1

CIS 5371 Cryptography

5a. Pseudorandom Objects in Practice

Block Ciphers

Based on: Jonathan Katz and Yehuda Lindell Introduction to Modern Cryptography

2

Block ciphers as encryption schemes or pseudorandom

permutations

Block ciphers should be viewed as pseudorandom permutations and not as encryption schemes.

Block ciphers should be viewed as basic building blocks for symmetric key applications as not just as encryption schemes themselves.

3

Block ciphers in practice and Definition 3.28

Although we consider block ciphers as pseudorandom permutations, practical constructions of block ciphers do not quite meet the definition.

Practical block ciphers are defined for one (or a few) key and block lengths.

This is in contrast to Definition 3.28 that refers to all possible key and block lengths.

4

Substitution-Permutation Networks

A block cipher is that it should behave like a random permutation.

However, for a block cipher with input and output length of bits, the size of the table needed for holding the random permutation is roughly .

Thus, we need to somehow construct a concise function that behaves like a random function

5

The   confusion −diffusion  paradigm A substitution-permutation network is a direct

implementation of this paradigm. The substitution component refers to small random

functions, called S-boxes and the permutation component refers to the mixing of the outputs of the random functions.

The permutation involves the reordering of the output bits and are called mixing permutations.

6

The   confusion −diffusion  paradigm The secret key

One possibility is to have the key specify the S-boxes and mixing permutations.

Another possibility is to mix the key into the computation in between each round of substitution-permutation. This option is commonly used.

7

The   confusion −diffusion  paradigm The basic idea is to break the input up into small

parts and then feed these parts through different S-boxes (random permutations).

The outputs are then mixed together The process is repeated a given number of times,

called a rounds. The S-boxes introduce confusion into the

construction. In order to spread the confusion throughout, the

results are mixed together, achieving diffusion.

8

Single round of substitution-permutation network

9

The avalanche effect An important property in any block cipher is that

small changes to the input must result in large changes to the output.

To ensure this, block ciphers are designed so that small changes in the input propagate quickly to very large changes in the intermediate values.

10

The avalanche effectIt is easy to demonstrate that the avalanche effect holds in a substitution-permutation network, when the following hold:

1. The S-boxes are designed so that any change of at least a single bit to the input to an S-box results in a change of at least two bits in the output.

2. The mixing permutations are designed so that the output bits of any given S-box are spread into different S-boxes in the next round.

11

Feistel Networks A Feistel network is an alternative way of

constructing a block cipher. The low-level building blocks (S-boxes, mixing

permutations and key schedule) are the same. The difference is in the high-level design. The advantage of Feistel networks over

substitution permutation networks is that they enable the use of S-boxes that are not necessarily invertible.

12

Feistel Networks This is important because a good block cipher has

chaotic behavior (it should look random). Requiring that all of the components of the

construction be invertible inherently introduces structure, which contradicts the need for chaos.

13

Feistel Networks A Feistel network is thus a way of constructing

an invertible function from non-invertible components.

This seems like a contradiction in terms---if you cannot invert the components, how can you invert the overall structure.

Nevertheless, the Feistel design ingeniously overcomes this obstacle.

14

A Feistel network1. For input , denote by and the first and second

halves of respectively.2. Let and .3. For to (where is the number of rounds in the

network):a) Let and , where denotes the -function in the -th

round of the network.b) Let and c) The output is .

15

mmm

mmm

mmmmmm

mmmmmm

Feistel Network.