Block cipher: Difference between revisions

Content deleted Content added

Inline

Revision as of 00:20, 26 March 2010

In cryptography, a block cipher is a symmetric key cipher operating on fixed-length groups of bits, called blocks, with an unvarying transformation. A block cipher encryption algorithm might take (for example) a 128-bit block of plaintext as input, and output a corresponding 128-bit block of ciphertext. The exact transformation is controlled using a second input — the secret key. Decryption is similar: the decryption algorithm takes, in this example, a 128-bit block of ciphertext together with the secret key, and yields the original 128-bit block of plaintext.

To encrypt messages longer than the block size (128 bits in the above example), a mode of operation is used.

Block ciphers can be contrasted with stream ciphers; a stream cipher operates on individual digits one at a time, and the transformation varies during the encryption. The distinction between the two types is not always clear-cut: a block cipher, when used in certain modes of operation, acts effectively as a stream cipher.

An early and highly influential block cipher design was the Data Encryption Standard (DES), developed at IBM and published as a standard in 1977. A successor to DES, the Advanced Encryption Standard (AES), was adopted in 2001.

Generalities

A block cipher consists of two paired algorithms, one for encryption, E, and the other for decryption, E^-1. Both algorithms accept two inputs: an input block of size n bits and a key of size k bits, yielding an n-bit output block. For any one fixed key, decryption is the inverse function of encryption, so that

E_{K}(M)=C\;;\quad E_{K}^{-1}(C)=M

for any block M and key K. M is termed the plaintext and C the ciphertext.

For each key K, E_K is a permutation (a bijective mapping) over the set of input blocks. Each key selects one permutation from the possible set of $2^{n}!$ (see Factorial).

The block size, n, is typically 64 or 128 bits, although some ciphers have a variable block size. 64 bits was the most common length until the mid-1990s, when new designs began to switch to the longer 128-bit length. One of several modes of operation is generally used along with a padding scheme to allow plaintexts of arbitrary lengths to be encrypted. Each mode has different characteristics in regard to error propagation, ease of random access and vulnerability to certain types of attack. Typical key sizes (k) include 40, 56, 64, 80, 128, 192 and 256 bits. As of 2006^[update], 80 bits is normally taken as the minimum key length needed to prevent brute force attacks. For creating ciphers with arbitrary block sizes (or on domains that aren't powers of two) see Format-preserving encryption.

Iterated block ciphers

Most block ciphers are constructed by repeatedly applying a simpler function. This approach is known as iterated block cipher (see also product cipher). Each iteration is termed a round, and the repeated function is termed the round function; anywhere between 4 to 32 rounds are typical.

Usually, the round function R takes different round keys K_i as second input, which are derived from the original key:

M_{i}=R_{K_{i}}(M_{i-1})

where $M_{0}$ is the plaintext and $M_{r}$ the ciphertext, with r being the round number.

Frequently, key whitening is used in addition to this. At the beginning and the end, the data is modified with key material (often with XOR, but simple arithmetic operations like adding and subtracting are also used):

M_{0}=M\oplus K_{0}

M_{i}=R_{K_{i}}(M_{i-1})\;;\;i=1\dots r

C=M_{r}\oplus K_{r+1}

Many block ciphers can be categorised as Feistel networks, or, as more general substitution-permutation networks. Arithmetic operations, logical operations (especially XOR), S-boxes and various permutations are all frequently used as components.

History

Lucifer is generally considered to be the first civilian block cipher, developed at IBM in the 1970s based on work done by Horst Feistel. A revised version of the algorithm was adopted as a US government FIPS standard, the Data Encryption Standard (DES). It was chosen by the US National Bureau of Standards (NBS) after a public invitation for submissions and some internal changes by NBS (and, potentially, the NSA). DES was publicly released in 1976 and has been widely used.

DES was designed to, among other things, resist a certain cryptanalytic attack known to the NSA and rediscovered by IBM, though unknown publicly until rediscovered again and published by Eli Biham and Adi Shamir in the late 1980s. The technique is called differential cryptanalysis and remains one of the few general attacks against block ciphers; linear cryptanalysis is another, but may have been unknown even to the NSA, prior to its publication by Mitsuru Matsui. DES prompted a large amount of other work and publications in cryptography and cryptanalysis in the open community and it inspired many new cipher designs.

DES has a block size of 64 bits and a key size of 56 bits. 64-bit blocks became common in block cipher designs after DES. Key length depended on several factors, including government regulation. Many observers in the 1970s commented that the 56-bit key length used for DES was too short. As time went on, its inadequacy became apparent, especially after a special purpose machine designed to break DES was demonstrated in 1998 by the Electronic Frontier Foundation. A variant of DES, Triple DES, triple-encrypts blocks with (usually) two different keys (2TDES), resulting in a 112-bit keys and 80-bit security. It was widely adopted as a replacement and is still (2009) considered secure.

DES has been superseded as a United States Federal Standard by the Advanced Encryption Standard (AES), adopted by National Institute of Standards and Technology (NIST) in 2001 after a 5-year public competition. The cipher was developed by two Belgian cryptographers, Joan Daemen and Vincent Rijmen, and submitted under the name Rijndael. (See AES page for pronunciation.) AES has a block size of 128 bits and three possible key sizes, 128, 192 and 256 bits. The US Government permits the use of AES to protect classified information in systems approved by NSA.

Cryptanalysis

In addition to linear and differential cryptanalysis, there is a growing catalog of attacks: truncated differential cryptanalysis, partial differential cryptanalysis, integral cryptanalysis, which encompasses square and integral attacks, slide attacks, boomerang attacks, the XSL attack, impossible differential cryptanalysis and algebraic attacks. For a new block cipher design to have any credibility, it must demonstrate evidence of security against known attacks.

Tweakable block ciphers

M. Liskov, R. Rivest, and D. Wagner have described a generalized version of block ciphers called "tweakable" block ciphers. A tweakable block cipher accepts a second input called the tweak along with its usual plaintext or ciphertext input. The tweak, along with the key, selects the permutation computed by the cipher. If changing tweaks is sufficiently lightweight (compared with a usually-fairly-expensive key setup operation), then some interesting new operation modes become possible. The disk encryption theory article describes some of these modes.

Block ciphers and other cryptographic primitives

Block ciphers can be used to build other cryptographic primitives. For these other primitives to be cryptographically secure care has to be taken to build them the right way.

Stream ciphers can be built using block ciphers. OFB-mode and CTR mode are block modes that turn a block cipher into a stream cipher.

Cryptographic hash functions can be built using block ciphers. See one-way compression function for descriptions of several such methods. The methods resemble the block cipher modes of operation usually used for encryption.

Just as block ciphers can be used to build hash functions, hash functions can be used to build block ciphers. Examples of such block ciphers are SHACAL, BEAR and LION.

Cryptographically secure pseudorandom number generators (CSPRNGs) can be built using block ciphers.

Secure pseudorandom permutations of arbitrarily-sized finite sets can be constructed with block ciphers; see Format-Preserving Encryption.

Message authentication codes (MACs) are often built from block ciphers. CBC-MAC, OMAC and PMAC are such MACs.

Authenticated encryption is also built from block ciphers. It means to both encrypt and MAC at the same time. That is to both provide confidentiality and authentication. CCM, EAX, GCM and OCB are such authenticated encryption modes.

References

M. Liskov, R. Rivest, and D. Wagner, "Tweakable Block Ciphers", Crypto 2002 PDF.

External links

@@ Line 16: / Line 16: @@
 For each key ''K'', ''E<sub>K</sub>'' is a [[permutation]] (a [[bijective]] mapping) over the set of input blocks. Each key selects one permutation from the possible set of <math>2^n!</math> (see [[Factorial]]).
-The [[block size (cryptography)|block size]], ''n'', is typically 64 or 128 bits, although some ciphers have a variable block size. 64 bits was the most common length until the mid-1990s, when new designs began to switch to the longer 128-bit length. One of several [[block cipher modes of operation|modes of operation]] is generally used along with a [[padding (cryptography)|padding]] scheme to allow plaintexts of arbitrary lengths to be encrypted. Each mode has different characteristics in regard to error propagation, ease of random access and vulnerability to certain types of attack. Typical [[key size]]s (''k'') include 40, 56, 64, 80, 128, 192 and 256 bits. {{As of|2006}}, 80 bits is normally taken as the minimum key length needed to prevent [[brute force attack]]s.
+The [[block size (cryptography)|block size]], ''n'', is typically 64 or 128 bits, although some ciphers have a variable block size. 64 bits was the most common length until the mid-1990s, when new designs began to switch to the longer 128-bit length. One of several [[block cipher modes of operation|modes of operation]] is generally used along with a [[padding (cryptography)|padding]] scheme to allow plaintexts of arbitrary lengths to be encrypted. Each mode has different characteristics in regard to error propagation, ease of random access and vulnerability to certain types of attack. Typical [[key size]]s (''k'') include 40, 56, 64, 80, 128, 192 and 256 bits. {{As of|2006}}, 80 bits is normally taken as the minimum key length needed to prevent [[brute force attack]]s.  For creating ciphers with arbitrary block sizes (or on domains that aren't powers of two) see [[Format-preserving encryption]].
 ===Iterated block ciphers===