Differential cryptanalysis of DES like cryptosystems

Đây là bộ sách tiếng anh cho dân công nghệ thông tin chuyên về bảo mật,lập trình.Thích hợp cho những ai đam mê về công nghệ thông tin,tìm hiểu về bảo mật và lập trình.

[...]... one of them is likely to be veri ed successfully, and thus the right key can be identi ed 33 Typically, 16 encryptions are su cient for this attack These 16 encryptions contain eight pairs of the characteristic 1 , eight pairs of 2 , four pairs of 3 and four pairs of 4 In order not to increase the amount of data needed we use two octets that occupy four pairs of each of three plaintext XOR 4 DES reduced... to six rounds The cryptanalysis of DES reduced to six rounds is more complex than the cryptanalysis of the four round version We use two statistical characteristics 1 with probability 16 , and choose the key value that is counted most often Each one of the two characteristics lets us nd the 30 key bits of K6 which are used at the input of ve S boxes in the sixth round, but three of the S boxes are... known and the values of the six bits 33, , 38 of the plaintext XOR are zero The input XOR of the rst round is zero in all the bits entering S1 (S 10Ea = S 10Ia = 0) and thus the output XOR of S1 in the rst round must be zero (S 10Oa = 0) The left half of the ciphertext is calculated as the XOR value of the left half of the plaintext, the output of the rst round and the output of the third round (l... bits The advantages of counting on all the possible subkey bits are the good identi cation of the right key value and the small amount of data needed However, counting the number of occurrences of all the possible values of a large number of bits usually demands huge memory which can make the attack impractical We can count on a smaller number of subkey bits entering a smaller number of S boxes, and use... di erence of one bit in each S box input Thus, about six output bits di er at the third round These bits are XORed with the known di erence of the input of S1 in the second round (d0 = b0 C 0 ), making a di erence of about seven bits in the input of the fourth round and about 11 bits in the entries of the S boxes (due to the E expansion) Such an avalanche makes it very likely that the input of all the... just have to count the number of occurrences of each of the suggested keys The right key is likely to be the one that occurs most often Each characteristic lets us look for a particular number of bits in the subkey of the last round (all the bits that enter some particular S boxes) The most useful characteristics are those which have a maximal probability and a maximal number of subkey bits whose occurrences... all the keys equally likely The pushing mechanism is a statistical characteristic of the cryptosystem which is an extension of the single round analysis Before we de ne it formally we give an informal de nition and three examples De nition 6 (informal) Associated with any pair of encryptions are the XOR value of its two plaintexts, the XOR of its ciphertexts, the XORs of the inputs of each round in the... nition of a characteristic: De nition 7 An n-round characteristic is a tuple = ( P T ) where and T are m bit numbers and is a list of n elements = ( 1 2 : : : n), P each of which is a pair of the form i = ( iI iO ) where iI and iO are m=2 bit numbers and m is the block size of the cryptosystem A characteristic satis es the following requirements: 1 I 2 = the right half of P I = the left half of P n... key bits that we count on and the level of identi cation of wrong pairs that can be discarded before the counting If we are looking for k key bits then we count the number of occurrences of 2k possible key values in 2k counters The counters contain an average count of m2 counts where m is the number of pairs, is the average count per counted pair and is the ratio of the counted to all pairs (i.e., counted... noise ratio of a counting scheme is therefore: k S=N = m m p=2k = 2 p : k A simple corollary of this formula is that the signal to noise ratio of a counting scheme is independent of the amount of pairs used in the scheme Another corollary is that di erent counting schemes based on the same characteristic but with a di erent number of subkey bits have di erent S=N Usually we relate the number of pairs