rule for transposing bits. We need to know that a permutation table for an expansion P-box has m entries, but
m − n of the entries are repeated (those inputs mapped to more than one output).

Invertibility
A straight P-box is invertible. This means that we can use a straight P-box in the encryption cipher and its inverse in the
decryption cipher. The permutation tables, however, need to be the inverses of each other.

Compression and expansion P-boxes have no inverses. In a compression P-box, an input can be dropped during
encryption; the decryption algorithm does not have a clue how to replace the dropped bit (a choice between a 0-bit or a
1-bit). In an expansion P-box, an input may be mapped to more than one output during encryption; the decryption
algorithm does not have a clue which of the several inputs are mapped to an output.

S-Boxes
An S-box (substitution box) can be thought of as a miniature substitution cipher. However, an S-box can have a
different number of inputs and outputs. In other words, the input to an S-box could be an n-bit word, but the output can
be an m-bit word, where m and n are not necessarily the same. Although an S-box can be keyed or keyless, modern
block ciphers normally use keyless S-boxes, where the mapping from the inputs to the outputs is predetermined. The
relationship between input and output can be either linear or non-linear.

Exclusive-Or
An important component in most block ciphers is the exclusive-or operation. The five properties of the exclusive-or
operation in the GF(2n) field makes this operation a very interesting component for use in a block cipher. This operation
is closed under closure, associativity, commutativity, identity, and inverse. The identity is 0 and each element is additive
inverse of itself. The complement w.r.t this operation can be described by the following two relations.

Circular Shift
Another component found in some modern block ciphers is the circular shift operation. Shifting can be to the left or to
the right. The circular left-shift operation shifts each bit in an n-bit word k positions to the left; the leftmost k bits are
removed from the left and become the rightmost bits. The circular right-shift operation shifts each bit in an n-bit word k
positions to the right; the rightmost k bits are removed from the right and become the leftmost bits.

Invertibility
A circular left-shift operation is the inverse of the circular right-shift operation. If one is used in the encryption cipher,
the other can be used in the decryption cipher.

Swap
The swap operation is a special case of the circular shift operation where k = n/2. This means this operation is valid only
if n is an even number. Because left-shifting n/2 bits is the same as right-shifting n/2, this component is self-invertible.
A swap operation in the encryption cipher can be totally canceled by a swap operation in the decryption cipher.

Split and Combine

Two other operations found in some block ciphers are split and combine. The split operation normally splits an n-bit
word in the middle, creating two equal-length words. The combine operation normally concatenates two equal-length
words to create an n-bit word. These two operations are inverses of each other and can be used as a pair to cancel each
other out. If one is used in the encryption cipher, the other is used in the decryption cipher.

Product Ciphers
Shannon introduced the concept of a product cipher. A product cipher is a complex cipher combining substitution,
permutation, and other components.

Diffusion and Confusion

Shannon’s idea in introducing the product cipher was to enable the block ciphers to have two important properties:
diffusion and confusion. The idea of diffusion is to hide the relationship between the ciphertext and the plaintext. This
will frustrate the adversary who uses ciphertext statistics to find the plaintext. Diffusion implies that each symbol
(character or bit) in the ciphertext is dependent on some or all symbols in the plaintext. In other words, if a single
symbol in the plaintext is changed, several or all symbols in the ciphertext will also be changed.
The idea of confusion is to hide the relationship between the ciphertext and the key. This will frustrate the adversary
who tries to use the ciphertext to find the key. In other words, if a single bit in the key is changed, most or all bits in the
ciphertext will also be changed.

Rounds
Diffusion and confusion can be achieved using iterated product ciphers where each iteration is a combination of S-
boxes, P-boxes, and other components. Each iteration is referred to as a round. The block cipher uses a key schedule or
key generator that creates different keys for each round from the cipher key. In an N-round cipher, the plaintext is
encrypted N times to create the ciphertext; the ciphertext is decrypted N times to create the plaintext. We refer to the
text created at the intermediate levels (between two rounds) as the middle text.
Feistel Cipher
The left-hand side of figure depicts the structure
proposed by Feistel. The inputs to the encryption
algorithm are a plaintext block of length 2w bits
and a key K. The plaintext block is divided into
two halves, L0 and R0. The two halves of the data
pass through n rounds of processing and then
combine to produce the ciphertext block. Each
round i has as inputs Li-1 and Ri-1 derived from
the previous round, as well as a subkey Ki derived
from the overall K. In general, the subkeys Ki are
different from K and from each other. In the
figure, 16 rounds are used, although any number
of rounds could be implemented.
All rounds have the same structure. A substitution
is performed on the left half of the data. This is
done by applying a round function F to the right
half of the data and then taking the exclusive-OR
of the output of that function and the left half of
the data. The round function has the same general
structure for each round but is parametrized by the
round subkey Ki. Another way to express this is to
say that F is a function of right-half block of w
bits and a subkey of y bits, which produces an
output value of length w bits: F(REi, Ki+1).
Following this substitution, a permutation is
performed that consists of the interchange of the
two halves of the data. This structure is a
particular form of the substitution-permutation
network (SPN) proposed by Shannon.
The exact realization of a Feistel network depends
on the choice of the following parameters and
design features:
• Block size: Larger block sizes mean
greater security (all other things being
equal) but reduced encryption/decryption speed for a given algorithm. The greater security is achieved by
greater diffusion. Traditionally, a block size of 64 bits has been considered a reasonable trade off and was
nearly universal in block cipher design.
• Key size: Larger key size means greater security but may decrease encryption/decryption speed. The greater
security is achieved by greater resistance to brute-force attacks and greater confusion. Key sizes of 64 bits or
less are now widely considered to be inadequate, and 128 bits has become a common size.
• Number of rounds: The essence of the Feistel cipher is that a single round offers inadequate security but that
multiple rounds offer increasing security. A typical size is 16 rounds.
• Subkey generation algorithm: Greater complexity in this algorithm should lead to greater difficulty of
cryptanalysis.
• Round function F: Again, greater complexity generally means greater resistance to cryptanalysis.

There are two other considerations in the design of a Feistel cipher:

• Fast software encryption/decryption: In many cases, encryption is embedded in applications or utility functions
in such a way as to preclude a hardware implementation. Accordingly, the speed of execution of the algorithm
becomes a concern.
• Ease of analysis: Although we would like to make our algorithm as difficult as possible to cryptanalyze, there
is great benefit in making the algorithm easy to analyze. That is, if the algorithm can be concisely and clearly
explained, it is easier to analyze that algorithm for cryptanalytic vulnerabilities and therefore develop a higher
level of assurance as to its strength.

Feistel Decryption Algorithm

The process of decryption with a Feistel cipher is essentially the same as the encryption process. The rule is as follows:
Use the ciphertext as input to the algorithm, but use the subkeys Ki in reverse order. That is, use Kn in the first round,
Kn-1 in the second round, and so on, until K1 is used in the last round. This is a nice feature, because it means we need
not implement two different algorithms; one for encryption and one for decryption.