Table of Contents

Team LiB
Next Section
Modern Cryptography: Protect Your Data with Fast Block Ciphers
Modern Cryptography: Protect Your Data with Fast Block Ciphers
by Nik Goots, Boris Izotov, Alex Moldovyan and Nik Moldovyan ISBN:1931769125
A-LIST Publishing © 2003 (412 pages)

This book gives a general picture of modern cryptography and covers specific issues related to developing fast block ciphers using software and/or hardware implementation in a way that is easily understandable to a wide circle of readers.

Table of Contents
 | Modern Cryptography—Protect Your Data with Fast Block Ciphers
 | Introduction
 | Chapter 1 | - | Cryptography in the Information Age
 | Chapter 2 | - | Flexible Software Ciphers
 | Chapter 3 | - | Controlled Permutation
 | Chapter 4 | - | Controlled Operational Substitutions
 | Chapter 5 | - | Designing Fast Ciphers Based on Controlled Operations
 | Chapter 6 | - | Elements of the Cryptanalysis of Ciphers Based on Controlled Operations
 | Conclusion
 | Glossary
 | References
 | Index
 | List of Figures
 | List of Tables
 | List of Examples
Team LiB
Next Section


BackCover

Team LiB
Back Cover

This book gives a general picture of modern cryptography. At the same time, it covers specific issues related to developing fast block ciphers using software and/or hardware implementation in a way that is easily understandable to a wide circle of readers. The material dedicated to the meaning of cryptography in informational society, two-key cryptography, cryptographic protocols, digital electronic signatures, and a number of well-known single-key ciphers, can be filed under the heading of general description. The detailed look at the issues concerning and methods of dealing with designing fast block ciphers can also be classified as a subject that should interest many, considering their importance in modern information protection technologies and their widespread use. If one skips over the detailed mathematical computations and proofs, one can say that this part of the book’s content can also appeal to a good number of readers, since the different ways of designing fast ciphers are also illustrated with an ample number of pictures and diagrams.

About the Authors

Nik Goots, Ph.D., is the author of 23 scientific articles in the area of information protection, and has two patents.

Boris Izotov, Ph.D., is the author of 21 scientific articles in the area of information protection, and has two patents.

Alex Moldovyan, Ph.D., Assistant Professor, is the author of more than 60 scientific articles in the area of information protection, and has 26 patents on fast encryption methods.

Nik Moldovyan, Ph.D., is the author of more than 100 scientific articles and has 50 inventions to his name. He is head researcher at a specialized center for software systems.

Team LiB


Modern Cryptography-Protect Your Data with Fast Block Ciphers

Nick Goots
Boris Izotov
Alexander Moldovyan
Nick Moldovyan

A-List

Copyright © 2003 A-LIST, LLC

All rights reserved.

No part of this publication may be reproduced in any way, stored in a retrieval system of any type, or transmitted by any means or media, electronic or mechanical, including, but not limited to, photocopy, recording, or scanning, without prior permission in writing from the publisher.

A-LIST, LLC
295 East Swedesford Rd.
PMB #285
Wayne, PA 19087
702-977-5377 (FAX)
mail@alistpublishing.com
http://www.alistpublishing.com

All brand names and product names mentioned in this book are trademarks or service marks of their respective companies. Any omission or misuse (of any kind) of service marks or trademarks should not be regarded as intent to infringe on the property of others. The publisher recognizes and respects all marks used by companies, manufacturers, and developers as a means to distinguish their products.

Modem Cryptography: Protect Your Data with Fast Block Ciphers
By Nick Goots, Boris Izotov, Alexander Moldovyan, Nick Moldovyan

1-931769-12-5

03 04 7 6 5 4 3 2 1

A-LIST, LLC titles are distributed by Independent Publishers Group and are available for site license or bulk purchase by institutions, user groups, corporations, etc.

Book Editor: Jessica Mroz

LIMITED WARRANTY AND DISCLAIMER OF LIABILITY

A-LIST, LLC., INDEPENDENT PUBLISHERS GROUP AND/OR ANYONE WHO HAS BEEN INVOLVED IN THE WRITING, CREATION OR PRODUCTION OF THE ACCOMPANYING CODE ("THE SOFTWARE") OR TEXTUAL MATERIAL IN THE BOOK, CANNOT AND DO NOT WARRANT THE PERFORMANCE OR RESULTS THAT MAY BE OBTAINED BY USING THE CODE OR CONTENTS OF THE BOOK. THE AUTHORS AND PUBLISHERS HAVE USED THEIR BEST EFFORTS TO ENSURE THE ACCURACY AND FUNCTIONALITY OF THE TEXTUAL MATERIAL AND PROGRAMS CONTAINED HEREIN; WE HOWEVER MAKE NO WARRANTY OF ANY KIND, EXPRESSED OR IMPLIED, REGARDING THE PERFORMANCE OF THESE PROGRAMS OR CONTENTS.

THE AUTHORS, THE PUBLISHER, DEVELOPERS OF THIRD PARTY SOFTWARE, AND ANYONE INVOLVED IN THE PRODUCTION AND MANUFACTURING OF THIS WORK SHALL NOT BE LIABLE FOR DAMAGES OF ANY KIND ARISING OUT OF THE USE OF (OR THE INABILITY TO USE) THE PROGRAMS, SOURCE CODE, OR TEXTUAL MATERIAL CONTAINED IN THIS PUBLICATION. THIS INCLUDES, BUT IS NOT LIMITED TO, LOSS OF REVENUE OR PROFIT, OR OTHER INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THE PRODUCT.

THE USE OF "IMPLIED WARRANTY" AND CERTAIN "EXCLUSIONS" VARY FROM STATE TO STATE, AND MAY NOT APPLY TO THE PURCHASER OF THIS PRODUCT.

Acknowledgements

The authors are grateful to the US Air Force for funding the research underlying a significant part of this book, and Dr. V. A. Skormin of the AFOSR for providing editorial support.


Introduction

Today, cryptographic methods are widely applied not only in protecting data against unauthorized access, but also as a basis for many emerging information technologies, such as online document circulation, digital cash, online voting, etc. Modern cryptography provides the following three essential services:

  • Ensures privacy (secrecy)

  • Authenticates information and its message source

  • Provides anonymity (for example, hiding a digital cash transfer from one entity to another)

The first need has been around for thousands of years, the latter two are relatively new, and the solutions to all of them are addressed by a number of promising new directions in theoretical and applied cryptography. Nevertheless, the traditional cryptographical task of ensuring information secrecy is as important as ever. This is mainly related to the fact that, in the present age of wide-spread computer use, the task of electronic information protection has become a large-scale problem. At the same time, strict technological requirements are put on encryption algorithms, by a multitude of various electronic devices (telecommunication systems, computers, computer networks, smart cards, etc.). The number of requirements for ciphers is growing simultaneously in the areas of security, speed, and implementation simplicity. Tightening the requirements on security is motivated by the fact that the expanding use of cryptography is also accompanied by ever-greater possibilities that an attacker can use under certain operating conditions of a cryptosystem. (For example, he or she might perform an external action in order to cause hardware errors, measure the power consumption, determine the computing time, etc.) The increased requirements are related to the necessity of retaining high performance after building protection mechanisms into computer systems. A simple hardware design is necessary in order to decrease the cost of encryption tools, facilitate their use, and make it more convenient to be built into portable devices. Due to the nature of data in digital devices, block ciphers are most useful and can, for example, provide random access to data on cryptographically protected media.

Thus, the design of fast block ciphers is an important challenge of applied cryptography, with many cryptographers making contributions. A typical feature of most new fast ciphers is the use of precomputations that extend the secret key. When creating software ciphers, the use of complex precomputation algorithms to simplify enciphering transformations is justified in many applications. When designing ciphers with dual orientation (software and hardware), such as the new American standard AES, cryptographers must first of all take into account modern commercially available processors, given the fact that modern microelectronic technology can easily provide a hardware implementation for very complicated transformation algorithms. However, for popular enciphering devices in computer and telecommunication systems and smart cards, hardware resources are critical. Economical solutions have made it possible to manufacture cheaper and more reliable devices, while decreasing power consumption.

In some network applications, high encryption speed is necessary with frequent key changing, which limits the use of ciphers with precalculations, since they significantly hold the performance back. Thus, decreasing the complexity of precalculations while maintaing a high level security is paramount. Taking this into account, it seems reasonable to completely abandon preliminary transformations of the secret key and replace it with transformations of subkeys that depend on the data being transformed, these operations being performed at the same time as the data transformation. Thus, it is urgent to design a new generation of fast ciphers that have inexpensive hardware implementation and retain a high encryption speed with frequent key changing. Such cryptosystems must possess high security against the classical variants of attacks, such as known-text or chosen-text attacks, as well as against new types of attacks, such as differential fault analyses.

One promising area of fast ciphers is the use of flexible operations and/or transformation procedures. For example, for a software implementation, it is easy to implement cryptosystems in which the precalculation stage includes generating the encryption algorithm from the secret key. This can be done by tweaking transformation operations at special points in the algorithm, or by combining transformation procedures from a specific subset of enciphering functions (the library of transformation procedures). Such ciphers can be called flexible. Actually, flexible block algorithms with inputs that are b bits long are formally described just like any other cipher - using a monoalphabetic substitution in the set of possible input texts with a length of b. However, taking into account the trend toward standard microprocessor commands, it is reasonable and convenient to describe such ciphers in terms of algorithm tweaking. Such an approach to the design of flexible hardware ciphers can be used with microprocessor-based enciphering devices. A disadvantage of this approach is that it is necessary to perform some quite complicated precalculations, which significantly slows down encryption when the keys are changed frequently.

One interesting method to build block ciphers is whith hardware-oriented ciphers based on controlled operations. By a flexible (controlled) operation, we mean an operation controlled by a binary vector. For a fixed value of the control vector, transformations are connected with one of the variants (modifications) of the flexible operation. Thus, a controlled operation can be described as a set of different modifications, each of which corresponds to a particular value of the control vector. In general, one modification can correspond to different values of the control vector. However, when designing controlled operations, it makes sense to implement the following:

  • Unique modifications

  • A large number of modifications

  • Significant differences between the modifications

Controlled transformation operations are essentially new cryptographic primitives that specify fixed encryption/decryption procedures for a given secret key. The control vector in these procedures is generated using the secret key and/or the data block being transformed. Cryptalgorithms built in that way are flexible in that the modifications of typically traditional operations depends on variable parameters of the cryptosystem (the key and the text being encrypted).

If the control vector only depends on the data block being transformed, such a flexible operation will henceforth be called a data-dependent operation (DDO). If the control vector is generated from the key and data, this flexible operation specifies a certain set of modifications depending on the key. A particular current modification is chosen from this set, depending on the current control subblock of data. In this case, we have a DDO depending on the key. Such primitives extend the possibilites for developers creating flexible ciphers.

DDOs usually specify non-linear transformations, even if all the corresponding modifications are linear. Generally, the effectiveness of DDOs is related to the size of the transformed data subblock on which they specify a substitution. If the modification of a particular DDO specifies a transformation of n-bit binary vectors, and the number of these modifications is M, then the DDO itself specifies a transformation on N-bit vectors, where N = n + log2M. It is evident from this equation that, in order to increase the DDO's effectiveness, it is necessary to significantly increase the number of modifications. Another way is to develop DDOs that include special modifications. Currently, DDOs have been approved in practice for such block ciphers as RC5, RC6, and MARS, which have been comprehensively tested in recent years. It has been demonstrated that rotation operations that depend on the data being transformed and that include just 32 modifications effectively counteract the most powerful modern attacks - differential and linear cryptanalysis.

More effective encryption methods based on DDOs include solutions patented in Russia that use controlled permutations (Russian patent Nos. 2127024, 2140710, 2140713, and 2140715) and controlled binary operations (patent No. 2140716). The number of modifications corresponding to a controlled permutation operation can be as large as n! (≈ 2n(log2n−1). For controlled binary operations, it is possible to develop fast operational boxes, specifying the M value to be between 2n and 2kn, where k ≥ 2 is a natural number.

In this book, we'll look at using controlled operations to build fast ciphers that combine high security, high speed of data transformation, and low hardware complexity. We'll demonstrate the possibility of building operation boxes that implement unique operation modifications for each value of a control code. Generating a control code depending on the secret key and data being transformed makes it possible to effectively implement a new technological solution (patent No. 2124814) to the design of fast ciphers, in which the enciphering algorithm is generated depending on the secret key by adjusting a DDO. One remarkable feature of such ciphers is that they don't use precalculation. Thanks to this, the hardware implementation is not complicated, and an encryption speed of 1 Gbit/s or more can be attained with randomly and frequently changing secret keys. We'll also discuss building controlled permutations and controlled operational substitutions and, in particular, controlled adders of a special type and current methods of designing fast iterated ciphers based on this.

Ciphers based on controlled operations posses the following properties, which provide high security against linear and differential cryptanalysis:

  • Non-linear transformations are performed on large subblocks (32, 64, 128, or 256 bits long).

  • DDOs depend on a secret key.

  • Round keys are transformed depending on the transformed data.

When extending basic microprocessor instructions with those that implement a controlled permutation, it is easy to design software ciphers with speeds greater than 1 Gbit/s when commercially available processors like Pentium are used. Such extension of a command set won't actually affect the cost of a microprocessor, due to the low hardware complexity of the operation boxes implementing the controlled permutation. This type of new command may perform a rotation operation on binary vectors with an arbitrary length (say, on 32-bit words, simultaneously on two 16-bit words, or simultaneously on four bytes).

Using flexible ciphers without precalculations to design fast and secure hash functions of special interest is. The transformation procedures (discussed in standard operations) of such hash functions depend on the data being hashed, which allows us to call them flexible hash functions. However, it should be noted that the term "flexible operation," as well as "DDO," are conventional. They only emphasize the method of describing a more complicated operation on long binary vectors that uses simpler standard operations. This method is widely recognized. It provides a simpler description of new primitives, which would lose their clarity and ease of perception if they were formally described.

When writing this book, we intended to present a general picture of modern cryptography in a form understandable to a wide circle of readers, and discuss special issues related to the software and/or hardware design of fast block ciphers. Some general issues include the role of cryptography in modern society, two-key cryptography, cryptographic protocols, digital signatures, and a number of well-known one-key ciphers. A comprehensive discussion of the problem of designing fast block ciphers and approaches to its solution should also be of interest, due to their huge importance in modern data protection technologies, as well as their growing use. If one looks past the detailed mathematical reasonings and proofs, this part of the material should also be understandable to a wide range of readers, since the variants of building fast ciphers are illustrated with drawings and diagrams. The list of references that we provide reflects the degree of modern advances in theoretical and applied cryptography when it comes to block ciphers. Readers interested in a comprehensive account of controlled transformations as an approach to the design of fast block ciphers will find its mathematical basis here.


Chapter 1: Cryptography in the Information Age

1.1. Information Protection Problems in Computer Systems

Historically, cryptography has emerged as a response to the requirement of transmitting secret information. For a long time, it was only concerned with designing special methods of information transformation in order to represent it in a form incomprehensible to a potential opponent. After electronic methods of information processing and transmitting had developed, cryptography's tasks became more varied. Nowadays, when computer information technologies have become widely applicable, cryptography includes an abundant number of tasks not directly related to making information secret. Modern cryptography issues include developing digital signature systems, computerized voting systems, coin tossing protocols, remote user authentication protocols, protection against creating false messages, etc.

Many of software technology's actual problems are effectively solved using cryptographic methods. In cryptography, you must assume the existence of a potential malicious person (an opponent, an enemy's cryptanalyst, an adversary, an unauthorized user) who is aware of the cryptographic algorithms, protocols, and methods used, and tries to compromise them. Compromising a cryptosystem can involve, for example, unauthorized data reading, forging someone else's signature, modifying voting results, infringing on voting secrecy, or modifying data that won't be detected by the intended receiver. The opponent's actions are generally called a cryptographic attack (or simply an attack). One specific feature of cryptography is that it is aimed at developing methods that protect you against any of an opponent's actions, but when designing a cryptosystem, it is impossible to foresee the types of attacks that will be invented in the future, due to theoretical and technological advances. The main question is: how reliable is the solution of a certain cryptographic problem? The answer to this question is directly related to estimating the effort required to attack the cryptosystem. As a rule, the solution to this problem is extremely complex, and it is an individual research topic in itself, called cryptanalysis. Cryptography and cryptanalysis comprise a unified scientific area, called cryptology. Right now, this is a new area of mathematics that has important applications in modern information technologies.

The wide use of computer technologies in data processing and control systems has aggravated the problem of protecting information from unauthorized access. Information protection in computer systems has certain specific features related to the fact that information isn't rigidly bound to a medium - it can be easily and quickly copied and transmitted over communication channels. There are many known threats to information, and they can be implemented both by inside and outside adversaries.

A radical solution to the problem of protecting information that flows in high-performance computer systems can be obtained using cryptographic methods. In this case, it is important to utilize fast enciphering algorithms that don't decrease the performance of the computer or telecommunication systems. Cryptographic data transformations are a flexible and effective tool for providing data privacy, integrity, and authenticity. Using cryptographic methods in combination with technological and organizational methods can protect against a wide range of potential threats.

The demands of modern software technologies have led to the emergence of non-traditional data protection tasks, one of which is information authentication in situations where the parties exchanging information don't trust each other. This problem is related to the design of digital signature systems. The theoretical foundation of the solution of this problem was the invention of two-key cryptography by American researchers Diffie and Hellman in the mid-'70s [26], which was a brilliant breakthrough in the centuries-old evolution of cryptography. The revolutionary ideas of two-key cryptography led to a drastic growth in public research in this area, and revealed new directions for the development of cryptography and its unique worth in the present context of rapidly developing electronic information technologies.

The technological basis of the transition to an information society is modern micro-electronic technology, which provides for a continuous growth in the quality of computers, and in turn is the basis for their main design tendencies - (1) decreasing the size and power consumption of the hardware, (2) increasing the capacity of the random-access memory and built-in and removable disks, (3) increasing the performance and reliability of computer systems, and (4) expanding the areas for and increasing the intensity of computer use. These trends in computer development have led to a situation where modern protection of computer systems against unauthorized access requires using software cryptographic protection tools.

As recent practice shows, the use of hardware ciphers has gained popularity. One of the currently central problems in applied cryptography is designing algorithms that will provide a speed of 1,500 MBits/sec or more when implemented as inexpensive microcircuits (cryptochips). First of all, this is related to the wide use of enciphering in commercial TV. Another popular area using cryptochips is mobile telephony. Recently, information security specialists and users have become aware of the necessity of cryptographically protecting information transmitted from video security cameras and other security devices. This area of using cryptography requires that enciphering devices with a low hardware complexity be designed.

One of the important social and ethical problems that arose due to the expanding use of cryptographic data protection methods is the conflict between the users' desire to protect their information and messages transmitted and the desire of government intelligence services to access companies' and individuals' information in order to prevent illegal activities. In industrial countries, there is a wide range of opinions concerning regulations on the use of enciphering algorithms. The suggestions vary from total prohibition of using cryptographic methods on a large scale, to unlimited freedom in using them. Some proposals only give permission to use weak algorithms, or require the mandatory registration of encryption keys.

It is extremely difficult to solve this problem. How can one estimate the relationship between the losses of law-abiding citizens due to the illegal use of their private information and the losses of the government due to the impossibility of accessing the cryptographically protected information of certain groups trying to conceal criminal activities? How can one ensure that cryptalgorithms will not be used illegally by people who violate other laws? Besides that, there are various other ways of secretly storing and transmitting information. The answers to these questions have yet to be found by sociologists, psychologists, lawyers, and politicians.

As for research in the area of cryptography that can result in convenient and practically secure algorithms, hindering it doesn't seem to be reasonable. Law-abiding citizens and organizations should be provided with an equal opportunity to protect their information, since criminals who use cryptographic advances would thus be in a much better position if this were not the case.

Furthermore, limiting research in the field of cryptography would most likely slow down the development of cryptography, but it will by no means prevent criminals from using modern cryptographic methods obtained, for example, from other countries. As a result, it will be law-abiding citizens and organizations whose rights will be most seriously infringed upon. In many countries, this problem is fully understood, which has increased the number of industrial countries in which rigid limits on using encryption have been removed.

Regardless of the progress in developing cryptographic methods of data protection, the government can always require by law that all users of ciphers must register their keys (or a necessary portion of key data) with specially organized institutions. In this case, information is controlled, no matter how secure the algorithms used are. This and other issues demonstrate that hindering research in the area of cryptography is not objectively justified. As far back as the early '70s, the demands of practice in Western industrial countries aroused an interest in cryptography in many researchers in different areas, and gave the impetus to public research in this area, which was previously considered exclusive and was a matter of concern only to intelligence services.

There are a number of examples where secrecy in the field of cryptography has led to significant failures in producing enciphering devices, and even to falling behind scientific and technological progress. Intensive activities in such a "hot" domain of science created conditions ripe for increasing the quality of cryptographic research, which thus allowed Diffie and Hellman to discover two-key cryptography. Their ideas brought into existence new, non-traditional divisions of cryptography, and made it one of the most rapidly developing trends in modern mathematics. The discovery of two-key cryptography is a vivid example of the interaction between theory and practice, and is also an example of how politics influences theoretical advances.

Hindering research in the realm of cryptography simplifies some problems for intelligence services. However, the nation as a whole strongly suffers from it, and the negative effect is related to falling behind in designing modern data protection systems, spreading computer crimes, etc. Examples are found in global computer networks, such as the Internet, which are revolutionary achievements of computer technologies, but also are playgrounds for a great number of crimes and infringements.

As a result of working in the Internet, the vulnerabilities and shortcomings of traditional administrative and system mechanisms of data protection became clearer. Cryptography presents fundamentally new possibilities in providing information security in computer systems, and nowadays its methods have been widely introduced into global network technologies. It is not the refusal of progress in informatization, but rather the use of modern cryptography advances that has turned out to be the strategically correct decision, verified in practice. The possibility of widely using cryptography in computer networks is a great achievement and a sign of a democratic society.

Knowing the basics of cryptography in an information society cannot objectively be a privilege of individual government services, but is a vital necessity for scientists and engineers that utilize computer data processing or develop information systems, employees of security departments, and upper management in various organizations and companies. Only this approach can be a basis for introducing and operating high-quality tools for information protection.

A single organization cannot provide sufficient control over information streams within a whole country, and it cannot provide proper protection for national distributed information resources. However, certain government organizations can create conditions that allow a market of high-quality protection tools to emerge, a sufficient number of specialists to be trained, and "common users" to be taught the basics of data protection and cryptography.

In the early '90s, in Russia and the countries of the former Soviet Union, there was a distinct trend in which the intensity and propagation of the use of information technologies was getting ahead of the development of data protection systems. This situation, to some extent, is typical for certain industrial countries. This is a natural order: first practical problems must emerge, and then their solutions will be found. The turning point in the situation of the late '80s, when the countries of the former Soviet Union were falling behind in the domain of informatization, created fertile ground for overcoming the aforementioned trend. The example of the industrial countries and the possibility of purchasing system software and computers encouraged Russian users. A wide range of users concerned with online data processing and other advantages of modern computer systems were involved in solving the problem of expanding computer technologies, and this fact led to a very high rate of development in this area in Russia and the other countries of the former Soviet Union. However, the natural joint development of information processing tools and information protecting ones was broken, which was the cause of abundant computer crimes. It's no secret that these crimes have now become an urgent problem.

Using foreign protection tools can't correct this imbalance, because software products of this type available in the Russian market don't satisfy modern requirements due to the export limitations adopted in the USA, the main vendor of data protection tools. Another issue of prime importance is that software products of this type are subject to an established certification procedure in authorized organizations. Checking encryption algorithms, software, and hardware for various bugs and viruses is an extremely labor-consuming task. Recent investigations of cryptographers revealed that it is possible to design trapdoor encryption algorithms, these trapdoors being practically impossible to detect in a reasonable time, even by high-class specialists.

Certificates given by foreign companies and organizations cannot be a substitute for national ones. Just the fact of using foreign system and application software in crucial areas creates a threat for information resources. Using foreign protection tools without proper analysis of their correspondence to the functions performed and the security level provided can drastically complicate the situation.

Speeding up the informatization process requires that users be adequately provided with protection tools. An insufficient supply of tools that protect the information in computer systems in the internal market hampers top-quality data protection on the necessary scale for a long time. The situation is aggravated by the lack of a sufficient number of data protection specialists, since such professionals are usually only trained to work in intelligence services. The restructuring of these intelligence organizations caused by the processes taking place in Russia have led to independent firms that specialize in data protection absorbing the available staff. As a result, there arose competition, which produced a sufficiently large number of certified Russian-produced data protection tools.

One of the important features of the wide use of information technologies is that an effective solution of the problem of protecting national information resources requires distributing data protection measures to all users. Information must first be protected where it is created, gathered, and processed, and by the organizations that would suffer from unauthorized access to their data. This principle is both reasonable and effective: protecting individual organizations' interests is the basis of protecting national interests as a whole.


1.2. Problems in Cryptography

1.2.1. Traditional Cryptography Issues

The word "cryptography", taken from Greek, means "secret writing", which well reflects its original purpose. Cryptographic methods that seem primitive from the modern view point have been known since antiquity, and have long been treated as puzzles rather than as a strict branch of science. The classical cryptographic task is to provide for a reversible transformation of an understandable plaintext (original text) to a seemingly random character sequence called a ciphertext or a cryptogram. The ciphertext can contain both new characters and those present in the original message. Generally, the number of characters in a cryptogram and the number in the plaintext may differ. A mandatory requirement is the possibility of uniquely and fully restoring the plaintext by simply performing some logical operations with the characters of the ciphertext. In old times, the security of the information was determined by how well the transformation method was kept secret.

However, just a secret algorithm cannot provide absolute security, i.e., the impossibility of reading a cryptogram by an opponent possessing infinite computing resources. Since secret algorithms aren't available for large-scale cryptanalytical research, there is a much higher probability, as compared to public algorithms, that the vulnerabilities of secret algorithms will be found, and thus that so will effective ways of breaking them will be found as well. In connection with this, public algorithms that have undergone long-term testing and discussions in public cryptographic literature are more widely used nowadays.

The security of modern cryptosystems is not based on the secrecy of the algorithm, but on the secrecy of a relatively small amount of information, called a secret key. The key is used to control the process of cryptographic transformation (ciphering), and it is an easily changeable element of a cryptosystem. Users can change the key at any time, whereas the ciphering algorithm itself is a constant element of the cryptosystem, and it is the result of long-term research and testing.

Other things being equal, the lack of comprehensive information on the ciphering algorithm (provided it is implemented properly) significantly hampers any cryptanalytical attack. This is why modern ciphers with a ciphering algorithm directly being a pseudorandom changeable element were proposed. The information about the overall structure of such cryptosystems is available, thus making it possible to estimate its security as a whole. Such ciphers are implemented as flexible cryptosystems in which an algorithm used in a ciphering session is created according to a special initializing algorithm. This latter algorithm is public, and the algorithm used is unknown and depends on the user's secret key.

Many ages have passed, during which cryptography was mostly the occupation of the elite — priests, kings, military leaders, and diplomats. Though uncommon, cryptographic methods of breaking the opponent's ciphers had a significant influence on the results of important historical events. There are many examples where overestimating ciphering methods led to military and diplomatic losses. Despite using cryptographic methods in important areas, the occasional usage of cryptography didn't have anywhere near the importance it now has in modern society. Cryptography owes the fact that it has turned into a scientific discipline to practical demands and the development of electronic information technologies.

In the 19th century, a significant interest in cryptography led to further development in connection with emerging electrical means of communication. In the 20th century, the intelligence services of most industrial countries began to regard it as an essential tool for their activities.

When speaking about the historic aspects of scientific research in cryptography, we must mention the fact that the whole period from ancient times to 1949 can be called prescientific, since methods of making written information private had no strict mathematical grounds. The turning point that made cryptography scientific and set it off as an individual branch of mathematics was the publication of C. E. Shannon's article "Communication Theory of Secrecy Systems" [90] in 1949. This work was the basis for the emergence of one-key symmetric cryptosystems, in which it was necessary to exchange secret keys between the correspondents. Later, due to some peculiarities of their design, symmetrical ciphers were divided into two cryptosystems: (1) stream ciphers and (2) block ciphers. A distinguishing feature of the former is that individual characters in the input data stream are converted, whereas the latter converts whole blocks of data.

A fundamental conclusion in Shannon's work was that the reliability of an algorithm depends on the size and quality of the secret key, and on the informational redundancy of the original text. Shannon introduced the formal definition of information and a key's unreliability as a function of the number of known bits in cipher text. Furthermore, he introduced the important notion of unicity distance as the minimum text size for which only one decryption of an original text is possible. He showed that the unicity distance is in direct proportion to the key length and in inverse proportion to the redundancy of the original text. One result of Shannon's work was proof of the possibility of perfectly secure ciphers, such as Vernam's cryptosystem.

Another fundamental impetus in the development of cryptography was the publication of Diffie and Hellman's article "New Directions in Cryptography" [26] in 1976. In this work, it was shown for the first time that information secrecy can be provided without exchanging secret keys. This was the beginning of the epoch of two-key asymmetric cryptosystems, which are manifest in digital signature systems, online secret voting, protection against false messages creation, computerized coin-tossing, remote user identification and authentication, and other systems.

Over the past few years, due to the progress in electronic technologies, a number of theoretical works have appeared in the area of quantum cryptography [4], based on Heisenberg's uncertainty principle.

In parallel with the development of cryptographic systems, methods have been developed that make it possible to restore an original message based on the ciphertext and other known information. These methods are collectively known as cryptanalysis. Advances in cryptanalysis have led to tightening the requirements on cryptographic algorithms. The reliability of cryptosystems has always been of fundamental importance. This problem has been treated differently throughout the history of cryptography.

The Dutch cryptographer Kerkhoff (1835–1903) was the first to formulate the cipher security rule, according to which: (1) the complete transformation mechanism is assumed to be known to the opponent and (2) the security of an algorithm can only be determined by the unknown value of a secret key. This means that an opponent has no way of unlocking the protection, or of finding the true key in a time significantly shorter than the time it would take to try every possible secret key.

Apparently, one of the tasks for estimating a cipher's security, according to Kerkhoff, is testing cryptosystems under conditions more favorable for attacks than the conditions under which a potential violator usually acts. Kerkhoff's principle stimulated the emergence of higher-quality ciphering algorithms. One could say that here we have the first element of cryptography standardization, since it assumes the development of public methods of transformation. At present, this rule is more widely interpreted: it is assumed that all persistent elements of a security system are known to the potential opponent. This last definition of a cryptosystem includes security systems as a special case. The extended interpretation of Kerkhoff's principle assumes that all elements of a cryptosystem are divided into two categories — constant ones and easily changeable ones. Constant elements are those related to the cryptosystem structure, and they can only be changed by specialists. Easily changeable elements of a cryptosystem are those intended for frequent modification in accordance with a specified procedure. For example, the easily changeable elements of a cipher are the secret key, the password, the identifier, etc. Kerkhoff's principle reflects the fact that the required secrecy level must be achieved only by using the secret easily changeable elements of the cipher.

According to modern requirements posed on cryptosystems with a secret key of a limited size (128–256 bits), such ciphers must be secure when facing a cryptanalysis based on a known algorithm, a great amount of plaintext, and its corresponding ciphertext. Despite these general requirements, ciphers used by intelligence organizations are usually kept secret. This is due to the necessity of having an additional safety margin to protect secret information, since creating cryptosystems with provable security is nowadays a developing theory, and it is a rather complex problem. To avoid any possible weaknesses, a ciphering algorithm can be built on the basis of much-studied and approved principles and methods of transformation. Currently, no serious user will rely on simply keeping his or her algorithm secret, since it is extremely difficult to guarantee that information about the algorithm will remain unknown to a potential attacker.

Proving the reliability of systems being used is done both theoretically and experimentally, by modeling cryptattacks with the help of a team of experienced specialists, to whom much more favorable conditions are given than the conditions under which the cryptalgorithm will actually be used. For example, the cryptanalysts are provided not only with a ciphertext and a transformation algorithm, but also with an original text or some part of it, several independent ciphertexts obtained using the same key, or ciphertexts obtained from the given plaintext using different keys. The security of the tested cryptosystem is estimated against all known cryptanalytical methods, and ways of breaking the system are invented if possible. If the cryptosystem appears secure, it is recommend for actual use.

Modern cryptanalysis considers attacks on encrypting systems based on the following known data:

  • Ciphertext

  • Plaintext and its corresponding ciphertext

  • Chosen plaintext

  • Chosen ciphertext

  • Adapted plaintext

  • Adapted ciphertext

  • Additionally to this some attacks use

  • Hardware faults

  • Power consumption measurements

  • Calculation time measurements

We detailed the types of attacks on cryptosystems designed to cipher data for the purpose of protecting against unauthorized reading. As for other kinds of cryptosystems, there are a number of other attacks that will be discussed later. In the case of known ciphertext cryptanalysis, it is assumed that the opponent knows the ciphering mechanism, and that only the ciphertext is available to him or her. This assumption corresponds to the model of an external interceptor who has physical access to the communication line, but doesn't access the enciphering/deciphering device.

With known plaintext cryptanalysis, it is assumed that the cryptanalyst knows the ciphertext and a portion of the original text, and in special cases, also knows the correspondence between the ciphertext and the original text. The possibility of such an attack appears when enciphering standard documents are prepared according to standard forms under conditions where certain data blocks are known and repeated. In some modern tools intended for protecting information circulating over computer systems, the total ciphering mode is used, in which all information on the hard disk is written down as a ciphertext, including the main boot record, the boot sector, system programs, etc. If this hard disk (or the computer) is stolen, it will be easy to determine which part of the cryptogram corresponds to the standard system information, and obtain the bulk of a known original text in order to perform a cryptanalysis.

In chosen plaintext cryptanalysis, it is assumed that the cryptanalyst can enter a specially chosen text into the enciphering device and get a cryptogram created under the control of the secret key. This corresponds to the inside adversary model. In practice, this situation emerges when an attack on the cipher involves people who don't know the secret key, but, according to their given rights, can use the enciphering device to encrypt transmitted messages. To perform such an attack, lower-level employees can also be involved, who can prepare document forms, electronic spreadsheets, etc.

Chosen ciphertext cryptanalysis assumes that the opponent can use ciphertexts created by him or her for deciphering. The texts were specially chosen to most easily compute the secret key from texts obtained at the output of the deciphering device.

Adapted text cryptanalysis corresponds to a case in which the attacker repeatedly submits texts for encryption (or decryption), with each new portion being chosen depending on previously obtained of cryptanalysis results. This kind of attack is the one most favorable for the opponent.

Currently, the most powerful kinds of attacks based on chosen or adapted texts are differential cryptanalysis (DCA) [9] and linear cryptanalysis (LCA) [50], along with some methods derived from them.

When testing new cryptosystems, of special interest are attacks based on a known secret key, or an extended (working) key. We'll make a distinction between a secret key and a working key, since the secret key isn't necessarily used in transforming a text being encrypted, but is often just used to create an extended key, which is what is actually used in enciphering. There are ciphers (such as the GOST block cipher [84]), in which the secret key is used directly when enciphering data — i.e., the secret key is also the working key. Obviously, the extended key is a secret element. When carrying out a cryptanalysis based on known elements of the key (whether it be a secret or extended one), it is assumed that the cryptanalyst possesses some information about a part of the working key. The larger the known portion of the key using which the cipher remains secure, the less concern there will be over the cipher in actual attack conditions, where the attacker doesn't know the key, but attempts to restore its elements. When comparing two ciphers, the cipher that better meets the aforementioned criteria should be chosen.

One of the currents in designing fast software-oriented ciphers is to have the ciphering algorithm depend on the secret key. In such cryptosystems, a certain ciphering algorithm is known to the attacker, and it is changed simultaneously when the secret key is changed. Such ciphers are called non-deterministic or flexible ciphers. When testing flexible ciphers, it seems reasonable to analyze their secureness against attacks based on a chosen modification of the enciphering algorithm. In this kind of cryptanalysis, the attacker has the possibility of choosing the weakest (in his or her opinion) modification of the cryptalgorithm among those that can be implemented. Cryptanalysis is then carried out for the chosen algorithm modification based on specially selected texts, with a variant of the attack where there is a partially known ciphering key also conceivable. If the cryptanalyst fails to find the weakest modification of the cryptalgorithm, the flexible cipher in question can be called secure.

1.2.2. Modern Applications

The importance of cryptography goes far beyond providing data secrecy. As data transmission and processing become more automated, and the information flow becomes more intense, cryptographic methods gain greater importance. New information technologies are founded on two-key cryptography, which makes it possible to implement protocols that assume that the secret key is only known to a single user — i.e., protocols oriented towards the mutual distrust of the interacting parties. Here are the main applications of modern cryptography:

  • Protection against unauthorized reading (or providing information privacy)

  • Protection against creating false messages (both intentional and unpremeditated)

  • Valid user authentication

  • Information integrity control

  • Information authentication

  • Digital signatures

  • Computerized secret voting

  • Digital cash

  • Computerized coin-tossing

  • Protection against the repudiation of the receipt of a message

  • Simultaneous contract signing

  • Protection against document forgery

The first application was discussed above. We'll now briefly explain the other uses for cryptography. Data ciphering itself isn't sufficient to protect against creating false messages, but in many cases a valid receiver can easily detect that a cryptogram has been modified or substituted, for example, while being transmitted over the communication line. This can be done by analyzing the semantics of the message. However, when digital data are distorted, and in some other cases, it is extremely difficult to detect the fact that the data has been distorted judging by just semantics. One of the methods of protection against creating false messages by intentional or accidental ciphertext tainting is a message integrity check. Message integrity check is a notion related to protecting against creating false messages by generating some special additional information, depending on the secret key. This information is called the message integrity detection code, and is transmitted with the cryptogram. To compute the message integrity detection code, an algorithm is used that specifies how the message integrity detection code depends on each bit of the message. Here, two variants are possible: (1) computing the message integrity detection code from the plaintext, and (2) computing the message integrity detection code from the ciphertext. The longer the message integrity detection code, the higher is the probability that ciphertext distortion will be detected by the authorized (valid) receiver. An opponent can modify the ciphertext, but since he or she doesn't know the secret key, the new value of the message integrity detection code that corresponds to the modified message can't be computed. The opponent either doesn't change the message integrity detection code, or replaces it with a random value. If the algorithm used for the message integrity detection code computation has good cryptographic properties, the probability that the modification won't be detected by the valid user is P = 2−n, where n is the length of the message integrity detection code in bits.

Valid user authentication involves user recognition, after which the users are provided with certain access permissions to the resources of computational and automated information systems. Authentication is based on the fact that valid users possess some information unknown to outsiders. A special case of the authentication procedure is password protection of logging into a computer system. For example, the user generates some random information and uses it as a password, while keeping it secret. The password isn't explicitly stored in the memory of a computer or other device used to perform authentication. This requirement is aimed at preventing a possible inside adversary from reading a user's password and misappropriating the user's authorization. For a security system to be able to identify valid (authorized) users, the images of their passwords, which were computed according to a special cryptographic algorithm that implements a so called one-way function — y = F(x) — are stored in the computer memory. The main requirement to this function is that the complexity of computing its value from an argument be low, but the complexity of computing the argument from a function value be high (for example, it should be impossible to do in 10 years, provided all the computational resources of humanity are used).

User authentication on a workstation can be carried out in the following way:

  1. The security system asks for an identifier.

  2. The user enters his or her identifier (username) NAME.

  3. The security system asks for a password.

  4. The user enters his or her password P.

  5. The system computes the value of the one-way function y corresponding to the argument value x = P.

  6. The security system compares the F(P) value with the password image value (S) that relates the user to the NAME identifier.

If F(P) = S, then the security system gives the user the access rights (authorization) corresponding to the NAME identifier. Otherwise, an attempt at unauthorized access is registered in the user log. To pretend to be an authorized user, an intruder has to enter a valid password. It is computationally impossible to find the P password from the S image. If the security system is provided with mechanisms preventing the interception of a password by introducing software viruses or hardware bugs, or with induced electromagnetic radiation, or through an acoustic or optic channel, this user authentication method provides high-level protection against the misappropriation of someone else's access rights.

This example concerns user authentication on a workstation, i.e., logging in to a computer. For mutual authentication of remote workstations, it is important to assume that an eavesdropper is listening in on the communication line, and, therefore, the described authentication method is unsuitable, because password transmission via an unsecure channel is unacceptable. Remote workstation authentication can be done according to the following procedure, using the E enciphering algorithm and the K secret key shared by remote stations A and B:

  1. The A workstation sends a request for connection to the B workstation.

  2. The B workstation sends A a random number R.

  3. The A workstation encrypts R with the K secret key, thus obtaining the Ca = EK(R) ciphertext, and sends B the value Ca.

  4. The B workstation computes Cb = EK(R) and compares Cb with Ca. If Cb = Ca, it concludes that the request for connection was sent by the A workstation; otherwise, it hangs up.

Only one who knows the secret key can correctly encrypt a random text. If a violator intercepts correct cryptograms of random numbers with a key length of no less than 64 bits, he or she won't encounter two equal numbers in any reasonable amount of time. Therefore, he or she won't be able to replace a previously intercepted correct cryptogram. In this scheme, the B workstation's role can be taken on by a LAN server. We'd like to note that this scheme allows the B workstation to make sure that the connection is established to the A workstation. However, the A workstation can face a similar problem authenticating the B workstation. In this case, a similar authentication procedure is carried out to let A authenticate B. Such a scheme of mutual recognition by two remote parties (workstations) is called a handshake protocol.

Information integrity control means detecting any unauthorized modification of information stored in a computer, such as data or programs. In fact, a message integrity check is an important special case of the integrity control of information transmitted as a ciphertext. In practice, you often need to make sure that some programs, initial data, or databases haven't been modified by some unauthorized method when the data themselves aren't secret and are stored in public. Information integrity control is founded on using a cryptographic scheme to build a modification detecting code (MDC) that has a much smaller size than the information being protected against modifications. The basic requirement of the MDC computing algorithm is to specify how the MDC's value will depend on each binary representation bit of all the characters in the original text.

Checking that the information corresponds to its reference state (information integrity control) is done as follows. When freezing a reference state, say, of the FILE.EXE program, the MDC value that corresponds to this file is computed. The value obtained is written in a table that will be used for every check of information integrity. Suppose that the FILE.EXE program controls a complex and important technological process, and its failure can lead to downtimes that result in financial losses. If this is the case, it makes sense to check its integrity before every start. To do this, each time we compute the MDC and compare it to the corresponding value stored in the code table. This method is effective for detecting occasional data distortions.

This scheme of data integrity control isn't suitable when information is modified intentionally, since a violator can get around it. He or she can change the data at will, compute the new MDC value for the modified data, and substitute this value in the code table for the reference one (which corresponds to the reference state of the data). To prevent such an attack, you'll have to use one of the following additional techniques:

  • Use a secret algorithm to compute the MDC.

  • Use an MDC computing algorithm with a secret key that determines the MDC value.

  • Keep the code table in a protected memory area or on portable media, access to which is controlled by organizational arrangements.

In the first case, it is difficult to keep the algorithm secret, since it is a constant element of the cryptosystem. The third case requires significant effort in order to provide organizational arrangements. The second variant is probably the best. However, all three cases still require protection against spy programs.

Methods used for integrity control must ensure that the probability of intentional or occasional data modification that will not affect the code's representation is extremely small. Here the task of cryptanalysis is to study the weaknesses of the MDC generating algorithm and modify the original information so that the control code doesn't change. MDC computing algorithms are called checksumming algorithms, and the generated value is called a checksum. In modern cryptographic protocols and systems, hash functions, which are a special case of checksumming algorithms, are of great importance.

Information authentication is an action performed by an authorized receiver to establish the fact that a received message was sent by an authorized sender. Following a previously agreed protocol (a set of rules and procedures) should provide the maximum probability of this. Obviously, this also includes integrity checks to avoid replacement or distortion of the message. The accepted protocol must provide for counteractions against an opponent using previously sent messages. In symmetric cryptosystems, authentication is performed using one or more secret keys and checksums. In asymmetric cryptosystems, authentication is performed using public keys. For this to be possible, when public keys are distributed, they are authenticated using organizational arrangements.

The problem of open key authentication explicitly appeared as a fundamental cryptographic problem as soon as public-key cryptography (two-key asymmetrical cryptography) was invented in the mid-`70s. Public-key cryptography gave a very convenient solution to the secret key distribution problem, but using it requires performing a public key authentication procedure. It should be mentioned that the key authentication problem wasn't caused by two-key cryptography. It has always implicitly existed in secret key cryptography. Indeed, when distributing secret keys via a secure channel, their authentication is done at the same time. For example, when receiving a sealed package with a secret key inside, the receiver checks to make sure that the package and the seal aren't damaged.

While Shannon's work "Communication Theory of Secrecy Systems" [90] laid the foundation for cryptology to become a science, the invention of two-key cryptography marked the shift to a radically new stage of its development. This became the basis for the exhaustive solution to such problems as information authentication and creating digital signature systems that were to legalize documents and other messages transmitted in electronic form.

Digital signature (DS) is based on two-key cryptographic algorithms that involve using two keys — one public and one private. The idea of using a public key (i.e., a key known to all users of a cryptosystem, including a potential attacker) is fundamental, and so two-key cryptosystems are also called public ciphers, and the transformations performed are called public ciphering. Two-key cryptalgorithms make it possible to provide strict proof as to whether a certain message has been composed by certain subscribers (users) of the cryptosystem. The proof is based on the fact that two-key cryptosystems operate under conditions where the user doesn't have to tell his or her private key to anyone else. The fact of using a private key when generating a digital signature on a particular electronic document is verified with a public key. Knowledge of the public key doesn't make it possible to generate the correct digital signature. Thus, the responsibility for keeping the private key and for observing the rules of using it is wholly on the owner of this key. The private key makes it possible to compose a message with a special internal structure related to the document being signed and the public key. The fact that the message structure was built with the private key is verified with the public key. This procedure is called digital signature verification. The probability that a message composed by an intruder could be mistaken for a message signed by a subscriber to the DS system, is extremely low — say, 10−30.

Thus, the DS verification procedure using a public key makes it possible to state with a high degree of assurance that a received message was composed by the owner of the private key. The public key is derived from the private key, or both are simultaneously generated according to special procedures, computing the private key from the public key being a computationally complex mathematical problem.

Computationally complex (hard-to-solve) problems are problems that definitely have a solution, but finding it requires an extremely large number of computational operations (performed by a computer or other device). The number must be large enough so that using all the computational resources that might be involved in the process won't make it possible to find the solution with a significant probability (say, 0.001) in a reasonable time (decades, centuries, millennia, etc.). The average number of operations required in order to find the solution with the help of the best algorithm is used as a quantitative measure of the complexity of a hard problem. The problem of estimating the complexity is itself difficult, since the complexity depends on the algorithm used to solve the problem. In general, different complexity values are obtained for different algorithms. Given a particular hard problem, it is difficult to prove that the minimum-effort algorithm has been found (in other words, the best algorithm). Using two-key ciphers is based on the assumption that hard problems do exist — i.e., problems exist, for which there is no solution that can be achieved with comparatively little effort.

Based on two-key cryptographic algorithms, computerized secret voting systems use a blind signature mechanism, which makes it possible to sign a message without knowing its contents. Various methods of computerized secret voting are very promising when it comes to improving political systems in modern societies with an advanced information infrastructure.

A blind signature protocol makes it possible to build various digital cash systems. The difference between digital cash and payments using DS is that the former ensures the purchase's secrecy. Also of social interest are computerized coin-tossing systems, a variant of which is playing poker by telephone. In a broader approach, computerized gambling houses can be opened, in which protection against cheating will be guaranteed on a higher level than in conventional gambling houses.

Let's consider the simplest variant of computerized coin tossing. Suppose A and B are telephone subscribers who wish to play chess by telephone. They want to fairly decide who gets to be white, i.e., to provide an equal probability of the white color being selected for either player. Cryptography allows them to implement such coin tossing according to the following procedure, in which the y = F(x) one-way function is used. It is stipulated that the player who guesses the result of an experiment with two equally probable results will move first.

  1. Player A chooses a random value — xa — whose binary representation is, say, 80 bits long, computes the ya = F(xa) value, and tells B the ya value (B must guess whether xa is odd or even).

  2. Since the function used is one-way, B cannot compute xa from ya, so he or she has to guess whether xa is even or odd. Let's say that B guesses that it is even and tells A this.

  3. A tells B the number xa.

  4. Player B computes the value of y = F(xa). If y = ya, he or she is convinced that his partner actually did provide the initially chosen number for verification.

If the result of the coin-tossing is not to decide the color selection in an amateur chess game, but to deal cards when playing poker for money by telephone (dealing cards by telephone is only technically more complex), using a DS system can be additionally provided to sign all messages concerning dealing cards and making bets by telephone.

As an example of how computerized coin tossing can be economically justified, consider it being used in World (European, etc.) soccer (basketball, volleyball, etc.) championships. To make traditional lot-casting decisions, representatives of participant teams and international sport organizations periodically come together at the same place, spending a lot of time and money. If this procedure is replaced with computerized coin tossing, time will be saved, and expenses will be kept to a minimum. Other examples of using coin tossing are organizing lotteries and fairly distributing limited resources.

Cryptographic protection against document forgery is the most reliable modern method of preventing the forgery of documents, etc. It is based on the microstructural uniqueness of a particular physical medium. Given the appropriate equipment (such as a high-resolution scanner to analyze the paper), it is possible to reveal unique structural peculiarities of every piece from the same"factory lot". Cryptographic protection against forgery is done as follows. The unique peculiarities of the particular medium are scanned, and a digital passport is created, which includes the document's contents as well as information about the paper's (etc.) microstructure. Then the legitimate document issuer uses his or her (or its) private key to generate a digital signature for the passport, and writes the passport and the corresponding digital signature to the medium.

Validation of the document is done by scanning the microstructure of the medium on which the document is issued, reading the information it contains, and verifying the digital signature of the issuer using a public key that was published, say, in a number of official publications, or distributed through official channels. Forgery of the document on another physical medium, or modification of the document's contents (or its digital passport), is impossible without knowing the private key used to generate the digital signature. Any forgery will be detected by reading the digital passport and digital signature, comparing the passport with the document's contents, and verifying the digital signature with the public key (assuming that this method of protection against document forgery uses a cryptographically secure digital signature system).

1.2.3. Information Protectiin Technology

When developing a computer security system for general use, the topic of protecting information technologically becomes imperative. One peculiarity of this problem is that it is necessary to build a security system that allows the user to configure it according to specific operational conditions.

The best opportunities to launch an attack on a computer system (CS) are available to valid users who are technically involved in the operational process, and who can abuse their access rights. Generally, the complex part of technological information protection is that it is necessary to provide operators with certain access rights, and at the same time prevent them from abusing these access rights. Strongly limiting access rights results in the users' performance decreasing, and therefore the performance of the CS itself decreasing. To keep performance high, CS's security mechanisms must work in real time, which will minimize non-productive delays related to data protection transformations or to control and analytical functions of the security system.

One of the most effective and flexible security mechanisms are cryptographic transformations. In connection with this, the problem of creating fast software-oriented ciphering algorithms is an obvious one. The solution to this problem is a major stage in the development of a computer security system that can be widely used.

Thus, using data encryption in computer security systems that are widely used is mostly technological. This requires maximum speed for the cryptographic transformation methods used, provided they are secure enough. This is only one of the problems confronting developers of computer security systems. Another specific problem is creating various types of computer-oriented transformation algorithms.

From the technological point of view, it is important to solve the following problems:

  • Creating real-time algorithms for file encryption (transparent file encryption algorithms)

  • Creating algorithms to encrypt the information in the hard drive boot sector (so-called mini-algorithms)

  • Creating fast algorithms to encrypt data before writing them to the built-in hard disk (transparent disk encryption algorithms)

Each of these algorithm types must satisfy particular requirements related to their specific roles in the security systems. The disk encryption procedure is very important, due to how intensely it is used. Obviously, it must operate automatically and in real time, that is, in transparent mode.

It is possible to give some requirements to computer security systems that would correspond to the viewpoints of the various parties participating in creating and using security systems. From an operator's (user's) point of view, a computer security system should satisfy the following requirements:

  • It shouldn't alter the regular way of working with the computer.

  • It shouldn't demand excessive action from users.

  • It should allow users to use the applications they need.

  • It shouldn't result in additional delays.

From the point of view of economic efficiency, the following requirements could be placed on a security system:

  • Low cost

  • Ease of maintenance and operation that would allow you to decrease the technical staff

  • Full-scale functionality that would allow you to decrease the number of security tools used to provide overall security

  • The possibility of enabling security tools without having to stop data processing

  • Operating in real-time mode

To develop a security system that complies with these requirements, it seems reasonable to observe the following design principles:

  • Total disk encryption

  • Multilevel encryption (disk encryption, transparent file encryption, encryption on demand)

  • Keeping the basic operating system untouched

  • Controlling information integrity in real-time mode

The types of common computer security threats are shown in Fig. 1.1. External, internal, and combined threats are the reasons for the three main types of potential losses: information privacy violation, information integrity violation, and CS operation violation. In Fig. 1.1, various types of external threats and their goals are shown. Internal threats are oriented towards the same goals as external ones, but they are implemented in other ways, using other kinds of attacks. In general, computer security mechanisms must provide data privacy and integrity, as well as failure protection. The three main security mechanisms (Fig. 1.4) are data enciphering, controlling the bootstrap procedure, and using cryptographic checksums. These mechanisms must be built into the security system in various forms, depending on the peculiarities of its development for particular operating conditions. The main mechanisms must be combined with additional ones (Fig. 1.5), which will provide for the completeness of the security system and its efficiency in technological data protection.

Click To expand
Figure 1.1: The types of common computer security threats and the analysis of potential losses
Click To expand
Figure 1.2: The classification of external threats and the analysis of their goals
Click To expand
Figure 1.3: The classification of internal threats and the analysis of their goals
Click To expand
Figure 1.4: Security tasks and mechanisms of their implementation
Click To expand
Figure 1.5: Additional protection mechanisms and their goals


1.3. The Fundamentals of One-Key Cryptography

1.3.1. Conditional and Unconditional Security

A remarkable theoretical paper on cryptography was published by Claude Shannon in late '40s. This fundamental work [90] devoted to the theoretical analysis of secret systems (ciphers) triggered the development of modern cryptology, and became the basis for creating new cryptosystems. Shannon looks at enciphering as mapping an original message into a ciphered one (a cryptogram): C = Fi(M), where C is a cryptogram, Fi is the mapping, M is an original message, and the i index is to the particular key used. In order for the message to be deciphered uniquely, the Fi mapping must have a unique reverse mapping, so that FiFi−1 = I where I is the identity mapping: M = Fi−1 (C).

It is assumed that: the source of keys is a statistical process or a device that creates mappings F1, F2,…, FN1 with probabilities p1, p2,…, pN1, the number of possible messages N2 is finite, and messages M1, M2,…, MN2 have a priori probabilities q1, q2,…, qN2 (qi is the probability that can be assigned to the fact that an intercepted cryptogram contains the Mi message, without performing a cryptanalysis).

Let's look at a simple cipher, in which the initial character set of the message is the same as that of the key and of the cryptogram, and encryption is done using a sequential substitution of the characters of the original message with the characters of the cryptogram according to the next character of the key. In this case, the message, the key, and the cryptogram look like a series of characters from the same character set: M = (m1, m2,…, mn), K = (k1, k2,…, kn), C = (c1, c2,…, cn).

This step of encryption is described by the equation ci = f(mi, ki). In actual cryptosystems, the length of the key is usually much smaller than the length of a message being encrypted, so the series k1k2…kn, (called a keystream) is computed based on a primary key, or can even be periodical.

The task of cryptanalysis is to compute the original message from a cryptogram, provided the set of mappings F1, F2,…, FN1 is known. There are cryptosystems, for which any amount of intercepted information isn't sufficient to find the encrypting mappings, and this doesn't depend on the computational resources available to a cryptanalyst. This type of cipher is called unconditionally secure. Strictly speaking, ciphers are unconditionally secure if a cryptanalyst (even one possessing infinite computational resources) cannot improve the evaluation of the original message M based on his or her knowledge of the C cryptogram, as compared to an evaluation when the cryptogram is unknown. This is possible only when M and C are statistically independent, i.e., the condition P(M = Mi / C = Ci) = P(M = Mi) is true for all possible messages M. This condition means that the probability that the M message is contained in the cryptogram being analyzed doesn't depend on the cryptogram's look, or rather, on the sequence of characters in the ciphertext.

There are unconditionally secure systems that can be easily proved. In the simple cipher discussed earlier, let a character set of L characters be used, and the next character of the cryptogram be computed according to the ci = f(mi, ki) = (mi + ki) mod L formula, where each character ci, mi, and ki is matched with its ordinal number in the character set. For a keystream, let's take the sequence of n random characters k1k2…kn - i.e., we take a random key whose length is equal to the message length. To generate the key, let's use a physical random number generator that provides an equal probability for each element from the {1, 2,…, L} number set at its output. A number generated by this generator will be taken as the index of the chosen key character. This source will provide equal probability for any key having the n length. In this case, the probability of choosing a given random key having a length of n is P(K = Ki) = L−n.

The ciphering method used can transform any message Mi into the cryptogram Ci by using a Ki key whose value depends on M and Ci. Since P(K = Ki) = const for every i, an arbitrary message Mi can be transformed into any cryptogram Mi and Ci with equal probability - i.e., the P(M = Mi / C = Ci) = L−n condition is true.

This last statement means that a given cryptogram with the length n can correspond to any original message with the n length with the L−n probability. When encrypting a new message, we'll take a new random key. The described encryption procedures provide unconditional security. Cryptosystems that use an equally probable random key having a length equal to the length of the message are called ciphers with a one-time tape, or ciphers with an infinite keystream. In practice, such cryptosystems are of limited use, since they require transmitting very long keys.

It can be clearly proved that, in order to achieve unconditional security, it is necessary to use an equally probable random key having a length equal to the length of the message, regardless of the encryption procedure used. This means that these cryptographic transformation procedures play a secondary role for these type of ciphers, while it is principally important to use an infinite random key.

Cryptosystems of the second type have a feature that states that as the amount of the cryptogram available to the cryptanalyst increases when n = n0, there is only one solution to the cryptanalytic problem. The minimum amount of a cryptogram for which only one solution exists is called the unicity distance. With a one-time tape, n0 → ∞. When the length of a private key is finite, the n0 value is finite as well. We know that for a given cryptogram having a length greater than the unicity distance, it is possible to find the only solution to the cryptanalytic problem. However, for a cryptanalyst possessing limited computational resources, the probability of finding this solution (in the time for which the information remains valuable) in extremely small (10−30 or less).

These type of ciphers are called conditionally secure. Their security is based on the high computational complexity of the cryptanalytic problem.

The goal of a developer of secure cryptosystems is to decrease the costs of encrypting/decrypting procedures, and at the same time to set such a level of complexity for the cryptanalytic problem that finding its solution becomes economically inexpedient. Problems that require such an amount of computations are called hard or computationally complex, and their solutions are called computationally unfeasible. Ciphers based on problems for which finding the solution is computationally unfeasible are also called computationally secure. It is computationally secure cryptosystems that are most commonly used.

By the security of cryptosystems of this type, we mean the complexity of solving the cryptanalytic problem under certain conditions. Shannon introduced the notion of the work factor W(n) as the average amount of work required to compute the key from n known characters of a cryptogram, provided the best cryptanalytic algorithm is used. The amount of work can be measured, say, by the number of operations needed to compute the key. This parameter is directly related to the key-computing algorithm. The difficulty of determining W(n) is related to that of finding the best algorithm. Of special interest is the limiting W(n) value, when n → ∞. At present, no computationally secure cryptosystems are known for which the lower boundary W(∞) has been definitely found. In light of the complexity of such estimations, actual ciphers are characterized by an estimation of the W′(∞) work factor, which is obtained for the best of the known key computing methods.

Shannon suggested a model for estimating the unicity distance, from which the equation n0 = H(K)/D is obtained, where H(K) is the entropy of the key (for a random key, this is the key length in bits), and D is the redundancy of the language in bits per character. This relation can be rewritten as H(K) ≤ nD, where H(K) is the number of unknowns in the binary representation of the key, and nD is the number of equations available for computing the key. If the number of equations is less than the number of unknowns, there is no one solution to the system of equations, and therefore the cryptosystem is unconditionally secure. If the number of equations is greater than the number of unknowns, there is only one solution, and the cryptosystem isn't unconditionally secure. However, it can remain conditionally secure when n >> n0. The security level of conditionally secure cryptosystems heavily depends on the particular type of encrypting procedure (here we don't consider the case in which a very small private key is selected, where the complexity of trying every possible key is low). Certain transformation procedures also determine the profile of the work factor, i.e., the specific type of the W(n) dependency. In the following sections, we'll look at two-key ciphers, which are determining modern trend in the development of cryptography. By their nature, they are computationally, but not unconditionally, secure cryptosystems. The assumption that computationally complex problems exist is fundamental in modern cryptography.

1.3.2. General Issues of Cipher Design

In the last section, we showed that an unconditionally secure cipher can be built only by using an equally probable random key having a length equal to the length of the message, a new key being used for each new message. Since the key is used once and chosen at random, one might speak about an infinite random key. We'd like to note that, when using an infinite key, there is no need for any complex procedures that transform the characters of the original text into the characters of the ciphertext, since it will suffice to use the simple operation of applying key characters to the corresponding plaintext characters (for example, the operation of bitwise addition modulo 2).

Practical secrecy most often means the work effort needed to solve the cryptanalytic problem for ciphers with finite keys. This concerns a theoretical model of a cryptosystem that is disassociated from specific conditions of cipher usage - i.e., it has to do with a theoretical estimation of the computational complexity of the cryptanalytic problem. It seems best to describe ciphers having finite keys as computationally secure cryptosystems, since by practical secrecy we can also mean secrecy that depends not only on a theoretical security level, but also on the organizational and technical conditions of the cipher's use. For example, when using ciphers with infinite keys, practical secrecy is determined by various leakage channels related to processing the original message in the cryptosystem. These tapping channels can be used to intercept a part of the message or key. Actually, even when these ciphers are used, there is some probability that the transmitted information will become known to an interceptor.

In a broad sense, we can also understand practical security to mean the cipher's security, taking into account a great number of things that happen under the actual operating conditions of a cryptosystem, and are related to the integrity control of all components of the actual cryptosystem. These are things like the cryptographic protocol, the enciphering device, the secure channel used to transmit the secret key, the key controlling procedures, and the environmental elements (such as a protected premises, staff, physical and technical means of protection, etc.). In the theoretical model of a cryptosystem, only security related to solving the cryptanalytic problem and that determines the maximum achievable secrecy level is considered. (Under the actual operating conditions of cryptosystems, their secrecy may be much lower than this limiting value.)

Since actual practical secrecy cannot guarantee complete security of information, even when ciphers with an infinite keystream are used, using practically convenient cryptosystems with finite keys based on the high computational complexity of the cryptanalytic problem is completely justified. The fact that computationally secure ciphers can be decoded doesn't indicate the work effort such disclosure would take. When decoding a cipher in practice, the effort the cryptanalytic task takes is the most important feature, because an attacker's resources are limited in practice.

When using ciphers with keys that have a finite length, the specific choice of enciphering algorithm is crucial to ensure practical security. It is the transformation procedures that determine the complexity of the cryptanalysis. It is also important to keep in mind that the key length must be large enough to prevent completely the exhaustive search (i.e., to make it computationally impossible to try every possible key when using modern computing systems). With a key length of 128 bits or more, this requirement is satisfied.

If a computationally secure cipher doesn't allow key disclosure with a probability greater than the probability of information leakage through the channels connected to the actual operating conditions of a cryptosystem, then using this cipher is preferable. Besides which, there are a number of applications in which ciphers with infinite keys can not be used (for example, when protecting information that flows in a computer system where all data stored on the hard drive is encrypted). In such cases, it is better to use ciphers with finite keys (provided the computational security of such cryptosystems is high enough).

When developing computationally secure ciphers, two general techniques are used: diffusion and confusion.

Confusion is the extension of the influence of one character of a plaintext over several characters of a ciphertext. This begins an avalanche effect (in the case of block ciphers, it is necessary to extend the effect of every bit of an input text over all bits of the output text). Diffusion is a ciphering transformation that destroys the relationships between the statistical characteristics of the input and output texts - i.e., obscures the statistical characteristics of the input message. An example of a procedure that performs diffusion is a transposition of plaintext characters that leads to an equal redundancy distribution over the entire text. (Note that the redundancy of an original text plays a significant role in a cryptanalysis based on a ciphertext. However, when performing a cryptanalysis based on a known or chosen text, there is no point in taking this into account.)

To prevent the possibility of computing the key in parts, it is also commonplace to implement a principle of extending the effect of one key character over many characters of the cryptogram. In cryptosystems in which several successive simple ciphering procedures are carried out, this principle is automatically implemented during diffusion.

1.3.3. Product and Iterated Block Ciphers

In modern automated information processing systems, it is often preferable to use block ciphers. Block ciphers are cryptosystems that encrypt information in blocks of a fixed length, for example n bits. This type of cryptographic transformation is called block ciphering. For block ciphering, data are represented as a series of n-bit blocks. In actual practice, files, certain fields in spreadsheets, and other types of computer messages have an arbitrary length, which usually isn't a multiple of the block length. This is why a method of complementing the last data block is used.

The last data block is often complemented with a binary vector (1, 0, 0, …, 0), in which the number of zeroes can be anywhere from 0 to (n − 2). If the length of the last block is n, an additional n-bit block, having the (1, 0, 0, …, 0) structure, is appended to the message. This method makes it possible to unambiguously determine the appended binary vector and drop it if necessary. Using such a way of complementing a message up to a length that is a multiple of n, one can represent any message M as a series (concatenation) of n-bit subblocks Mi: M = M1||M2|| … ||Mi|| … ||Mm. Each block of the original message can be transformed independent of the other blocks, and so, when using block ciphers, direct access to encrypted data is possible. The most general mechanism of block enciphering is one that makes it possible to transform any input block into any output block, the size of the output block being greater than or equal to the size of the input block. A block of a ciphertext cannot be less than a plaintext block, because in that case several different plaintext blocks would correspond to the same ciphertext block. This would mean ambiguous decryption. If the length of the output block is greater than n, several different ciphertext blocks will correspond to the same plaintext block. In that case, deciphering is possible and unique. (Examples of such cryptosystems are probabilistic ciphers.) Since an increased length of encrypted data places certain limitations on the areas in which it can be applied, the most commonly used ciphers have the size of output blocks equal to that of input blocks. Block ciphers specify a one-to-one correspondence between possible input and output blocks. Since input and output block sets coincide, encryption makes a substitution on the 0, 1, …, 2n − 1 set of numbers, which can be presented as the following table:

where EK(M) is a function of enciphering with the K key - i.e., a function specified by enciphering procedures using the K enciphering key.

The enciphering function sets the correspondence between a plaintext block M and a cryptogram block C, which is written down as C = EK(M). For a given key, one substitution is implemented. In general, different substitutions correspond to different keys. If a cipher uses a key that is k bits long, this cipher specifies no more than 2k different substitutions, which is usually an extremely small portion of the number of all possible substitutions, equal to 2n!. To implement all possible substitutions, you need to use a key with the length of k = log2(2n!) ≈ n2n bits.

One of the statistical methods of breaking ciphers is a frequency cryptanalysis. This method is based on the examination of the frequency of characters in the cryptogram, and then making a correlation with the frequency of characters in the original text.

The frequency method makes it possible to break mono-alphabetic substitution ciphers that correspond to block ciphering when small input blocks are used (for example, when n = 8). As the input block size increases, the frequency properties of the language of the plaintext become less pronounced, but even with n = 16, the unevenness of the frequency properties of the original text can be effectively used to break the cipher. With n = 32, frequency cryptanalysis becomes extremely complex, and a block cipher with such an input size can be used in some cases. The minimum secure block length is considered to be n = 64. The greater the input block size, the higher the security that can be achieved. However, for large block sizes, manufacturing ciphering devices becomes more complex. When developing the American DES standard, the choice of the n = 64 value was a certain compromise between security and implementation convenience. This size was commonly used for over 25 years. Currently, the potentialities of microelectronics have dramatically increased, and the n = 128 input block size is now standard.

A large input block size itself is simply a necessary condition for the high security of the algorithm being developed. Designing secure block ciphers is associated with using non-linear transformations that have good diffusion and confusion properties, or with combining linear and non-linear transformations. The advantages of linear transformations are ease of implementation, small operating time, and the convenience of using the secret key as the transformation parameter. However, using only linear transformations isn't sufficient to design secure ciphers.

One method of achieving good diffusion and confusion is building a compound (product) cipher that includes a number of sequentially used simple ciphers, each of which makes a small contribution to diffusion and confusion. The idea of building product ciphers was suggested and justified by Shannon. In product ciphers, ciphering procedures of one type alternate with those of another type. For simple ciphers, substitutions (S), transpositions (T) and linear transformations (L) can be used. In such a case, the resulting cipher can be presented as F = SnTnLn… S2T2L2S1T1L1.

A secret key can be used with procedures of any one type (T, L, or S). The key can be also used with procedures of all (or some) types.

The simplest product cipher is shown in Fig. 1.6, where the S boxes denote a substitution operation on 4-bit subblocks of the input message, T means a transposition on a 4k-bit data block being transformed, and L is a linear transformation operation, using which the confusion of encrypted data is performed with a secret key as the K1, K2, …, Kr key set. In this r-cascade cryptoscheme, the encrypting procedure consists of r successive rounds of transformation using different round keys. A substitution operation involves replacing a 4-bit input binary vector with a 4-bit output binary vector according to a table called a substitution table. If we represent 4-bit binary vectors with their numeric values (i.e., interpret a binary vector as a binary number), we can write the substitution table as

where ∀i, αi ∊ {0, 1, …, 15}, and the columns set up a correspondence between the 4-bit input value (the upper row) and the 4-bit output value (the lower row).

Click To expand
Figure 1.6: The structure of a product cipher based on substitutions and transpositions

For an arbitrary substitution table, it is easy to write a table that specifies the inverse substitution. Similarly, the bit transposition operation T and the corresponding inverse transposition T−1 can be specified. For the linear transformation L, it is also easy to specify the corresponding inverse transposition L−1. The deciphering procedure is performed according to the following scheme:

Click To expand
Figure 1.7: The deciphering procedure scheme in a product cipher

The discussed cipher belongs to the so-called iterated ciphers, in which ciphering is done in the form of repeatedly performing a standard transformation procedure (called a ciphering round, or a round ciphering function), which is a composition of three simple transformations of different types. In the process, different keys called round keys are used in different rounds.

When implemented as a high-speed device, the enciphering/deciphering procedure for a product cipher will be performed using various electronic circuits. Later in this book, we're going to look at special cryptoschemes that make it possible to use the same electronic circuit for both encrypting and decrypting, thus making the hardware implementation more cost-effective. In such ciphers, changing the ciphering mode is done by changing the order of round keys.

Feistel's Cryptoscheme

Feistel's cryptoscheme (Fig. 1.8) is a general scheme for designing an n-bit block cipher based on an arbitrary function F with the n/2 input block size. An important advantage of this structure is that it specifies the same algorithm both for encrypting and decrypting. Specifying a particular enciphering mode is determined by the order of using the round keys. Changing the ciphering mode is done by inverting the order of the round keys. The security of ciphers designed using this scheme is determined by the properties of the F round function. A great many various ciphers are known that are designed according to this scheme, and only differ in the number of rounds and the structure of the round function.

Click To expand
Figure 1.8: Feistel's cryptoscheme: a - enciphering, b - deciphering

One thing to note is that the possibility of decryption is provided for an arbitrary round function - i.e., Feistel's cryptoscheme is a universal method of turning an arbitrary mapping over binary vectors with the n/2 length into a substitution (bijective mapping) over vectors with the n length. Due to this fact, a cryptalgorithm developer is free from the limitation of using only those mappings that have inverse mappings of low computational complexity. When building a round function, it will suffice to find fast direct transformations that have the necessary cryptographic properties. The same transformations will perform the correct decryption procedure after changing the schedule for using the subkeys. When designing ciphers according to Feistel's cryptoscheme, the main task is to provide round transformations that have good avalanche properties (when one input bit affects multiple output bits), and are secure against all known types of cryptattacks.

One disadvantage of Feistel's cryptoscheme is that only half of the data block being transformed is used during encryption (i.e., during the computation of the round function). This disadvantage is eliminated in universal cryptosystems of another type that are based on using so-called controlled operations, discussed in Chapters 3 to 6.

1.3.4. Controlled Operations - a New Cryptographic Primitive

General Characteristics of Controlled Operations

Modern applied cryptography increasingly tends to take into account requirements related to the peculiarities of electronic information technologies. At present, using encryption to protect information is becoming more and more technological. The technological nature of using encryption manifests itself in:

  • Common use

  • The variety of tasks fulfilled

  • The variety of operational conditions

  • Specialization to solve specific problems

This has led to increasing requirements imposed on:

  • Security (in various operating conditions, new kinds of cryptanalytic attacks, such as a so-called differential fault analysis, become relevant)

  • Encryption speed (this follows from the need to keep a high performance of the computer system and telecommunications after placing the security system in operation)

  • Cost-effectiveness of the hardware implementation (this is related to the wide use of enciphering devices)

The fact that contests for designing new ciphers take place in the USA (the AES contest), Europe (the NESSIE contest), and Japan indicates the recognition of encryption's technological role. The technological areas of application are so varied that designing new specialized encryption algorithms will still be an urgent topic for a long time. In modern cryptography, there is significant interest in looking for new cryptographic primitives to build block ciphers that may prove promising for technological applications, and that will provide:

  • High speed

  • High security

  • A low complexity of implementation

The cryptographic primitives traditionally used when designing one-key cryptosystems are substitutions, transpositions (permutations), arithmetic and algebraic operations, and also some other auxiliary operations. The most frequently used operation is substitution, which is also the most general. This operation is the cryptographic primitive on which the security of most block ciphers is based. The following ways of implementing substitutions are known:

  • In software and software-hardware ciphers, substitutions are implemented as substitution tables stored in the computer memory. In this case, it is easy to implement substitution over binary vectors that are 13 bits long (the required memory is about 10 KB). Despite the large memory size of modern computers, implementing substitution operations over vectors longer than 16 bits is problematic.

  • In hardware ciphers, substitutions are implemented as complex electronic circuits. General substitutions over binary vectors longer than 13 bits are very hard to implement.

An advantage of general substitution operations is that the best substitutions that comply with certain cryptographic criteria can be found. In the case of substitutions with a small size (say, 6 × 4), many effective substitutions can be found. However, for substitutions having a size of 8 × 8 or larger, choosing the best variants is problematic. In connection with this, choosing substitutions with big sizes is done in some ciphers by using certain known operations with certain properties. A typical example is the SAFER cipher, in which substitutions are defined by raising to a discrete power and performing a discrete logarithm operation on a modulo 257 residue field.

Because of some problems that emerge when designing fast block ciphers based on substitutions, alternative solutions were suggested. One such solution is the RC5 cipher, in which the only non-linear operation is rotation (end-around shift), which depends on the data being transformed, and is easily implemented on modern widely used processors. Despite its extreme simplicity, the RC5 cipher has proven to be very secure against linear and differential cryptanalysis. Theoretical investigations have revealed that having the selection of the rotation operation depend on the transformed data is an effective way to protect against these two important types of attacks. Due to its effectiveness, data-dependent rotation has found a use in such new ciphers as RC5 and MARS.

If a fixed rotation operation that is a special case of a substitution operation is linear, making it dependent on the transformed data leads to the creation of a new non-linear operation with good cryptographic properties. Apparently, besides the data-dependent rotation operation, there are other types of controlled operations. Their important features are 1) their type, and 2) the number of different variants from which the current modification used to transform a data subblock is chosen. The second parameter determines how many additional data bits can be used when performing a controlled operation on the current n-bit data subblock. For a controlled rotation operation, there are n modifications. Despite such a small number of modifications, this controlled operation appears to be an effective cryptographic primitive. One can expect that operations with an essentially greater number of modifications - say, from 2n to 23n or more - will prove to be more effective. An example of such a controlled operation is a bit permutation operation that depends on data being transformed, and is a generalized case of controlled rotation.

A different important direction is the design of special controlled operational substitutions for cryptographic applications - in particular, controlled binary operations. The simplest way of implementing such operations is by using a controlled adder (Fig. 1.9), which makes it possible to specify 2n different modifications of the Y = X *VA addition operation, including the bitwise addition modulo two ("*V" = XOR) for V = (0, 0, 0, …, 0), and the addition modulo 2n ("*V" = "+") for V = (1, 1, 1, …, 1) as a special case.

Click To expand
Figure 1.9: A controlled adder (e = 0 - "addition", e = 1 - "subtraction")

As opposed to table substitutions, it is possible to create a great many different types of controlled transformation operations with a sufficiently large input block size (32, 64, or 128 bits) that can be easily implemented as hardware. In this case, the operations actually implement a special substitution subclass. However, this substitution subclass belongs to substitutions of a much greater size. This creates prerequisites for designing secure fast ciphers with a low hardware implementation complexity.

Traditionally used table substitutions, as well as arithmetic and other operations that were initially used to solve other problems, aren't oriented towards cryptographic applications. From a cryptographic point of view, they have both advantages (for example, the bitwise addition modulo 2 is easy to implement and very fast) and disadvantages (for example, linearity). For cryptographic usage, it is best to develop operations that are adjusted for cryptographic applications and possess the special properties necessary for high security encryption algorithms. As a prototype for such operations, we can use the data-dependent rotation operation that was used as a basic cryptographic primitive in such ciphers as RC5 [79], RC6, and MARS. Specifying the current modification of such an operation depending on the data being transformed determines its non-linear properties. Despite the fact that the choice can only be made from n different modifications (n is the length of the binary vector on which the rotation is performed), this cryptographic primitive appears to be quite effective. Its merits are the simplicity of program implementation, non-linearity, and increasing the effective input size to log2n bits (this is the number of data bits that specify the choice of the current modification - in other words, of control bits).

In general, controlled permutations (CP) and controlled binary operations (CBO) seem to be more effective for cryptographic applications, since they include a very large number of possible modifications, which makes it possible to implement a control input with a size from n to 3n (and in some cases even more). Preliminary investigations of algebraic and probability-statistical properties of CP and CBO showed their usability for developing secure fast ciphers [32, 36].

The structure and working principles of controlled permutations and controlled adders are quite descriptive, so these variants of controlled operations are thought of as an individual class of cryptographic primitives. Controlled operational substitutions are an even wider class of controlled operations. However, this type of operation isn't so clearly perceived as an individual class of cryptographic operations. In connection with this, it is worth stressing how controlled operations differ from substitution operations of an m × n size, where m > n.

In essence, controlled operational substitutions are specially designed cryptography-oriented operations performed over two or more binary vectors. They are built according to a special rule that allows you to design operations for transforming binary vectors of arbitrary size. These operations have a structure that makes the complexity of their hardware implementation increase approximately according to a linear law, while increasing the size of binary vectors being transformed. Controlled operational substitutions (COS) have the following features:

  • Using standard Boolean functions that specify the relationship between the input and output bits

  • The possibility of designing COSs to transform binary vectors that are from 32 to 256 bits

  • A low complexity of hardware implementation

  • High performance

  • The possibility of a theoretical justification for choosing a COS of a certain type for an arbitrary input size

    Fig. 1.10 illustrates the possible types of controlled operational substitutions.

    Click To expand
    Figure 1.10: Types of controlled operational substitutions

Controlled operations have the following advantages:

  • They make it possible to use all the bits of the data block being transformed when a unified non-linear operation is performed. They also make it possible to reverse a direct operation by inverting a special bit that specifies the encryption or decryption mode.

  • They make it possible to design new types of cryptoschemes that allow you to change the transformation mode by changing the order of the subkeys used.

  • They make it possible to design effective mechanisms of internal key extension, which provides a high encryption speed in applications with frequent changes of secret keys.

Despite the initial hardware orientation, designing effective controlled operations can potentially lead to a significant leap in the performance of software-oriented ciphers. This is related to the fact that some types of controlled operations, such as controlled substitutions, are extremely effective as cryptographic primitives, and the cost of their hardware implementation is very low. This cost/effectiveness ratio makes it very attractive for processor vendors to include a new command - controlled permutation - among the standard processor commands. The possibility of providing a high software encryption speed, from 800 to 2,000 Mbit/sec, significantly increases the competitiveness of such processors, with minimum hardware costs. For example, implementing an operational controlled permutation box (CPB) with a 64-bit transformed data input and a 192-bit control input requires less than 1,200 transistors, and implementing a CPB with a 32-bit transformed data input and an 80-bit control input requires less than 1,000 transistors.


1.4. Two-Key Cryptosystems

1.4.1. The Public Key Distribution System

In 1976, Diffie and Hellman published a paper that marked the birth of two-key cryptography and led to increasing the number of public investigations in the area of cryptography. This work contained a stunning conclusion: it is possible to design practically secure secret systems that don't require secret key sending. Diffie and Hellman introduced the notion of a trapdoor one-way function. A one-way function f means that the f(x) function is easily computable for any argument x from the area of definition, but for a randomly chosen y from the area of values, it is computationally difficult to find a value of the x argument so that f(x) = y. Using such functions to protect login using a one-way password transformation is common. But how can you use a one-way function in cryptographic systems if even the valid receiver cannot perform the decryption procedure? For encryption, a trapdoor one-way function was suggested.

A trapdoor one-way function is a family of invertible functions fz with the z parameter such that for a given z it is possible to find the E z and D z algorithms that make it easy to compute the fz(x) value for all x from the area of definition, and also to compute the fz−1(y) value for all y from the area of values. However, for essentially all values of the z parameter and essentially all values of y from the area of values of fz finding fz−1(y) is computationally impossible, even when E z is known. As a one-way function, Diffie and Hellman suggested the discrete exponentiation function

where x is an integer, 1≤ x ≤ p − 1, and p is a k-bit prime number. The α < p number is chosen so that its power modulo p is an ordered set of numbers {α1,α2, …,αp−1} that is a permutation of the {1, 2, …, p − 1} number set. (Such a number α is called the primitive element modulo p.)

Even for a very large modulo p (for example, when k = 1024 bits) it is easy to compute the value of this function from a given x. The procedure of computing the function is called discrete exponentiation. To perform this procedure, it would suffice to perform about 2log2p multiplications of k-bit numbers (or log2p multiplications and log2p divisions of 2k-bit numbers by k-bit numbers). The procedure of discrete exponentiation is based on the preliminary computation of the α1,α2,α4,α8,…,α2k−1 values (modulo p).

The inverse function for the discrete exponentiation is the f−1(y) function, which sets the correspondence between the given value y and a value x for which the αx = y (mod p) condition is true. The problem of finding such an x is called the discrete logarithm problem (finding the discrete logarithm). Discrete logarithm are hard to compute when the p − 1 number includes one large prime factor — for example, when it can be presented as p − 1 = 2p', where p′ is a prime number. Under this condition, the complexity of the discrete logarithm problem is approximately equal to performing p1/2 multiplied by modulo p. The solution to this problem is computationally impossible for large k values (for example, when k ≥ 512), and therefore, for the conditions posed on the choice of the p and α numbers, the discrete exponentiation function in one-way.

The Diffie-Hellman method of public key distribution is the following method of using discrete exponentiation to exchange private keys between network users, using only public messages. A large prime number p is chosen, as well as the corresponding primitive element α < p. (To provide for the security of the public encryption system being discussed, the following requirement is posed on the p number: the expansion of this number into factors must include at least one large prime factor; the size of the p number must be no less than 512 bits.)

The mechanism of private key distribution over a public channel is as follows. Every subscriber chooses a random private key x and computes the corresponding public key y according to the formula

It is easy to compute y from any value of x. However, when the size of the p number is 512 bits or more, it is computationally impossible to find the discrete logarithm, and therefore to find the number x for which αxmod p is equal to the given p is equal to the given y value. All subscribers place their public keys in a commonly available directory. This directory must be certified by a specially founded certification center, in order to exclude possible attacks involving public key substitution or using false public keys. If two subscribers, A and B, want to establish a secret connection, they act in the following way. Subscriber A takes B's public key from the directory, and computes the shared private key using his (i.e., A's) private key:

where yA and yB are A and B's public keys, and xA and xB are the corresponding private keys. There is no need to transmit the shared private key ZAB over a communication network, since subscriber B computes its value in a similar fashion from A's public key taken from the directory

An opponent (a possible intruder) knows the yB = αxB(mod p) and yA = αxA(mod p) values, but, to compute ZAB, he or she must solve a complex discrete logarithm problem. The shared private key can be used by the subscribers to encrypt session secret keys, and those can be used to encrypt messages using symmetric encryption methods. The solution to the discrete logarithm problem exists, but it is computationally impossible. Thus, the security of the Diffie-Hellman method is based on the complexity of finding the discrete logarithm.

There are two basic problems in one-key cryptosystems:

  • Secret key distribution over a secure channel

  • Secret key authentication

By authentication, we mean a procedure that allows the receiver to become convinced that the secret key belongs to a valid sender (for example, a key distribution center).

The public key distribution system solves the first problem — i.e., it makes it possible to do without a secure channel when distributing secret keys. However, it doesn't eliminate the necessity of authentication. It should be noted that in two-key cryptography, the authentication problem doesn't arise, but rather, moves to the foreground, since the key distribution problem is solved using its methods.

1.4.2. The Notion of a Cryptographic Protocol

The terms "algorithm" and "protocol" are often used in cryptography. Intuitively, their meaning is clear enough. They are widely used in other areas of science and technology. An algorithm is one of the main notions in programming and applied mathematics, just as a protocol is in communications. From now on in this book, by an algorithm we will mean a set of commands, actions, instructions, or computations that must be performed in order to obtain some result. In the process, new data can appear as the result of source data transformation, or as the result of a random choice at some step of the algorithm, or as the result of the computer taking some measurements of the environmental parameters (the parameters of external objects). The algorithm is performed by a subject (computer).

By a protocol, we mean a collection of actions (instructions, commands, computations, algorithms) performed in a specified order by two or more subjects to obtain a certain result. The correctness of performing a protocol depends on the actions performed by each subject (user, subscriber) of the cryptosystem. A subject can be a workstation, a computer program, a radio transmitter, an artificial satellite, an operator, a server, an authority, etc.

Subjects participating in protocols of a system usually act according to specified algorithms, i.e., an algorithm appears as an internal element of the protocol. For a protocol to lead to a desired goal, it is necessary to satisfy the following requirements.

  • The protocol must be correct — the set of actions specified by the protocol must allow you to obtain the required result under all possible conditions.

  • Completeness and unambiguity — the protocol must specify the actions of each participant for every possible situation.

  • Consistency — the results obtained by different participants mustn't contradict each other.

  • Awareness and agreement of all the participants — each subject must know the protocol and all the steps he or she (or it) must perform; all the subjects must agree to play their roles.

Cryptographic protocols are protocols in which cryptographic data transformations are used. Even though cryptographic protocols often use some encryption algorithm, secrecy isn't always their goal. For example, the parties of a cryptographic protocol may wish to simultaneously sign a contract, carry out computerized coin tossing, authenticate the participants of a conference, etc.

Enciphering data and computing one-way functions constitute the execution of corresponding algorithms. The schemes of user or remote workstation authentication and computerized coin tossing that we discussed previously are examples of protocols. If a protocol uses a cryptographic function, the function must be secure. Even if encryption algorithms used are secure, this doesn't ensure the protocol's security. For a cryptographic protocol to be secure, it is necessary that the cryptographic algorithms used are secure under the conditions of this particular application.

In cryptosystems, the existence of a probable adversary is assumed (in practice, this theoretic notion is quite real). Developers of cryptographic algorithms and protocols take precautions, as far as possible, against an adversary's (or adversaries') possible actions, and try to ensure that the protocol's goal is achieved with regard to all possible attacks. An attack on an algorithm, protocol, or cryptosystem is made up of the adversary's actions, using which he or she tries to read a cryptogram, break a one-way functions(i.e., compute the argument value by a function value), pretend to be another subject, create false messages, widen his or her authorization, and in general, create conditions under which the correctness of using the algorithms and protocols of the cryptosystem will be violated. If such actions are possible, it is said that the cryptosystem is vulnerable with respect to such-and-such an attack. Two types of adversaries can be distinguished by their actions:

  • An active adversary

  • A passive adversary

A passive adversary is an adversary who doesn't take any action that causes the disorganization of a cryptographic protocol. His or her goal is to intercept messages that pass over the cryptosystem in order to read their contents, compute distributed keys, or discover the results of a vote or a coin tossing. Using radio to transfer messages creates conditions favorable for a passive adversary, under which the fact of an attack on the cryptosystem can be detected only indirectly. When using a wired means of communication, unauthorized connections reveal a passive adversary. However, it must be taken into account that he or she can use induced electromagnetic radiation.

An active adversary is an adversary who tries to create false messages, intercept and modify messages, get access to databases, widen his or her authorization, make a false public key, forge a signature, etc. When using a wired telephone communication, conditions are ripe for an active adversary, whereas, when using radio communication, the adversary's actions can be easily detected. You will also need to foresee cases in which an active adversary is a valid user of the system.

According to their relationships with the organization using the cryptosystems (or other protection tools), adversaries can be divided into two following types:

  • Internal adversaries

  • External adversaries

An internal adversary is a person with certain valid authorization inside the organization he or she attacks, or a participant in a cryptographic protocol who tries to do harm to other participants of the protocol. Both internal and external adversaries can be active or passive. An attack by an internal adversary is called an internal attack.

An attack in which only external adversaries are involved is called external. It is possible for external and internal adversaries to unite, thus creating the most serious threat to the secure operation of the cryptosystem. If there is an adversary among the developers, attacks that use trapdoors built into the algorithms that compute the key parameters or hard-to-detect harmful software viruses will also be possible.

1.4.3. Digital Signatures

Based on the aforementioned idea of using a trapdoor one-way function, Diffie and Hellman suggested a public-key cryptosystem structure for a multi-subscriber network. Each subscriber — say, the ith — chooses a random value of the zi parameter and keeps it secret. Next, he or she designs the E zi algorithm and publishes it in a commonly available directory. He or she also designs the D zi algorithm and keeps it secret. Any other subscriber — say, the jth — uses the public encrypting algorithm E zi and computes the C = fzi(M) cryptogram, which he or she then sends to the ith subscriber. Using the D zi private algorithm, the ith subscriber computes the original plaintext: fzi−1(C) = M.

The authors of this generalized scheme of public-key encryption proved that it can be used to obtain digital signatures. In general, a digital signature is a number with a specific structure that makes it possible to use a public key to verify the fact that this number was created for some message with the help of a private key. To implement a digital signature, you have to choose a trapdoor one-way function fz so that for every value of the z parameter, the area of the definition of the fz function coincides with its area of values. With this requirement, for every message that can be represented as a number from the area of definition of the fz(x) function, the subscriber i can use the private algorithm to compute the fzi−1(M) number. (If the message is too long, it can be divided into parts of the necessary sizes, and each of them can be signed independently.)

Each user of the cryptosystem can restore the M message from the S value. If M is an understandable message, or if it can be correlated with such a message according to a pre-specified rule, the S value can be considered the i subscriber's digital signature of the M message. Indeed, only the owner of the D zi private algorithm can generate a "plaintext" S that is encrypted to the understandable cryptogram M with the help of the E zi algorithm, since only the i subscriber knows how to compute fzi−1.

The i subscriber can also send the j subscriber a signed secret message. To do this, he or she encrypts S using the private algorithm E zj, thus obtaining the C = E zi(S) cryptogram. Having received the encrypted message, the jth subscriber decrypts it with his or her secret algorithm D zj(C) = S and then decrypts the S number with the ith subscriber's public algorithm E zi(S) = M. Therefore, the jth subscriber restores i's signature and the original message with the received cryptogram C.

Using protocols based on symmetric cryptographic methods assumes that the two parties trust each other. Public-key cryptosystems (asymmetric cryptosystems) make it possible to implement interaction protocols for parties that don't trust each other. Digital signature systems are one of the most important examples of these. In order to effectively use a digital signature in actual business relationships, it is necessary to legalize it. For this, it is necessary to adopt corresponding national (or international) laws, and support public key exchanging with a regular legal procedure that will provide protection against public key repudiation.

1.4.4. The RSA Cryptosystem

The RSA cryptosystem is the most widely known digital signature system. At the same time, it is the simplest one to understand. It was invented by R. Rivest, A. Shamir, and L. Adleman [80]. Let's examine this cryptosystem. According to Euler's theorem that comes from number theory, for each relatively prime numbers M and n, where M < n, the Mφ(n) = 1 (mod n) equation is true.

For M, we're going to take the original message that needs to be signed or encrypted. The requirement of relative primeness of the M and n numbers will be satisfied by choosing an n equal to the product of two large prime factors. In this case, the probability that a random message won't be relatively prime with the modulus is negligibly small. For a one-way transformation, we're going to take the modular exponentiation. With an e value of the power, we have the E encryption function, which transforms the original message M into the cryptogram C = E(M) = Me (mod n).

The e parameter is considered public. It is computationally difficult to find M from a known value S with a known n and e. As the trapdoor of the corresponding one-way en-ciphering function Me (mod n), we're also going to use exponentiation, but with another value for the power. The new power value d must be chosen so that the deciphering function D(C)=Cd (mod n) is the inverse of E(M) = Me (mod n) — i.e., the condition M = D[E(M)] = (Me)d = Med (mod n) must be true.

From this equation, it follows that ed = 1 (mod ϕ(n)). Thus, two exponentiations of modulo n will be mutually inverse if the product of the powers equal one modulo of the Euler function of the n number. The d parameter is the key to the trapdoor, and there-fore it is private. Now the problem is choosing the necessary values for the e and d powers. Obviously, it is first necessary to find the value of the Euler function of the n number. You can clearly see that, for every prime number p, we have ϕ(p) = p − 1. Since we choose n = pq where both factors are prime numbers, then, using the multiplicative property of Euler's function, we obtain: ϕ(n) = ϕ(pq) = ϕ(p)ϕ(q) = (p − 1)(q − 1).

Even as far back as Euclid's time, it was known that if integer numbers e and m fit the conditions 0 < e < m and GCD(m, e) = 1, then there is only one d that meets the conditions 0 < d < m and de = 1 (mod m). Besides which, d can be computed using an extended Euclidean algorithm.

Let's turn to the following operating scheme of the RSA cryptosystem.

(1) Each user chooses two large, unequal numbers p and q, finds their product n = pq, and computes ϕ(n) = (p − 1)(q − 1).

One of the requirements for choosing p and q is that at least one of the numbers (p − 1) or (q − 1) must have one large prime factor. The size of the n value modulus must be no less than 512 bits. For important applications of an RSA system, the recommended size of a modulus is 1,024 bits.

(2) Then, an integer e is chosen such that e < ϕ(n) and GCD(e, ϕ(n)) = 1, and a d is calculated that complies to the ed = 1 (mod ϕ(n)) condition.

(3) A private key is a triplet of numbers — p, q, and d — that is kept secret. (Actually, it will suffice to keep d secret, since the prime numbers p and q are only necessary at the stage when the n modulo is chosen and the d number is computed. After that, the p and q numbers can be destroyed.)

(4) The n and e pair of numbers is a public key that is available to all subscribers of the RSA cryptosystem.

(5) The signing procedure for the M message is raising the M number to the d power modulo n: S = Md (mod n).

(6) The verification procedure for the S signature corresponding to the M message is raising the S number to the e integer power modulo n: M' = Se (mod n).

If M' = M, then the M message is recognized as signed by the user who previously provided the e public key. Obviously,

Click To expand

that is, it is possible to generate a cryptogram corresponding to a given public key and a given message with only a know private key d.

The security of an RSA cryptosystem is based on the complexity of factoring a modulus into two large prime factors. If the problem of such factoring were solved, it would be easy to compute Euler's function of the modulus and then compute the private key from the public key, using Euclid's algorithm.

Up to the present, no practically feasible general ways to solve this problem for a modulus 512 bits long or greater have been found. However, for special cases of prime numbers p and q, the complexity of this problem decreases drastically, and so when generating a private key in an RSA cryptosystem, it is necessary to perform a number of special tests. Another peculiarity of the RSA cryptosystem it is necessary to perform a number of special tests. Another peculiarity of the RSA cryptosystem is its multiplicativity — E(M1, M2) = E(M1)E(M2) (mod n) — which makes it possible for an adversary to use two signed messages to generate the signature of a third message M3 = M1M2 (mod n). Since M3 in the great majority of cases won't be a comprehensible text, this peculiarity isn't a disadvantage. In the RSA system, it is also necessary to take into account the following possibility. Having chosen an arbitrary value S, it is possible to compute the M′ = Se value — i.e., an arbitrary value can be presented as the signature of a message. Of course, such forged messages are random. However, in some applications, it is sometimes required that you sign random messages. In such cases, the following scheme is used:

  1. A prearranged binary vector V with a length of v = 64 bits is appended to the T message, which you must sign and transmit over a public channel:

  2. The signature for the M message is generated:

  3. The S value is sent to the receiving party.

  4. The receiver computes the values from the S value:

  5. If V' is equal to the prearranged value V (i.e., if the V' = V condition is true), the receiving party decides that the T' message is signed by the owner of the public key used to verify the signature. (The probability that a random message can be mistaken for a signed one is 2−v.)

One useful feature of the public-key encryption system being discussed is that, when encrypting a message with two or more users, the encryption procedures can have any order. For example, let C = E1[E2(M)]; then D1[D2(C)] = D2[D1(C)] = M. This feature can be used in blind signature protocols or in computerized ballot systems.

Thus, the private key is used to sign messages, and the public key is used to verify the signature. To send subscriber A a secret message, any user can use A's public key to generate the C = EA(M) cryptogram. Only subscriber A can restore the M message with the C value, because only he or she knows the private key corresponding to the public key used to create the cryptogram. In the RSA cryptosystem, signature generation is the same as the decryption procedure, and signature verification is the same as the encryption procedure.

The speed of encryption provided by two-key (asymmetric) ciphers is much lower than the speed of one-key (symmetric) cryptosystems. This is why hybrid cryptosystems, in which information is encrypted using one-key ciphers and distribution of session keys is performed via a public channel with the help of two-key ciphers are most effective. For example, using the RSA cryptosystem, it is easy to exchange a session key with any subscriber, having encrypted the session key with his or her public key. The encrypted session key can be easily transmitted over a non-secure communication channel, since the private key necessary for decryption belongs only to the subscriber whose public key was used for encryption. To directly encrypt information, two-key ciphers are of limited usefulness.

1.4.5. The El Gamal Digital Signature

Let's now take a look at a digital signature system [29] named after its inventor, Tahir El Gamal, and based on the public and private key generating scheme used in the Diffie-Hellman method. Let's say that there is a large prime number p such that factoring the number p – 1 includes at least one large prime factor and the primitive element α modulo p.

The procedure of signing is as follows. A subscriber A chooses a private key xA, using which he or she generates the public key yA = αxA. A's signature under the M document (the signed message must have a length less than the p prime modulus, i.e., M < p) is the (r, s) pair of numbers (where 0 ≤ r < p − 1 and 0 ≤ s < p − 1) that fits the (α M) = yAr rs (mod p) equation.

This equation is used to verify the fact that the document was signed by subscriber A. (The yA = αxA value is A's public key, and it is available to all users, which makes it possible for anyone to verify that a given message was indeed signed by subscriber A.)

This digital signature system is based on the fact that only the true owner of the xA private key can generate the (r, s) pair of numbers that fits the signature verification equation. Using the xA value, subscriber A generates a digital signature according to the following algorithm:

  1. Generate a random number k that fits the conditions:

  2. Compute r = αk (mod p).

  3. Compute s from the M = xAr + ks (mod (p − 1)) equation.

From number theory, it is known that the last equation has a solution for s if GCD(k,p − 1) = 1. This equation is easily obtained by substituting the r = αk (mod p) value into the signature verification equation: αM = αxAr αks = yArrs (mod p).

From the two last formulas, it is obvious that the owner of the private key can sign the document, and his or her signature can be verified using the public key. Finding the (r, s) pair of numbers without knowing the private key is computationally complex. There can be many extremely different signatures corresponding to a given document (note that k can have different values), but only the owner of the private key can generate the correct signature. Possible signatures differ in their r value, but it is practically impossible to find the corresponding s value for a given r without knowing the private key. To compute the private key from the public one, you need to solve a computationally complex discrete logarithm problem.

One peculiarity of the El Gamal digital signature is generating a random number k. In this cryptosystem, you aren't allowed to use the same k value to generate signatures for two different messages. This is connected with the fact that it is possible to compute the private key from two different signatures generated using the same k values. In addition, the k values used during generation are to be destroyed. If an adversary gets the k value, he or she will be able to compute the private key. Systems that are actually used generate a random k number with a large size, and implement a mechanism for destroying the number after generating the signature. In a program implementation, a scheme of digital signing is provided in which the number k only appears in the processor registers and the random-access memory, and the destroying mechanism involves writing a random value at the memory location that just held the k value.

Earlier in this chapter, we looked at two-key cryptography schemes that make it possible to sign messages that have a limited length (about 103 bits). If a message has a large size, the straightforward use of such schemes requires that you split the original message into a large number of smaller blocks and generate as many signatures as there are message blocks. This significantly complicates the task of storing the signatures and the signed messages in a database containing many signed documents. To simplify this problem, it is not the document itself that is signed, but its small digital image obtained according to special cryptographic procedures called hashing.

The hashing algorithm must be one that provides for the computational impossibility of finding two messages with the same value for the digital image (the hash function value of the message). Currently, there are algorithms that comply with this requirement and also make it possible to compute the hash function value of a given document. Rather than create many separate parts of a document, actual digital signature systems compute the hash function of a document and sign the hash function value. If the hash function is signed, the document is considered signed.

1.4.6. The Chaum Blind Signature

The notion of the blind signature was first introduced by David Chaum, who also suggested the first variants of its implementation [18–20]. By a blind signature, we mean a two-key cryptosystem that makes it possible to sign electronic messages so that the signing party has no access to the information contained in the message being signed. This requirement, far-fetched and absurd at first glance, is very important for a number of cryptographic protocols. For example, blind signatures are used in computerized voting systems and for digital cash — i.e., in cryptographic protocols where it is necessary to provide untraceability. The blind signature procedure itself requires that one of the participants agrees that he or she may be subject to a certain penalty consisting of obligations that he or she would likely prefer not to undertake.

In actual protocols where blind signatures are used, there are also procedures that assure the signing party that he or she won't be cheated. This assurance is based on certain additional procedures and conventions that put limitations and responsibility on the party that is submitting a document for a blind signature. Naturally, either party must agree to a certain risk and have a certain assurance, otherwise it would be impossible to solve the problem that both parties want to solve. For example, when using a DS system, users take the risk that someone may compute their private keys. The assurance of their interests lies in the high complexity of private key computation. Another type of assurance used in cryptographic protocols is the low probability of replicating random numbers if they are long enough. With the blind signature protocol, it is possible to solve some important practical problems (such as building a computerized voting system, using digital cash, etc.).

Let's examine the Chaum digital signature protocol based on the RSA cryptosystem with which you are already familiar. Suppose subject A wants subject B to sign message M. To do this, it is necessary to perform the following steps.

User A (the subjects are users of this cryptosystem) generates a random prime number k, such that GCD(k, N) = 1, where N is a part of B's public key, i.e., the modulus used for computations. Then, he or she computes the M′ = ke M (mod N) value, and submits it for signing. The signer cannot read the M message because it is encrypted with a one-time key, ke, and by performing the modular multiplication operation.

The B user signs the M′ message according to the procedure of signing a message in the RSA system: S′ = (ke M)d = kMd (mod N).

Having generated the S′ signature, the signer cannot read the Md value, since it was encrypted by applying the k one-time key to it. If the signer could find out the Md value, he or she could easily compute M: (Md)e = M (mod N). This means that, having obtained the Md (mod N) value (which is the goal of the blind signature protocol), user A must keep it secret from the signer.

Now, using the extended Euclidean algorithm, user A takes k and computes its multiplicative inverse element (k−1) in the residue field modulo N, and restores the signature for the M message: S′ = k−1S′ = k−1kMd = Md (mod N).

Thus the goal is achieved — user A has generated B's correct signature corresponding to the M message, and he or she is sure that the signer doesn't know the contents of the M message.

1.4.7. Types of Attacks on a Digital Signature

In the digital signature system, three cryptographic algorithms are used: the algorithm of generating a signature with the private key, the algorithm of verifying a signature with the public key, and the algorithm of computing the hash function of the message being signed. The algorithms of generating the private and public keys can also be said to have a mathematical foundation. Operating actual systems also requires a legal, organizational, software, and hardware basis. The legal basis includes adopting laws that legalize digital signatures. The organizational basis includes user registration in a trust center and the signing of documents between the user and the trust center (or between two users) that states their responsibility for the public keys exchanged. The software and hardware basis includes a set of software and hardware tools that make it possible to perform complex computations and provide for the security of a database containing signed documents and signature samples for them.

The possible types of attacks against a digital signature can be divided into several groups:

  • Attacks on cryptographic algorithms

  • Attacks related to protocol violations

  • Attacks related to violations of the integrity of a digital signature system

An attacker can be an external subject, or the signing party (signature repudiation), or the signature verifying party (creating a false signature).

Attacks on cryptographic algorithms involve solving complex mathematical problems, such as finding a discrete logarithm modulo of some large prime number. An attacker has very little hope of success. Such an attack can be launched against a two-key cryptographic algorithm or a hash function. In the case of the former, the signature is forged, while in the latter case the document is forged. Attacks related to protocol violations include, for example, the replication of signed messages, or delaying messages. To prevent such actions, the document includes special fields in which the data and the number of the document are specified. It is also necessary to use mechanisms that protect against the repudiation of message reception.

Attacks related to violations of the digital signature system's integrity are the most diversified ones. They include deleting a signed message from the database, private key interception using software or hardware tools, using a false public key, and replacing a public key in the database. These examples illustrate that many attacks are related to unauthorized access to the data in the digital signature system. The safe operation of a digital signature system requires a secure environment.

Attacks on a cryptosystem can also be based on assigning the system user a false digital signature or by taking advantage of hidden vulnerabilities of facilities meant to protect against unauthorized access, or on forced use of some system software or an application that has built-in undocumented viruses. To prevent this, cryptographic tools and facilities that protect against unauthorized access must be certified by special organizations.


1.5. Probabilistic Ciphers

One promising method of increasing the security of known ciphers is making the enciphering process non-deterministic. This idea can be implemented by introducing random data into the message being transformed. If data-dependent operations or procedures are used in an enciphering mechanism (like in the RC5 cipher), the operations themselves will change randomly. The idea of introducing probabilistic elements in the enciphering process pursues the goal of hampering the use of the general principle of block cipher cryptanalysis that is based on attempts to reveal the statistical properties of the encryption algorithm, for example, by choosing special original texts or cryptograms.

1.5.1. Homophonic Ciphers

Cryptograms obtained by using monoalphabetic or polyalphabetic substitution are easily disclosed by a frequency cryptanalysis. To hide the frequency properties of the message source, and thus hamper the cryptanalysis, a homophonic (or monophonic) encryption method can be used, which involves equalizing the frequencies of the cryptogram characters, i.e., using cryptographic transformations that will produce cryptograms using each character used to write down the ciphertext an equal number of times. The simplest homophonic encryption method is the following. Let's say that there is a message source with known statistical properties. We denote the frequency of the occurrence of every letter of the original alphabet by an integer number fi, where i is the number of the letter in the alphabet — f1, f2, …, fL, where L is the number of letters in the original alphabet. We'll match each letter Ti of the original alphabet, where i = 1, 2, …, L, with the Ψi subset of the output alphabet (i.e., the alphabet used to write down the cryptogram). We specify these subsets with two requirements: (1) no pair of subsets can include the same elements, and (2) the number of different characters in a Ψi subset is equal to fi.

We're going to perform encryption by substituting each letter Ti of the original text with a randomly chosen character from the Ψi subset. Then, when a given letter Ti of the original text is repeatedly substituted with characters of the Ψi subset, the characters of the output alphabet will be used, on average, an equal number of times. This number is inversely proportional to the number of elements in the Ψi subset, i.e., it is directly proportional to 1/fi. The frequency of accessing the Ψi subset is equal to the frequency of the occurrence of the letter Ti in the original text, i.e., it is directly proportional to fi. From these rations, we conclude that the average frequencies of all the characters of the output alphabet in a cryptogram are equal. Decryption isn't difficult: using a character of the cryptogram, we determine its corresponding subset, and from the subset we determine the letter of the original alphabet. The described encryption method requires using f1 + f2 + … + fL characters in the output alphabet. The most important feature of this method is that the transformation includes a probabilistic process — choosing a random element from the given subset.

The described method isn't of great interest for practice now, but the basic idea of introducing randomness into the encryption process can be used when designing modern probabilistic block ciphers.

1.5.2. Ciphers with a Simple Probabilistic Mechanism

In the previous sections, we examined a number of ciphers in which data-dependent transformation operations are used. Such operations aren't predefined, and they vary from one input block to another. If such encryption mechanisms are used to transform random data, the operations will vary randomly. "Mixing up" random data with the message being encrypted makes it possible to impart random features to the transformation operations, thus enhancing the computational security of the system. Let E be a b-bit encryption function, P be a p-bit block of plaintext, and R be an r-bit random block where b = r + p. Give the B = R||P block at the input of the encryption function, where the "||" character denotes the concatenation of two binary vectors, R and P: P → B = R||P → C = E(B, K), where K is the encryption key. Since the size of the input block increases during encryption, this encryption maps the given block of the P plaintext on a large set of ciphertext blocks {C1, C2, …, Cn}, where n = 2r. The general scheme of a probabilistic cipher with a simple mechanism of appending random data is shown in Fig. 1.11. The random number generator (RNG), as well as the encryption algorithm implementing the E encryption function, are internal components of the enciphering device. It is assumed that the RNG is located in a protected part of the enciphering device, and that an adversary cannot replace it (i.e., the adversary has no access to the R value). This assumption is acceptable, since enciphering devices are designed so as to provide protection against encryption algorithm substitution, as well as against reading and copying the key. When decrypting a block of ciphertext, the valid user who owns the private key restores the B = R||P block, after which the R value is discarded and the original message P is separated.

Figure 1.11: The basic scheme of probabilistic encryption

Figure 1.12: A scheme with a probabilistic mix of random and data bits

When choosing various values of the b/p ratio, it is possible to control the encryption strength. The greater this ratio, the greater the strength. The difference between probabilistic encryption and a cryptoscheme with frequently changing session keys is that it doesn't significantly decrease the encryption speed when using ciphers with a pre-calculation stage, during which the encryption key is generated using the session key. The probabilistic encryption scheme makes it possible to control decreasing the transformation speed. If the E function has the s0 initial value of the transformation speed, the speed of the probabilistic encryption is s = s0(b − r)/b.

There were a number of successful attacks on the DES, RC5, and Blowfish cryptosystems when a small number of enciphering rounds was used. Obviously, one can choose a size of a random block R that will make reduced versions of these ciphers secure against known attacks. For this purpose, the r = b − 1 value will do. Ciphers with a simple probabilistic mechanism have the following advantages:

  • The security of the known block ciphers can be significantly increased.

  • In a sense, it is possible to control the cipher's security by choosing various values for the r/b ratio.

  • The probabilistic cryptoscheme makes it possible to use new mechanisms of specifying the dependence between ciphering procedures and the private key.

The cost of these advantages is in the following drawbacks:

  • The speed decreases by a factor of r/b.

  • Ciphertext blocks are longer than plaintext ones.

The latter disadvantage puts significant limitations on using probabilistic ciphers in computer systems. To compensate for the expansion effect, it is possible to compress the original message beforehand. In some cases, this method makes it possible to design probabilistic ciphers in which the ciphertext length is equal to the length of the original message. (It is interesting to note that the compression of data before their encryption significantly increases the encryption's security against ciphertext attacks. However, precompressing information doesn't increase the encryption's security against known plaintext or chosen-text attacks, since, according to Kerkhoff's principle, we must assume that the cryptanalyst knows the compression algorithm used.)

1.5.3. Probabilistic Combination of Data Bits and Random Bits

The aforementioned simple probabilistic encryption mechanism, based on generating a ciphered data block by combining random and data bits, can be used to increase encryption security when using many of the known block cryptoalgorithms. In regard to many types of attacks, this problem is solved with a relatively small ratio of random bits to data bits. However, for some known ciphers vulnerable to differential (DCA) and linear (LCA) cryptanalysis, strengthening on the basis of this probabilistic encryption method (including the patented variant of random and data bit combination depending on the private key) requires that you significantly increase the portion of random bits — up to 80% or more. This results in noticeably decreasing the effective encryption speed, and significantly increasing the ciphertext size.

In this section, we'll look at variants of making this probabilistic encryption method more effective for a small portion of random bits when using encryption procedures with good diffusion properties, but possibly, with unexpected vulnerabilities to DCA and LCA. These variants can be also used to protect against possible attacks using trapdoors in cryptoalgorithms.

The probabilistic enciphering scheme, is shown in Fig. 1.11, where the random number generator (RNG) is assumed to be an internal component of a ciphering device unavailable to an attacker. Let E be a b-bit encryption function, T a t-bit block of a plaintext, and R an r-bit random block where t < b and r = b − t. Supply the B = R||T data block at the input of the E encryption function. The original text T can be written as

where K is the encryption key. Since the size of the input block increases during encryption, such encryption maps a given text T to a large set of ciphertext blocks {C1, C2, …, Cn}, where n = 2r. When decrypting the block of the ciphertext, the valid user who owns the private key restores the B = R||T block, after which the R value is discarded, and the original message T is separated. When choosing various values of the b/p ratio, it is possible to control the encryption strength. The greater this ratio, the greater the strength.

Obviously, the encryption speed decreases by a factor of b/t = 1 + r/t, and the size of the C ciphertext increases by the same factor.

In the first variant of enhancing the probabilistic encryption, the decrease in the r/t ratio, with a significant growth in security, can be achieved by using a non-deterministic mix of random and data bits. To implement this idea, a random binary vector is divided into two parts with a pre-specified length: R = R1||R2. Then, prior to carrying out encryption transformations over the R2||T binary vector, a bit permutation is done, which depends on the R1 random value that specifies randomly mixing the bits of the T message and those of the R2 random value. For bit mixing, it is possible to use controlled operational permutation boxes P, used earlier as a basic cryptographic primitive to design secure fast ciphers [32–40]. The permutation performed by a P box depends on the value of the control vector V that is generated depending on R1. The sequence of transformations in a variant with a random combination of data and random bits (Fig. 1.14) is as follows:

In typical P boxes, the length v of the V control vector is at least twice the length of the R2||T (r2 + t) vector being transformed. In this case, it is assumed that the r1 < r2 + t < v condition is true, so the control vector can be created, for example, by repeatedly replicating the R1 vector (V = R1||…||R1||R1), or by alternating R1 and the K1 fragment of the private key (V = R1||K1||R1||K1). In the latter case, mixing the bits of R2 and T is done probabilistically, depending on the private key. Increasing the security against DCA and LCA is connected with the probabilistic distribution of the data bits over the bit positions of the data block being encrypted. For example, when performing a chosen-plaintext DCA, the probability of getting two data blocks with a given difference is significantly small for r1, r2 = 8. When b = 64 and 128, this corresponds to a rather small portion of random bits (25% and 12%, respectively).

The second way of making a simple probabilistic encryption scheme more secure is related to the idea of pre-encrypting an original text T using a randomly generated value R as a one-time pre-encryption key (Fig. 1.13). The transformation sequence is the following:

Click To expand
Figure 1.13: A pre-encryption scheme with a random vector

Strengthening is done using additional transformations with a one-time key whose duplication probability is about 2−r during attacks based on the chosen T and C values (due to good diffusion properties of E″ encryption procedures). When doing the pre-encryption, the basic scheme of probabilistic encryption can be used, which will lead to the following transformation sequence (Fig. 1.14):

Click To expand
Figure 1.14: Two-stage probabilistic encryption

This case relates to the third variant of increasing security, and it is a generalization of the first variant, in which mixing up random and data bits can be considered a special case of encrypting transformation.

For a hardware implementation, the first variant is the most cost-effective, while the second and third variants are the most cost-effective for a software implementation. From the standpoint of increasing security, the third variant is best. In general, the increase in security in the variants discussed is related to the fact that the ratios that connect the T and C pairs of values also include a random (pseudo-random) value R during chosenplaintext T attacks (chosen-plaintext C attacks).

These probabilistic encryption methods seem to be quite effective for insuring against unexpected weaknesses of the encryption algorithm used, and against built-in trapdoors. Expanding the ciphertext block puts significant limitations on using probabilistic ciphers in computer systems. To compensate for the expansion effect, it is possible to compress the original message beforehand. In some cases, this method makes it possible to design probabilistic ciphers in which the ciphertext length is equal to the length of the original message. Besides which, compressing data before they are encrypted significantly increases the security of the encryption. For many applications in telecommunication systems, this variant of probabilistic encryption can be used without significant limitations.

1.5.4. Probabilistic Mechanisms in Two-Key Ciphers

In two-key cryptosystems, enciphering is done according to a widely known enciphering algorithm E z (a public key), and so the following attack is possible in principle. Having a E z ciphertext, in order to find the original text T, a cryptanalyst can randomly choose different variants of possible plaintexts Ti′ and compute their corresponding cryptograms C1′ = E z(T1′), C2 = E z(T2), …, Cm′ = E z(Tm′). If he or she guesses the true original text, it will be clear from the C″ = C equation. In such a cryptanalytic scheme, each unsuccessful attempt gives the cryptanalyst certain information, since it decreases the number of remaining variants of possible original texts.

Naturally, the probability of choosing the correct original text is extremely low for typical original message sizes, so this attack will not likely be successful in actual practice, if this probability is relatively large. Right now we are only concerned with the fact that some information about the original message might be leaked. However, one might imagine the following situation, where such an attack could be highly effective. Suppose an administrative center sends its subordinates instructions (plaintexts) as documents that have a certain format and style. In this case, various plaintexts differ only in certain fields of a spreadsheet. Besides which, a standard style of instructions will lead in some cases to a situation in which only a small part of an original message is unknown to the cryptanalyst (for example, the date, the amount of money paid, the name of a contractor, etc).

Probabilistic mechanisms make it possible to prevent an information leakage in the foregoing cryptanalytic method. As with one-key cryptosystems, when probabilistic encryption mechanisms are used in two-key ciphers, a given original text is mapped to a set of possible cryptograms {C1, C2, …, CN}, each of which is decrypted with a secret decryption algorithm D z (a private key) to the same original text T: T = D z(C1) = D z(C2) = … = D z(CN). This is only possible if the length of the ciphertext is greater than that of the original text. If the length of the ciphertext is r bits greater than the length of the original text, it is possible to design a probabilistic mechanism, such that the number of ciphertexts corresponding to a given plaintext is N = 2r. During probabilistic encryption, for the given text T, we generate one of the possible cryptograms — for example, Ci, chosen from the {C1, C2, …, CN} set according to the probabilistic law.

A cryptanalyst can correctly choose the original text, but he or she cannot verify this fact, since, when encrypting, he or she will generally obtain another cryptogram from the set of possible variants. Having encrypted T, the cryptanalyst will get Cj = E z(T). The probability that Cj = Ci is 1/N. The cryptanalyst has to guess not only the original text, but also the value of a randomly selected parameter that controls the probabilistic encryption process.

1.5.5. The El Gamal Public Cipher

Let's now take a look at the El Gamal enciphering algorithm. This method is based on discrete exponentiation procedures, and is outlined below. As in the Diffie-Hellman public key distribution method, a large prime number p and its corresponding primitive element α are chosen. Each user of the secure network chooses a private key, computes his or her public key y = αx(mod p), and puts y into a certified directory. To send the ith user a secret message T, the sender must perform the following steps:

  • Choose a random number R that is reciprocally prime with the p − 1 number.

  • Compute the C′ = αR (mod p) value.

  • Compute C″ = yRT (mod p) from the ith user's public key.

  • Send the ith user the (C′, C″) cryptogram.

In this method, the length of the ciphertext is approximately twice the length of the original text, and a given plaintext is matched by no less than 2k different cryptograms (k is the length of the p modulus in bits). Having received the (C′, C″) cryptogram, the user i can easily compute the T = C″/(C′)x (mod p) original text. Indeed,

With two-key ciphers, for a general method of introducing randomness into the enciphering process, one can use a simple mechanism of adding random data to the message being enciphered. In this case, a size t for the original text block is stipulated, and a random binary vector is appended to the most significant bit side, for example. The structure of the B block being encrypted can be the following: B = R||T, where R is a random number and T is a block of the original text. Obviously, the numeric value of the B block mustn't exceed the maximum valid value for the cryptosystem used. This is why the b size of the B block must be such that its maximum value doesn't go beyond the range of valid values. For example, in the RSA cipher, the B value must be less than the n = pq modulus. Therefore, we obtain the 2b < n or b < log2n condition.

If these requirements are fulfilled, the steps of enciphering an original text are described in such way:

and deciphering the cryptogram is done as follows:

Any message can be divided into texts of the required size, and each of them can be encrypted using probabilistic encryption.


1.6. Using Encryption in Practice

1.6.1. Encryption Algorithms in Protection Tools

Modern microelectronic technologies support the continuous growth of computer quality, and are the basis of maintaining the main trends in computer development — minimizing their sizes, decreasing power consumption, increasing the capacity of random-access memory and built-in and removable disks, enhancing the performance and reliability of computers, and expanding the area and increasing the intensity of use.

These trends led to a situation in which, in the present circumstances, the protection of computer systems against unauthorized access (UA) is leaning more and more towards software protection tools than hardware ones. We should mention that the role of physical and hardware protection tools aimed, for example, at protecting against side-effect electromagnetic radiation, induced current, acoustic eavesdropping, etc., is considered traditional, and using computers and specialized software in these areas is auxiliary. The increasing importance of software protection tools should be understood in the sense that newly emerging problems in the area of protecting computer systems (CSs) against UA requires using mechanisms and protocols with a comparatively high computational complexity and can be effectively solved by using computer resources.

Using "pure" software mechanisms in data protection tools (DPT) makes it possible to effectively solve important practical problems. Among these problems, one might mention reducing the cost of DPTs, minimizing the time it takes to develop secure information processing technologies, speeding up the spread of DPTs, and providing a high degree of portability to other platforms and compatibility with system and application software.

When designing data protection tools, it makes sense to utilize encryption techniques on various levels of computer data processing. This will make it possible to effectively solve the following problems by using only software tools:

  • Protecting CSs against intentional bugs

  • Protecting information in case of the theft of a hard drive or a whole computer

  • Detecting unauthorized modifications in the data or software

  • Protecting against viruses

  • Establishing demarcation between the users' authorizations

  • Retaining high performance and routine operation procedures for the users

  • Providing data protection when maintenance or other services are performed

CSs are subject to a many potential threats to information. This makes it necessary to provide a comprehensive range of possible protection tools and functions. It makes the most sense to first protect the most informative channels of data leakage, such as: the possibility of quickly and easily copying data onto removable high-capacity media, unsecure communication channels, and the theft of a hard drive or a whole computer. The problem of barring these leakage channels is complicated by the requirement that data protection procedures shouldn't lead to a noticeable decrease in the performance of the CS.

This places high requirements on ciphers oriented towards use in systems that protect against UA and that operate in real time:

  • High security against known-text or chosen-text cryptanalysis, based on a large amount of text encrypted with the same key.

  • A high encryption speed of a software implementation.

  • Retaining the possibility of random access to the data. This issue makes it necessary to use block ciphers in DPT against UA.

A modern computer security system oriented towards extensive use must be secure, technologically effective, and ergonomic. Here are a number of basic properties that make such a system attractive to a wide circle of users

  • Universality — the possibility of installing various modes of secure data processing, depending on the needs of different users.

  • Compatibility — the system must be compatible with all applications written for the particular operating system, and it must provide for the secure network operation of the computer.

  • Portability — the possibility of installing the system on various types of computers, including laptops.

  • Operating convenience — the system must be easy to operate, and it shouldn't change the working procedures that users are accustomed to.

  • Real-time operating mode — data processing (including encryption) must be fast.

  • A high level of data protection.

  • Minimum cost of the system.

As an ideological basis of designing DPTs intended for wide use, we suggest that you extensively use fast software enciphering methods using new types of block ciphers. When designing effective real-time DPTs, the following principles should be observed:

  • Global encryption — all information on the hard disk, including the boot sector, the system and application software, etc., must be transformed with a fast software cipher.

  • The platform operating system must be kept unchanged in order to provide high portability and compatibility.

  • Use a special cryptographic module for the startup initialization to provide complete control over the startup procedure.

The mechanisms listed are just the main ones. They should be supplemented with a number of additional modules in order to perform standard tasks of securely operating the CS, such as program and data integrity control, guaranteed destruction of the remaining information, locking the keyboard and display, protecting information transmitted through network communication lines, etc.

In modern software systems of computer security, a technology called transparent protection is used. According to it, the user's everyday working environment doesn't change, and he or she doesn't feel uncomfortable as a consequence of the protection tools being enabled. In other words, the security system, when working, is invisible to the user. The basic technology of transparent protection is the method of dynamic encryption of the private information with which the user is working. Private information written on external media is automatically encrypted using a key that depends on the user's password. When being read by an authorized user, this information is automatically decrypted. Since this dynamic encryption isn't noticed by the user, it is called transparent encryption, or transparent cryptographic transformation.

In integrated computer security systems (such as the "COBRA" system that protects against UA), one can note the subsystems shown in Fig. 1.15. Among these are the following subsystems:

  • An erasing subsystem, to destroy the remaining data in the external memory

  • A keyboard and display locking subsystem, providing time-out locking of these access devices when left unattended

  • A shutdown subsystem, to correctly finish the user session by checking whether the state of the operational environment matches the reference state and writing the appropriate record into the work log

  • A system creating an additional logical disk on the hard disk, which makes it possible to save information without repeatedly partitioning it

Click To expand
Figure 1.15: The structure of the "COBRA" system and the purpose of its main components

The information protection level provided depends both on the design quality and completeness of the computer security system, and on the setup of its operating modes, taking into account the opponent model. The security administrator must set up the necessary protection scheme. By a protection scheme, we mean a set of activated components of the security system, as well as their setup parameters and enabled operating modes. To configure a particular scheme, the security administrator must perform the following steps:

  1. Determine and understand security requirements by finding and analyzing threats to information in the computer system.

  2. Determine the required security levels by analyzing the potentialities of the information protecting system.

  3. Generalize the acquired information and perform the final configuration of the protection scheme.

When performing the above steps, you need to take into account the fact that effective protection should satisfy two mutually contradictory requirements:

  • Provide secure information protection in the computer system

  • Provide comfortable working conditions for computer users (the protection system shouldn't be troublesome; it also should not have any other demerits that interfere with users' normal work)

Taking these requirements into account results in a more effective use of computer security systems. After having determined the protection scheme, the security administrator can proceed with the installation and setup of all the necessary components of the protection scheme.

Typical features demarcating the users' access to the computer resources that are provided by security systems are the following:

  • Demarcation at the logical disk and I/O port level implemented by the authorized access subsystem

  • Demarcation at the file and directory level implemented by the file access demarcation subsystem

Many computer security systems support multilevel encryption — disk encryption, file encryption, and boot sector encryption.

1.6.2. Some Features of Applications

The Key Length and Security

The length of the key determines the upper boundary of the cryptosystem's security. An attacker can always launch a brute-force attack, which consists of trying every possible key from the keyspace. However, the size of the keyspace increases exponentially with the increase of the key length. If the length of a key in bits is equal to l = 64, the number of possible keys is more than 1019. When l = 128, there are >1038. Currently, computational technologies are approaching a solution to the problem of trying 1020 variants in a reasonable time interval. Trying 1038 variants is considered unfeasible not only for up-to-date technologies, but also in the foreseeable future. At present, there is a general shift from 56-bit keys in the DES cryptosystem to 80-bit or 128-bit keys in modern symmetric ciphers.

Among the provably secure block cryptosystems are ciphers, for which it was theoretically proven that even the best method of cryptanalyzing them requires a work effort that is no less than a value that guarantees that this method will remain computationally unfeasible in the near future. At present, various cryptographic methods have been proposed for many ciphers, and an estimation of the work-effort needed to solve the cryptanalytic problem has been given for each of them. However, there is the fundamental theoretical complexity of finding the best cryptanalytic algorithm, and this determines the complexity of the general proof of security.

For a new cipher to be adopted, it must conform to the following conditions:

  • It must be designed in accordance with the requirements of a specific application, and it must include mechanisms that implement modern principles of providing cryptographic security.

  • It must have been tested by experienced experts for a long time, and its security against all known methods of cryptanalysis must be proven.

Cipher testing is the most complex and expensive stage of cryptosystem development. To increase confidence in the security of new ciphers, they are tested in conditions favorable for solving the cryptanalytic problem. For example, versions with a decreased number of enciphering rounds are investigated; the possibility of generating hardware failures in the enciphering device is considered; an assumption is made that a portion of the encryption key is known to an opponent, etc. When testing non-deterministic ciphers, testers consider attacks based on a known version of the encryption algorithm, or on its weakest version. Other types of attacks can be used, such as attacks on cipher versions with decreased sizes of the encryption key and input data block. The stricter the testing procedure, the greater the assurance that no new specific types of attacks will be found. Theoretical guarantees of security can only be provided by ciphers that have infinite random keys. However, these are extremely inconvenient for computer information protection. Besides which, in such applications, there is the problem of protecting a key whose length is equal to the length of the message.

The notion of a password is close to the notion of a secret key. A password is also a secret component. By the term key, we mean a component that controls the encryption process, while a password is a component used to authenticate a subject (such as a user or a workstation). In many cases, a password is used to control enciphering, and a secret key is used to authenticate subjects. A random key or password are difficult to remember, so they are often stored in removable media that, in turn, are kept protected against unauthorized access. Choosing a password that is easy to remember significantly diminishes the number of possible variants, so in this case longer passwords or even pass-phrases are required.

In two-key ciphers, private keys whose length is significantly greater than the lengths of keys used in one-key cryptosystems are used. This is due to certain peculiarities of the cryptanalytic problem for asymmetric ciphers. In some two-key cryptosystems, private keys are chosen at random, and then the corresponding public keys are generated (for example, in the Diffie-Hellman method and the El Gamal digital signature). In other cryptosystems, private keys that satisfy special requirements are generated (such as p and q factors in the RSA digital signature system). In the latter case, private keys are also chosen at random, but, after the random choice of a private key, the key is checked to see whether it satisfies certain requirements (for example, prime numbers are required, or numbers that are relatively prime to some previously chosen parameter).

It is convenient to store random private keys in removable electronic devices (such as electronic keys or smart cards). You can also use combinations of passwords stored in the memory and keys stored in removable media.

Enciphering and Archiving

When creating secret archives, it is assumed that the data is stored in encrypted form. As a rule, archives contain a great amount of information; this is why it is good to compress data when archiving in order to eliminate excessive information. This procedure decreases the archive's size and simplifies creating work and backup copies. It also makes sense to previously compress data when transmitting large amounts of data over low-speed communication channels. Encryption transforms an original text into a pseudo-random sequence that won't compress, and so the data compressing procedure must be performed prior to encryption. (One of the tests used to qualitatively estimate cipher security is a test for cryptogram compression. If a cryptogram compresses poorly, the cipher passes the test.)

Thus, when archiving secret data (or transmitting them over a telecommunication channel) the following sequence of transformations takes place:

  • Data compression

  • Enciphering

  • Writing on a medium (or sending over a communication channel)

To extract data from an archive or receive them from a communication channel, the reverse sequence is done:

  • Reading the ciphertext from a medium (or receiving encrypted data over a communication channel)

  • Deciphering

  • Restoring (decompressing) the data

Eliminating the redundancy of an initial message significantly increases the encryption's security against ciphertext attacks. However, the encryption security against known-text attacks doesn't change if a known compression algorithm is used. Since we assume that the opponent knows the encryption algorithm, we all the more must assume that he or she also knows the data compression algorithm.

Of special interest is using the data compression procedure in combination with probabilistic encryption with a simple mechanism of inserting random data into the cryptogram. Each of these two additional transformations increases the encryption security. When used, one of them decreases the initial size of the message, while the other increases it. Probabilistic ciphers based on the concatenation of blocks of encrypted data with random binary vectors make it possible to easily control increasing the size of the cryptogram, and therefore parameters of the probabilistic encryption can be chosen so that the generated ciphertext will have a size approximately equal to the size of the message before the redundancy was eliminated.

Encrypting and Coding

When transmitting private information over telecommunication channels with noise, you need to perform not only enciphering, but interference-tolerant coding of the data being transmitted as well. For block cryptosystems, the enciphering and deciphering procedures exhibit a pronounced diffusion of the influence of input characters over many output characters, this influence being pseudo-random. In connection with this, when using block cryptosystems, the interference-tolerant coding procedure must be performed after enciphering on the sending side. As for the receiving side, you must first decode and then decipher the message.

When using stream enciphering, which involves the generation of a keystream by a secret key and synchronous bitwise XORing of the keystream and transmitted message, error propagation during deciphering doesn't take place. In this case, regardless of the order of the ciphering and coding procedures, deciphering and decoding on the receiving side can be successfully carried out. For example, when sending and receiving, one can use the following sequence of data transmission: coding-enciphering-deciphering-decoding.

1.6.3. Standardization of Encryption Algorithms

The significant role of enciphering algorithms when solving the data protection problem on a broad scale is the reason for the adoption of enciphering standards, among which the most known and widely used is the American Federal Standard DES adopted in the mid-'70s that was a predecessor of the Russian Standard GOST [84]. Today, both standards seem obsolete, and neither conforms to modern requirements of data transformation speed. Besides which, DES uses a 56-bit private key that nowadays cannot provide sufficient security against an attack of trying every possible key value, and the Russian Standard is difficult for hardware implementation. A significant disadvantage of GOST [84] is that it uses persistent secret components, such as substitution tables, that are supplied in a set order. According to widely adopted cryptographic requirements, the security of an algorithm must be based only on the secrecy of an easily changeable element — a key. Neither of the ciphers is secure against attacks based on a differential fault analysis. Such an attack is relevant for ciphers used in smart cards. (In this type of attack, it is assumed that the opponent can physically influence the enciphering device from outside and cause occasional random failures in the registers containing data when the enciphering procedure is being carried out).

The fact that the world's first public official standard was adopted in the USA played an important role in strengthening the leadership of American vendors of data protection systems. The influence of the American DES standard on public cryptography trends all over the world appeared to be so significant that, for many years, developers of block enciphering algorithms were "hypnotized" by the approaches used in DES development. The general design scheme of the DES cryptosystem became a common pattern. This fact became the reason for a certain restraint in trying new approaches to the design of block cryptosystems, which vividly showed itself in the early '90s, when there was a boom in the need for using fast software-oriented encryption methods.

The leading industrial countries pay much attention to developing new encryption algorithms that satisfy modern technological requirements. In 1998-2000, the USA, while retaining their leadership in this area, held a world-wide contest (visit http://www.nist.gov/aes) for the adoption of their new standard — Advanced Encryption Standard (AES). A number of conferences were devoted to this contest, in which the proposed ciphers were discussed. The leading world cryptographers were involved in this competition, and 15 AES candidates were presented. The contest is now over. A Belgian cipher, Rijndael, was the winner. The RC6 and Twofish ciphers were also among the better competitors. Soon after that, a similar European contest was announced, which is currently in full swing. When distributing encryption algorithms and data protection tools, the leading countries strengthen their positions on the information security market by offering their products and services, and also increase their influence and, to some extent, acquire the possibility of controlling the information resource security of other countries.

In Russia, the problem of developing fast ciphers satisfying modern requirements and trends has also been officially declared. One of these trends is the increasing technological requirements for encryption algorithms. While the requirements of providing guaranteed security remains urgent, there is also the problem of providing a high encryption speed, both with a software implementation (more than 100 Mbit/sec) and a hardware one (more than 1,000 Mbit/sec). At the same time, the cost of enciphering devices should be affordable enough for the average buyer. There is also the need to provide algorithm security against a number of non-traditional attacks, such as differential fault analysis.

The needs of software technology formed the public cryptographic school of thought outside Russia in the mid-'70s. In Russia, public cryptography began to actively develop in the mid-'90s. Currently, applied cryptography topics are common in many Russian scientific magazines. Russian cryptographers took out more than 30 patents for enciphering. Enciphering issues are usually discussed at conferences devoted to information security. At the end of 1999, a non-profit organization was founded in Russia — the "RusCrypto" association — which intends to propagate cryptographic knowledge, increase the quality of the data protection tools developed in Russia, and expand Russian public research in the field of cryptography.

Russian approaches to the design of fast ciphers and certain particular ciphers include important new elements. For example, some suggested encryption methods based on data-dependent permutations (Russian patents Nos. 2140710,2140714, 2140716, 2141729) are advantageous for hardware implementation. This approach has sufficient theoretical and experimental justification, and has led to the rise of a new direction in applied cryptography related to the use of specially designed cryptographic operations — controlled cryptographic primitives.

The prime requirement for encryption algorithms is high security. When this isn't satisfied, the other features are of no concern. A specialist familiar with the basics of cryptography and having sufficient skills in this area can design a secure algorithm relatively quickly. However, there are other requirements on algorithms intended for wide use. Here are some of them.

  • It is necessary to convince experts and consumers that a suggested algorithm is secure. To do this, design criteria are specified, and theoretical investigations of the operations and transformation mechanisms used are carried out. Statistical properties of the cipher are also explored.

  • It is necessary to convince users that the proposed algorithm doesn't include trapdoors that make it possible to compute the key or read ciphertexts without knowing the private key.

  • The algorithm must possess necessary properties that make hardware implementation inexpensive (and/or software implementation convenient).

  • The algorithm must provide a high encryption speed.

  • The algorithm must provide high security not only against traditionl cryptanalytic attacks (such as known-plaintext attacks and chosen-plaintext or chosen-ciphertext attacks), but against attacks related to special applications. These are, for example, differential fault analysis, power consumption measurements, computing time measurements, and others.

AES candidates had to meet the requirement of a high speed hardware and software implementation (provided the hardware implementation is inexpensive). This seems reasonable, since a widely used algorithm whose aim is first of all to provide information privacy should be able to be implemented in various ways. The maximum speed of encryption is difficult to achieve. Obviously, an algorithm oriented towards only a software or only a hardware implementation can provide a higher performance in the corresponding area. This is very important when designing ciphers with high technological requirements.

Now, when information technologies are advanced, even minor losses in performance result in significant economic damage when they are multiplied. In crucial application areas, even a small delay can lead to a disaster. These considerations show that even the adoption of a common encryption standard can't cope with all the problems of applied cryptography. Not only is the cryptanalysis of already designed algorithms continuously developing, but the design of new ciphers is as well.

1.6.4. Built-in Trapdoor Issues

By a trapdoor, we mean the presence of a secret that, if known, it is possible to disclose the cipher, i.e., to read a ciphertext without knowing the key, or to compute the encryption key. One of the major issues of the wide usage of encryption methods is gaining users' confidence. In the DES algorithm, no trapdoors have been found in more than 20 years, but many users still have doubts about this point. Using secret substitutions in GOST complicates comprehensive trapdoor investigations, which increases the distrust of independent users. How important for users is the threat that trapdoor ciphers can be imposed on them? The discussion of trapdoor issues in public cryptographic papers has been one-sided for a long time. In particular, it was directed towards looking for trapdoors in ciphers that had already been designed. Belgian scientists V. Rijmen and B. Preneel formulated the trapdoor topic in another way [77]: is it possible in principle to design ciphers for which it would be computationally impossible to detect the presence of trapdoors? (Even if the encryption algorithm is published and thoroughly explored by users and cryptographers.) The Belgians' research gave a positive answer. They revealed ways of designing block DES-like ciphers containing trapdoors that nowadays would be computationally impossible to detect. This result is rather disappointing for users. If the risk of trapdoor presence in ciphers must be taken into account, is it possible to avoid attacks based on trapdoors? It is difficult to guarantee protection against such an attack. However, the following approaches that significantly diminish the risks can be suggested:

  • The users or their proxies should take part in designing substitution boxes or the whole cipher (this approach requires professional training; it also has another disadvantage related to the confidence of other users in a cryptoscheme designed in such a way).

  • The user can reject using a cryptosystem with predefined substitutions, and choose ciphers in which substitutions (for example, substitution tables) are generated from the user's private key (such as Blowfish or Twofish).

  • The user can reject using substitutions as a basic cryptographic primitive (as an example, take the RC6 and SPECTR-H64 ciphers); this variant is also connected with the trapdoor issue: will it be possible some day to built trapdoors in ciphers without substitutions as well?

  • It is possible to use cryptosystems in which controlled operations are used, i.e., cryptographic primitives that specify transformations depending on variable parameters of the encryption process — on the user's private key and/or on the message being encrypted. Using data-dependent operations as cryptographic primitives gives a relatively secure guarantee that there aren't trapdoors in the ciphers used. Examples of such ciphers are RC5, RC6, MARS, and SPECTR-H64 with data-dependent operations.

  • To neutralize trapdoors, it is possible to use simple probabilistic encryption schemes, which are comprehensively described in above. To retain the original data size, one can compress the data beforehand (note that this method significantly increases the encryption security at the same time).

  • It is possible to utilize double encryption using two different algorithms, whose developers are unlikely to be in collusion with each other. For example, one can encrypt data first using DES and then using GOST (one cipher will neutralize the trapdoor of the other cipher and vice versa).

1.6.5. Cryptography and Steganography

Steganography is a technique used for secret transmission or secret storage of information. The goal of steganography is to conceal the very fact of the message's transmission. To do this, one can use invisible ink, acrostics, microphotography, hiding places, etc. Electronic data processing devices make it possible to use new steganographic methods. These methods use the pseudo-random distribution of information over time or space (or both), adding noise, and masking information in a container message or in auxiliary information. In multimedia, they can be based, for example, on hiding a message inside video frames.

The basic distinction between cryptography and steganography is that the former doesn't conceal the fact of sending messages, but only conceals their content. Using steganography to transmit important messages is very risky. Cryptography is a much more secure tool for data protection. Steganographic methods can provide a high level of information protection only if they are supplemented with a preliminary cryptographic transformation of messages. The transformation will actually determine the security of such a combined secret scheme.

Currently, developers of steganographic methods use secret keys, and this actually means developing steganographic methods that include cryptographic subsystems. The fact that steganography needs to use secret keys means accepting the fact that the development of secure methods of concealing message transmission involves cryptography. The ideas of one-key and two-key cryptography can significantly enrich steganography.

Steganography doesn't include the versatile internal possibilities that are inherent to cryptography, and which have defined the very important role of cryptography in this society with its advanced information infrastructure.


Chapter 2: Flexible Software Ciphers

2.1. The Principles of Designing Software Ciphers

In using the term software ciphers, we mean those that use operations with computer words and take into account the features of data processing in computer systems, making it possible to obtain high encryption speeds when using common microprocessors. Considering the huge problem of protecting electronic information, software ciphers have quite good possibilities when it comes to practical use. Let's take a look at the peculiarities of designing software ciphers. Ensuring the most reliable secure data processing mode in computer systems is connected with the enciphering of all data stored in the non-volatile memory. In general, data processing involves random requests for data reading and writing, so it is necessary to encrypt individual data blocks independently.

Modern computers typically have a large volume of persistent memory, and provide high speeds of reading and writing. These two features make serious demands on ciphers oriented towards use in real-time systems that protect data from unauthorized access:

  • A high security against cryptanalysis based on a large volume of known or chosen texts encrypted using the same key

  • A high enciphering speed in a software implementation

To design fast software ciphers, it is suggested that you use pseudo-random subkey selection [56, 57]. For cryptoschemes with such a non-deterministic selection of subkeys, elements of the cryptographic key used to transform input data blocks are typically selected in accordance with the structure of the data block being transformed and the structure of the encryption key. For ciphers based on such a cryptoscheme, subkey scheduling isn't predetermined, which significantly increases the security of the encryption. Due to this, the number of enciphering rounds can be decreased, thus increasing the encryption speed. Ciphers with a data-dependent subkey selection can be called pseudo-random thanks to this type of key selection.

Data-dependent subkey selection is generally just a formal mapping operation (substitution) performed according to the table specified by the encryption key. The encryption key consists of a set of numbered subkeys. An input block specifies the number of the selected subkey, and the subkey specifies the value obtained as a result of the mapping operation. The element array using which the mapping operation is performed is called an S-box (or a substitution box). We're going to use the term "data-dependent subkey selection", since the transformed data subblock that determines the currently selected subkey isn't replaced by the selected subkey, but rather both of them are used in subsequent transformations. In such cases, the encryption process is easier to understand when it is described in terms close to the procedures actually performed. The term "substitution operation" is best used in cases in which the transformation procedure is limited to replacing an input block with a value from the substitution table.

For software ciphers, the basic principle of diffusion and confusion is supplemented with the following mechanisms:

  • The dependence of S-boxes on the secret key

  • An increase in the size of S-boxes

  • An increase in the size of the transformed data block, up to 512 bytes

  • The dependence of the encryption algorithm on the secret key (for example, adjusting the transformation operations by the secret key)

  • Data-dependence of the transformation operations (i.e., controlling the selection of a modification of the current operation depending on the input message)

  • Data-dependence of the subkey selection

  • Various combinations of the mechanisms listed in items 1 to 5 (for example, specifying the dependence of the subsets of possible modifications of the controlled operation on the secret key, i.e., a combination of items 3 and 4)

Despite the large number of various encryption mechanisms and their actual implementations, in general, a block cipher can be considered a subset of substitutions assigned to the set of possible input data blocks. The number of substitutions does not exceed the number of different possible secret keys in the cipher. The choice of a secret key corresponds to the choice of a particular substitution. Thus, a block cipher is a way of specifying a simple substitution in a very large alphabet. Due to the large size of the input alphabet (for n-bit input blocks, the number of possible input blocks is 2n, and the number of possible permutations is 2n!), substitutions cannot be specified in tabular form, and the only practical, convenient way of specifying them is algorithmically, i.e., by specifying a rule for computing output blocks using input blocks.

The method of specifying substitutions in the form of procedures controlled by the secret key determines that substitutions are randomly selected not from the (2n!) subset of all possible substitutions, but from the subset of 2k substitutions, where k is the maximum length of the secret key in bits. Since it is assumed that the cryptanalyst knows the encryption algorithm, this means that he or she also knows the subset of substitutions implemented by this algorithm. The complexity of cryptanalysis results from the fact that the number of possible substitutions is extremely large, and each of them can be only considered to be an algorithm describing it when the secret key has a certain value.

The specific kind of the algorithm determines the rule for building the subset of possible substitutions, and therefore, the block cipher has certain algebraic and statistical properties that can be used when performing a cryptanalysis. The question is only how complex a certain cryptanalytic method is for a particular encryption algorithm. While the encryption algorithm plays a secondary role in ensuring the security of ciphers with infinite keys, for block ciphers with fixed secret keys, the characteristics of the encryption mechanism are the most important. The principles of cipher design and the specific kinds of the mechanisms used are oriented towards specifying a pseudo-random substitution that is hard to distinguish from a random one, provided the cryptanalyst has a large (but reasonable) amount of initial data to launch an attack.

The complexity of the cryptanalysis is related to two different factors. When encryption algorithms with good diffusion and confusion properties are used, the work effort needed for a successful cryptanalysis depends on the complexity of analyzing the enciphering procedures themselves. When the encryption algorithm depends on the secret key, the complexity of the cryptanalytic problem significantly increases due to the ambiguity of the interpretation of the statistical connections between the original texts and their corresponding cryptograms. Ciphers in which the encryption algorithm is built depending on the secret key are called flexible or non-deterministic. In flexible ciphers, a given key corresponds to only one implementable modification of the encryption algorithm. A limited set of keys means that a flexible cipher is a set of encryption algorithms described using an algorithm that specifies a rule for building an encryption algorithm depending on the secret key. Building secret substitution tables or an encryption algorithm assumes that software ciphers use a precalculation stage, which is executed only once after entering the secret key. This is the stage in which is initialized a cryptosystem that will later on repeatedly perform the data encryption and decryption procedures.


2.2. Initializing Software Ciphers

As a rule, iterated ciphers use keys with a length from 56 to 256 bits. Currently, if you have a key of 80 bits or more, an attack based on trying every possible key cannot be launched by any organization, even one that has many computational resources. To ensure security against all the other known cryptanalytic methods, a large number of transformation rounds are used, with transformation procedures that have good diffusion and confusion properties being executed in each of them.

Obviously, when longer encryption keys are used, there are more possibilities for designing fast encryption procedures. However, when using longer keys, it is more difficult to control (generate, transfer, and store) them. In cryptosystems intended for a software implementation, the possibility of using and storing long encryption keys can be provided by special procedures of one-way transformation of a relatively small initial secret key into an extended cryptographic key, whose size can be anywhere from 1 to 64 KB. In this case, it would suffice to control the secret keys, since the encryption key can be generated from the secret key when needed according to the known procedures. The stage of generating the encryption key is a precalculation stage, executed only once when the enciphering device or computer is switched on. When such a scheme of cipher design is used, the crypt-analyst must choose between the two main variants of an attack:

  • He or she may assume that the extended key is chosen at random, and analyze relatively simple encryption procedures with the aim of revealing their vulnerabilities.

  • He or she may investigate significantly more complicated procedures of generating the encryption key and try to solve the encryption equations for the secret keys.

Obviously, the procedures of generating the encryption key must be complex enough so that it would be impossible to compute any portion of the secret key from individual fragments of the extended encryption key. The basic algorithm requirements for generating the encryption key are:

  • An approximately equal influence of each bit of the secret key on all the bits of the extended key being generated

  • A high computational complexity of finding the secret key using the known extended key

A high cipher security based on the key extension mechanism is achievable in principle, since in the precalculation stage you can use algorithms belonging to a wider class of transformations than encryption algorithms. We know that a basic limitation of the latter is the necessity of performing an inverse transformation controlled by key parameters and restoring the original message from the ciphers. Such a limitation isn't put on an algorithm generating the encryption key, and a wider class of algorithms suggests that there are even more secure ones from the cryptographic point of view.

Because the setup procedure is supposed to be performed only during the initialization (switching on) of the cryptosystem, there are no substantial restrictions on how long it takes to execute the setup algorithm or on the computational resources used (the precalculation subprogram isn't a resident program). This means that it is acceptable to use multistage one-way procedures, including non-deterministic algorithm: in the first precalculation stage, a one-way transformation algorithm is generated, and executed in the second stage, in which the final transformation of the secret key into the extended encryption key is carried out.

When performing setup procedures, you can also make the generation of the encrypting algorithm modification unique for each user [60]. In fact, the algorithm for generating the encryption procedures is just a form of specifying the choice of a certain modification of the encryption algorithm from a very large number of possible modifications according to the user's secret key. The practical implementation of cryptosystems with nondeterministic encryption algorithms is a special feature of software tools, which follows from the idea of using precalculations.

Thus, a software cipher can be implemented as one of two subroutines - an initialization module intended for a single run, and a resident enciphering module servicing requests from other programs to encrypt and decrypt data.

One of the requirements put on the algorithm generating the encryption key is the following: the number of output sequences mustn't be significantly less than the number of the possible secret keys. The length of the extended output key is greater than that of the secret key, but, for certain precalculation procedures, it may appear that different secret keys correspond to the same encryption key. When one-way transformations are used in the encryption key generating stage, narrowing the encryption keyspace seems unlikely. However, it is best to ensure that the capacity of a set of encryption keys is equal to that of the set of secret keys of the specified length. This can be easily achieved by using encryption procedures for the extended key algorithm generation. Indeed, by repeating the secret key the necessary number of times, you can easily obtain a unique extended text for every secret key. After encrypting this extended text, we obtain a ciphertext that can be used as an extended key. When a non-deterministic cipher is required, build an input extended text whose size is greater than the necessary length of the extended key. A portion of the transformed text will be used as an extended encryption key, and the other portion will be used to build the encryption algorithm.


2.3. Non-Deterministic Software Ciphers

2.3.1. The Principles of Designing Flexible Ciphers

In the traditional approach, a cryptosystem is built based on a fixed set of transformation operations. A key is used to control the encryption process by specifying the parameters used in the encryption transformations. These parameters can be either key elements selected according to a certain rule, or characters of a pseudo-random sequence generated based on the key. The most favorable conditions to launch cryptanalytic attacks are the availability of:

  • Complete information about the data encryption procedures used

  • A sufficient amount of a known plaintext, including a specially chosen one, and the corresponding ciphertext

Testing the cryptosystem under such conditions is a general rule.

Using cryptalgorithms in software tools for computer protection requires that all the encryption procedures be stored on the computer's magnetic carrier if we don't want to burden users with having to repeatedly perform additional actions. Thus, in a user-friendly computer security system, the algorithm of the cryptomodule is basically available to a malefactor. Obviously, the absence of information or partial information about the cryptographic procedures used makes it much more difficult for a potential adversary to solve the task of breaking the protection system.

Using software tools to carry out cryptographic transformations and the precalculation stage, in which the encryption mechanism is initialized, makes it possible to design cryptosystems in which the encryption algorithm for a particular user isn't known to an attacker beforehand, because in such flexible (non-deterministic) ciphers, the encryption algorithm is automatically changed when the secret key changes. This is achieved thanks to the fact that, in the precalculation stage, the procedures generating the encryption algorithm are executed depending on the secret key. Thus, when using a computer to complicate cryptanalytic attacks, the encryption algorithm can be built according to a generating algorithm, which must be assumed to be known to an attacker. The set of possible encryption algorithms is finite, and the rule that determines (the generating algorithm) is considered known to the cryptanalyst. However, the cryptanalyst doesn't know which particular modification of the encryption algorithm will be implemented, since its choice is determined by the secret key.

If the number of implementable modifications is 109 or more, the non-determinism of the transformation procedures can be an effective tool for counteracting cryptanalytic attacks. Moreover, reducing the cryptanalytic problem to trying every possible variant doesn't seem realizable, since it requires that you first consider the majority of the algorithms of this class, and then find an individual approach to each of them. This is unlikely. It is possible to execute a cryptanalytic attack that looks for any general regularities over the entire set of possible modifications of the cryptalgorithm, or over a sufficiently large subsets. Building such a generalized cryptanalytic algorithm is a much more complicated task than designing a method to analyze a cipher with a fixed encryption algorithm.

A universal method of cryptanalysis is keyless reading, based upon known input texts and corresponding blocks of ciphertext. However, it is easy to design a flexible algorithm, each modification of which will be secure against such a generalized type of cryptanalysis. In the following sections, we describe flexible algorithms that meet this requirement. In addition, these flexible ciphers are secure against attacks based on a known modification of the cryptoalgorithm and attacks based on a chosen modification (in the latter case, the attacker can choose the weakest cryptoalgorithm from the set of potentially implementable modifications).

The following theoretical question is directly related to the problem of creating crypto-systems with non-deterministic transformation algorithms: can the system generate a weak second-stage algorithm during the initialization stage? It is difficult to formally describe such an object as a cryptoscheme with a non-deterministic transformation algorithm, and it is even more difficult to provide a strict theoretical proof of the security of all its modifications. However, the following points in favor of using these new systems can be listed:

  • The probability of generating a weak algorithm is very small, and it drastically decreases when using diversified methods of specifying non-deterministic procedures.

  • The generating algorithm can be made responsible for controlling the quality of the encryption algorithm generated (for example, you can have a control encryption in this stage and then analyze the cipher as to whether it passes a special spectral test).

  • In systems with a multi-pass encryption mode, you can use cryptoschemes with fixed encryption procedures as one or more of the component algorithms. The security of these cryptoschemes can be estimated according to approved methods.

  • It is possible to design cryptoschemes that will allow for arbitrary modification of a certain set of operations or transformation procedures, i.e., cryptoschemes whose security is not sensitive to the modification of the set of operations and procedures used.

The latter approach seems the most promising in designing practical, non-deterministic ciphers.

Non-deterministic ciphers pose a basically new logical problem for the cryptanalyst-algorithmic uncertainty, which can be quantitatively described with a number of different potentially implementable modifications of the encryption algorithm. In ciphers with a fixed algorithm, the uncertainty of the encryption process for a cryptanalyst is related to the fact that he or she doesn't know the secret key, whose components (subkeys) are used as parameters in the transformation procedures.

From the standpoint of the uncertainty of the encrypting transformations, flexible ciphers can be presented as a form of specifying key components as adjustable operations and encrypting transformation procedures. Obviously, it is possible to design non-deterministic ciphers that use only such "functional" key components. However, it is more reasonable to design flexible ciphers in which all modifications of the encryption algorithm also use a regular encryption key that contains "parametric" key components. One feature of using "functional" key components is specifying the uncertainty of the encryption procedures, which strongly hampers giving a general analytic description of even elementary transformation steps.

With a high level of algorithmic uncertainty, the transformation of a given block (or a number of blocks) can be described by the subset of all the possible modifications of the encryption algorithm. From the point of view of quantitative uncertainty characteristics, parametric and functional components are equivalent, since the number of variants that can direct the encryption process depends only on the number of key bits. However, algorithmic uncertainty introduces an important qualitative feature-the difficulty of using analytic expressions when carrying out a cryptanalysis. The uncertainty specified by parametric key elements is often removed when mathematical formulas are used, whereas the uncertainty specified by functional key elements is very difficult to generalize, and it is by no means obvious as to how to write down the transformation equations. This significantly complicates building a cryptanalytic algorithm that would make it possible to eliminate a trial-and-error method of finding key elements.

It is especially advantageous to use combinations of functional and parametric key components. The former give us logical complexity, while the latter give us quantitative complexity. The major reason for such a combination is overcoming the difficulties of providing a high level of algorithmic uncertainty.

We should mention that a strict discussion of the security of non-deterministic crypto-systems is related to a number of formalized issues that are difficult to consider, such as how to take into account the differences in the security properties of individual modifications. Minimum estimations can be considered acceptable, but excessive assumption in favor of the cryptanalyst can result in the rejection of promising cryptoschemes. Other important problems that require solutions when designing non-deterministic software ciphers are:

  • Ensuring high security for all possible modifications of the encrypting algorithm against the keyless reading method

  • Specifying a large number of non-equivalent modifications

  • Providing an approximately equal probability of choosing a modification from each subset of equivalent modifications

  • Providing for security against attacks based on a known and chosen modification of the cryptalgorithm

Let's consider a number of ideas that can be used as the basis for creating non-deterministic ciphers.

2.3.2. A Cryptoscheme with Permutations of Fixed Procedures

Let's assume that the encryption of each input message consists of sequentially performing a number of elementary operations on it-F1, F2, …, Fn. In this case, a specific encryption algorithm can be created by specifying the dependence of the sequence of elementary transformations on the secret key. In practice, this can be easily implemented as the creation of an encrypting program basing on subroutines. The number of various possible algorithms is S = n!, and for n = 16 we have S > 1013.

2.3.3. Multi-Pass Cryptoschemes with Flexible Algorithms

When using fast ciphers, it is possible to repeatedly encrypt the original text. Let's say that we have a library of encrypting programs E1, E2, …,En, and their corresponding deciphering programs D1, D2, …,Dn. In order to specify non-determinism for the encryption algorithm, we can provide an implementation of variants of the encryption procedure that consist of m sequential procedures selected from the {E1, E2, …, En, D1, D2, …,Dn} set, i.e., the resulting encryption will take the form of the superposition of m procedures: E = Fim∘…∘Fi2 ∘ Fi1, where F ∊ {E1, E2, … En, D1, D2, … Dn} and i ∊ {1, 2, … n}.

Since sequential execution of the E and D procedures with the same indices doesn't change the message being encrypted, we'll prohibit modifications of the resulting function that correspond to such cases. For Fi1, any of 2n elements of the {E1,E2, … En, D1, D2, … Dn} set can be chosen, while for Fi2, Fi3, … Fi2m, you can choose one of the 2n−1 elements. Taking this into account, it is easy to calculate the number of all possible modifications S of the resulting encryption function: S = 2n(2n−1)m−1.

If the encryption function has the form E = Fim ∘ … ∘ Fi2 ∘ Fi1, its corresponding decryption function will be

where F−1i = Ej if Fi = Dj, and F−1i = Dj if Fi = Ej, (j = 1, 2, … n).

Of special interest are ciphers based on procedures and transformation operations that depend on the data being transformed. In these ciphers, the particular form of the operation (or procedure) performed at a given step depends on the value of the text being transformed. When describing an encryption algorithm based on standard operations, the set of these operations changes from one input text to another. Unlike the non-deterministic ciphers discussed earlier, the transformation algorithm i n ciphers with data-dependent operations is fixed, since the rule for choosing a particular type of operation depending on the current value of the data being transformed is known. The use of encryption procedures with operations that depend on the input message is rather promising when building fast ciphers that have a high security.

2.3.4. A Cryptosystem Adjusting of Transformation Operations

The idea of using transformation operations as key elements consists of the following. A template for the procedure of transformation of a current data subblock is set. The template contains a set of numbered transformation operations. The particular values of the operations are adjusted in the precalculation stage depending on the secret key. This can be done according to the following scheme. A pseudo-random number sequence is generated under the control of the secret key. Depending on the value of the number that corresponds to the number of the operation, a specific variant of that operation is adjusted. For example, a procedure for transforming the current 32-bit data subblock T can include computations according to the following formulas:

where C is the transformed value of the data subblock; K1, K2,…, K6 are 32-bit subkeys that are constants in the encryption program or variables selected depending on the data being transformed; G is a binary vector that determines the influence of the previous data subblocks on the transformation of the current subblock; the ⋙x operator denotes a reserved unary operation (i.e., an operation performed on one number-for example, W⋙x denotes a right circular shift by x bits), the ∗n symbol denotes a binary operation such as modulo 232 addition (+), modulo 232 subtraction (−), or bitwise addition modulo 2 (⊕), and n1, n2,…n7 are the numbers of the reserved binary operations. It is suggested that you establish a specific set of reserved operations in the precalculation stage depending on the secret key.

2.3.5. A Pseudo-Probabilistic Non-Deterministic Cipher

There is a definite interest in creating ciphers in which a non-deterministic transformation mechanism is directly combined with data-dependent subkey selection [60, 62]. With such a combination, the creation of weak algorithm modifications is prevented by the fact that the security of encryption procedures with pseudo-random subkey selection is not terribly important when it comes to choosing the particular set of binary and unary transformation operations used. (Moreover, if the the subkey selection is dependent on every bit of the input message for any modification, then it is impossible to create a weak modification, even if you specially choose the operation sets.)

An example of implementing such an approach is the following algorithm, in which an encryption key including 2051 8-bit words is used: {qj}, where j = 0, 1, 2, … 2050. The 32-bit subkeys are specified by the relationship Q(x) = qx+3 || qx+2 || qx+1 || qx where x = 0,1,2,…211−1. The encryption key should be created at the precalculation stage. The right circular shift of the W word to x(f) bits serves as a reserved unary W⋙x operation, where f = 1,2,3…, is the ordinal number of the reserved operation. The input message is a 512-byte data block that is represented as a sequence of 32-bit words {Tw}, w = 0, 1, … 127.

INPUT: The 512-byte data block {Tw}, w = 0, 1, … 127.

  1. Set r = 1, R = 2k (k is a natural number) and define Lw = Tw, w = 0, 1, … 127.

  2. Set the counter i: = 1 and the initial values of the variables: U, V, Y, G and n: U: = Q(1), V: = Q(2), Y: = Q(3), G: = Q(4), n: = Q(5) mod 211.

  3. Compute:

  4. Compute the index of the subblock currently being transformed: w = 120 − i if r = 2, 4, …, 2k or w = i − 1 if r = 1, 3, … 2k − 1.

  5. Perform the current encryption step:

  6. Save the Cw value.

  7. If i < 128, increase i and go to Step 3.

  8. If i < R, increase r, define Lw = Cw, w = 0,1, … 127, and go to Step 2. If not, STOP.

OUTPUT: The 512-byte ciphertext block {Cw}, w = 0, 1, … 127.

This algorithm describes the encryption procedures. Their corresponding decryption procedures are easy to create, since they differ only in Steps 3 and 4. The number of possible modifications (different variants of setting the reserved operations) of this non-deterministic algorithm is S ≈ 1010R. The size of the resident part of the encryption program for these algorithms does not exceed 5 KB. The number of encryption cycles of the given input block is determined by the R parameter, whose valid values are R ≥ 3. The encryption speed is about 300/R Mbits/sec (for Pentium processors), and the number of implementable non-equivalent modifications of the cryptalgorithm is greater than 1010R. This algorithm is secure, assuming that an attacker knows all the transformation operations and 90% of the subkeys. A variant of an attack based on a known part of the extended key will be discussed later.

In general, the security of specific modifications of pseudo-random ciphers isn't critically sensitive to the operation sets used or their specific types, and so using a subkey selection mechanism depending on the data being transformed presents many opportunities of varying and combining various types of binary and unary transformation operations. The main advantage of this feature of pseudo-random ciphers is not so much in the ease of creating a wide range of fast cryptalgorithms for software implementation as in the possibility of developing a great number of fast non-deterministic cryptosystems, in which the transformation algorithm as well as the encryption key are unknown to the cryptanalyst. To build ciphers with a modifiable cryptalgorithm, you must additionally provide an initialization function for the encryption algorithm, this function being executed under the control of the user's secret key (or password). If the number of possibly implementable modifications of a cryptalgorithm is very large (for example, 1020), this method of providing for the transformation's security will be quite effective.

Even though the modification being implemented is assumed to be unknown in non-deterministic ciphers, this doesn't contradict Kerkhoff's principle, according to which the data encryption algorithm must be considered known to an attacker. This principle is one of the most important ones when creating new single-key cryptosystems. It can be stated more generally: all constant elements of data protection mechanisms must be considered known to an attacker. For example, in the Russian encryption standard GOST 28147-89, "filling in the tables of the substitution box", which is a "constant key element common for the computer network", must be considered known to an attacker, even though, according to the documentation, it is "a secret element supplied in compliance with the established procedure". Using such permanent (though changeable) secret parts of encryption schemes provokes some other comments. In non-deterministic ciphers, the setup procedures for the encryption algorithm are constant elements, and its particular modification and the en-cryption key are changeable elements of the cryptosystem, which are automatically changed simultaneously when changing the passwords, and are unique for every user (or every pair of subcribers to the protected communication network).

Ciphers with pseudo-random key selection are secure against known cryptanalytic methods. However, new methods may be invented in the future which may be based on the analysis of the statistical properties of the transformation procedures and operations or some other features of the encryption algorithm. The development of non-deterministic ciphers is aimed at minimizing the risk of compromising the cryptosystem for a long time to come.

2.3.6. Flexible Ciphers with a Provable Non-Equivalence of Cryptalgorithm Modifications

A key selection mechanism depending on the transformed data seems to be the basis that can provide high transformation security over the entire set of implementable modifications of the cryptalgorithm. This is ensured by the fact that every possible modification determines the uniqueness of the subkey selection for every input message. For non-deterministic ciphers, one important issue is the following: could it be possible to select such modifications of a multi-round encryption function so that several subsequent rounds are equivalent to a decryption function that specifies inverse transformations relative to several previous enciphering rounds? This question is urgent for ciphers that generate a transformation algorithm using a randomly selected secret key. One can assume that for the class of encryption functions based on the subkey selection depending on the transformed data such situations are impossible.

The proof of this statement generally seems to be quite complex. However, it can be true for specific types of flexible ciphers. An example is the flexible cipher discussed in Section 6.7.2. No modifications of direct encrypting transformations can lead to inverse modifications for this flexible 64-bit block cipher. It is possible to demonstrate that, for a number of rounds from among all possible modifications of the algorithm, it is impossible to find such a modification to which one could specify round groups that determine mutually inverse transformation functions. In other words, no modification of the algorithm includes two mutually inverse transformation stages.

This proof makes sense as one of the properties supporting the conclusion that security increases as you increase the number of encryption rounds. It was proved earlier for the aforementioned 64-bit cipher that, in a certain sense, all possible modifications of the cryptalgorithm are unique [57]. This assertion is very useful when estimating the effectiveness of the dependence of the encryption algorithm on the secret key, in the sense that the set of modifications will not break up into subsets of equivalent cryptalgorithms, which in principle could significantly simplify the cryptanalysis. Another example of flexible cryptosystems for which the properties of uniqueness and irreducibility can be proved is the 128-bit cipher discussed in [59].

We should mention that the aforementioned issues, specific to flexible ciphers, only indirectly indicate the security of this type of cryptosystem. If the cryptosystem didn't satisfy the requirements of the irreducibility of the direct and inverse transformations and the uniqueness of all enciphering transformations, it would be possible to speak about the insufficient effectiveness of the mechanism for specifying the dependence of the encryption algorithm on the secret key. However, just because these requirements are satisfied, the issue of estimating the security of a flexible cipher doesn't become less urgent. This means that the security estimation must be performed with the assumption that the cryptalgorithm modification is known.

The possibility of using the subkey selection mechanism depending on the transformed data as a basis for designing flexible cryptosystems that possess uniqueness and irreducibility is an important general future. For practical use, the fast ciphers given in [60, 92] are more interesting, but it is more difficult to prove these properties for them, due to their more complex subkey selection controlling mechanism. Building flexible ciphers in which both common operations and data-dependent ones are adjusted according to the key also seems promising. It is also difficult to present a formal proof that these flexible ciphers possess the properties of uniqueness and irreducibility, but the presence of these properties in simpler constructions based on key selection depending on the transformed data is one of the elements for justifying the practical use of more complex constructions.


2.4. The Combinational-Probabilistic Model

The security of the cipher described above is mainly based on the following points:

  • The subkey selection is unique for every input block.

  • The number of possibly implementable modifications of the cryptalgorithm is extremely large.

  • The subkeys aren't directly used when transforming the words of an input message.

The nature of the transformations is such that the numbers of the subkeys selected during encryption make up a pseudo-random sequence — i.e., the subkey selection depending on data seems random. For a general estimation of the security of this type of cipher, we can use a combinational-probabilistic model (CPM), which is expressed in the following assumptions:

  • A cryptosystem is considered cracked if an attacker finds a pair of words that were transformed using the same set of values of the U, V, and Y variables.

  • The effort it takes to find such a pair of words in the set of known or chosen texts determines the value of the security of the cryptosystem.

  • In the case of a known-plaintext attack (CPM-1) or a chosen-plaintext attack (CPM-2), in the rounds with the numbers r ≥ 2 (CPM-1) or r ≥ 3 (CPM-2), the U, V, and Y variables take random values.

The probability that the values of the used variables coincide for two transformed words is P = M−3(R−1) (CPM-1) and P = M−3(R−2) (CPM-2), where M ≈ 232 is the number of different possible values taken by the U, V, and Y variables. Taking into account the "birthday paradox", the N ≈ P−1/2 value specifies the number of input words for which, with a probability approximately equal to 0.5, there are two input words transformed using the same values of the U, V, and Y variables in the rounds with the numbers r ≥ 2 (CPM-1) or r ≥ 3 (CPM-2). The N value determines the volume of texts necessary to launch a crypt-analytic attack. The minimum effort the attack takes, Smin, is determined by trying half of the possible combinations of 2 out of N elements. It is easy to obtain Smin ≈ srM3(R−1)/4 (for CPM-1), Smin ≈ srM3(R−2)/4 (for CPM-2), where sr is equal to the complexity of some criterion of repetition detection (sr ≥ 1 operations). Here we assume that the algorithm modification is known to the attacker. The secrecy of the algorithm is considered an additional guarantee of security. To test the factor related to the secrecy of the set of transformation operations, it is possible to suggest an attack based on a specially chosen modification of the cryptalgorithm that would allow a cryptanalyst to select the most convenient of the implementable modifications by him- or herself.

Pseudo-random ciphers similar to those described earlier are secure against attacks based on a known part of the extended key, even if the modification is known.

Let's consider the issue of estimating security when an attacker knows a portion of the extended key equal to Δ.

When the value of Δ is large enough, in a chosen-text attack (we are referring to CMP-2) an attacker can choose an input text for which the subkeys will be selected only from the known part of the extended key in the first round. This is why the input text for the second round can be computed, but in the second and subsequent rounds, the subkeys will be selected according to a pseudo-random law. Therefore, in each selecting step, addressing an unknown part of the key will take place with a probability of 1 − Δ. If this happens before completing the transformation of several words in the next to last round, the problem of computing the subkey values will seem complicated, since, in this situation, the numbers of the selected subkeys are unknown. The probability that, when transforming the current word in the second and subsequent rounds, only subkeys from the known part of the extended key will be selected is P1 = Δ3. The probability of selecting known subkeys in all the steps in rounds r = 2, 4, …, R − 1 is P2 = Δ3e(R−2) where e is the number of words being transformed. If P2 is a small value Pa, say, Pa = 10−30, we can consider the cipher secure against this attack variant. From the Pa value, it is possible to compute a secure known portion of the extended key Δa. For e = 120, we can easily obtain from the previous formula that

For CPM-1, the following estimation can be obtained in a similar fashion:

For the algorithm described in Section 2.3.5, CPM-2 gives the following estimate: Δa is about 0.82 (for R = 3) and 0.91 (for R = 4). Obviously, for the same R value, the secure portion of the known key for CPM-1 is greater than Δa for CPM-2.


Chapter 3: Controlled Permutation

Overview

In this chapter, the following terms are used.

Let GF(2) be a two-element field {0,1} with the binary addition "⊕" and multiplication "·" operations. The set of all vectors with the length n having the form X = (x1, x2, …, xn), where xi ∊ GF(2) ∀i ∊ {1, 2, …, n}, will be designated as X. The power of the X set is designated as #X (#X = 2n). Depending on the operations specified for the set, it possesses certain properties and has special notations. For example, an X set with the "·" operation of multiplication of a vector by a scalar α ∊ GF(2), or more precisely: α · X = (α x1,α x2, …,α xn), and the "⊕" binary operation of bitwise addition of vectors — X ⊕ V = (x1 ⊕ v1, x2⊕v2, …, xn⊕vn) — is a linear vector space (X,⊕,·), for which we're going to use the notation GF(2)n.

In most cases, the GF(2)n notation for the X set is used in this book; however, in some cases, there is no need for the presence of all the properties of the linear space. In other cases, the X space acquires new properties, introducing some additional operations as well. There are special terms used for these properties in mathematics. For example, in a simplified statement, if such a binary operation as bitwise vector multiplication (⊗), namely X ⊗ V = (x1v1, x2v2, …, xnvn, is specified for the X set in addition to the binary operation of bitwise addition (⊕), this set is called a ring (X, ⊕,⊗).

Note

When designating binary vectors with uppercase letters—say, X—it is usually implied that this vector is considered a variable value, whereas a lowercase letter x denotes a fixed value of the X vector. However, to specify a particular bit of a vector being discussed, a lowercase letter with a subscript is used (for example, xn).

For some constant vectors we introduce special uppercase designations:

  • Ei—a vector containing a "one" only in the ith bit, the other bits being zeroes (i ∊ {1, 2, …, n})

  • E0—a vector containing no "ones" (we'll also use the e0 notation)

  • Di—a vector containing a zero in the ith bit, the other bits being ones (i ∊ {1, 2, …, n})

  • D0—a vector containing no zeroes (we'll also use the d0 notation)

  • —the complement for the X vector, i.e., the [image] vector.

The E0 vector is neutral, relative to addition to and multiplication by a scalar (X ⊕ E0 = X and α · E0 = E0), and the D0 vector is neutral relative to bitwise multiplication (X ⊗ D0 = X), ∀X∊ GF(2)n and ∀α ∊ GF(2)).

Below are the definitions of the most commonly used terms related to transformations over linear vector spaces.

Concatenation X ∥ V of the X and V vectors (X ∊ GF(2)n and V ∊ GF(2)m) is the mapping of GF(2)n × GF(2)m → GF(2)n+m, or more precisely:

Obviously, for an arbitrary function F(Y), the following equations are true:

A Boolean function is the mapping of f: GF(2)n → GF(2).

A balanced Boolean function is an f(X) such that

A vector Boolean function is the mapping of F: GF(2)n → GF(2)m, or more precisely:

where fi are generating Boolean functions i ∊ {1, 2, …, m}, X∊ GF(2)n.

The Hamming weight is an integer function WH, whose value is equal to the number of non-zero components of the X vector. Obviously,

Click To expand

and

The Hamming distance between the X and Y vectors (X, Y ∊ GF(2)n) is an integer function DH whose value is equal to the number of non-zero components of the X ⊕ Y vector, i.e., DH(X, Y) = WH(X ⊕ Y). This is why the same notion WH is often used for both functions.

An vector oddness function is a Boolean function WH⊕: GF(2)n → GF(2), or more precisely:

A scalar product (<X, Y>) is an integer function whose value is equal to the number of non-zero components of the X ⊗ Y vector, i.e., [image] .

A scalar product (X • Y) is the following Boolean function:

From the definitions of the X•Y scalar product and the WH⊕ oddness function, the X•Y = WH⊕(X⊗Y) equation directly follows, which will be intensively used later in this chapter when proving various statements related to controlled permutations.


3.1. The Concept of a Controlled Permutation

Before proceeding to controlled permutations, we're going to explain the difference between the notions of a substitution and a permutation, which, unlike in traditional mathematics, are essential for cryptographic applications.

In traditional mathematics, the notion of a substitution is introduced as follows.

Definition 3.1

The substitution σ of a finite set Ω consisting of n different elements is a bijection (one-to-one mapping) of the Ω set to itself.

Substitutions conforming to this definition will be hereafter called σ substitutions. One of the variants of illustrative representation for a σ substitution of the Ω = {1, 2, …, n} set is the following:

Here, the lower row contains the σi ∊ {1, 2, …, n} values (σi ≠ σj for i ≠ j), with which the elements of the upper row should be substituted. The n value is called the length of the substitution. For example,

A set of all σ substitutions of the n length is commonly designated as Sn. Obviously, |Sn| = n!.

There are various ways of representing substitution. Another way of specifying σ substitutions is cyclic. For example, in the case in (3.2), the σ substitution has the following six equivalent cyclic representations:

Click To expand

Finally, considering a substitution to be a function of an integer argument, the σ(i) notation is used, where σ(i) = σi, ∀i ∊ {1, 2, …, n}.

According to the general rule of mapping composition (σ′∘σ″)(i) = σ″(σ′(i)), a group multiplication operation ∘σ = ∘ is easily introduced to the Sn set of substitutions, the Sn set being a group of substitutions. In particular, the unity element of a group is commonly designated as e(σ∘e = σ = e∘σ, ∀σ ∊Sn), for which e(i) = i,∀i ∊ {1, 2, …, n}, and the inverse element is designated as σ−1.

The Sn set considered with the natural operation of multiplying its elements, is called a symmetric group of the nth power.

In cryptography, the notion of a substitution is related to the process of substituting certain elements with others, and it significantly differs from the traditional definition. Bijectivity isn't mandatory. Also, the two alphabets (the domain of the mapping and its range of values) don't have to coincide. Moreover, there are substitution ciphers in which every element α of the original sequence is matched with its corresponding set of values Ωα from the substitution alphabet Ω′. However, the term "substitution" is used in this book according to the following definition.

Definition 3.2

A substitution of the s type, or an s substitution, is the mapping s: Ω → Ω′, where Ω and Ω′ are finite sets, and for ∀ω∊Ω there is only one element-ω′ ∊ Ω′: ω′ = σ(ω).

For Ω = {ω1,ω2, …ωn}, the s substitution has the form:

where ω′1,ω′2, …, ω′n ∊ Ω′.

Obviously, the values in the ω′1,ω′2, …, ω′n, sequence are not necessarily all different.

In particular, in the DES algorithm, substitutions of this type (s substitutions) are implemented as special units called S-boxes. A 6-bit binary vector ω ∊ GF(2)6 is supplied at the input of an S-box, and a 4-bit binary vector ω′ ∊ GF(2)4 is generated at its output.

This type of design for S-boxes is caused by the necessity of a hardware implementation of the algorithm where each value of input or output bits is indicated by the presence or absence of an electrical current, and the whole S-box is implemented as an electronic circuit. This is why it is appropriate to consider an S-box as an operational unit implementing a given substitution operation.

That is, an S-box implements the substitution s: GF(2)6 → GF(2)4, and each of the 64 vectors ω1,ω2, …,ω64 is matched by one of the sixteen binary vectors ω′1,ω′2, …,ω′16. In general, an S-box implementing the GF(2)n → GF(2)m mapping (a substitution of the s type) is called an S-box of the n×m size.

The case of Ω′ = Ω corresponds to a substitution of the σ type, and Definition 3.2 in this case is equivalent to Definition 3.1. Note that σ substitutions are widely used in modern block ciphers intended for software implementation (Rijndael [25], GOST 28147-89 [84], etc.). However, the σ substitution is often called a "one to one permutation" in literature, since the lower row in the two-row notation is a permutation of the upper row's elements. On the other hand, by permutation we often mean a process of changing the order of the elements of an original sequence. Accordingly, there is also the notion of permutation ciphers in cryptography.

Thus, if Q = ω1,ω2, …ωn, is a finite sequence of ωi (i = 1, 2, …, n) elements of a Ω″ set called an alphabet, the action of a permutation cipher on the Q sequence can be represented in two-row form:

where the lower row specifies the new order of the elements of the Q sequence. For example, if i1 = 3, then, regardless of the nature of the ωi elements, the first element of the transformed sequence will always be ω3. We should mention that first of all, the {i1, i2, …, in} and {1, 2, …,n} sets coincide, and second, the ωi elements are not necessarily all different. For example, as an original sequence Q, you can use a binary vector with the length n, i.e., Ω″ = GF(2).

In the case of an infinite original sequence, a permutation can be also specified with two rows, such as:

And here the set of indices in the upper row and the set in the lower row coincide with the natural series N = {1, 2, 3, …}.

Regardless of the nature of the Ω″ alphabet, a permutation considered a transformation is uniquely determined by the mutual correspondence between the indices in the upper and lower rows. We'll designate a permutation as the Greek letter π. For example, in the case of (3.4), the π permutation has the form

where the jth column (1 ≤ j ≤ n) means that the ω element with the ij index from the original sequence must be moved to the jth position of the transformed sequence. Obviously, with such a representation of the π permutation, the relative positions of the columns can be arbitrary. This is why a notation is often used in which the upper index row is ranked in ascending order:

where the lower row specifies the numbers of the positions to which the elements of the upper row must be moved. That is, πi is the number of the position to which the ω element with the i index must be moved.

For example, if (3.4) for the Q = ω1,ω2,ω3,ω4 sequence has the form

then the representations for (3.5) and (3.6) are the following:

Click To expand

Note that in (3.5) and (3.6), the sets of the upper and lower rows coincide with the {1, 2, …, n} set. In other words, the π permutation is a bijection (one-to-one mapping) of the {1, 2, …, n} set to itself. However, then the set of all permutations π with the length n coincides with Sn. When considering a permutation as a function of an integer argument-namely, π(i) where π(i) = πi,∀i∊{1, 2, …n} - in the Sn substitution set according to the general rule or mapping composition (π′∘π″)(i) = π″(π′(i)), the ∘π = ∘ operation of permutation multiplication coincides with the group operation ∘σ defined on the Sn permutation set. More precisely, the (Sn, ∘π) permutation group is isomorphic to the (Sn,∘σ) substitution group, and the notions of a symmetric permutation group Sn and a symmetric substitution group Sn are synonymous. It is this fact that explains the "insignificant" difference between the terms "permutation" π and "substitution" σ in traditional mathematics.

Let's turn back to the discussion of the design principles of S-boxes in DES, which are important in introducing the notions of controlled permutations and controlled operational substitutions.

One peculiarity of every S-box is that the substitution σ(j):{(x2, x3, x4x5)} → GF(2)4, σ(j) ∊ S16 is implemented in the S-box for each of the four values (x1, x6) of an input binary vector X = (x1, x2, x3, x4, x5, x6) ∊ GF(2)6. This feature makes it possible to treat the (x1, x6) binary vector as a control vector (control code), and to treat the S-box as a controlled operational substitution. Note that, for a randomly chosen substitution s (an S-box with the n × m size, n > m), it isn't always possible to choose n − m bits as a control vector. However, as practice shows, the best cryptographic properties are characteristic of substitutions in which such a separation is possible. In the latter case, one could say that an S-box is a union (a block) of 2n−m substitutions, each of which belongs to S2m.

When designing an S-box, the correspondence between the value of the control vector V and the chosen σ substitution is determined by the developer, taking into account some additional requirements. If every substitution σ ∊ S2n is assigned a unique number, say, σ(j) (j = 1, 2, …,2n!), then the correspondence between the control vector V ∊ GF(2)m and the chosen substitution σ(j) can be specified as a function j = α(V), it being possible that different vectors V are matched with the same substitutions σ(j). Since the number of various values of the V vector with the m length is 2m it is not possible to use more than 2m different σ substitutions in an S-box. Thus, an S-box can be appropriately regarded as an operational box of controlled substitutions, whose definition can be introduced using a more convenient notation.

Definition 3.3

A mapping Sn/m(X,V) (GF(2)n × GF(2)m → GF(2)n), being a union of 2m substitutions σ(j)∊S2n, is called a box of controlled substitutions if for each fixed value V ∊ GF(2)m a substitution σ(α(V))∊S2n is specified such that Sn/m(X,V) = σ(α(V))(X).

In addition to the Sn/m(X,V) notation, we're going to use the notations S(X, V) and S(V)(X).

It should be mentioned that the designation Sn/m introduced above is not only more convenient, but makes more sense as well when examining controlled operations. The correspondence between the parameters of an S-box with the n′ × m′ size input into a DES cryptosystem and the parameters of the Sn/m box of controlled substitutions is: n′ = n + m,m′ = n.

Generally, when designing a box of controlled substitutions, the length of a substitution and the number of substitutions used don't have to be a power of 2. Let there be k fixed substitutions σ(0),σ(1), …,σ(k−1) with the length n that belong to Sn. The parametric transformation S(i, j), which involves applying the σ(j) substitution to the i argument where i ∊ {1, 2, …, n}, can be considered a box of controlled substitutions.

Definition 3.4

For a given set of substitutions σ(0),σ(1), …,σ(k−1) with the length n, a box of controlled substitutions is an S(i, j) mapping such that S(i,j) = σ(j)(i) equation holds for every i ∊ {1, 2, …, n} and every fixed value j (j = 0, 1, …, k−1).

In particular, when k = 2m, the j parameter can be represented with a binary vector V ∊ GF(2)m, for which j = α(V) = /V/ = v1 + v221 + … +vm2m−1 and σ(j) = σ(/V/).

Definition 3.5

A mapping Ψ corresponding to a particular value of the control code V is called a modification, and is designated as ΨV.

For example, S V is a modification for Sn/m(X,V). For each fixed value of the V∊GF(2)m vector and SV = σV, where σV = σ(α(V)) is a fixed substitution corresponding to the V vector.

Definition 3.6

Two modifications ΨV and ΨV corresponding to control vectors V and V′ ≠ V are called equivalent if for ∀X the ΨV(X) = ΨV′(X) equation holds true.

Definition 3.7

A ΨV modification is called unique if for ∀V′ ≠ V the ΨV ≠ ΨV′ inequality holds true.

In other words, a modification is called unique if there is no other modification equivalent to it.

Thus, in the Sn/m notation, the first parameter n denotes the dimension of the binary vector being transformed (the dimensions of the input and output coincide), and the second parameter m denotes the dimension of the control vector. For example, in the round function in DES, each of the eight S-boxes that in aggregate perform a parallel transformation over a 32-bit binary vector of input data implements a box of controlled substitutions S4/2, two adjacent S-boxes implement an S8/4 box, and all eight of the boxes implement an S32/16 box. In particular, the round function in DES is a controlled operational substitution with 216 modifications.

As the numbers n and m increase, implementation of basic S-boxes becomes more complicated, since it is necessary to implement 2m substitutions, each of which belongs to S2n. In software implementations, tables are often used, and the size of the computer memory also places limits on the valid values of the n and m parameters. In past decades, certain methods of analyzing the properties of implemented mappings and transformations have been developed. In most cases, these methods are based only on the possibility of trying all the values of the input and output parameters of basic S-boxes, which in turn makes it possible to compute elements of the secret key in parts [8, 9, 50]. This is why mappings and transformations that exclude the possibility of such attempts are of special interest.

Let's consider the permutation

A hardware implementation of the π permutation involves wire switching for input and output bits, so a fixed permutation is often called a fixed connection. Since every input and output bit of the π permutation is a component of an electric circuit, the transposition of elements of the GF(2) set is actually performed from an i bit to the πi bit. In other words, the π permutation specifies a bijective substitution mapping (transformation) σπ:GF(2)n →GF(2)n. An operation box implementing this transformation is called a P-box, and so, in addition to the σπ designation, we're also going to use the Pπ designation. The advantages of this operation are the simplicity of implementation and the absence of a time delay (t(π) = 0). Fixed switches (permutations) are intensively used in almost every block algorithm (for example, in DES, n = 32, 64).

Definition 3.8

The substitution σπ (GF(2)n →GF(2)n) is called a substitution with digit connection and is designated as Pπ, if ∀i(i = 1, 2, …n), yπi ≡ xi, where Y = Pπ(X) and X,Y ∊ GF(2)n.

Note that every substitution Pπ implements a bijective mapping that retains the Hamming weight ∀X ∊ GF(2)n, or more precisely:

Indeed,

where yj = yπj = xi∀j = 1, 2, …, n.

Obviously, an identical e ∊ Sn permutation is matched with an identical Pe = E ∊ S2n substitution.

Definition 3.9

The substitution [image] is called inverse for Pπ if the Pπ−1∘Pπ = Pπ∘Pπ−1 = E condition holds, where E is an identical transformation on GF(2)n.

It is easy to check to make sure that for each substitution Pπ, there is an inverse substitutions, or more precisely:

Let's demonstrate that Pπ−1∘Pπ = E. Indeed, if Y = Pπ−1(X) and Y′ = Pπ(Y), then ∀i = 1, 2, …n, yi ≡ xπi and y′πi ≡ yi ≡ xπi, since πi → i for π−1 and i → πi, for π. But the y′πi ≡ xπi, ∀i = 1, 2, …, n notation means that Y′ = X. Therefore,

Similarly, Pπ∘Pπ−1 = E can be proven.

But then the G = {Pπ} set is a subgroup in S2n, and the properties of the Pπ substitutions significantly depend on the properties of the π permutations. It should suffice to mention that the transformation subgroup G = {Pπ} is isomorphic to the Sn group. Correspondingly, |G| = n!. From the viewpoint of the examination of mathematical properties, the difference between Pπ ∊ G and π ∊ Sn is only that for the former case, input and output values are binary vectors from GF(2)n, and for the latter case, they are j bit numbers (j = 1, 2, …, n). Between the j bit numbers and binary vectors Ej (Ej ∊ GF(2)n and WH(Ej) = 1, ej = 1), a one-to-one correspondence can be established, or more exactly, Ej ⃡ j, and it is obvious enough that Es = Pπ(Ej) ⇔ s = π(j).

Let's demonstrate that a subgroup G ⊂ S2n is an isomorphic group of the (GF(2)n,⊕,⊗) ring to itself. That is, for ∀X,Y ∊ GF(2)n and ∀Pπ ∊ G, the following equations hold:

Indeed, if Z = Pπ(X), Z′ = Pπ(Y), and Z″ = Pπ(X ⊕ Y), then ∀i = 1, 2, …, n, zπi ≡ xi, z′πi ≡ yi, and z″πi ≡ (X ⊕ Y)i ≡ xi ⊕ yi ≡ zπi ⊕ z′πi. That is, Pπ(X ⊕ Y) = Pπ(X) ⊕ Pπ(Y). If additionally Z′′′ = Pπ(X ⊗ Y), then ∀i = 1, 2, …, n, z′′′πi ≡ (X ⊗ Y)i ≡ xi ⊗ yi ≡ zπi ⊗ z′πi. Therefore, Pπ(X ⊗ Y) = Pπ(X) ⊗ Pπ(Y).

Since Formula (3.8), or more exactly, WH(Pπ(X)) = WH(X), is true for ∀X∊GF(2)n, it is also true for the E0 vector: WH(Pπ(E0) = 0. Therefore, Pπ(E0) = E0. That is, Pπ is indeed an isomorphism of the (GF(2)n, ⊕, ⊗) ring to itself.

Let there be k fixed permutations π(0),π(1), …π(k−1) with the length n that belong to Sn. Like the operational box of controlled substitutions S(i, j), the parametric transformation π(i, j) that involves applying the π(j) permutation to the i argument where i ∊ {1, 2, …, n} can be regarded as an operational box of controlled permutations.

Definition 3.10

For a given set of substitution π(0),π(1), …,π(k−1) of the length n, a box of controlled permutations is a π(i, j) mapping such that, for ∀i∊{1, 2, … n} and each fixed value j(j = 0, 1, …, k−1), the π(i,j) = π(j)(i) equation is relevant.

In particular, for k = 2m, the j parameter can be represented as a binary vector V∊GF(2)m or more exactly, j = α(V). For example:

In this case, the [image] mapping for every fixed value V ∊ GF(2)m and ∀i∊{1, 2, … n} is also called a box of controlled permutations, and πV = π(α(V)) is correspondingly called a modification of the π(i, V) mapping.

Since each permutation π(j) specifies a bijective substitutional transformation Pπ(j): GF(2)n → GF(2)n, a box of controlled permutations π(i, j) generates a box of controlled substitutions P(X, j) = P(j)(X), where X ∊ GF(2)n. For the case j = α(V), we're going to use the PV designation rather than Pπ(j) = Pπ(α(v)).

However, we're going to call the operational box of controlled substitutions P(X, V) that is thus generated a box of controlled permutations, thus emphasizing the specific features of generating such a box. The following definitions allow us to distinguish between πn/m(i,V) and Pn/m(X,V).

Definition 3.11

A πn/m(i, V) ({1, 2, …, n} × GF(2)m → {1, 2, …, n}) mapping, which is a union of 2m permutations πV = π(j) ∊ Sn, is called a πn/m, box of controlled permutations if, for every fixed value V ∊ GF(2)m, a permutation πV = π(α(V)) ∊ Sn is specified such that πn/m(i, V) = πV(i) = π(α(V))(i).

Definition 3.12

A Pn/m(X, V)(GF(2))n × GF(2)m → GF(2)n) mapping, which is a union of 2m substitutions Pπ(j) ∊ S2n, is called a Pn/m box of controlled permutations if, for every fixed value V ∊ GF(2)m, a permutation πV = π(α(V)) ∊ Sn is specified such that Pn/m(X, V) = PV(X) = Pπ(α(V))(X) = Pπ V(X).

When necessary, we're going to use the designations P(X, V) and π(i, V), or P(V)(X) and π(V)(i), in addition to the Pn/m(X,V) and πn/m(i,V) designations.

A PV modification is called unique if for ∀V′≠V the PV ≠ PV′ inequality is true. Obviously, the number of different PV modifications isn't greater than min(n!,2m).

The notion of a πn/m box is introduced in order to study the properties of the Pn/m operational box. Everything that was said concerning the dependence of the properties of the Pπ substitution on the properties of the π permutation holds for the Pn/m and πn/m boxes. In particular, for a Pn/m box and ∀ν ∊ GF(2)m, ∀X, Y ∊ GF(2)n, Formulas (3.8), (3.10), and (3.11) take the form:

Click To expand
Click To expand

Correspondingly, Es = P(Ej) ⇔ i = πV(j), where PV and πV are modifications of the Pn/m and πn/m boxes.

Since for each fixed value V ∊ GF(2)m the Pn/m box of controlled permutations implements a bijective transformation GF(2)n → GF(2)n, the issue of designing and using an operational box implementing all the inverse (by the first parameter) transformations P−1n/m = (Pn/m)−1 is of special interest for cryptographic applications. Obviously, such an operational box exists, which is also a box of controlled permutations. Indeed, because each a PV modification is a σ substitution with digit connection PπV, it has an inverse σ substitution P−1πV = (PπV−1), which is also a substitution with digit connection, and we'll designate it PV−1. Then, a union of 2m σ substitutions PV−1 ∊ S2n is the sought-for box of controlled permutations (Pn/m)−1.

Definition 3.13

A P−1n/m(X, V) (GF(2)n × GF(2)m → GF(2)n) mapping, which is a union of 2m substitutions PV−1 = Pπv−1 ∊ S2n is called an inverse box of controlled permutations relative to the Pn/m(X,V) box, or simply, an inverse transformation if the Pn/m(X, V) (GF(2)n × GF(2)m → GF(2)n) box is a union of 2m substitutions PV = PπV ∊ S2n.

Indeed, ∀Pv ∊ Pn/m, Pv ○ Pv−1 = Pπv ○ Pπv−1 = P(πv ○ πv−1) = Pe E, where e is an identical permutation and E is an identical transformation. Also, ∀V ∊ GF(2)m.

Later in this book, we're going to use the designation shown in Fig. 3.1 for an operation box of controlled permutations Pn/m in diagrams representing an algorithm of block ciphering (or a portion of it).

Figure 3.1: A box of controlled permutations Pn/m

When generating operation boxes Pn/m for their subsequent use in block ciphering algorithms, the following parameter set is decisive:

  • The length n of a data block being transformed, and the bit length m of the control vector

  • The number of different modifications and the modification uniqueness for each value of the control vector

  • The operating time t(Pn/m) of a transformation; see Section 3.2

  • The hardware complexity t(Pn/m) see Section 3.2

  • The hardware complexity CΩ(Pn/m); see Section 3.2

  • The hardware complexity of the inverse transformation; see Section 3.2

  • Conformity to the condition of an equiprobable bit diffusion; see Section 3.3

  • The box order h; see Section 3.3

  • Generating modifications that fall into a particular class (such as full-cycle permutations, involutions without single cycles, etc.); see Section 3.3

In this chapter, various types of Pn/m boxes are discussed, and the listed parameters are examined in order to choose the best variant. Besides which, the computation methods for special linear characteristics in linear cryptanalysis suggested by M. Matsui in 1993 are thoroughly discussed in Section 3.4.

In Section 3.5, issues related to the generation of control vectors for boxes of controlled permutations are discussed.

Note

In application tasks related to computer data processing, of special interest is the case where n is a power of 2. This is why we'll hereafter assume that n = 2k unless otherwise stated.


3.2. The Design of Operational Controlled Permutation Boxes with a Specified Speed and Hardware Complexity

The process of synthesizing block enciphering algorithms is significantly influenced by such parameters as the algorithm operating speed and the hardware complexity of the algorithm implementation. The same task can be fulfilled in a longer time by using less resources or, by contrast, in a shorter time if more resources are allocated. The concepts of operating time and implementation complexity are closely related to the computational complexity theory, founded by Claude Shannon [90], who demonstrated the importance of Boolean algebra for analysis and synthesis of relay switching circuits. Modeling computational processes is often done in the form of Boolean (combinational) circuits implemented using a basic set of primitive Boolean elements (gates) that implement Boolean operations. Such basic sets can be complete and incomplete. For example, the Boolean operations "AND" (&), "OR" (ˇ), and "NOT" (–) comprise a complete basic set that makes it possible to implement any Boolean function. In other words, the Ω = {&, ˇ, –} set of Boolean operations is complete. Other examples are Ω = {⊕, &, ˇ, –}.

Definition 3.14

By the complexity of a hardware implementation (combination complexity) CΩ(F), we mean the number of gates implementing the F circuit.

Note that combination complexity significantly depends on the Ω basic set. In addition, the same logical circuit can have different implementations. In this book, the complexity of the discussed combination circuits is estimated relative to the Ω = {&, ˇ, –} basic set.

Note

Quantitative estimations for hardware implementations should actually be treated as qualitative, since precise estimations require special investigations taking into account continuously developing hardware technology.

To estimate the speed parameters of an F circuit, the time required to perform the slowest basic operation is generally used, and it is called the delay time, τ. For example, it is τΩ = t& for the Ω = {&, ˇ, –} basic set, and τΩ = t⊕ for Ω = {⊕, &, 1}.

Definition 3.15

The maximum route length dΩ(F) (a route is the number of gates through which a signal passes from the input to the output) is called the circuit depth.

It is said that an F circuit has the dΩ delay time if the circuit depth is equal to dΩ and the operating time of the circuit is tΩ(F) ≤ dΩ · τΩ. When necessary, the precise value of the circuit operating time can be obtained, which is the maximum value computed for all the routes.

3.2.1. The First (Formal) Variant of a Pn/m Controlled Permutation Box

This variant is shown in Fig. 3.2. The circuit works as follows.

Click To expand
Figure 3.2: A formal synthesis circuit of a box of controlled permutations

A binary decoder Dm, to whose input an m-bit control vector V = (v1, v2, …, vm) is supplied, outputs a binary vector U = Dm(V) with a length of 2m and the Hamming weight WH(U) = 1 — i.e., the value 1 is only generated in one bit:

Connection input and output bits according to a specified fixed permutation π(s−1) is implemented in the circuit shown in Fig. 3.3, a, in which the bits of the X vector are supplied to the inputs of n logic elements "AND" simultaneously with the control signal us. Connection is only performed when the value of the one-bit control signal is us = 1.

Click To expand
Figure 3.3: Implementation of controlled selection of a π(s−1) modification: a — general view, b — an example for a π4/4 box

For example, suppose the V = (1,1,1,0) vector in the π4/4 box of controlled permutations is matched with the following modification:

The implementation of the π(7) modification is shown in Fig. 3.3, b.

We'll call the circuit shown in Fig. 3.2 a matrix structure. When examining the speed parameters of such an implementation, we see that t(Pn/m) = t(Dm) + t&, where t(Pn/m) is the operating time of the circuit, t(Dm) is the time of generating the control vector (t(Dm) ≈ log2m · t&), and t& is the time of performing the "AND" operation. When designing particular circuits for data transformation algorithms, if it is possible to generate the U vector in advance, the delay time is less than (log2m + 1)τ, where τ = t&. In general,

The complexity of implementation of a Pn/m box with the matrix structure is

Click To expand

We're going to explain the formula for CΩ(Pn/m). The n2m value is obtained in the following way: for each of the 2m modifications π(s) (Fig. 3.3, a), n gates implementing the & conjunction are required.

However, when n ≥ 2m, it will suffice to use n2 gates f&(ij)(u), whose indices i and j denote a particular pair of input and output bits, and the f&(ij) gate "closes" the circuit if u = u(ij) = 1, where

Click To expand

and

Since in Sum (3.18), us = 1 only for one s, there is no need for additional gates of the fˇ type to implement Function (3.18).

The implementation complexity of a binary deciphering device lies within 2m + m − 2 ≤ CΩ(Pn/m) ≤ 2m + (m − 2)2⌈m/2⌉, where ⌈m/2⌉ is rounding to the nearest integer greater than or equal to m/2. This is why the combination complexity of implementation of the Pn/m box of controlled permutations lies within

Click To expand

For m ≥ log2n and a large n, CΩ(Pn/m) ≥ n2 + 2m + m − 2 ≈ n2 + 2m, which results in drastically increasing the complexity and price of the electronic circuit of the box.

An advantage of the matrix structure is the variable speed parameters of a box performing permutation with a delay time of no more than log2m + 1, the minimum delay time being τ. For smaller values n (n ≤ 8) and the number of modifications 2m comparable to n, such an implementation is justified. Particular recommendations on using such a box synthesis technology with the specified parameters will be discussed later. For now, note the following.

Note

The properties of a box of controlled permutations with the matrix structure depend on the particular set of pre-specified permutations (modifications) and on their order, since analytic investigations are aimed not only at the values of the input and output vectors, but at the values of the control vector as well.

This is why, as the m value increases, the complexity of generating a Pn/m possessing the necessary properties also increases.

3.2.2. The Second (Cost-Effective) Variant of Implementing a Pn/m Controlled Permutation Box

Obviously, a combination of two or more P-boxes is also a P-box, the total delay time being less than or equal to the sum of the delays of all the boxes. As we will demonstrate later in this chapter, using this combination principle, it is possible to design boxes with an acceptable hardware implementation complexity and a small delay time.

It must be noted that, in electronics, so-called switching networks have received wide acceptance. In these networks, each bit of the V vector controls a switching element, and a whole network implements bijective switching between the input and output bits for each value of the control vector. As an example, Fig. 3.4 illustrates a four-layer switching R-network, whose name and appearance are borrowed from M. Portz's paper [76].

Click To expand
Figure 3.4: An R-network with 16-bit input and output

With such a structure, each value of the control vector V implements one-to-one switching between the input and output bits—i.e., it generates a πV permutation of the n length. Correspondingly, a switching network with an m-bit control vector V(V ∊ GF(2)m) generates 2m permutations, and it is simultaneously a πn/m box and a Pn/m box. This is why switching networks are also called permutation networks. Note that, unlike in the first variant of synthesis of controlled permutation boxes with the matrix structure in which the control vector just selects a fixed permutation πV, in a permutation network, the control vector generates it. This is because there is no indication of a method generating the PV and πV modifications in the definitions of the Pn/m and πn/m boxes (see Section 3.1).

Generally, a switching network with the n × n size has a layered structure, in which fixed switches are used before the first layer, after the last one, and between adjacent layers, and each layer is a combination of parallel disjoint switching networks (boxes) with smaller sizes. In such a construction, the delay time is equal to the sum of delays on each layer.

Of the most interest are networks (Fig. 3.5) in which n is a power of 2—i.e., n = 2k—and each layer is a combination of n/2 parallel switching elements P2/1. For such a layer, which is also a box of controlled permutations, we're going to use the Ln or Ln(V) notation, and the layer itself will be called active. The term "active" is used as an opposite for fixed switching between the layers.

Click To expand
Figure 3.5: The general view of a Pn/m box with a layered structure

In the simplest box P2/1, named a switching element, two information bits are either swapped (y1 = x2 and y2 = x1) or not (y1 = x1 and y2 = x2) depending on the value of the control bit v (for example, they're swapped when v = 1, and left alone when v = 0).

Obviously, P−12/1 = P2/1. Correspondingly, an Ln box implements a substitutional transformation Y = Ln(v)(X), where X, Y ∊ GF(2)n and V ∊ GF(2)n/2, and ∀i (i = 1, 2, …, n/2), y2i−1 = x2i−1+νi and y2i = x2i−νj. It is also obvious that L−1n(V) = Ln(V).

For the circuit being looked at, the number of layers is [image] , the transformation time is t(Pn/m) = l τ, and the implementation complexity is CΩ(Pn/m) = mCΩ(P2/1).

3.2.3. Designing the P−1n/m Inverse Transformation

For the formal variant of designing the inverse transformation P−1n/m, it will suffice to take the inverse modification P−1V for each modification PV and combine them into a box. From a theoretical point of view, for Pn/m boxes with a layered structure (Fig. 3.5), there is an obvious hardware-simple solution corresponding to the second variant: just swap input and output. If we represent a control vector V as a concatenation of l vectors of the m/l size (V = V1 ‖ V2 ‖ … ‖ Vl, where Vi ∊ GF(2)n/2), and take into account the possibility of dividing the Pn/m box into layers:

Click To expand

where Ln(Vi) is the ith layer consisting of P2/1 boxes, then the P−1n/m(V) inverse transformation will take the form:

Click To expand

Since L−1n(Vl) = Ln(Vl) and (Pπ(l))−1 = P−1π(l),

Click To expand

Thus we find that P−1n/m(V) = P′n/m(U), and the control vector U in the P′n/m(U) box has the following form:

that is, the concatenation of m/l vectors has an order that is the reverse of the V vector. This is why, to provide the possibility of using a formal notation P−1n/m(V), we'll adopt the following convention, with which the inverse transformation P−1n/m(V) is performed with the same value of the control vector V = V1 ‖ V2 ‖ … ‖ Vl.

Convention

In P−1n/m boxes with the layered structure, P2/1 boxes are numbered layer-wise from left to right, bottom to top.

Indeed, with this convention, first the Vl vector controls the P−1n/m(V) box, and then the Vl−1 vector, etc. We should mention that the P−-1n/m box inherits all the major properties of the Pn/m one (the uniqueness of modifications, equiprobable bit shift, and a box order that retains the cyclic structure as shown in Section 3.3). The truth of this statement directly follows from either the general properties of permutations (the uniqueness of modifications, the same cyclic structure) or the invariance of the definitions related to the input and output (equiprobable bit diffusion, the box order). This is why it is reasonable in cryptographic applications to use the P−1n/m box as well as the Pn/m box, as in Russian patent No. 2140714[1], for example.


3.3. Designing Controlled Permutation Boxes with Specified Algebraic and Probability-Statistical Properties

3.3.1. Boxes with Equiprobable Bit Diffusion and Boxes of the hth Order

Definition 3.16

A box of controlled permutations Pn/m satisfies the requirement of having an equiprobable bit diffusion if all the modifications of the box are equiprobably distributed, and if after the transformation a randomly chosen input bit xi, i ∊ {1, 2, …, n} can appear at the output with equal probability in any of the n bit positions.

When applied to a πn/m box, this requirement is determined by the expression [image] , where PrV is the probability of the {πn/m(i) = j} event computed over all V ∊ V.

Definition 3.17

A Pn/m box is called a box of the hth order if it allows you to move any h input bits to any h output bit positions. We're going to use the P(h)n/m designation for an hth order box.

In terms of a πn/m box, this definition is equivalent to the following one:

Definition 3.18

A πn/m box is called a box of the hth order if, for any different elements i1, i2, …, ih ∊ {1, 2, …, n} and for any different elements j1, j2, …, jh, ∊ {1, 2, …, n} there is a πV ∊ πn/m permutation such that

We're going to use the π(h)n/m designation for an hth order πn/m box. Obviously, 0 ≤ h ≤ n.

Theorem 3.1

Let πn/m be a box with equiprobable bit diffusion. Then the number of modifications is a multiple of n, and if n = 2k, then first, m ≥ k, and second, πn/m is at least a box of the first order - i.e., h ≥ 1.

Proof

Indeed, by definition, for a box of equiprobable bit diffusion

but on the other hand

where

Hence

Since for every modification πv the describing function θv(i,j) takes one of two values (0 or 1), there is an integer in the left-hand side of the previous equation, and therefore, [image] is an integer. In other words, the number of modifications is a multiple of n. If n = 2k, then [image] .

Therefore, m−k = log2(2m−k) > 0. The first part of the statement is proven.

The second part of the statement is evident enough. Indeed, since [image] , there is πν ∊ πn/m such that [image] . That is, h ≥ 1.

The theorem is proved completely.

From the point of view of practical application, the h = n condition is of interest. As mentioned earlier, boxes of controlled permutations that satisfy this condition are called boxes of maximum order. Such boxes implement any permutation that is equivalent to the Sn ⊆ πn/m expression.

Let's consider three examples of boxes with the matrix structure, and one with the cascade structure.

Example 3.1.
Start example

An elementary box P2/1 (Fig. 3.6, a). With the basic set of function elements Ω = {ˇ, &-}, an implementation of such a box is shown in Fig. 3.6, b, where the triangle denotes a signal inversion corresponding to logical negation (-). Obviously, t(P2/1) = τ, and the implementation complexity without regard to inversion is CΩ(P2/1) ≈ 4. The box possesses the following properties:

  • It is a box with equiprobable bit diffusion.

  • It implements all permutations (identical and swapping) - i.e., it is a box of the maximum order.

  • All the modifications are unique.

  • It implements involution-i.e., P−12/1 = P2/1.

End example
Click To expand
Figure 3.6: A box of controlled permutations P2/1 (a) and its practical implementation (b)
Example 3.2.
Start example

The P4/m boxes. For n = 4, there are 24 different permutations. This is why, for example, it is impossible to implement all permutations with the matrix structure of the P4/4 box (24 = 16 < n! = 24), but it is possible to select any 16 unique modifications. On the other hand, using the P4/5 box, it is possible to implement all permutations (25 = 32 > 24). However, to conform to the uniqueness requirement, it is only necessary to provide for the generation of 24 values of the control vector. For example, for P4/4, the performance is τ ≤ t(P4/4) ≤ 3 τ, and the implementation complexity of the matrix structure is CΩ(P4/4 ≈ n2 + 2m = 32. A cost-effective P4/4 scheme (Fig. 3.7) has a performance of 2τ and a complexity of CΩ(P4/4 ≈ 16.

End example
Click To expand
Figure 3.7: The structure of the P4/4 box
Example 3.3.
Start example

The rotation box Tn (Fig. 3.8). The Tn box with the matrix structure that implements the rotation operation over input data in one tick is a special case of the Pn/m box for m = log2n. It consists of

  • Input and output buses shown in the figure as vertical and horizontal solid lines, respectively.

  • A binary deciphering device generating key control signals; the key control bus is shown with dotted lines.

  • At the crossing points of input and output buses, there are keys (the "AND" logical elements) that close or open the circuit, depending on the signal supplied to the key control input.

End example
Click To expand
Figure 3.8: A controlled rotation box Tn with the matrix structure

When m = log2n, the implementation complexity of the circuit is CΩ(Tn) ≈ n2 + 2m = = n2 + n. The Tn box is a first-order box of equiprobable bit diffusion with the minimum possible length of the control vector, all the modifications being unique.

There are other constructions of boxes of equiprobable bit diffusion.

Example 3.4.
Start example

In addition to the matrix structure of the Tn box, let us consider a hardware-inexpensive cascade structure (Fig. 3.9), which is analogous to a switching network with the following features:

  • The box consists of m = log2n layers, each of which contains n P2/1 boxes arranged in parallel, each P2/1 box using only one output (CΩ(P2/1) ≈ 2) connected to two inputs of different P2/1 boxes of the next layer.

  • Each layer is controlled by one bit of the control vector, the sth layer Tsn/1 performing data rotation by a value of νs2s−1.

End example
Click To expand
Figure 3.9: The cascade structure of the rotation box Tn

The total value of rotation r is computed according to the formula:

Click To expand

The implementation complexity of a cascade structure is CΩ(Tn) ≈ 2n log2n, and the operating time is t(Tn) = τlog2n.

Before we proceed with particular implementations of boxes of equiprobable bit shift, maximum order boxes, and hth order boxes, let's take a look at Clos switching networks [3, 4, 22], since the majority of the subsequently discussed schemes of controlled permutation boxes are actually Clos networks, even though they have individual names.

Clos Networks

When we describe a switching three-stage Clos network (named after its creator) using a box with the r × r size, we mean a switch that has r inputs and r outputs and that makes it possible to perform arbitrary switching between the inputs and outputs. In the first half of the twentieth century, there was actually an analog of this box - a telephone commutator (pin switch), in which the number of inputs was greater than the number of outputs. However, for reasons important from the cryptographic point of view, we're going to assume that the number of inputs is equal to the number of outputs, and that every such box is a box of controlled permutations.

So, let n = rs, where r and s are integer positive values.

Definition 3.19

A switching network in which the first level consists of s boxes having the r × r size, the second one consists of r boxes with the s × s size, the third is the same as the first, and switching between the adjacent stages is implemented according to the principle "each box has only one connection with each box", is called a three-stage Clos network with the (r, s) parameters [3]. Correspondingly, a two-stage Clos network is a network containing only the first two stages.

For a three-stage Clos network with the (r, s) parameters, we introduce the C<r,s,r>/m designation, where rs = n, and a two-stage Clos network with the (r, s) parameters will be designated as C<r,s>/m.

An example of a three-stage Clos network is shown in Fig. 3.10.

Click To expand
Figure 3.10: A three-stage Clos network

Note that most of the boxes of controlled permutations discussed in this book are actually Clos networks. It is obvious enough that the properties of a Clos network are completely determined by the properties of boxes of sizes r × r and s × s.

For example:

  • If each of the boxes of sizes r × r and s × s is a box with equiprobable bit diffusion, then the two-stage Clos network is a box of equiprobable bit diffusion.

  • If each of the boxes of sizes r × r and s × s is a first order box, then the two-stage Clos network is a first order box.

  • If each of the boxes of sizes r × r and s × s is a maximum order box, then the three-stage Clos network is a maximum order box.

These statements are given without proof, since there is abundant literature devoted to this issue. For n = 2k and k ≥ 2, the sequence of two-stage CClos networks is given by the following formula:

A Recursive Model of Equiprobable Bit Diffusion Boxes with a Layered Structure

Fig. 3.11 shows two variants of recursive models for synthesis of the P2n/2m+n and P′2n/2m+n boxes from two Pn/m boxes, and correspondingly, from two P′n/m boxes and n P2/1 boxes, for which we're going to use the special designations R2n/2m+n and R′2n/2m+n.

Click To expand
Figure 3.11: The design of the boxes R2n/2m+n (a) and R2n/2m+n (a)′ (b)

The properties of the R2n/2m+n and R′2n/2m+n boxes depend on the properties of the Pn/m and P′n/m boxes. For example, if Pn/m and P′n/m boxes are ones with an equiprobable bit diffusion, the R2n/2m+n and R′2n/2m+n boxes are also boxes with an equiprobable bit diffusion.

If we confine ourselves to a requirement that the Pn/m and P′n/m boxes are first-order ones, then the R2n/2m+n and R2n/2m+n (a)′ boxes are also boxes of the first order.

The proof of these statements is quite evident, since:

  • The first of the considered constructions is a two-stage Clos network with the (2, n) parameters.

  • The second construction is a two-stage Clos network with the (n, 2) parameters.

All we have to do now is use the properties of a two-stage Clos network for which the statements are true. Indeed, since each P2/1 box is a box with an equiprobable bit diffusion, and the Pn/m and P′n/m boxes are boxes with an equiprobable bit diffusion (or those of the first order), it follows that the R2n/2m+n and R′2n/2m+n boxes are also boxes with an equiprobable bit diffusion (or those of the first order).

Obviously, if a P−1n/m box is used as a P′n/m box, the model shown in Fig. 3.11, b is a R−12n/m+n box for the model shown in Fig. 3.11, a. Further refinement of the models (Fig. 3.11) depends on the structure of the Pn/m and P′n/m boxes.

Thus, having started with n = 2 and m = 1, and using the first variant, it is possible to build the following sequence of recursive boxes with an equiprobable bit diffusion: R8/12, R16/32, R32/80, R64/192, etc.

Special designation

Taking into account the importance of the properties of boxes built in such a way, we will introduce a special designation - Rk. Here, n = 2k, the bit length of the control vector is [image] , and the boxes themselves will be hereafter called recursive boxes of equiprobable bit diffusion.

Note that in a recursive box of equiprobable bit diffusion Rk, the number of layers is l = log2n = k, and each modification is unique. The sequence of recursive boxes of equiprobable bit diffusion given earlier has the following form: R2, R3, R4, R5, R6, R7, etc. On the other hand, using the second variant, it is possible to build a sequence of recursive boxes of equiprobable bit diffusion R2−1, R3−1, R4−1, R5−1, R6−1, R7−1, etc.

Note

Even though the P2/1 box cannot be represented by the recursive model because it is a "building box" used to construct switching networks, it possesses all the properties of the Rk box. This is why we're going to use R1 rather than P2/1 when necessary.

In Fig. 3.12, the R3 and R−13 boxes are given as an example.

Click To expand
Figure 3.12: The structure of R3 (a) and R−13 (b)

The implementation complexity is

and the operating time is tΩ(Rk) = tΩ(Rk−1) = kt.

When comparing these estimates with similar ones for a rotation box with a cascade structure, we can draw the following conclusion.

Conclusion

The speed parameters and hardware implementation complexity of a controlled rotation box with cascade structure Tn and a recursive box of equiprobable bit diffusion Rk are the same.

However, the dimension of the control vector in the latter case is n/2 times larger, thus providing a higher quality of "diffusive property" implementation, due to an increased number of implementable modifications.

It should be mentioned that there are various implementation schemes of boxes of equiprobable bit diffusion with a layered structure, since they are intensively used in algorithms of Fast Fourier Transform computing, in matrix transpositioning, in polynomial computing, and also in sorting algorithms. They all have the same implementation complexity and time delay, and they only differ in switching between the layers. In particular, the recursive model examined earlier was called a baseline network in [44]. We'd also like to note that the R-network shown in Fig. 3.4. differs from a recursive network only in that it has a non-identical switch after the last active layer. The proof of the equivalence of switching networks, the Omega network of Lawrie, and the R-network is given in S. Parker's work [72]. In [72], in addition to the results obtained, of interest is a mathematical representation of fixed switches between layers. Also note that Pease's network is often called a "butterfly" network, due to its resemblance to this insect. However, we're going to confine ourselves to only considering the recursive model, since its representation is the most illustrative for proving certain cryptographic properties of controlled permutation boxes.

Representing an Rk Box as a Two-Stage Clos Network

Theorem 3.2

A box of equiprobable bit diffusion Rk(V) that satisfies the k ≥ 2 condition for each i, 1≤ i ≤ k − 1, can be represented as a two-stage Clos network C<2k-i, 2i > /m(W), in which:

  • The first stage is comprised of 2i boxes of equiprobable bit diffusion Rk−i.

  • The second stage is comprised of 2k−i boxes of equiprobable bit diffusion Ri.

  • The arrangement of P2/1 boxes in the first and last active layers doesn't change.

  • The control vector W is a permutation of the control vector V, the permutation of individual bits only being possible within the same active layer.

Proof

To prove the theorem, we'll use the method of induction.

For k = 2, the statement is obvious, since the 1 ≤ i ≤ k − 1 condition is only satisfied by the i = 1 value, and the structure of a two-stage Clos network C<21, 21>/4 coincides with that of R2 in its construction (Fig. 3.7). Also, all the additional requirements posed on a two-stage Clos network C<21, 21>/4(W) - in particular, the arrangement of P2/1 boxes in the first and last active layers - doesn't change, and the W control vector coincides with the V control vector.

It is easy to check the theorem for k = 3.

Indeed, for i = 2, the structure of the C<21, 22>/12 box coincides with that of the R3 box (Fig. 3.12, a) in its construction, and for i = 1 the structure of the C<22, 21>/12 box coincides with that of the R−13 box (Fig. 3.12, b).

Let the control vector V of the R3 box have the form

Then the control vector W of the C<22, 21>/12 box has the form

In other words, to transform the R3 box to the C<22, 21>/12 form in the second active layer of the R3 box, it would suffice to swap two P2/1 boxes with control bits v6 and v7, but retain switching these boxes with the P2/1 boxes of the second and third active layers. The invariance of the arrangement of P2/1 boxes in the first and last active layers is confirmed by the coincidence of the first four, and respectively, the last four bits in the V and W vectors.

Let the theorem be true for every k and every i: 1 ≤ i ≤ k − 1.

We're going to prove it for k + 1 and every j: 1 ≤ j ≤ (k + 1)− 1.

Indeed, for k + 1 and j = k, the theorem is true, since Rk+1 = C<2, 2k>/2m+n in its construction (Fig. 3.13).

Click To expand
Figure 3.13: The structure of the Rk+1 box

We're going to prove the statement for j that satisfies the 1 ≤ j ≤ k − 1 condition.

In the Rk|1 box, according to the induction assumption, each of the two Rk boxes for every i(1 ≤ i ≤ k − 1) can be represented as a two-stage Clos network C<r, s>/m, where (r = 2k-i, s = 2i), while retaining the invariance of the arrangement of P2/1 boxes in the first and last active layers. In particular, such a representation takes place for every i = j.

For a given i, such a representation is shown in Fig. 3.14, in which the first stage consists of n P2/1 boxes, the second one consists of 2s Rk−i boxes, and the third consists of 2r Ri boxes.

Click To expand
Figure 3.14: The modifies structure of the Rk+1 box

Note that switching between the first and second stages remains unchanged, since the order of P2/1 boxes in the first active layer of each two-stage Clos network C<r, s>/m remains unchanged.

It just remains to demonstrate that the first two stages consist of s boxes of equiprobable bit diffusion Rk+1−i. To do this, we group together adjacent P2/1 boxes of the first stage into non-overlapping classes with r boxes in each. We'll obtain exactly s = 2i classes (2i = n/2k-i = 2k/2k-i).

Consider, for example, the first r P2/1 boxes, numbered from left to right. Each of them has switching with the first and s + 1th Rk−i boxes of equiprobable bit diffusion of the second stage (in Fig. 3.14, the boxes being discussed are the darkest ones). These r P2/1 boxes of the first stage and two Rk−i boxes of the second stage comprise an Rk+1−i box.

The number of such Rk+1−i boxes is equal to the number of classes, i.e., s = 2i.

Switching between the newly created Rk+1−i boxes and the Ri, ones according to the "each with each" principle is obvious.

Indeed, taking into account the total dimension of the Rk|1 box and the dimensions of the Rk+1−i and Ri, boxes, the lack of switching between any two boxes Rk+1−i and Ri would contradict the condition of equiprobable bit diffusion for Rk+1. After we regroup the second-stage Rk−1 boxes as shown is Fig. 3.15, the Rk+1 box takes the final form of a two-stage Clos network C<2k+1-i, 2i>/2m+n consisting of the Rk+1−i and Ri boxes.

Click To expand
Figure 3.15: A two-stage Clos network C<2k+1-i, 2i>/2m+n

To conclude, note that after the second-stage Rk−1 boxes have been regrouped, the arrangement of P1/2 boxes in each active layer of the second stage changed, but only within their active layer, and without affecting the arrangement of P2/1 boxes at the first stage.

The theorem is proved completely.

The Equivalence of the Rk and Rk−1 Models

We are going to consider this issue, since it is necessary to prove that, for the recursive model Rk not only is the Rk(V) ∘ R−1k(U) construction a box of the maximum order, but the R−1k(U) ∘ Rk(V) construction is as well.

The proof of this statement for the first construction, called a modernized Benes scheme, is given in Section 3.3.2.

The second construction is the result of iterated block ciphers based on Russian patent No. 2140714 [1]. It is relevant to this construction, since the R−1k(U) ∘ Rk(V) construction isn't formally a Benes scheme. However, a solution can be obtained if, for example, we prove the equivalence of the R−1k(U) and Rk(V) boxes. Of course, a one-to-one correspondence must exist between the U and V vectors. Indeed, one does exist, and the U Vector is simply the result of bit permutation of the V vector.

Theorem 3.3.

The box models Rk and Rk−1 are equivalent with respect to the bit order in the control vector - that is, ∀k ≥ 1, ∃π: U = π(V), π ∊ Sn and R−1k(U) = Rk(V).

Proof.

To prove the theorem, we'll use the method of induction. For k = 1, 2, and 3, the statement is quite evident. For example, the control vector U for the R−13(U) box (Fig. 3.12, b) has the following form, taking into account bit numbering in the R−13(U) box:

If we consider the R−13(U) box as an R′8/12(U) box (Fig. 3.11, b), the control vector W has the form:

i.e., it differs from the V vector only in the swapping of the sixth and seventh bits.

Assuming that Theorem 3.3 is true for every k, we'll prove the theorem for k + 1.

We'll use Theorem 3.2 for the Rk+1(V) box.

Taking into account Theorem 3.2, the Rk+1(v) box (Fig. 3.16, a) can be represented as a two-stage Clos network C<2k, 2>/2m n(W) (Fig. 3.16, b) consisting of boxes Rk and R1 = P2/1, the arrangement of the P2/1 boxes in the first and the last active layers being constant. The control vector W of the C<2k, 2>/2m n(W) box is a permutation of bits of the V vector, such transposition only being possible within the same active layer. In particular, in the W control vector, the values of the bits related to the first and the last active layers coincide with the corresponding bits of the V control vector.

Click To expand
Figure 3.16: The structure of the Rk+1 (a) and C<2k, 2>/2m+n(W) (b) boxes

However, according to the induction assumption, each of the two Rk boxes can be replaced with an R−1k box with the corresponding bit permutation in the control vectors of the Rk boxes. A C<2k, 2>/2m n(W) box built in such a way is obviously an Rk+1−1 box, and this proves the theorem.

Corollary 3.1

When representing an Rk box as a two-stage Clos network C<2k-i, 2i>/2m+n(W) consisting of Rk−i and Ri boxes (1 ≤ i ≤ k − 1), any of the Rk−i (Ri, respectively) boxes can be replaced with the Rk−i box (Ri−1, respectively).

Taking into account Corollary 3.1, for example, a two-stage Clos network C<8, 8>/192 can be used as a controlled permutation box P64/192. Moreover, if R3 boxes are used at the first stage, and R3−1 boxes are used at the second, such a structure provides symmetry relative to input/output. That is, the structure of a P64/192 controlled permutation box coincides with that of the P−164/192 box. A P64/192 box with the suggested structure is used in the SPECTR-128 block cipher described in Chapter 5.

3.3.2. Implementation Schemes for Maximum-Order Boxes

The Universal Scheme

The underlying idea behind this scheme (Fig. 3.17) is to represent a permutation as a product of transpositions. The scheme is implementable for any n.

Click To expand
Figure 3.17: The universal implementation scheme for a maximum-order box

An αj (1 ≤ j ≤ n − 1) box consists of j P2/1 boxes in which, only for this scheme, "cross-switching" is done for the zero value of the control bit, and for a binary deciphering device Dk, where k is the nearest integer greater than or equal to log2(j + 1) (see, for example, Section 3.2.1). A k-bit control vector V(j), where V = V(n−1) ‖ V(n−2) ‖ … ‖ V(2) ‖ V(1) ‖, is supplied at the input of a Dk deciphering device, and a U(j) binary vector with a length of 2k and a Hamming weight equal to 1 is generated at the output - i.e., a value of 1 is only generated in one bit, or more exactly,

An α j box implements an identical transformation if the value of the control bit us(j) = 0 for each P2/1 box, and it also implements a transposition involving the (n − j)th input bit of the X vector. For example, an αn−1 box implements an identical transformation if U(n−1) = E0 = (0, 0, …, 0), and a transposition involving the first and sth bits if us(j) = 1.

In other words, an αn−1 box implements switching the xs bit, which is the sth bit of the X input vector specified by the V(n−1) vector, with the y1 bit, which is the first output bit. x1, which is the first bit of the X input vector, is switched with the sth input bit of the αn−2 box. In turn, the αn−2 box implements the switching of the tth bit xt of the input vector of the αn−2 box, specified by the αn−2 vector with the second output bit y2. The second bit x2 of the input vector of the αn−2 box is switched with the tth input bit of the αn−3 box, etc.

The last box, α1, implements switching xn−1 to yn (correspondingly, xn if V(1) = νm = 1, and switching α n−2 (and accordingly, xn to yn) if V(1) = νm = 0.

The main advantage of the universal scheme is its implementability for every n, but the scheme is asymmetric and asynchronous. It is only of theoretical interest, but it is impractical in actual data protecting applications, due to its speed and hardware complexity parameters. The implementation complexity of the scheme is

and its delay time is t(P(n)n/m) = (2n − 3)τ.

An additional implementation complexity is the result of having two binary deciphering devices, which complicates the implementation of an equiprobable modification selection. To provide for the uniqueness of each modification, it is necessary to provide exactly j + 1 values of the V(j) vector in the V = V(n−1) ‖ … ‖ V(2) ‖ V(1) control vector for every 1 ≤ j ≤ n − 1.

Benes Scheme

The Benes scheme [3] is intended for the synthesis of maximum order boxes for n = 2k that have a special structure. We'll introduce a special designation, Bk, for them. Starting with an elementary box of the maximum order B1 = P22/1 = P2/1, the transition from a Bk box to a Bk+1 box is implemented as shown in Fig. 3.18, a.

Click To expand
Figure 3.18: The recursive Benes scheme Bk+1 (a) and the scheme of the symmetric initial box P2/2(2) (b)

The Benes scheme is a special case of a three-stage Clos network with the (2, n, 2) parameters.

In a Bk box, the number of active layers l is equal to 2log2n−1 = 2k − 1, and the length of the control vector m is equal to [image] .

Obviously, the structure of the Bk−1 and Bk boxes is the same. That is, B−1k(V) = Bk(U), where V = V1 ‖ V2 ‖ … ‖ V2k-1 and U = V2k-1 ‖ V2k-2 ‖ … ‖ V1. The boxes of maximum order are B1 = P(2)2/1, B2 = P(4)4/6, B3 = P(8)8/20, B4 = P(16)16/56, B5 = P(32)32/144, etc.

Using this scheme in cryptographic applications is limited by the speed parameters: t(Bk) = τ(2k − 1) and also by the necessity of generating an m-bit control vector, for which the independence and equal probability of its the 2m values is an important requirement.

Fig. 3.18, b shows the scheme of a symmetric initial box P(2)2/2 that allows you to build the modernized Benes scheme discussed below, which is of the most interest from the cryptographic application point of view.

A Modernized Version of the Benes Scheme

Theorem 3.4

If the middle layer of P2/1 boxes is replaced with P(2)2/2 boxes (Fig. 3.18, b) in the scheme of the P(2m)2n/2m+n = Bk+1 box (Fig. 3.18, a), then a P2n/m′ box will conform to the following requirements:

  • It is a box of the maximum order.

  • It can be represented as a superposition of recursively built, mutually inverse first-order boxes of equiprobable bit diffusion Rk+1(V) ∘ R−1k+1(U).

  • It is a box of equiprobable bit diffusion.

The theorem is obvious, since the P(2)2/2 box (Fig. 3.18, b) is equivalent to the P2/1 box with the one-bit control vector V′ = ν1 ⊕ ν2, or more exactly:

A P(2n)2n/m′ box consists of 2(log2n + 1) = 2(k + 1) L2n layers, and m′ = 2n(log2n + 1) = 2k+1(k + 1).

Indeed, the first k + 1 L2n layers of the P(2n)2n/m′ box implement the recursive model of the Rk+1(V) box of equiprobable bit diffusion (Fig. 3.11, a), and the other k + 1 layers implement the recursive model of the R−1k+1(U) box of equiprobable bit diffusion (Fig. 3.11, b).

For this construction, the boxes of the maximum order are P(4)4/8, P(8)8/24, P(16)16/64, P(32)32/160, etc. As in the basic Benes scheme, the structure of the (P(n)n/m)−1 box is the same as the structure of the P(n)n/m box - i.e., (P(n)n/m(V))−1 = P(n)n/m(U), where V = V1 ‖ V2 ‖ … ‖ V2k−1 and U = V2k−1 ‖ V2k−2 ‖ … ‖ V1.

Practical use of the modernized Benes scheme, or more exactly, the superposition of the (P(n)n/m(V))−1 and P(n)n/m(U) boxes, is discussed in Chapter 5.

Waksman Scheme

Based on the Benes scheme, A. Waksman proposed an implementation scheme for maximum-order boxes with a control vector of minimum length (Fig. 3.19) in [97]. Like in the Benes scheme, a method of recursively building P(2n)2n/m′ boxes is utilized, in which, starting with n = 4, the last layer L2n of each P(2n)2n/m′ box there is one P2/1 box missing.

Click To expand
Figure 3.19: The recursive Waksman scheme

For example, for n = 8, the fourth active layer is missing two P2/1 boxes, since the second, third, and fourth layers are two parallel P(4)4/5 boxes, and the fifth active layer is missing one box.

Given an n value (n) = 2k), a P(n)n/m box consists of 2log2n − 1 layers, and m = nlog2n−n + 1. Accordingly, for a P(2n)2n/m′ box, m′ = 2nlog2n + 1. The boxes of the maximum order are P(2)2/1, P(4)4/5, P(8)8/17, P(16)16/49, P(32)32/129 etc.

In general, the Waksman scheme is a generalization of a three-stage Clos network with the (r, s, r) parameters, in which one box of r × r size is missing at the third stage, and each box of the minor size is also a Waksman scheme.

The Waksman scheme is impractical for cryptographic applications due to its asymmetry.

Turning back to the scheme shown in Fig. 3.18, a, note that the properties of a P2n/m′ box are determined by the properties of the Pn/m box.

  • If the Pn/m box is an equiprobable bit diffusion box, the P2n/m′ box is also an equiprobable bit diffusion box.

  • If the Pn/m box is an hth order box [image] , the P2n/m′ box is at least a 2hth order box.

  • The P2n/m′ box is a three-stage Clos network with the (2, n, 2) parameters.

Using the recursive method to build P2n/m′ boxes of at least the 2hth order P2n/m′ based on two P(h)n/m boxes is discussed in Section 3.3.3.

3.3.3. A Recursive Implementation Scheme for h-Order Boxes

Let's consider the recursive Benes sheme (Fig. 3.18, a), in which P(h)n/m boxes of the hth order (1 ≤ h ≤ n) are used, rather than the maximum-order P(n)n/m boxes. In Fig. 3.20, the P(2h)2n/2m+2n and P(4h)4n/4m+8n boxes are shown, which are based on P(h)n/m boxes. Switching between the layers is also shown. Thus, for example, two sloped lines at the upper edge of an active layer L2n show switching between the "left" and "right" input bits of P2/1 boxes in this active layer, and the lines at the lower edge show switching between the output bits of P2/1 boxes in the L2n active layer.

Click To expand
Figure 3.20: The structure of the P(2h)2n/2m+2n (a) and P(4h)4n/4m+8n (b) boxes

Let h = 1. Obviously, in the scheme shown in Fig. 3.20, a, the first layer L2n and two P(n)n/m boxes comprise a recursive model of the first-order R2n/2m+n box. But then, for every input bit of the P(2h)2n/2m+2n box and every output bit, there are at least two variants of switching. Indeed, each P2/1 box of the first layer L2n has just one switching with the "left" and "right" P(h)n/m boxes. Similarly, each P2/1 box of the last L2n layer also has just one switching with the "left" and "right" P(h)n/m boxes. Since P(h)n/m boxes are boxes of the first order, there is at least one switching between each input and each output bit of the P(h)n/m boxes. Therefore, swithching between any input and any output bit of the P(2h)2n/2m+2n box is possible both through the "left" and through the "right" P(h)n/m box.

It is easy to verify that the P(2h)2n/2m+2n box is actually a second order box if we consider four variants of the mutual arrangement of two input and output bits and determine whether the input (and accordingly, output) bits belong to one P2/1 box. If, for example, the input bits belong to the same P2/1 box of the first layer L2n, then, by choosing "left" switching for one of the input bits, we automatically obtain "right" switching for the other input bit, since the P2/1 box is controlled with one bit. If the input bits belong to different P2/1 boxes of the first layer L2n, and we choose "left" switching for one of the input bits, "right" switching for the other input bit is set, regardless of the value of the first input bit.

In a similar fashion, we will consider two variants for output bits.

The proof for h ≥ 2 using the method of induction doesn't drastically differ from the case of h = 2, but the induction statement has to be exact.

Fig. 3.21 demonstrates some examples of boxes of various orders for n = 32.

Click To expand
Figure 3.21: The structure of the P(2)32/96 (a), P(4)32/112 (b), and P(8)32/128 (c) boxes
Note

Note that in the recursive model of the P(2h)2n/2m+2n box (Fig. 3.20, a), switching, say, the "left" output bits of the P2/1 boxes of the first active layer L2n with the left box Pn/m, strictly follows the numbering of the P2/1 boxes of the first active layer. However, observing this numbering isn't mandatory, so it is possible to generate various modifications of the P(2h)2n/2m+2n box model, and to simply consider this model as the basic one.

There are also other variants of designing boxes of a specified order.

Since the implementation complexity of the Pn/m box significantly depends on the value of the h parameter, we recommend that you use controlled Pn/m boxes with the minimum value of the h parameter that can satisfy the requirements of the problem being solved.

A possible variant of the structure implementing the P(4)n/m box of the fourth order is presented in Fig. 3.22. Such a box conform to the following requirements:

  • The condition of the equiprobable bit shift is met.

  • The operating time of permutation done by the P(4)n/m box doesn't depend on the n length and is constant.

  • The implemented modifications for each value of the control vector should be unique.

  • The m: n parameter ratio isn't greater than 2 - i.e., the m length of the control vector is at most twice that of the data block transformed.

Click To expand
Figure 3.22: A control permutation box P(4)n/m

In Fig. 3.22, the n, m, and s parameters have the following values:

and the Xij notations correspond to fixed switching elements and are used to provide for the uniqueness of all modifications. If for the T4s/k−1, T2s/k−21, and Ts/k−2 rotation boxes (see the α, β, and δ layers in Fig. 3.22) the control vactors are set beforehand, then the time delay of the P(4)n/m does not depend on n.

We should also mention that, when it is impossible to generate the control vector beforehand, the (P(4)n/m)−1 box should be used in place of the P(4)n/m box. In this case, the έ-layer parmutation, in which decoders are not used, and an additional delay caused by the decoders won't exceed the k - 4 value, is performed first. The scheme is implementable in practice for k = 4 ÷ 8 (n = 2k), and for k ≥ 4 values there are variants providing for the uniqueness of implemented permutations for each value of the control vector.

3.3.4. Implementing Full-Cycle Permutations

Some cryptographic applications pose the problem of designing controlled boxes of full-cycle permutations with an increased performance. It seems likely that the following variant of building full-cycle permutations with a length of n from a special fixed permutation and permutations that consist of g cycles with the h length where n = gh is an appropriate solution.

Let π1 be an arbitrary permutation. It can then be presented as a product of cycles:

Click To expand

where 1 ≤ g ≤ n, 1 ≤ hj ≤ n, h1 + h2 + … + hg = n, and all zij are different, except for zi1 = zihi when hi = 1.

Lemma 3.1

A product of permutations π = π1 ∘ π2, where π2 = (z11, z21, …, zg1), is a full-cycle permutation.

The proof is obtained by simple multiplication, the π permutation having the form:

Click To expand
Theorem 3.5

The superposition of the π1 and π2 permutations is a full-cycle permutation if the π2 permutation only consists of one cycle with a length greater than 1, and this cycle contains exactly one element of each cycle of the π1 permutation (including cycles with a length of 1). The order of elements in the π2 permutation doesn't change the full-cycle structure of the π permutation.

Proof

The statement of the theorem is obvious, taking into account that, in the π1 permutation, first of all, the cycles can be written down starting from any element (say, from the representative of this cycle in the π2 permutation), and, second, the cycles can be interchanged (e.g., they can be written down in the order of their representatives in π2). With such a representation of the π1 permutation, the conditions of the lemma are met, and the theorem is proved.

But then, according to this theorem, to design controlled boxes of full-cycle permutations with a length of n, it would suffice to use, for example, matrix boxes of full-cycle permutations with a lesser length (say, h) and simple wires that implement a fixed permutation. Using full-cycle permutations makes it possible to speed up the controlled operation. This is of primary importance, for example, in controlled adders, in which boxes of full-cycle permutations are used both to control carry bits and as a function complicating the output value of the adder.

3.3.5. Synthesis of Boxes with a Specified Cyclic Structure

The issue of synthesis of controlled permutation boxes that implement permutations with a specified cycle structure is also of interest. In [63], a method of building pseudo-random substitutions with a specified cyclic structure was suggested. This method is based on a well-known theorem in group theory, which asserts that, for arbitrary substitutions σ and δ, the substitutions δ and σ ∘ δ ∘ σ−1 have the same cycle structure. Besides which, the σ substitution is generated by the Sn/m box of controlled substitutions (Fig. 3.23, a).

Click To expand
Figure 3.23: Controlled boxes S′n/m and In/m with a specified cyclic structure

In [63], actual variants of implementation of the Sn/m boxes aren't considered, which makes it impossible to estimate the properties and effectiveness of such constructions.

Remember, in modern block ciphers using boxes of controlled permutations, the dimension of a block usually isn't greater than 8.

This is why, to increase the total dimension of the data block that can be processed at once, it is common to use several parallel Sn′/m′ boxes. In other words, S′n/m = Sn′/m′ ‖ Sn′/m′ ‖ … ‖ Sn′/m′ (n = n′ + n′ + … + n′, m = m′ + m′ + … + m′), where n′ ≤ 8. In particular, DES uses 8 different Sn′/m′ = S4/2 boxes, which comprise a box of controlled permutations, S32/16(n = 32, m = 16). The problem of building a general fixed δ substitution for n = 32 still remains to be solved, since for such a substitution δ ∊ S232. However, this construction can be of practical use if, say, a Pπ substitution with bit switching is used as a δ substitution.

In addition, if a Pn/m box of controlled permutations is used instead of the Sn/m box of controlled substitutions, we'll obtain a box of controlled permutations P′n/m = Pn/m ∘ Pπ ∘ P−1n/m with a specified cyclic structure.

This structure is general in nature, and the number of possibly implementable modifications is determined by the properties of the Pn/m box. In particular, the number of modifications of the P′n/m box can be less than 2m, even when all the 2m modifications of the Pn/m box are unique. This method of synthesis of special classes of controlled permutations with a given cyclic structure is universal.

In particular, it easily allows a designer to create controlled permutation boxes that implement only full-cycle permutations, and the scheme obtained will be more cost-effective and faster than the universal design scheme of controlled full-cycle permutation boxes.

Involutions

Definition 3.20

An involution is a transformation I for which (I)2 is an identical transformation.

This transformation is of interest when designing ciphers, due to the convenience of using it in encryption and decryption, because I = I−1.

In particular, a π permutation is an involution if its representation as a product of non-overlapping cycles doesn't contain cycles whose length is greater than 2.

Definition 3.21

A transformation I = Pπ is called a permutational involution if the π permutation is an involution.

If, in the scheme shown in Fig. 3.23, b, the π permutation is an involution, then I = Pπ is a permutational involution, and the controlled permutation box In/m = Pn/m ∘ I ∘ P−1n/m implements a class of permutational involutions. A significant design disadvantage of the method of creating controlled involutions that was proposed in [63] is a delay time twice as large as the delay time of the Pn/m box.

To overcome this disadvantage, you can use the scheme of synthesis of the controlled involution box I2n/m with the 2n-bit input and the m-bit control vector (Fig. 3.24). In a sense, this scheme is also universal, since an arbitrary Pn/m box can be used. The Pn/m(V) and P−1n/m(V) boxes operate in parallel rather than in sequence, which provides a higher performance than that of the scheme shown in Fig. 3.23, b. The transformation of a binary vector X = L ‖ R with a length of 2n for the scheme shown in Fig. 3.24 is performed in the following fashion: the n-bit vectors L and R are supplied at the inputs of the Pn/m and P−1n/m boxes, respectively, and then the transformed values are swapped.

Click To expand
Figure 3.24: A high-speed box of controlled involutions I2n/m

The transformation formula is as follows:

Click To expand

since Y = L′ ‖ R′ = I2n/m(V)(X) = I2n/m(V)(L‖R) = P−1n/m(V)(R)‖Pn/m(V)(L).

Obviously, I2n/m is truly an involution, since

Thus, the scheme in Fig. 3.24 implements a box of controlled permutational involutions I2n/m box. The cardinal number of the set of implementable involutions is equal to the cardinal number of the set of various permutations implementable by the Pn/m box. In particular, if all the modification of the Pn/m box are unique, then exactly all the unique 2m involutions are implemented.

We should say that this scheme (Fig. 3.24) implements just a minor part of the actual involutions: no more than n! involutions out of a possible 2n!! = (2n − 1)(2n − 3) × … × 3 × 1 involutions without single cycles.

To conclude, we'd like to note that in the scheme shown in Fig. 3.24, it is possible to use different V and U control vectors for the Pn/m and P−1n/m boxes, or more exactly, you can use Pn/m(V) and P−1n/m(V). In this case, we use the P2n/2m(G(V‖U)) box of controlled permutations for which the G(V ̎ U) function determines the order of the bits of the V and U vectors in the combined control vector, taking into account the adopted conventions.

The transformation formula for the P2n/2m(G(V‖U)) box of controlled permutations is the following:

We're going to demonstrate the universality of this scheme for the inverse transformation. The inverse transformation can be expressed by the following formula:

That is, to perform the inverse transformation, just swap the V and U vectors. Indeed,


3.4. Linear Cryptanalysis of Controlled Permutations

The method of linear cryptanalysis of block ciphers was suggested in 1993 by M. Matsui [50] to break the key of the DES algorithm. Even though this method mainly uses a linear correlation between the values of the input and output vectors, i.e., a special case of correlation between two functions, it has an individual name, first of all, because of its clear formalization, and second, because of the practical result achieved when analyzing DES. Thus, using the linear cryptanalysis method, it will be enough to analyze about 243 pairs of original and transformed blocks of binary data, and this is the lower estimate for the DES algorithm. The method was further developed in later works [24, 34, 51, 65], of which the most notable is the article written by K. Nyberg in 1994 [65]. In particular, in [65], a fundamental theorem of linear approximation of block ciphers was proven, and, for DES-like ciphers, how to use non-linear functions in order to achieve the provable resistance of a cipher against the linear cryptanalysis method was demonstrated. It should be noted that most papers devoted to linear cryptanalysis deal with a case of independent round keys. However, this condition is not met in all ciphers - far from it. A case of dependent keys or dependent input data is a much more complicated problem, and investigations in this area aren't yet complete.

The linear cryptanalysis of boxes of controlled permutations as cryptographic primitives will be considered here, using the basic method, since this will allow us to understand its internal mechanisms both when constructing special features and when coordinating or computing them.

3.4.1. Basics of Linear Cryptanalysis

Linear cryptanalysis [50] investigates statistically stable linear dependencies between some fixed subsets of key bits, as well as input and transformed blocks of binary data, to predict the values of some key bits on the basis of available input and corresponding transformed blocks of binary data. In fact, it is a combined method, which combines the search for statistical linear dependencies, the analysis of available input and transformed data blocks, and the coordinating and trying methods.

Let's say that X ∊ GF(2)n. It is then possible to set up a correspondence between each subset M = [i1, i2, …, is] of the bit numbers of the input binary vector X (0 ≤ s ≤ n) and the binary vector a = (a1, a2, …, an), in which aj = 1 if j ∊ M, and aj = 0 otherwise. When necessary, the M set can be written with a subscript as Ma, or designated as [a] = [i1, i2, …is].

In the base method of linear cryptanalysis, as applied to a vector Boolean function Y = F(X,K), where X, Y ∊ GF(2)n and V ∊ GF(2)m, linear relationships between the subsets of values of specified bits of input and output vectors are investigated for the presence of statistically stable linear dependencies having the form of:

where ∊ ∊ GF(2) is a constant, and a, b (b ≠ e0), and c are fixed vectors called masks. The a mask always corresponds to the input (original) vector X, b to the output (transformed) value Y of the F(X,K) function, and c to the K key.

Since equation (3.27) does not hold true for all values of X and K, the linear dependency is said to have a probabilistic nature. If, additionally, the requirement of independent random and equiprobable selection of the X and K values is met, and the probability

then it is said that there is a statistically stable linear dependency.

If [image] , Equation (3.27) is satisfied. If [image] , Equation (3.27) is said to hold true for ∊′ = 1 − ∊.

Since the [image] value is decisive, it is assumed that ∊ = 0 in Equation (3.27), and the value

Click To expand

is called a bias. The concatenation (a, b, c) = a ‖ b ‖ c ∊ GF(2)2n+m is called a united mask. It is evident that [image] .

When the requirement of equal probability of key usage isn't satisfied, it is necessary to use the full probability formula:

Click To expand

where

Click To expand

is a bias for the united mask (a, b, c) and the fixed key k, and PrK{K = k} is the probability of using the k key.

Even though in most works it is assumed that the keys are used with equal probabilities, this isn't always the case in practice. Moreover, the key set isn't used in its entirety. For example, we can look at a V vector rather than a K key, which depends on the K key and a portion of input data. Formula (3.30) takes such peculiarities into account.

When examining individual functions, biases are often written with superscripts, say, p(F) or p(Fk).

In practice, the linear cryptanalysis problem of finding certain bits of the key is solved by generalization, or more precisely:

  • Finding and analyzing statistically stable dependencies for any individual operation. Here, biases and their corresponding masks of input and output vectors are what we'll call linear characteristics.

  • Coordinating linear characteristics for the whole sequence of transformations within one round and building a one-round characteristic based on them.

  • Building the resulting characteristic by coordinating the round characteristics, which makes it possible to obtain a probabilistic estimation of the evenness of some key bits on the basis of the available input and corresponding output vectors.

A one-round characteristic [7] is a (a, b, c, 1/2 + p) quartet, where a, b, and c are the masks of the input and output vectors and of the key, and p is a bias corresponding to Equation (3.29). Characteristics for which the absolute value of the bias is 1/2 are called best. According to the theory, for the coordination of the two characteristics (a(1), b(1), c(1), 1/2 + p1) and (a(2), b(2), c(2), 1/2 + p2) with independent keys, it is necessary and sufficient that the a(2) = b(1) equation be true. In this case, the resulting characteristic will take the form (a(1), b(2), c(1) ⊕ c(2), 1/2 + p′). For a DES with independent keys, it will be p′ = 2p1p2.

This is why, when designing a round function, you need to strive towards having the maximum absolute value of the bias of such a function be less than a specified value, 0 < δ < 1/2. For dependent keys, computing the bias is quite a complicated problem.

Analyzing an individual operation implies building a table of linear dependencies between some subsets of input and output bits, and then using it to build a table of linear characteristics. The structure of the linear characteristics and their coordination rules are generally similar to those of round characteristics.

Let's consider more closely how the table of linear characteristics is built for an individual operation. Let F: GF(2)r → GF(2)n be a vector Boolean function on the set of binary vectors X with the r (r ≥ n) length. The table of linear dependencies for the F function consists of 2r rows and 2n columns, its elements being the p biases of the linear characteristic (a, b, 1/2 + p), and the coordinates being the values of the a and b vectors. Actually, the values for the linear dependency table are computed according to the formula

Finding an analytical dependency between the mask configuration and the bias value for large values of r and n is a complicated problem that doesn't always have a general solution. However, with smaller values of r and n, this problem can be solved using computers. The second problem is the illustrative representation and analysis of the linear dependency table for long input and output vectors, including for a case of several inputs. This is why we suggest that you represent data as a table, each row of which contains the parameters of a particular linear characteristic, the table itself being organized in descending order of the absolute values of the bias, and containing only linear characteristics with a non-zero bias. It is convenient to represent the mask values as hexadecimal values with low-order bits specified. In practice, it makes sense to use the p′ = |2p| parameter in linear characteristic tables in addition to the p value. An example of a linear characteristic table is Table 3.2.

Let's consider some general properties of linear characteristics related to the form of input and output data.

Composition and Decomposition of Input and Output Vectors

Let's represent an X vector and its corresponding mask a as a concatenation of shorter vectors: X = X(1) ‖ X(2) ‖ … ‖ X(s) and a = a(1) ‖ a(2) ‖ … ‖ a(s).

Then the F function can be regarded as an F′ function of s variables F(X(1), X(2), …, X(s)) with the (a(1), a(2), …, a(s), b, 1/2 + p) characteristic. Equation (3.32) will take the form:

Click To expand

Hence, if the F function depends on two variables X and K, then, assuming that s = 2 and X(2) = K, the mask of the K key in linear characteristic is a(2) = c. Such a representation is equally valid both for a fixed key k and for a key selected from a {K} set of keys. The linear characteristic will have the following form: (a, c, b, 1/2 + p). In particular, characteristics with the zero key mask (c = e0) can be considered.

The inverse transition from s independent variables to one variable is also possible. That is, if F′ is a function of s independent variables F′(X(1), X(2), …, X(s)) for which a linear characteristic (a(1), a(2), …, a(s), b, 1/2 + p) is built, then, considering the concatenation of vectors X(1), X(2), …, X(s) as a new variable X - X = X(1) ‖ X(2) ‖ … ‖ X(s) - it is possible to represent the F′ function as a function of one variable with a greater dimension, the dimension of this new variable X being equal to the sum of the dimensions of all the Xi variables, and rather than consider masks a(1), a2, …, a(s), it is necessary to look at their concatenation a = a(1) ‖ a2 ‖ … ‖ a(s).

The requirement of the independence of the variables is significant in this case. In a similar fashion, linear characteristics are considered in which the representation of a single variable as a concatenation of several ones is considered for the output vector Y.

Coordination of Linear Characteristics

The coordination of linear characteristics for two transformations performed sequentially one after the other will be illustrated with an example in which the X ⊕ K operation is taken as the first transformation F1(X, K), and for the second one a F2(X) transformation with the best linear characteristic (a′, b′, 1/2 + p′) is used. In the terms introduced earlier, the linear characteristic for the F1 transformation has the form (a, c, b, + p⊕). As you know, p⊕ = 1/2 if and only if a = c = b, and p⊕ = 0 in the other cases. That is, for the ⊕ operation, all linear characteristics with the same masks are best. Therefore, taking into account the coordination rule, the best total linear characteristic (a″, c″, b″, 1/2 + p″ will take the form (a″ = a, c″ = a, b″ = b′, 1/2 + p′j), since a′ = b = a and p″ = 2p⊕p′ = p′.

We will now demonstrate how to compute the total linear characteristic for two sequential transformations that depend on the same key. Let (a(1), c(1), bj, 1/2 + pj) and (a(2) = bj, c(2), b(2), 1/2 + p′j) be a pair of linear characteristics corresponding to the bj mask.

In the case of independent keys, the total linear characteristic has the form (a(1), c(1) ⊕ c(2), b(2), 1/2 + p′), where p′ = 2Σbj pjp′j.

If the c(1) and c(2) masks belong to the same variable K, then the total linear characteristic will have the form (a(1), c, b(2), 1/2 + p′), where p′ = 2Σbj, c(1)|c(1)⊕c(2) = c pjp′j.

The justification of such a representation is based on the fact that the mask bits that belong to the same variable and are taken into account in Equation (3.32) an even number of times, regardless of the particular values of the variable in these bits, don't affect computing the bias according to Formula (3.32). In this example of transformations, in which input parameters coincide completely or partially, we see demonstrated the principle of computing total linear characteristics. A different order of the masks, as compared to the round characteristics suggested in [7], isn't of basic importance, but it is only determined by the order of the presentation of the material.

In later works devoted to the examination of the security of individual functions against linear cryptanalysis, an analog of the p bias, such as |p| [65] or (2p)2 [51], is often considered, rather than the bias itself. It is appropriate to study the p′ = |2p| parameter, for which ∀pi: 0 ≤ p″ ≤ p′j ≤ 1 holds.

Some results of these papers, as well as the p′ parameter, will be discussed later. For now, we're just going to note that, as an estimation of the function's security against linear cryptanalysis, the maximum value of |p| is considered, relative to all the characteristics in which the output mask isn't equal to e0. Obviously, if |p0| is the maximum value for |p|, then the values p0′ and p0″ are also maximum, and correspond to the same characteristic as |p0| does.

3.3.2. Linear Characteristics of Controlled Permutation Boxes

Before we directly proceed with computing the biases for controlled P(X, V) permutation boxes, we're going to introduce some additional designations:

  • - for which the b = P(a, v) condition is true

  • - the probability of the V = V(a → b) event

  • - a set of vectors v, for which two conditions are true at the same time: b = P(a, v) and c * v = 0

  • - the probability of two conditions being true at the same time: b = P(a, v) and c * V = 0.

In general,

Click To expand

where

Similarly,

where

For a uniformly distributed random variable V ∊ V = GF(2)m, Formula (3.34) takes the form:

The following statements resulting from the general properties of permutations are quite obvious and given without proof.

Click To expand

Note that some of these statements were discussed in previous sections.

From now on, we'll say that X is a uniformly distributed random variable (X ∊ X = GF(2)n) if

Lemma 3.2

Let X be a uniformly distributed random variable independent of V, and WH(a) > 0. Then

Proof

Since WH(a) > 0, there is a bit j:aj = 1, j ∊ {1, 2, …, n}, for which the Boolean function a * X ⊕ c * V is linear by xj, because in the expression a * X, aj · xj = xj, and the c * V expression doesn't depend on X at all. But then a * X ⊕ c * V is a balanced Boolean function, and

which proves the statement.

Lemma 3.3

Let P(X, V) be a box of controlled permutations. Then for ∀X, b ∊ X and ∀V ∊ V, the following equation is true:

Proof

We'll demonstrate that Formula (3.48) is true for every fixed x and v value.

Let X = x, V = ν, and b′ : b′ = Pν−1(b) = P−1(b, ν). Then, by sequentially applying the substitution of b with P(b′, v), Formula (3.15), and Formula (3.13), we'll obtain

which proves the statement.

Corollary 3.2

Let F(X, V) be a box of controlled permutations. Then, for ∀a, b, X, ∊ X and ∀ν ∊ V, the following equation is true:

Lemma 3.4

Let X be a uniformly distributed random variable independent of V, and P(a, ν) ≠ b > 0. Then, for a vector Boolean function P(X, V), the bias pv(a, b, c) = 0.

Proof

Taking into account Formula (3.31) and Lemma 3.3,

Since P−1(b, ν) ≠ a, then P−1(b, ν) ⊕ a ≠ e0.

However, then WH(P−1(b, ν) ⊕ a) > 0, and, taking into account Lemma 3.2,

Therefore, [image] .

The lemma is proved.

Corollary 3.3

Let X be a uniformly distributed random variable independent of V, and WH(a) ≠ WH(b) > 0. Then, for a vector Boolean function P(X, V), the bias is p(a, b, c) = 0.

Proof

Taking into account Formula (3.30) and Lemma 3.4,

Corollary 3.4

Let X be a uniformly distributed random variable independent of V. If, for a vector Boolean function P(X, V), the bias is p(a, b, c) ≠ 0, then WH(a) = WH(b).

Lemma 3.5

Let X be a uniformly distributed random variable independent of v. If b = P(a, v), then

Proof

The b = P(a, v) requirement is equivalent to P−1(b, v) = a. This is why, taking into account formula (3.31) and Lemma 3.3,

Click To expand

The lemma is proved.

Theorem 3.6

On the biases of controlled permutations

Let X be a uniformly distributed random variable independent of V. Then

Proof

The second item is equal to zero, since, taking into account Lemma 3.4, pv(a, b, c) = 0 if P(a, v) ≠ b.

Hence

which proves the theorem.

Corollary 3.5

Indeed,

Corollary 3.6

For ∀a, b, the [image] equation is true.

The proof is evident, since

Corollary 3.7

Indeed,

Corollary 3.8

The property of completeness

Click To expand

Indeed,

and

Click To expand

Therefore,

The second formula can be proven in a similar fashion.

Similar results in a generalized form are presented in [51] for the (2p)2 parameter.

Corollary 3.9

If a = b = e0 or a = b d0, then 2p(a,b) = 1.

Corollary 3.10

Let WH(a) = 1. If, for ∀b: WH(b) = 1, the probability PrV{V(a → b)} = const, then

Indeed, since PrV{V(a → b)} = const, ∀b: WH(b) = 1, and there are exactly n such vectors, then [image] . But then [image] . A similar result was obtained, for example, in [38] for the rotation operation.

Important Conclusion

In a controlled permutation box, the absolute value of the linear characteristic bias with a non-zero key mask isn't greater than the value of the linear characteristic bias with a zero key mask, which is equal to half of the probability of the event that the input mask is transformed to the output mask.

Note that the corollaries from Theorem 3.6 use the double bias value. As mentioned earlier, this is the reason why, in linear characteristics, it makes sense to use the p′ = |2p| parameter in addition, which, for the zero key mask, is equal to the PrV{V(a → b)} probability - i.e., P′ = |p| = 2 p(a, b) = PrV{V(a → b)}.

The main practical result of Theorem 3.6 and its corollaries is in the following:

  • For boxes of controlled permutations, it is enough to just analyze linear characteristics with the zero key mask.

  • Computation of the p(a, b) bias is equivalent to computation of the PrV{V(a → b)} probability.

  • You only need to analyze the biases for WH(a) ≤ n/2.

  • You have to design boxes of controlled permutations for which the following condition is true: ∀a, b ∉ {e0, d0}, PrV{V(a → b)} ≤ 1/n.

Let's examine the last item more closely.

Let [image] be the function of the maximum value PrV{V(a → b)} for the given weight WH = t. Obviously, ξ(n − t) = ξ(t); this is why it will suffice to consider this function only for t = 1, 2, …, n/2. For WH(a) = 1, taking into account Corollary 3.8, ξ(t) ≥ 1/n, because the number of possible values of b vectors such that WH(b) = 1 isn't greater than n. Correspondingly, ξ(t) = 1/n in the case when the box is a box of equiprobable bit diffusion, i.e., a box in which ∀a, b ∊ GF(2)n: WH(a) = WH(b) = 1 and PrV{V(a → b)} = const. As the t value increases, the number of possible b vectors with a specified weight t is equal to [image] .

Therefore, there are objective conditions for building controlled permutation boxes for which the ξ(t) function of the t = 1, 2, …, n/2 values will be monotonously decreasing.

In particular, this requirement for t = 1, 2, …, h is satisfied by h-order boxes, discussed in Section 3.3.

3.4.3. Methods and Practical Recommendations for Computing the Linear Biases of Controlled Permutation Boxes

In this section we present two methods of computing the biases for controlled permutation boxes, and also give practical recommendations on dividing the sets of input and output masks into classes of equivalence and computing the biases only for the representatives of each class.

Rather than use the words "the mask of the a input" and "the mask of the b output", we'll say "the a vector" and "the b vector", or just a and b.

Fig. 3.25 shows a P4/4 box with the n = 4 and m = 4 parameters that implements 16 unique permutations, which we'll use as an explanatory example. The box consists of four P2/1 boxes, each of which implements an identical transformation at the zero value of the control signal.

Click To expand
Figure 3.25: The P4/4 box

Method 1. Let T be a table representation for P(X, V), in which each row corresponds to a particular value of the control vector V and contains:

  • The binary representation of the V = (v1, v2, …, vm) vector, its index /V/(/V/ ≥ 0), and the probability of using Pν = PrV{V = ν}

  • The particular kind of permutation being implemented, specified in the first n columns, the column number i (i = 1, 2, …, n) containing the number of the output bit j's row-i.e., Ej ‵ P(Ei, ν), ∀ Ei ∊ GF(2)n

Then, computing p′ = PrV{V(a → b)} is done as follows:

  • i numbers (1 ≤ i ≤ n) are chosen from the first n columns, such that ai = 1 in the vector a = (a1, a2, …, an).

  • Rows are chosen such that the chosen columns specified by the a vector contain all the numbers of the bits corresponding to the non-zero values bj of the b vector-i.e., for these rows θV(a,b) = 1.

  • The sum of the Pv probabilities is computed for the chosen rows, thus computing the PrV{V(a → b)} λV(a, b) probability.

Let T be a table representation for P4/4 (Table 3.1), and a a = (0,1,0,1), b = (1,0,1,0). Then, [a] = [2, 4] and [b] = [1, 3].

Table 3.1: Linear Dependencies for the P4/4 Box
1 | 2 | 3 | 4 | θV(a, b) = 1 | /V/ | v1 | v2 | v3 | v4 | Pv | p
1 | 3 | 2 | 4 |  | 0 | 0 | 0 | 0 | 0 | P0 |
1 | 4 | 2 | 3 |  | 1 | 0 | 0 | 0 | 1 | P1 |
2 | 3 | 1 | 4 |  | 2 | 0 | 0 | 1 | 0 | P2 |
2 | 4 | 1 | 3 |  | 3 | 0 | 0 | 1 | 1 | P3 |
1 | 3 | 4 | 2 |  | 4 | 0 | 1 | 0 | 0 | P4 |
1 | 4 | 3 | 2 |  | 5 | 0 | 1 | 0 | 1 | P5 |
2 | 3 | 4 | 1 | * | 6 | 0 | 1 | 1 | 0 | P6 | *
2 | 4 | 3 | 1 |  | 7 | 0 | 1 | 1 | 1 | P7 |
3 | 1 | 2 | 4 |  | 8 | 1 | 0 | 0 | 0 | P8 |
4 | 1 | 2 | 3 | * | 9 | 1 | 0 | 0 | 1 | P9 | *
3 | 2 | 1 | 4 |  | 10 | 1 | 0 | 1 | 0 | P10 |
4 | 2 | 1 | 3 |  | 11 | 1 | 0 | 1 | 1 | P11 |
3 | 1 | 4 | 2 |  | 12 | 1 | 1 | 0 | 0 | P12 |
4 | 1 | 3 | 2 |  | 13 | 1 | 1 | 0 | 1 | P13 |
3 | 2 | 4 | 1 |  | 14 | 1 | 1 | 1 | 0 | P14 |
4 | 2 | 3 | 1 |  | 15 | 1 | 1 | 1 | 1 | P15 |

From Table 3.1, we can see that the numbers 1 and 3 are only present in the second and fourth columns for V = (0,1,1,0) and V = (1,0,0,1). Therefore,

According to Theorem 3.6, to compute the bias with a non-zero mask of the control vector V = v, it is necessary to compute the λV(a, b, c) value. To do this, you must select from the rows chosen when computing λV(a, b) only those rows for which, according to the mask c, the evenness of the sum of the selected bits of the v vector is equal to 1 (i.e., c * ν ⊕ 1 = 0), and then compute the sum of the Pv probabilities for these rows only.

The sum obtained is the λV(a, b, c) value.

Taking into account Formula (3.51) of Theorem 3.6 for bias calculation:

the absolute value of the double bias takes the form:

Let c = (c1, c2, c3, c4,) = (1,1,1,0) in our example.

Then it will suffice to check the c*ν ⊕ 1 = 0 condition for the V6 and V9 vectors-i.e., to check the oddness of the sum of the first, second, and third bits.

Since c*ν ⊕ 1 = 0 only for V9, then λV(a, b, c) = P9, and

Click To expand

Thus, given a table T, computing any characteristic is done in a single pass through a table containing 2m rows.

However, it is difficult or even impossible to build such a table for large m values, so, as we mentioned earlier, it is enough to use a table of linear characteristics that contains only linear characteristics with a non-zero bias that is arranged in descending order of the values of the p′ parameter.

Table 3.2 contains a fragment of an ordered table of linear characteristics for P4/4, using which it is possible to verify the truth of Theorem 3.6 and its corollaries.

Table 3.2: A Fragment of a Table of Linear Characteristics for a P4/4 Box
A | B | C | P | 2p | A | B | C | P | 2p | A | B | C | P | 2p | A | B | C | P | 2p
0 | 0 | 0 | 0.500 | 1.000 | 9 | 3 | 0 | 0.125 | 0.250 | 9 | 9 | 0 | 0.062 | 0.125 | 1 | 4 | 2 | −0.125 | 0.250
15 | 15 | 0 | 0.500 | 1.000 | 9 | 12 | 0 | 0.125 | 0.250 | 9 | 10 | 0 | 0.062 | 0.125 | 1 | 8 | 2 | 0.125 | 0.250
1 | 1 | 0 | 0.125 | 0.250 | 10 | 3 | 0 | 0.125 | 0.250 | 10 | 5 | 0 | 0.062 | 0.125 | 2 | 4 | 2 | −0.125 | 0.250
1 | 2 | 0 | 0.125 | 0.250 | 10 | 12 | 0 | 0.125 | 0.250 | 10 | 6 | 0 | 0.062 | 0.125 | 2 | 8 | 2 | 0.125 | 0.250
1 | 4 | 0 | 0.125 | 0.250 | 11 | 7 | 0 | 0.125 | 0.250 | 10 | 9 | 0 | 0.062 | 0.125 | 3 | 5 | 2 | −0.125 | 0.250
1 | 8 | 0 | 0.125 | 0.250 | 11 | 11 | 0 | 0.125 | 0.250 | 10 | 10 | 0 | 0.062 | 0.125 | 3 | 6 | 2 | −0.125 | 0.250
2 | 1 | 0 | 0.125 | 0.250 | 11 | 13 | 0 | 0.125 | 0.250 | 1 | 1 | 1 | −0.125 | 0.250 | 3 | 9 | 2 | 0.125 | 0.250
2 | 2 | 0 | 0.125 | 0.250 | 11 | 14 | 0 | 0.125 | 0.250 | 1 | 2 | 1 | 0.125 | 0.250 | 3 | 10 | 2 | 0.125 | 0.250
2 | 4 | 0 | 0.125 | 0.250 | 12 | 5 | 0 | 0.125 | 0.250 | 2 | 1 | 1 | −0.125 | 0.250 | 4 | 4 | 2 | 0.125 | 0.250
2 | 8 | 0 | 0.125 | 0.250 | 12 | 6 | 0 | 0.125 | 0.250 | 2 | 2 | 1 | 0.125 | 0.250 | 4 | 8 | 2 | −0.125 | 0.250
3 | 5 | 0 | 0.125 | 0.250 | 12 | 9 | 0 | 0.125 | 0.250 | 3 | 5 | 1 | −0.125 | 0.250 | 7 | 7 | 2 | −0.125 | 0.250
3 | 6 | 0 | 0.125 | 0.250 | 12 | 10 | 0 | 0.125 | 0.250 | 3 | 6 | 1 | 0.125 | 0.250 | 7 | 11 | 2 | 0.125 | 0.250
3 | 9 | 0 | 0.125 | 0.250 | 13 | 7 | 0 | 0.125 | 0.250 | 3 | 9 | 1 | −0.125 | 0.250 | 8 | 4 | 2 | 0.125 | 0.250
3 | 10 | 0 | 0.125 | 0.250 | 13 | 11 | 0 | 0.125 | 0.250 | 3 | 10 | 1 | 0.125 | 0.250 | 8 | 8 | 2 | −0.125 | 0.250
4 | 1 | 0 | 0.125 | 0.250 | 13 | 13 | 0 | 0.125 | 0.250 | 4 | 1 | 1 | 0.125 | 0.250 | 11 | 7 | 2 | −0.125 | 0.250
4 | 2 | 0 | 0.125 | 0.250 | 13 | 14 | 0 | 0.125 | 0.250 | 4 | 2 | 1 | −0.125 | 0.250 | 11 | 11 | 2 | 0.125 | 0.250
4 | 4 | 0 | 0.125 | 0.250 | 14 | 7 | 0 | 0.125 | 0.250 | 7 | 13 | 1 | −0.125 | 0.250 | 12 | 5 | 2 | 0.125 | 0.250
4 | 8 | 0 | 0.125 | 0.250 | 14 | 11 | 0 | 0.125 | 0.250 | 7 | 14 | 1 | 0.125 | 0.250 | 12 | 6 | 2 | 0.125 | 0.250
5 | 3 | 0 | 0.125 | 0.250 | 14 | 13 | 0 | 0.125 | 0.250 | 8 | 1 | 1 | 0.125 | 0.250 | 12 | 9 | 2 | −0.125 | 0.250
5 | 12 | 0 | 0.125 | 0.250 | 14 | 14 | 0 | 0.125 | 0.250 | 8 | 2 | 1 | −0.125 | 0.250 | 12 | 10 | 2 | −0.125 | 0.250
6 | 3 | 0 | 0.125 | 0.250 | 5 | 5 | 0 | 0.062 | 0.125 | 11 | 13 | 1 | −0.125 | 0.250 | 13 | 7 | 2 | 0.125 | 0.250
6 | 12 | 0 | 0.125 | 0.250 | 5 | 6 | 0 | 0.062 | 0.125 | 11 | 14 | 1 | 0.125 | 0.250 | 13 | 11 | 2 | −0.125 | 0.250
7 | 7 | 0 | 0.125 | 0.250 | 5 | 9 | 0 | 0.062 | 0.125 | 12 | 5 | 1 | 0.125 | 0.250 | 14 | 7 | 2 | 0.125 | 0.250
7 | 11 | 0 | 0.125 | 0.250 | 5 | 10 | 0 | 0.062 | 0.125 | 12 | 6 | 1 | −0.125 | 0.250 | 14 | 11 | 2 | −0.125 | 0.250
7 | 13 | 0 | 0.125 | 0.250 | 6 | 5 | 0 | 0.062 | 0.125 | 12 | 9 | 1 | 0.125 | 0.250 | 3 | 5 | 3 | 0.125 | 0.250
7 | 14 | 0 | 0.125 | 0.250 | 6 | 6 | 0 | 0.062 | 0.125 | 12 | 10 | 1 | −0.125 | 0.250 | 3 | 6 | 3 | −0.125 | 0.250
8 | 1 | 0 | 0.125 | 0.250 | 6 | 9 | 0 | 0.062 | 0.125 | 13 | 13 | 1 | 0.125 | 0.250 | 3 | 9 | 3 | −0.125 | 0.250
8 | 2 | 0 | 0.125 | 0.250 | 6 | 10 | 0 | 0.062 | 0.125 | 13 | 14 | 1 | −0.125 | 0.250 | 3 | 10 | 3 | 0.125 | 0.250
8 | 4 | 0 | 0.125 | 0.250 | 9 | 5 | 0 | .0.062 | 0.125 | 14 | 13 | 1 | 0.125 | 0.250 | 12 | 5 | 3 | 0.125 | 0.250
8 | 8 | 0 | 0.125 | 0.250 | 9 | 6 | 0 | 0.062 | 0.125 | 14 | 14 | 1 | −0.125 | 0.250 | 12 | 6 | 3 | −0.125 | 0.250

Method 2. This method is applicable in cases where a box of controlled permutations has a cascade structure, i.e., when it can be represented as a superposition of two or more sequentially applied boxes of controlled permutations. Besides that, if

where V = V(1) ‖ V(2) ‖ … ‖ V(s), and correspondingly,

then

Click To expand

Formula (3.55) is a consequence of Theorem 3.6, which was proven earlier.

For example, computing the PrV{V(a → b)} probability for s = 3 is done only with such masks b(1) and b(2) for which p′(a, b(1)) ≠ 0, p′(b(1), b(2)) ≠ 0 and p′(b(2), b) ≠ 0 at the same time. In particular, the P4/4 box has a cascade structure (Fig. 3.25), P<2>V(2) being a fixed permutation:

Let a = (1,0,1,0) and b = (0,0,1,1).

It is evident that the biases considered are simultaneously other than zero only for b(1) = (0,1,0,1) and b(2) = (0,0,1,1), the p′(a, b(1)) = 1/4, p′(b(1), b(2)) = 1 and p′(b(2), b) = 1 conditions being true. Therefore, p′ = PrV{V(a → b)} = 1/4.

Dividing a Set of United Masks into Classes of Equivalence

In addition to the methods proposed earlier, we must also take into account the features of a particular implementation of controlled permutation boxes. Since equality is an equivalence relationship, the whole set of linear characteristics can be represented as a union of non-overlapping adjacent classes of vector pairs a and b relative to the values p′ = PrV{V(a → b)} and WH = WH(a) = WH(b).

The class of equivalence to which the (a,b) pair belongs will be designated as [(a, b)]p′WH. With such a division, it is sufficient to compute the bias for just one representative of each class. There are various ways of obtaining such classes.

Definition 3.22

The output bits i and j are equivalent relative to a, if ∀b: = WH(b) = WH(a) − 1, bi = bj = 0 and PrV{V(a → b′)} = PrV{V(a → b″)}, where b′ = b ⊕ Ei, b″ = b ⊕ Ej. This is designated as (i,j)a.

Obviously, for a fixed a, the whole set of the numbers of output bits M(B) = [1, 2, …, n] can be represented as a union of non-overlapping subsets of equivalence:

Click To expand

where t ≥ 1 and s1 + … + st = n.

Let μ(WH(a), t, s1, …, st) be the number of variants of distribution WH(a) "balls" over t "boxes", provided the "box" with the j (1 ≤ j ≤ t) number can accommodate no more than sj "balls". Then, for a fixed a, there are no more than μ(WH(a), t, s1, …, st, adjacent classes [(a, b)]p′,a, and it will suffice to approximately choose just μB(WH(a)) = μ(WH(a), t, s1, …, st) b vectors corresponding to the particular variants of "ball" distribution, and compute PrV{V(a → b)} for them. If (μ 1, μ 2, ……, μ t) is one of the variants of "ball" distribution for a fixed input a where 0 ≤ μj ≤ sj and ∑j μj = WH(a), then we need only to consider [B] = ⋓j μj ≥ 1[i1(j), i2(j), …, iμj(j)]. For example, let P4/4 and a = (1,0,1,0). In this case, M(B) = [1, 2]a ∪ [3, 4]a, and if (0,2) is a variant of "ball" distribution, then [B = [3, 4], i.e., b = (0,0,1,1).

Equivalence for input bits relative to the b vector and adjacent classes [(a, b)]p′,b are introduced in a similar fashion.

Definition 3.23

The output bits i and j are equivalent relative to WH(a) if they are equivalent for ∀a′: WH(a′) = WH(a). This is designated as (i, j)WH(a).

It should be mentioned that if (i1, i2, ……, is1)WH(a) is a subset of equivalence, it doesn't have to be a subset of equivalence for the WH ≠ WH(a) value. Thus, in P4/4, for WH(a) = 1, M(B) = (1, 2, 3, 4)1, but for WH(a) = 2, M(B) = (1,2)2∪(3,4)2.

Let

Click To expand

Accordingly,

Click To expand

Since for PrV{V(a → b)} > 0 the WH(b) = WH(a) condition is always true, then for each value of WH, there are no more than μA(WH) · μB(WH) [(a, b)]p′, WH classes of equivalence. However, the total number of classes of equivalence is then equal to the sum of WH from one to n/2.

Besides this, when building subsets of equivalence, it is possible to use various types of symmetry in the design scheme of a controlled permutation box. For example, boxes P2/1, P4/4, P16/32, P32/80 are boxes with mirror symmetry (they're do not vary when the order of bit numbering is reversed), but only the first three of them have "input/output" symmetry, that is, symmetry that allows you to swap input and output.

Thus, the obtained results make it possible to draw the following conclusions:

  • Using boxes of controlled permutations as a basic primitive - taking into account protection against linear cryptanalysis - seems to be promising in designing secure fast algorithms of block data encryption.

  • The suggested methods of computing linear characteristics can be used to optimize the designed boxes of controlled permutations.

  • When constructing the schemes of data block ciphering algorithms, it makes sense to choose constructions that exclude or limit the possibility of using a united mask (a = d0, b = d0, c) in controlled permutation boxes.


3.5. Generating Control Vectors

3.5.1. The Procedures to Generating a Control Vector for Pn/m Boxes

When designing algorithms of data block encryption based on controlled operations, the following variants of generating control vectors can be distinguished:

  • Using a secret key

  • Using one of the subblocks of input data

  • Using a secret key and one of the subblocks of input data

In the first case, during the entire interval for which the same secret key is used, all modifications of controlled operations are fixed. This variant is used, for example, in the ICE cipher [46].

In the second case, for every controlled operation, the value of the control vector changes in accordance with the changing of the data block, which leads to changing the modification that takes part in the transformation. However, a certain disadvantage of this variant lies in the fact that, in some cases, the process of selecting modifications can be controlled (for example, when a chosen input data attack is launched). This variant of generating the control vector is used, for example, in the RC5 [79] and RC6 [78] algorithms.

In the third case, the choice of modification depends on both the secret key value and the value of the input data block. This is why this variant is the most interesting.

A classic example of this variant of control vector generation is the DES algorithm, in which a 16-bit binary control vector V is the result of the bitwise addition of 16 key bits to 16 bits of the input data block being transformed. Remember that a 16-bit control vector represented as a concatenation of eight binary vectors, each 2 bits long, controls the combined substitution S32/16 = S4/2 ‖ S4/2 ‖ … ‖ S4/2 consisting of eight S4/2 boxes, and each 2-bit binary vector "chooses" one of four specified 4-bit-long substitutions.

Note that in the DES algorithm, the same 32-bit data block is used both at the input of an S-box and to control this S-box, and in the process, 32 bits and 16 bits of this data block are used, respectively. Such a construction is possible due to the fact that the round function of the DES algorithm includes a procedure for expanding the input vector, which converts a 32-bit vector into a 48-bit one.

Using a 48-bit round key for bitwise addition to a newly generated 48-bit binary vector is a sufficient condition, which allows you to select not only all possible modifications (216 altogether) but all possible values of the input data block (232) as well.

Indeed, a 48-bit binary vector of concatenated input data can be regarded in this case as a uniformly distributed random variable for which the selection of an S-box, taking into account the necessary algebraic and probability-statistical properties, is reduced to solving a mathematical problem. This problem was solved by the developers at IBM, and the requirements posed on the generated S-boxes were kept secret for quite a long time. Now they are well known.

Since 32 bits of the 48-bit vector were used as input data for the S32/16 substitution box, we might find it useful to speak about the procedure of expanding the control vector V, which we'll hereafter designate as E(X, KV). The first parameter corresponds to the input data box, and the second corresponds to the round key KV.

Designing a E(X, KV) procedure significantly depends on the scheme of one round, on basic requirements both to the whole round and to a particular controlled operation box, and on the construction of the controlled operation.

In a DES, such a procedure takes a rather simple form after bit renumbering:

where all lj and kj are independent of each other.

Everything is much more complicated when one or more controlled permutation boxes are used in a block ciphering algorithm. The main problem there is that the bit length of an input data block X in each round of, say, a 64-bit block cipher is equal to 64, whereas the length of the control vector, for example, for one P32/80 box, is 80. That is, in equations having the νs = lj ⊕ ki form, some lj and kj are sure to be repeated.

Let's consider a controlled permutation box Pn/m(V), and the E(L,KV) procedure of expanding the control vector.

In the E(L,KV) notation, the L vector is half the input data box - that is, X = L ‖ R, ω(L) = ω(R) = n/2, where ω is the dimension. Since the necessary condition of implementability of all modifications by the Pn/m(V) box is independence and the uniform distribution of all the bits of an m-bit control vector V, then, in order to meet this condition, it is necessary that the number of independent variables of the input vector (L ̎ KV) aren't less than m. This requirement is satisfied if ω(KV) = m − ω(L) ≥ m − n/2, because ω(L) = n/2.

When designing the E(L,KV) procedure, it is usually necessary to meet the following requirements:

  • Maximum performance with a low hardware complexity of implementation.

  • Each vi bit of V must take a of value 0 or 1 with the probability of 1/2 on the whole set of input values {L ̎ KV}, i.e., the Boolean function vi = Ei(L, KV) must be balanced.

  • Each vi bit of V must significantly depend on the L vector, that is, there must be an L and j (1 ≤ j ≤ n/2) such that Ei(L, KV) = Ei(L ⊕ Ej, KV).

  • All bits of the input data L must be uniform in their participation in controlling the box of controlled permutations.

  • For an arbitrary chosen switching of one input bit with one output bit, different bits of the L vector and different bits of the KV key must participate in the controlling, thus ensuring the possibility of implementing all variants of switching.

These requirements are met by the simple Boolean functions vi = lj and νi = lj ⊕ (KV)s(1 ≤ i, j, s ≤ n). For the former, τ = 0, and for the latter, τ = τ⊕. It is these two classes of functions that are commonly used when creating the E(L, KV) procedure.

It should be mentioned that if we use Pn/m box with layered structure, and the control vector V = V1 ‖ V2 ‖ … ‖ Vs, where s = 2m⊟n, and the V1 vector is generated using only Boolean functions vi = lj, then the E(L, KV) procedure doesn't present an additional time delay for the Pn/m box, which is quite important when implementing a fast algorithm.

Another even more important feature that must be taken into account when creating a E(L, KV) procedure is the construction of the whole round scheme.

For example, in the updated scheme of Russian patent No. 2140714 [1], two mutually inverse boxes of controlled permutations are used: Pn/m(V) and P−1n/m(U). If the same procedure of expanding the control vector is used, then the KV and KU keys must be different. Otherwise, V = E(L, KV) = E(L, KU) = U, and a part of the transformation performed on the right subblock of data, or more exactly, Pn/m(U)−1(Pn/m(V)(R)), becomes an identical transformation. That is, Pn/m(U)−1(Pn/m(V)(R)) = R.

Besides which, there is another peculiarity of the P−1n/m(U)(Pn/m(V)(R)) construction, and failing to take it into account may result in violating the requirements that the P−1n/m(U)(Pn/m(V)(R)) construction must meet.

Indeed, if Boolean functions that only depend on the input data box when generating the Vs vector controlling the Pn/m box are used, i.e., wi = fi(L) and Vs = W, then for the P−1n/m(U)(Pn/m(V)(R)) construction, this will be equivalent to using P-boxes with s − 1 layers, because, according to Formulas (3.19) and (3.21),

Click To expand

Obviously, such an implementation of the procedure of expanding the control vector cannot be recognized as good, since it reduces the number of potentially implementable modifications. Particular models of procedures of expanding the control vector for particular algorithms of block data transformation (SPECTR-H64 and SPECTR-HI128) are discussed in Chapter 5.


3.6. Summary

The main results of examining the controlled permutations discussed in this chapter are the following:

  • We gave a mathematical description of controlled permutation boxes, which implement non-linear substitution transformations that retain Hamming weight. When discussing various approaches to the design of such boxes (formal, cost-effective, universal, cascade, recursive), we demonstrated that the best performance, along with a low hardware complexity, is gotten by so-called permutation networks (P-networks).

  • We demonstrated the simplicity and effectiveness of the implementation of the inverse transformation for permutation networks.

  • We examined particular models of controlled permutation boxes that possess specific algebraic and probability-statistical properties (boxes of equiprobable bit diffusion, boxes of the hth order, boxes of the maximum order, boxes of full-cycle permutations, boxes with a specific cyclic structure, uniqueness, inversability). Taking into account the priority of the specifications, variants of their implementation were suggested.

  • We demonstrated that, having the same performance and combinational complexity of implementation, a first-order box of equiprobable bit diffusion built using the recursive scheme possesses better confusion properties than a controlled rotation operation. This is due to the significantly greater number of implementable unique modifications in the first scheme (2n as opposed to n).

  • Based on two mutually inverse first-order recursive boxes of controlled permutations, we proposed a method of synthesizing maximum-order boxes that can implement any permutations.

  • For boxes of controlled permutations for linear characteristics in the linear cryptanalysis method, we proved a theorem on computing biases that expressed the correlation between input and output parameters of the transformation being analyzed.

  • We proposed practical recommendations for effective computation of the biases for given linear characteristics, which can be used to optimize designed boxes of controlled permutations.

  • We considered the main principles of generating control vectors for controlled permutation boxes.


Chapter 4: Controlled Operational Substitutions

4.1. The Main Features of Controlled Operational Substitutions

According to the theoretical foundations of cryptography [84], the quality of a block enciphering algorithm directly depends on such properties as the "diffusion" and "confusion" of binary data, which are provided by alternating substitution and permutation. In this chapter, theoretical and even some practical issues of using substitutional transformations are discussed. In modern block ciphers, such transformations are usually connected with using two types of cryptographic primitives:

  • Special non-linear S-boxes specified in tabular form

  • Standard arithmetic and algebraic operations implemented as computer commands

Using primitives of the first type in block ciphers is connected with dividing an n-bit data block, giving it subblocks that are k bits long, and generating smaller substitutions (S-boxes) for these subblocks. Tables specifying such substitutions have sizes that are in direct proportion to the 2k value. The disadvantages of tabular representation of substitutions are the complexity of a hardware implementation and the fast growth of the table size as the k value increases. This makes using large S-boxes problematic in both hardware and software implementations of block ciphers. Due to this, the sizes of S-boxes are usually limited to 4 or 8 bits. This significantly deteriorates certain cryptographic properties of transformations performed over the whole n-bit data block, and also decreases the diversity (the number of modifications) of such transformations.

Substitutional primitives of the second type are rather effectively implemented as standard software operations. However, these operations perform linear transformations (the XOR operation), have a low linearity (addition modulo 2n), or imply a significantly complex hardware implementation (such operations as exponentiation, multiplication modulo 2n or a prime number, and some others).

When estimating the quality of any cryptographic primitive, the combination of the following three parameters determining the cipher's security against various cryptanalytic methods should be taken into account [84]:

  • The degree of non-linearity

  • The degree of error propagation

  • The level of correlation immunity

These properties and the mechanisms of their influence on the cryptographic security of block ciphers are discussed in the following sections of this chapter.

When taking a brief look at these properties of substitutional primitives, one should keep in mind that the S-boxes mentioned earlier are intended to provide the degree of non-linearity and the degree of error propagation specified within each S-box. At the same time, simultaneously achieving the best values for all three parameters for the whole data block being transformed using a series of S-boxes with a smaller size is quite a complicated problem.

On the other hand, mathematical operations that have an effective software and a simple hardware implementation (such as XOR and addition modulo 2n) possess a high correlation immunity for the whole data block being transformed, but they have low levels of non-linearity and modification propagation. It should be noted that these and other mathematical operations weren't thought of as cryptographic primitives of block ciphers at all, and were used in cryptography just because they had been already implemented as computer processor commands.

Thus, it is obviously promising to create special cryptographic primitives that combine and optimize the good points of substitutions used in block ciphers.

Another important direction in improving cryptographic primitives is increasing their non-determinism by increasing the size of data blocks being transformed, and by introducing additional parameters that define the transformation results and increase the number of their modifications. In particular, this idea can be implemented in the form of special operations additionally controlled by some pseudo-random vectors depending on the data being transformed and on cipher keys. We mentioned in previous chapters that such cryptographic primitives are called controlled transformations.

This can be illustrated using as examples of existing block ciphers where the operating principles of controlled transformations have found a simplified application, but haven't been fully developed yet. Thus, each of eight S-boxes implementing a surjective (Section 4.2) mapping GF(2)6 → GF(2)4 in DES can be regarded as a controlled substitution GF(2)2 × GF(2)4 → GF(2)4, containing four bits of transformed data and two control bits [71]. For example, the S2 box performs the following combined substitution, consisting of one top row that numerically determines the original bits of the tetragram, and of four lower rows that specify the resulting bit tetragrams:

In this table, four data bits specify the number of the substitution column, and two control bits specify the number of the substitution row, thus determining the transition of a bit tetragram in the transformation. As a result, for eight S-boxes, there are 48 = 65,536 different variants (modifications) of the transformation of the whole 32-bit data block (GF(2)32 → GF(2)32.

The analytical notation of the transformation functions for each S-box in DES is rather complicated. For example, a Boolean function determining the first of four output components for the S2 box looks like this:

Click To expand

In the LOKI91 [118] block cipher, the controlled mappings GF(2)4 × GF(2)8 → GF(2)8 are used in four S-boxes, each of which specifies the random selection of one of 16 substitutions on eight bits of the original data. Despite the increased size of the S-boxes, this cipher, like DES, includes just 164 = 65,536 different modifications of the transformation of the whole 32-bit data block.

It follows from the given examples that surjective mappings can be treated in some cases as controlled bijective transformations (Section 4.2), defined by control binary vectors that specify various modifications of bijective transformations.

As another example of a cipher that includes a controlled transformation, we earlier gave the example of the RC5 block cipher [79], whose round function uses the controlled operation of cyclic rotation by 0 to 31 positions, depending on the values of five control bits.

Currently, when designing modern block ciphers such as those presented in the AES contest, controlled transformations are still widely used. For example, the round function of the MARS block cipher [13] uses two controlled rotations by 0 to 31 positions, depending on the value of a five-bit control vector. A controlled rotation is used in another AES candidate — the RC6 block cipher [78] — which is an improved version of the RC5 algorithm.

Thus, the actual development of block ciphers demonstrates that using controlled transformations is a promising direction in designing new cryptographic primitives. In the past decade, a great number of open works on cryptography have been published, in which using controlled transformations in block cipher design was theoretically substantiated. However, an analysis of the controlled transformations that were actually used, including those in the aforementioned examples, showed that the methods of their design and use have significant shortcomings, among which are the following:

  • Small S-box sizes make it possible in many cases to use methods of breaking key elements into parts within the operating scopes of individual S-boxes.

  • A small number of different modifications of controlled transformations create conditions for the successful use of probability-algebraic methods of cryptanalysis.

  • The cryptographic properties of existing controlled transformations aren't the best, and they don't provide a highly effective data transformation.

  • In some cases, the high mathematical complexity of controlled transformations hampers the high-speed hardware and software implementation of block algorithms.

The listed shortcomings of controlled transformations evidence the need to further improve these cryptographic primitives based on fundamentally new methods of their implementation. In the following sections, a non-standard approach to solving this problem is discussed. The proposed method implies creating special cryptography-oriented controlled substitutions, and provides for their effective use in block ciphers. The main directions of improving the cryptographic properties of new primitives and increasing the quality of block algorithms based on them are:

  • Increasing up to 32 to 128 bits the sizes of data blocks that undergo simultaneous controlled transformations

  • Significantly increasing the number of possible modifications of controlled transformations up to 2n (n = 32 to 128) or more by improving the control mechanisms

  • Designing various models of controlled transformations that possess specified cryptographic properties and a low complexity

  • Defining new principles of building cryptoschemes based on controlled transformations that ensure a high level of security against modern cryptanalytic methods and a high performance of the hardware, and in some cases, software implementation

The suggested method of solving these problems is related to the further development of the general idea of controlled transformations as a generalized notion of controlled operational substitutions (COS). The main feature of these new cryptographic primitives is that, while retaining many properties of substitutions or otherwise playing the role of S-boxes, COSs have signs of classical mathematical operations that perform the transformation of one or two input data streams into one output stream, depending on the control vector. Using COSs in combination with boxes of controlled permutations (see Chapter 3) and controlled rotations that perform the functions of permutations (P-boxes) is especially effective. Such a combination of cryptographic primitives makes it possible to impart qualitative improvements to the properties of substitution-permutation transformations in block ciphers and to implement in full measure the principles of effective "diffusion" and "confusion" of the transformed data.

The COSs suggested in the following sections are inherently the development of two algebraic operations on binary vectors: bitwise addition modulo 2 (XOR) and bitwise addition modulo 2n. The theoretical basis for designing new operations is an adaptation of Boolean functions that determine the value of every bit at the output of the transformation in order to optimize the parameters of non-linearity, correlation immunity, and error propagation of the whole transformation. Such functions, called generating Boolean functions, depend on one or two operands controlled by an additional vector, depending on the transformed data and the key.

It should be noted that, in their purpose, generating Boolean functions are in many respects similar to non-linear functions that complicate the transformations in stream ciphers (non-linear filters). However, despite a certain similarity of the COS mechanism in block ciphers to the process of stream encryption, the basic difference between the former and the latter is in using generating Boolean functions to transform whole data blocks rather than individual characters of the text. This necessitates, when creating COSs, that you take into account some special features of block transformations such as inversibility (bijectivity), general non-linearity, and a number of other cryptographic parameters inherent only to block ciphers (for more detailed information, see Section 4.3). These peculiarities directly influence the necessary properties of Boolean functions generating COSs.

The prototypes of one of the COS models are cryptographic transformations of binary data based on so-called cellular automata [101]. These primitives use the simplest generating Boolean functions as basic components. Cellular automata were previously widely used to model "chaos" in physical processes, and since the early '90s they have been effectively used in designing various ciphers and hash functions. In this chapter, the concepts of cellular automata have been generalized and developed further in special variants of the serial COS model as vector Boolean functions with some necessary cryptographic properties and a low implementation complexity.

A whole set of transformation models was developed for COS, and the most important of them are the serial bijective model (a development of the XOR operation) and the special recursive model (a development of the addition modulo 2n operation). The term "controlled", with respect to the suggested substitutions, is actually related to a pseudo-random choice of unary or binary operations belonging to various algebraic structures, which are used depending on additional parameters (the key and/or data being transformed). One of the simplest examples of a COS is a controlled adder modulo 2n, in which the values of the carry bits also depend on the bits of the binary control vector.

Unlike tabular substitutions, various types of COSs are easily implemented in the form of simple electronic circuits with delay time values no more than the delay time of several XOR operations. Investigations of algebraic and probability-statistical properties of COSs and other controlled operations, along with the methods of their application, revealed how promising these cryptographic primitives are in designing fast and secure block ciphers. Examples of such ciphers are the SPECTR-H64 (128), COBRA-128, and CIKS-128 block algorithms, along with some other (for details, see Chapter 5).

In the following sections of this chapter, to specify controlled operational substitutions, as new cryptographic primitives, the following issues are discussed:

  • The notion of COS is formalized on the basis of Boolean functions.

  • COS classes are modeled and described.

  • Cryptographic and hardware-implementation properties of various COS models are investigated.

  • The influence of COSs on the security of block ciphers against modern cryptanalytic methods is determined.

  • The implementation complexity of various COS models is estimated.

  • The main principles of using COS in combination with other controlled transformations to design effective hardware- and software-oriented block ciphers are given.

To conclude this introductory section, it should be noted that the suggested new cryptographic primitives aren't considered ideal constructions, or complete alternatives to the other cryptographic transformations. They are just possible ways of creating cryptographic primitives that give a certain effect when creating block ciphers. We don't think it is inconceivable that some theoretical points concerning the suggested transformation models can be improved and developed both in the mathematical and application sense. The main purpose of this chapter is to illustrate the possibilities of creating new methods of cryptographic data transformation, regardless of the fact that these possibilities may seem exhausted at first glance. We'd like for the interested and critically thinking reader to use the material of the chapter as a basis for further pondering over the design and implementation of this new generation of block ciphers.


4.2. Mathematical Properties of Cryptographic Transformations

Cryptographic transformations of data, from the viewpoint of their structure and the sequence of their implementation in block ciphers, can be presented as a set of basic cryptographic primitives. In past decades, certain mathematical techniques have been developed in modern, non-secret literature devoted to block cipher theory. The properties of various cryptographic primitives and whole ciphers are being analyzed based on these techniques.

Permutations and substitutions that provide for the principles of "diffusion" and "confusion" of binary data and that comprise the basis of any block cipher, have found representation in the form of mathematical structures. Their features and properties are described using mathematical formulas. Below is a brief review of the results of investigations carried out recently in open literature on the topic of studying the mathematical properties of cryptographic transformations. A great number of the terms and results presented below are used in the following sections of this chapter, when modeling and estimating the properties of new cryptographic primitives - controlled operational substitutions.

4.2.1. Representing Cryptographic Transformations as Mappings and Substitutions

According to the general theory, each basic cryptographic primitive that performs some transformation in various stages of block encryption can be represented as a GF(2)n → GF(2)m mapping of a GF(2)n vector space of n-dimensional binary vectors X=(x1, x2, …, xn) onto another vector space GF(2)m of m-dimensional binary vectors Y=(y1, y2, …, ym), where ∀i ∊{1, …, n} and ∀j ∊ {1, …, m}, xi ∊ GF(2), yj ∊ GF(2). This mapping can be defined in function form, Y = F(X), which sets the correspondence X → Y, where X ∊ GF(2)n, Y ∊ GF(2)m.

Among cryptographic transformations, mappings having the form GF(2)kn → GF(2)n are often encountered, and in some cases it is convenient to write them using the direct product of k identical sets: GF(2)n × … × GF(2)n → GF(2)n.

When analyzing cryptographic transformations, we need to distinguish from among three types of mappings according to the following definitions.

Definition 4.1

A mapping Y = F(X): GF(2)n → GF(2)m is called injective, or an injection, if for any X1, X2 ∊ GF(2)n, the F(X1) = F(X2) equality entails the X1 = X2 equality.

Definition 4.2

A mapping Y = F(X): GF(2)n → GF(2)m (n ≥ m) is called surjective, or a surjection, if for any Y ∊ GF(2)m there is an element X ∊ GF(2)n such that F(X) = Y.

Definition 4.3

A mapping that is both an injection and surjection is called a one-to-one or bijective mapping, or a bijection.

It is easy to demonstrate that all in all there are 2n2m different surjective mappings GF(2)n → GF(2)m. Each bijection GF(2)n → GF(2)n is a substitution, the converse being also true: each substitution on a GF(2)n set is a bijective mapping. There are altogether 2n! different substitutions or bijections.

4.2.2. Boolean Functions in Cryptographic Transformations

An effective technique for analyzing cryptographic transformations is the use of Boolean functions, which makes it possible to represent any mapping GF(2)n → GF(2)m as a vector Boolean function whose components are classic Boolean functions with the GF(2)n domain and the GF(2) range of values:

where ∀ i ∊{1, …, m}, yi = fi(X), X ∊ GF(2)n, and yi ∊ GF(2). The fi(X) functions are called generating Boolean functions of the Y = F(X) transformation.

In some cases, to write down the arguments and values of Boolean functions, a one-to-one correspondence that is established between vectors from GF(2)n arranged in lexicographical order, and the integer number set {0, …, 2n−1}, are used. For convenience, this correspondence can be defined by βi ∊ GF(2)n vector, whose integer representation is i ∊ {0, …,2n−1}, i.e., [image] .

When describing the properties of cryptographic transformations and appraising their security against known cryptanalytic methods, of great importance are the features of generating Boolean functions, which will be presented later.

Definition 4.4

A series of values of a Boolean function f(X) that consists of the {0, 1} elements and has the form [image] , where β j takes all different values from GF(2)n, is called the truth table of the Boolean function f(X) [86].

In cryptographic transformations, the balance of generating Boolean functions and the regularity of the transformation as a whole are very important, and these notions are defined below. These properties make it possible to avoid direct statistical attacks on the elements of the block cipher, and in many cases, they should be considered as necessary conditions when designing basic cryptographic primitives of block algorithms.

As for the notions of balance and regularity, the following definitions and assertions can be made [86, 89].

Definition 4.5

A Boolean function f(X) (X ∊ GF(2)n) is called balanced if its truth table contains the same number of zeroes and ones.

Statement 4.1

If one of the Boolean functions [image] or [image] [image] is a balanced Boolean function, then the [image] function is also a balanced Boolean function.

Definition 4.6

A mapping Y = F(X)(GF(2)n →GF(2)m), where n ≥ m, is called regular if Y takes all 2m different values from GF(2)m exactly 2n−m times while X ranges over all 2n values from GF(2)n.

Obviously, each regular mapping Y = F(X)(GF(2)n = GF(2)m) for m = n is bijective.

Statement 4.2

A mapping Y = F(X)(GF(2)n → GF(2)m), where n ≥ m, is regular if and only if every linear combination of elements of the F(X) = {f1(X), f2(X), …, fm(X)} vector is a balanced Boolean function, i.e., if for ∀α =(α1, …,αm ∊ GF(2)m, the [image] sum is a balanced Boolean function.

For convenience when describing the properties of cryptographic primitives, an arbitrary Boolean function f(X) is sometimes replaced with its conjugate function f*(X) = 1−2f(X) =(−1)f(X), which takes values on the set of two real numbers {1, −1} rather than on the {0, 1} set. An analog for the truth table of this function is the characteristic sequence built in accordance with the following definition:

Definition 4.7

A sequence consisting of the {1, −1} elements and having the form

where βj takes all different values from GF(2)n, is called a characteristic sequence of the real function f*(X) = (−1)f(X).

There are various ways of writing Boolean functions. Of all the possible types of notations, we'll hereafter adhere only to algebraic normal forms (ANF), which look like this: , where X ∊ GF(2)n and all γ ∊ GF(2). (In this notation, only Boolean operations of bitwise multiplication "." ("^") and bitwise addition "⊕" ("XOR") are used.)

The degree of the maximum (rightmost) element of ANF is called the algebraic degree of the f(X) Boolean function, and is designated as deg(f).

There is an effective method of obtaining the ANF of an arbitrary Boolean function f(X) based on a special linear transformation matrix An and the truth table of this function [76].

If all 2n possible factors from fANF(X) are arranged in lexicographical order as a [image] sequence and are presented as a [γ(f)] column, and 2n values from the [S(f)] truth table are also presented as a column, then the ANF factors can be obtained from the relationship [γ(f)] = An[S(f)], where An is built according to the following iteration:

and "⊕" denotes tensor (Kronecker) matrix multiplication, the transformation itself being an involution, i.e., A2n = in.

4.2.3. Using a Discrete Fourier Transform in Describing the Properties of Cryptographic Transformations

In differential [8], linear [50], and other types of cryptanalysis [53], the leading role belongs to the notion of the Walsh-Hadamard transformation [76], which is a modification of the discrete Fourier transform. To define this transformation, we're going to introduce some new concepts.

Definition 4.8

Affine functions {faff(X)} (X∊GF(2)n) are Boolean functions that have the form [image] , where [image] , and the "*" character denotes scalar multiplication. For c = 0, affine Boolean functions comprise a subset of linear functions {flin(X)}, each of which is a scalar product having the form flin(X) = α*X).

Definition 4.9

A Walsh-Hadamard transformation (WHT) of a real function f(X) ∊ GF(2) over an α vector (X, α ∊ GF(2)n) is a linear transformation, which takes its values from the set of real numbers, and has the following form:

For the conjugate function f*(X), WHT looks like:

Click To expand

It should be mentioned that, for the WHT of the f(X) function, the α*x element is considered to be a function that takes the real values 0 and 1, and for the WHT of the conjugate function f*(X), these real values are taken by [image] function.

It follows from Definitions 4.4 and 4.7 that the WHT is expressed as a scalar product of the truth tables and the characteristic sequences of the corresponding Boolean functions

The given transformations are related to each other according to the following relationships [67]:

Click To expand

where

It follows from Definitions 4.5 and 4.9 that the WHT value in the α = 0 = (0, 0, … 0) point determines the degree of misbalance of the Boolean function f(X), the balance condition itself being expressed in the following way:

For the inverse Walsh-Hadamard transformation, the following formulas are respectively true:

Click To expand

The generating elements of the linear transformations performed by WAT are Walsh-Hadamard matrices that comprise a special class of Hadamard matrices built according to the following rules:

Definition 4.10

An H matrix with elements from the {−1, 1} set is called an Hadamard matrix if HHT = n In, where HT is the transposed H matrix and In is the unity matrix.

If 2n values of a characteristic sequence S*(f) of an f *(X) function and 2n values of a real function are written in columns [S*(f)]and [U*α(f)], WHT is specified by the Walsh-Hadamard matrix Hn as [U*α (f)] = Hn[S*(f)], where Hn is built with the following iteration:

The main properties of Walsh-Hadamard matrices are:

  • ∀ s, t | s + t = n,Hn = Hs ⊕ Ht

  • H2n=2nIn.

  • Every ith row of the Hn matrix is the characteristic sequence S*(αi*X) of an αi*X linear function, where the integer representation of the αi∊GF(2)2 vector is equal to i. On the other hand, every characteristic sequence S*(flin) of a linear function of n variables is a row of the Hn matrix.

The WHT technique is a basic tool for estimating the cryptographic properties of transformations that directly influence the quality of block ciphers. As we mentioned earlier, a special position among these properties is held by the degree of non-linearity, the level of correlation immunity, and the degree of error propagation, which are discussed in the following sections.

4.2.4. Non-Linearity Characteristics of Boolean Functions

When estimating the effectiveness of cryptographic primitives in regard to their security against linear cryptanalysis, one of the main characteristics of function non-linearity is the distance between the generating Boolean functions and the set of affine or linear functions. To present the notion of a Boolean function's non-linearity in greater detail, we'll introduce the following definitions and statements [76].

Definition 4.11

The Hamming distance DH(f, g) between two Boolean functions, f(X) and g(X), is the number of values in which these functions are different that correspond to the condition DH(f, g) = WH(S(f) ⊕ S(g)).

Statement 4.3
Click To expand
Definition 4.12

The correlation C(f, g) between two Boolean functions f(X) and g(X), is the value of the following expression:

From Definition 4.12, it follows that [image] , and the relationship between the correlation functions and the Hamming distance is as follows:

Click To expand
Statement 4.4

For an arbitrary Boolean function f(X), the Parseval equality is true [23]:

A principally important corollary follows from the Parseval equality:

Corollary 4.1

For any Boolean function f(X), a correlation with some linear Boolean function always exists, i.e., [image] .

Definition 4.13

The non-linearity of a Boolean function f(X) (GF(2)n → GF(2)) is the value of the following expression [45, 70]: .

In the terms of linear Boolean functions, the N(f) value is expressed as follows:

Click To expand

where

Click To expand

The C(f, flin) function plays a decisive role in linear cryptanalysis, where it is used as a linear characteristic of Boolean functions f(X) over a linear Boolean function flim(X)= α * X.

Statement 4.5

According to Statement 4.3, the value of the non-linearity of a Boolean function f(X) can be found from the following equality:

This relationship is a quite effective tool for determining the non-linearity of Boolean functions for a small n.

Statement 4.6

If f(X, Y) = f1(X)⊘f2(Y)(X ∊ GF(2)n1, Y ∊ GF(2)n2) and d1, d2 are the non-linearity values of the f1(X) and f2(Y) functions, respectively, then [image] In addition, the following inequalities are true [89]: and

Definition 4.14

The linearity of a Boolean function f(X) (GF(2)n → GF(2)) is the value of the following expression [70]: .

It follows from Definitions 4.13 and 4.14 that the linearity and non-linearity of a Boolean function f(X) are connected by the following relationships: N(f)=2−n−2(1−L(f)) and L(f)=1−21−nN(f).

It follows from the Parseval equality that 2−n/2 ≥ L(f)≥1 and 0 ≥ N(f) ≥ 2n−1.

Definition 4.15

General non-linearity and, respectively, the general linearity of a vector Boolean function F(X) are the values of the following expressions [70]:

From Definitions 4.14 and 4.15, it follows that [image] .

Definition 4.16

Mean non-linearity (and respectively, linearity) of a vector Boolean function F(X) are the values of the following expressions:

Click To expand

In block ciphers, one of the main methods of ensuring the non-linearity of transformations is using S-boxes that in general can be defined as non-linear mappings of the GF(2)n → GF(2)m type. Since for large of original data blocks (n) it is rather difficult to perform such a transformation as a whole, the data are divided into parts and then transformed using a series of S-boxes of smaller sizes (s). This kind of combined transformation is designated as Sk×s: GF(2)S × … × GF(2)S → GF(2)m, where k is the number of S-boxes, and n = k × s is the size of the whole transformation.

4.2.5. Autocorrelation of Boolean Functions

When designing cryptographic primitives that ensure high security against differential cryptanalysis, an important role is played by the autocorrelation function, for which there are a number of definitions and statements, according to [23, 76].

Definition 4.17

The autocorrelation of a Boolean function f(X) relative to a vector α ε GF(2)n is a function having the form

Click To expand
Definition 4.18

The autocorrelation of a vector Boolean function F(X) (GF(2)n → GF(2)m) relative to a vector α ∊ GF(2)n over a vector ω ∊ GF(2)m is a function having the form

Thus, the autocorrelation of a vector Boolean function F(X) can be described with an autocorrelation matrix R = || Ri,j(F) ||, where i and j are the integer values of binary vectors α1, … α2n arranged in lexicographical order.

Statement 4.7

For a Boolean function f(X)(X ∊ GF(2)n), the following is true [76]:

Click To expand

Here, the (U*ω (f))2 function is called the energy spectrum of the Boolean function f(X).

If we use WHT (Section 4.2.3), it will follow from Statement 4.7 that

Click To expand

i.e., the autocorrelation is in direct proportion to the WHT of the energy spectrum of the Boolean function f(X).

Statement 4.8

For a Boolean function f (X) (X ∊ GF(2)n), the following relationship are true [76]:

Click To expand

If we consider the α vector as a modification or an error in the original vector X, the first of the probabilities in Statement 4.8 determines how this error statistically affects the value of the Boolean function, i.e., how the α error statistically propagates in the cryptographic transformation f(X). The closer this probability is to the 1/2 value, the less information is available to an opponent trying to find the original value X from a known value Y. Hence, the closer the autocorrelation at the α point is to zero, the more effectively the α error propagates.

The second expression in Statement 4.8 determines the general estimation of error propagation over all values of α Here, the closer the value of the energy spectrum of the f(X) Boolean function in the zero point is to zero, the higher the quality of error propagation.

Statement 4.9

For a vector Boolean function F(X) (GF(2)n → GF(2)m), the following equality is true [23]:

Click To expand

This relationship is fundamental in the context of the mathematical interpretation of differential cryptanalysis. The aforementioned probability analytically determines the degree of error propagation in the vector Boolean function F(X).

4.2.6. Strict Avalanche Criterion and Propagation Criterion

Important characteristics of the quality of cryptographic primitives that clarify the autocorrelation properties presented in Section 4.2.5 are the notions of the strict avalanche criterion (SAC) and the propagation criterion (PC) [23, 31, 45, 49, 76]. These criteria focus on estimating the probability of changing the values of Boolean functions depending on changing some arguments of these functions.

Suppose a Δ f (X, α) = f (X) ⊕ f (X⊕α), where X α ∊ GF(2)n and f(X) ∊ GF(2). Then, for a Boolean function f(X), the following definition can be formulated [45]:

Definition 4.19

A Boolean function f(X) conforms to:

  • SAC, if Δ f (X, α) is a balanced Boolean function ∀ α | WH(α) = 1.

  • SAC of the k order (SAC(k)), if every specific function obtained from f(X) by fixing any k of its variables conforms to SAC.

  • PC of the l ≤ PC(l)) degree, if Δ f (X, α) is a balanced Boolean function ∀ α | 1 ≤ WH(α) ≤ l.

  • PC of the l ≤ n degree and the k ≤ n − 1 order (PC(l, k), if every specific function obtained from f(X) by fixing any k of its variables conforms to PC(l).

Statement 4.10

If a Boolean function f(X) conforms to SAC(k) for 0 ≤ k < n − 2, then deg(f) ≤ n − k − 1.

In the terms of a Boolean function's autocorrelation (see Definition 4.17), the basic notions of the aforementioned criteria take the following form:

Statement 4.11

A Boolean function f(X) conforms to:

  • SAC if r α(f)= 0, ∀ α | WH (α) = 1

  • PC(l) if r α (f) = 0, ∀ α | 1 ≤ WH(α)≤l

The notion of "error propagation" can be defined not only by a set of vectors with a certain Hamming weight, but also by an arbitrary set of binary vectors.

Definition 4.20

A Boolean function f(X) conforms to the propagation criterion on the set of binary vectors {α}⊂GF(2)n PC({α})) if [image] .

The concepts in SAC were first formulated by A. Webster and S. Tavares [98]. Later, this concept was developed by R. Forre, who introduced the notion of SAC(k) [31]. A generalization of the estimates of a Boolean function's non-linearity and SAC was given by B. Preneel et al., who, in particular, defined and developed the notions of PC(l) and PC(l,k) [76]. Methods of building Boolean functions conforming to the SAC(k) and PC(l,k) criteria are given in [31, 45, 49] and a number of other papers.

Example 4.1. The Boolean function [image] (in quardatic form) conforms to the following criteria:

  • SAC(n − 2).

  • PC(l, k) for l + k ≤ n − 1 or (l + k = 1 and l is even).

  • PC(2, n − 2) (it is the only Boolean function that conforms to this criterion).

  • PC(n) for an even n, i. e., f(X) is a bent function (see Section 4.2.8).

  • PC(n − 1) for an odd n, and f(X) will be a balanced Boolean function.

In particular, the quadratic form

Click To expand

conforms to the PC(6), PC(4, 2), PC(2, 4) criteria, and has the following truth table, WHT spectrum, and autocorrelation:

Click To expand

An important qualitative characteristic of cryptographic primitives is the avalanche effect, which determines how the output value of a transformation changes with the changing of a number of data or key bits at the transformation input. The vectors that determine these changes are called avalanche vectors, and have the form [image] . The characteristics of an avalanche effect are estimated in accordancce with the values of vector autocorrelation resulting from Statement 4.9.

4.2.7. Correlation Immunity and Resiliency of Boolean Functions

Naturally strengthening the balance property of a Boolean function f(X) is, among other things, done by fulfilling the requirement of being balanced for all the functions obtained from the original function by fixing some of its variables. This requirement contributes to the security of cryptographic primitives against direct statistical attacks with fixed values of some bits at the transformation input. This property and some other cryptographically important features of Boolean functions are connected to the notions of their correlation immunity and resiliency stated in accordance with the following principles [14, 21, 95]:

Definition 4.21

A Boolean function f(X) (X ∊ GF(2)n) is known as correlationally immune, degree l, CI(l), if ∀ α | 1 ≤ WH(α)≤ l < n, U*α(f) = 0.

The notion of the correlation immunity of a function was first introduced by T. Siegenthaler [91], and then developed by G. Xiao and J. Massey [99], and also by P. Canion and C. Carlet [14]. In particular, it was demonstrated that for ∀ f(X) conforming to CI(l), the inequality l + deg(f) ≤ n is always true.

A degree l correlation immunity means that the values of the Y = f(X) function are not statistically dependent on any set of no more than l components of an arbitrary vector argument X ∊ GF(2)n. This is equivalent to the condition that at the output of the transformation, there is no "leakage" of information about vectors supplied at the transformation input and having a Hamming weight no greater than l. A remarkable fact is that, according to Corollary 4.1, if a function has a degree l correlation immunity, it is sure to have a correlation with a linear Boolean function α * X, where vector WH(α) > l, i.e., ∃α | WH(α)> l, U*α(f)≠0. Hence:

Corollary 4.2

The maximum degree of the correlation immunity of a Boolean function Y = f(X) (X ∊ GF(2)n) is not greater than n − 1.

In individual cases where it is impossible to achieve complete degree l correlation immunity for an f(X) function, this notion can be considered a weakened variant relative to a part X * of the original vector X rather than to the vector itself, adhering to the following definition:

Definition 4.22

A Boolean function f(X) (X ∊ GF(2)n) has a degree l correlational immunity with the X * set (CI(l, X *)) that consists of some of the components of the X vector, if ∀α = αX\X*∪α X* and 1 ≤ WH(αX*) ≤ l < n ⇒ U*α(f) = 0, where α X* are the components of the α vector that correspond to the X * set, and αX\X* = 0 are the other components of the α vector.

Since the balance of Boolean functions is one of the more important properties of cryptographic transformations, the notion of correlation immunity is further developed by the following definition:

Definition 4.23

A Boolean function f(X) is called resilient of degree l and order k (R(l, k)) if any special function obtained from f(X) by fixing k variables is degree l correlationally immune and balanced.

Thus, balanced correlationally immune Boolean functions are a special case of resilient Boolean functions.

Example 4.2. The Boolean function of six variables

Click To expand

conforms to the R(2, 0) criterion, and has the N(f) = 24 non-linearity, with the maximum possible value of non-linearity being 26 for balanced Boolean functions of six variables. The truth table, the WHT spectrum, and the autocorrelation value of this Boolean function are the following:

Click To expand
Definition 4.24

A vector Boolean function Y = F(X) (GF(2)n → GF(2)m) is known as (n, m, k)-resilient (R(n, m, k)) if any special function obtained from F(X) by fixing k variables is regular, i.e., its values run through all possible m-grams from GF(2)m an equal number of times when the other n − k variables of the function run through 2n − k values from GF(2)n − k only once.

It follows from Definition 4.6 that the regularity of vector Boolean functions is a specific case of resilience (regular Boolean functions are (n, m, 0)-resilient ones).

The notion of resilient functions was introduced by O. Goldreich et al. [21]. The theory of such functions was further developed by J. Seberry, X-M. Zhang, and Y. Zhang [87], P. Sarkar and S. Maitra [83], Y. Tarannikov [95], and others.

4.2.8. The Role of Bent Functions in Cryptographic Transformations

A special position among Boolean functions is held by those possessing an extremely high level of non-linearity and error propagation (PC(n)), thus contributing to increasing the security against linear and differential cryptanalysis of block ciphers.

Definition 4.25

A Boolean function f(X) (X ∊ GF(2)n) is called perfect non-linear, or a bent function [76], if for ∀ α ∊ GF(2)n, the following equality is true: U*α (f) = ±2n/2

The concept of bent functions was first introduced by O. Rothaus in the 1960s, and published in 1976 [81]. His ideas were then developed by J. Dillon [27] and other mathematicians.

The main properties of bent functions are the following [86]:

  • Any fbent(X) (X ∊ GF(2)n) has an even number of n variables, and deg(fbent) ≤ n/2.

  • All fbent(X) have the maximum non-linearity N(fbent(X)) = 2n−1 −2(n/2)−1 and, correspondingly, the minimum linearity L(fbent(X)) = 2−n/2, while the other Boolean functions don't reach these limits.

  • {fbent(X)} is the only class of Boolean functions that conform to PC(n), i.e., ∀ α∊ GF(2)n | 1≤ WH(α) ≤ n, f(X) ⊕ f (X) ⊕ f (X⊕α) is a balanced Boolean function.

  • {fbent(X)} is a set of unbalanced Boolean functions, each of which takes a 1 value 2n−1 ± 2(n/2)−1 times, and a 0 value 2n−1 ± 2(n/2)−1 times.

  • The correlation coefficient of bent functions with each linear Boolean function is constant in its absolute value |C(fbent,flin) | = 2−n / 2, and tends to zero as n increases.

Statement 4.12

If gaff(X) and fbent(X)(X ∊ GF(2)n) are affine and bent functions, respectively, then h(X) = gaff(X)⊕ fbent(X) will be a bent functions.

Rothaus formulated the following practical construction that makes it possible to build bent functions of any degree deg(f) based on quadratic forms [81]: fbent(X) = x1x2 ⊕ x3x4 ⊕ … ⊕ x2k−1x2k ⊕ φ (x1, x3, …, x2k−1), where φ is an arbitrary Boolean function.

Definition 4.26

A vector Boolean function F(X) = {f1(X, …, fm(X)} is called a vector bent function if, for ∀ η ∊ GF(2)m and η ≠ 0, the T(X) = η * F is a bent function.

It was demonstrated in [69] that only vector bent functions reach the maximum non-linearity N(F) = 2n−1−2(n/2)−1, and the minimum linearity L(F) = 2−n/2 for the mappings GF(2)n → GF(2)m, and that such functions only exist for n ≥ 2m and an even n.

Example 4.3. The following Boolean functions are bent functions:

Click To expand

For example, the truth table, the WHT spectrum, and the autocorrelation of the f2(X) function have the following form:

Click To expand

We should mention that bent functions with large numbers of variables haven't been sufficiently explored; for example, all such functions of 10 variables haven't been obtained or even listed. However, there are now methods that make it possible to build some classes of bent functions with arbitarily large numbers of variables and a degree of algebraic normal form. Among the most widely known methods, we can mention constructions by R. McFarland [52], K. Nyberg [69], C. Carlet [15], J. Dillon [27], and H. Dobbertin [28]. Also notable is the method by W. Meier and O. Staffelbach [92] and the construction by J. Seberry [86], which make it possible to build balanced Boolean functions having high non-linearity and conforming to the PC(l) criterion of a high degree based on combinations and modifications of bent functions. These methods will be used for synthesizing and optimizing controlled operational substitutions in Section 4.3.

4.2.9. Linear Structures of Boolean Functions

An alternative approach to estimating a Boolean function's non-linearity is to estimate their distance from a set of functions having linear structures. This notion and its properties are formulated in the following definitions and statements.

Definition 4.27

An α ∊ GF(2)n vector is called a linear structure of a Boolean function f(X) [88, 92] if the Δ f(X, α) = f (X) ⊕ f (X⊕α) function is a constant, i.e., if it takes a value of 0 or 1 ∀ X ∊ GF(2)n.

Statement 4.13

The set of linear structures of a Boolean function f(X) form a linear space with a dimension of l ≤ n. This dimension is called the linear dimension of the Boolean function f(X) [89].

Statement 4.14

The maximum value of the linear dimension n is only reached by affine functions.

Statement 4.15

For an even n, the minimum linear dimension is 0, and is only reached by bent functions; for an odd n, the minimum linear dimension is 1.

If we denote the set of Boolean functions f(X) (X ∊ GF(2)n) having linear structures as LS(n), the non-linearity N *(f) of the Boolean function f(X) relative to linear structures is defined like this: .

Similar to the definitions of the general and mean non-linearity of vector transformations in terms of the distance to the set of affine Boolean functions (N(F) and N′(F)), there are corresponding definitions for the alternative notion of the non-linearity of vector Boolean functions.

Definition 4.28

The general and mean non-linearity of a vector Boolean function F(X) relative to the linear structures are the values of the following expressions [92], respectively:

Click To expand

Obviously, the farther the function is from the LS(n) set, the lower the possibility of its approximation with linear functions. It should be mentioned that the alternative definitions of non-linearity N(f) and N* (f) of Boolean functions are closely related to each other. For example, the only functions missing linear structures are bent functions for which N* (f) reaches its maximum value of 2n−2. It is this class of Boolean functions that corresponds to the maximum possible non-linearity in the sense of the distance from affine Boolean functions N(f) = 2n−1−2(n/2)−1.

In cryptographic primitives, linear transformations of original vectors are often used as intermediate transformations. In connection with this, to increase the effectiveness of estimating such primitives, the following properties of transformations should be taken into account [89]:

Statement 4.16

If B is a non-singular matrix of the order n over the GF(2) field, and the g(X) = f(X B) relationship is true for a Boolean function f(X), f(X) and g(X) have the same algebraic degree (deg(f) = deg(g)) and non-linearity (N(f) = N(g), N *(f) = N*(g)), and they also have the same dimension.

Statement 4.17

If a Boolean function has the form f (X) = haff(X1)⊕hbent(X2), where haff(X1)(X1 ∊ GF (2)l) and hbent(X2)(X2 ∊ GF (2)n−l, n− l) is even) are affine and bent functions, respectively, the original function has the linear dimension l and a non-linearity value of N(f) = 2n−1 − 21/2(n+l)−1.

4.2.10. Generalized Non-Linearity Properties of Cryptographic Transformations

In this section, we give some important and useful results that can be used to synthesize and analyze cryptographic primitives and entire block ciphers. In particular, [16] presents the lower non-linearity boundary of vector Boolean functions Y = F(X): GF(2)n → GF(2)m, which has the following form: L(F)≥ 1/2n[3 · 2n − 2 − 2(2n − 1)(2n − 1 − 1)/(2m − 1)]1/2 = = Q(n, m), where

  • Q(n, m) < 2−n/2 for 1 < m < n − 1.

  • Q(n, m) = 2−n/2 for m = n − 1.

  • Q(n, m) = 2−(n−1)/2 for m = n.

  • Q(n, m) > 2−(n−1)/2 for m > n

  • for n/2 < m < n and m > n, the minimum value of linearity isn't known.

As we mentioned in Section 4.2.8, only vector bent functions where n ≥ 2m and with an even n reach the minimum linearity L(F) = 2−n/2 for vector mappings.

It was demonstrated in [64, 67] that, for n = m and an odd n, there are transformations even bijective Y = F(X): GF(2)n → GF(2)n for which L(F) = 2−(n−1)/2. These Boolean functions are called almost bent functions, and one of their features is that their correlation with linear Boolean functions takes only three values: ∀η∊ GF(2)m, C(η*F, flin) = ±2−(n−1)/2, or C(η*F, ftin) = 0.

Since balanced Boolean functions play a special role in cryptographic transformations, the non-linearity estimations for these functions are of a certain interest. In particular, the following upper estimation is valid for balanced Boolean functions [86]:

where [[x]] denotes the maximum even number no greater than x.

A constructive lower estimation was also obtained [86], which is of great practical importance and proves the existence of highly non-linear balanced Boolean functions, according to which, for any even n ≥ 4, there exists balanced function whose non-linearity is determined by the following inequality:

Click To expand

4.2.11. General Requirements for Cryptographic Primitives

Summarizing the results concerning the mathematical properties of substitutions presented in the previous sections, we can formulate requirements for cryptographic primitives such that Y = F(X): GF(2)n → GF(2)m, which play an important role in various applications. Among these requirements providing inversibility and a high security of block ciphers against cryptanalytic methods are:

  • Bijectivity (for n = m), regularity, or (n, m, k)-resiliency of a vector transformation Y = F(X) for n ≥ m

  • A high degree of correlation immunity (CI(l), CI(l,X *)), or the R(l, k) property of generating Boolean functions

  • A large algebraic degree deg(f) and a high non-linearity N(f) (N* (f)) of generating Boolean functions

  • A high general non-linearity N(F) (N * (F)) or, in some cases, a high mean non-linearity N*′(F) (N *′ (F)) of the vector mapping as a whole

  • Low autocorrelation values r α (f) and Rα,ω(F) for generating and vector Boolean functions, providing a strict avalanche criterion SAC(k) or a propagation criterion PC(l, k) of a high degree l and order k

Since, according to the properties of Walsh-Hadamard transformation, some of these requirements are in conflict, the problem of optimizing generating Boolean functions and entire vector mappings comes up. Methods of solving this problem are demonstrated in Section 4.3.8 using the examples of the synthesis of new cryptographic primitives - controlled operational substitutions.


4.3 Models of Controlled Operational Substitutions

4.3.1. The Definition of a Controlled Operational Substitution

An integral part of the design of cryptographic primitives is modeling them as mathematical objects. In this section, as an example of such a design, we will consider the synthesis of new cryptographic primitives — controlled operational substitutions (COS), based on the Boolean functions discussed in Section 4.2. In this and the following sections of this chapter, we formalize the notion of controlled operational substitutions and describe their models and the main cryptographic properties that are to act as the basis for designing specific implementations of these operations [36].

Definition 4.29

A controlled operational substitution is a mapping Y = GV(X, A) (GF(2)m · GF(2)n · GF(2)n → GF(2)n) that is performed involving two operands X,A ∊ GF(2)n(Y ∊ GF(2)n) and that depends on the control vector V ∊ GF(2)m(m ≥ n) (Fig. 4.1.)

Click To expand
Figure 4.1: A diagram of controlled operational substitution (X = (x1, x2, …, xn), A = (a1, a2, …, an), V=(v1, v2, …, vm), Y=(y1, y2, …, yn))

According to the definition, a COS actually implements a vector Boolean function of three variables — X, A, and V. However, to emphasize the cryptographic properties and peculiarities of using these functions in block ciphers, it is necessary to consider the COS as a binary (or unary when A = 0) operation on two operands, X and A, depending on an additional vector V (in other words, being controlled by the V vector). In the given notation, the control vector V is itself a function of the elements of a K key and/or of the data being transformed, the X operand corresponds to a block of the data being transformed for which the bijectivity or inversibility of the transformation is provided, and the A operand corresponds to some arbitrary information being transformed.

Definition 4.30

A vector Boolean function Y = GV(X, A) corresponding to a specific value of the control vector V is called a modification of the controlled operational substitutions or, in other words, a GV modification. It determines the GF(2)n × GF(2)n → GF(2)n mapping.

The total number of different binary mappings with 2n inputs and n outputs (GF(2)n × GF(2)n → GF(2)n) is equal to 2n2n+1. Therefore, the theoretically maximum possible number of COS modifications is determined by the | GF(2)m | = 2m value, where m = n2n+1 is the size of the control vector V.

Definition 4.31

The two modifications GV and GV′ are called equivalent if ∀X, A, GV(X, A) = GV′(X, A).

Definition 4.32

The modification GV is called unique if it doesn't have equivalent modifications.

Definition 4.33

A COS is called complete if all 2m of its modifications are unique.

Definition 4.34

Given m = n, a controlled operational substitution is called effectively complete if for any fixed pair {X, A} and for ∀{V, V′ ≠ V} ∊ GF(2)n, GV(X, A) ≠ GV′(X, A).

Obviously, for m > n, a COS cannot be effectively complete, since in this case, the {V} → {Y} (GF(2)m → GF(2)n) mapping won't be a one-to-one mapping.

Since a COS determines the GF(2)n) × GF(2)n → GF(2)n mapping for a fixed V, then, for any modification GV, there is always a set of different pairs {{X, A}, {X′,A′}} such that GV(X, A) = GV(X′,A′). Such a situation is called a collision on two operands X and A.

Definition 4.35

For a GV modification, a collision on one operand — say, X — is a situation where, for a vector Boolean function Y = GV(X, A) and a fixed A, there are two values, X and X′ ≠ X, such that GV(X, A) = GV(X′,A).

Definition 4.36

A GV(X, A) COS is called inversible on X if, for any fixed {A, V}, there is a one-to-one inverse transformation GV−1 such that, for ∀ X, it follows from the Y = GV(X, A) equality that X = GV−1(Y, A).

In its general form, the vector Boolean function Y = GV(X, A) determines the mapping {V} × {X} × {A} → {Y} (GF(2)m × GF(2)n × GF(2)n → GF(2)n) that, for fixed values of the pairs {A, V}, {X, V}, and {X, A}, induces the following mappings, respectively:

Obviously, vector Boolean functions GV, σA(V)(X), v(v)X(A) and μX, A are interrelated, and each of them reflects certain COS properties. Later in this chapter, we'll use different ways of representing COSs when appropriate.

4.3.2. The General Model of a Controlled Operational Substitution

As a basic representation of a COS, consider one of the mapping variants (vector Boolean functions) given in the previous section:

Click To expand

where yi = f1(V)(X, A) are certain Boolean functions written down in normal algebraic form (X, A, Y∊ GF(2)n, V∊ GF(2)m, m ≥ n).

Definition 4.37

A representation of a COS in terms of the vector Boolean function Y= σA(V)(X) is called the general model of the COS, and designated as Mσ. The {fi(V)} functions are called generating functions of the Mσ model.

If this model contains a non-trivial operand A, we have the general model of a binary COS, and when the model doesn't contain an A operand, we have the general model of a unary COS. It follows from Definition 4.37 that, in a broad sense, the Mσ model can be considered the general model of an arbitrary cryptographic primitive that performs surjective mapping, including a controlled permutation.

Definition 4.38

Each COS corresponding to a model is called an implementation of this model.

Definition 4.39

Two implementations GV and GV′ of a model are equivalent if ∀ X, A, V, GV(X, A) = GV′(X, A). An implementation of a model is considered unique if there are no equivalent implementations for it.

Since Mσ has too general of a representation for a whole class of mappings, using its implementations in practice when creating cryptographic primitives makes the further refinement of its structure necessary, which depends on the specific scheme of a block cipher.

In particular, it seems promising to use a COS instead of the "⊕" operation in the traditional Feistel scheme [30] (Figs. 4.2 and 4.3) consisting of r rounds (iterations) of a block transformation over an n-bit block x ∊ GF(2)n (original text) and a set of round keys K = {K1, … Kr}, where Ki = (k1(i), k2(i), …, kn/2(i)) ∊ GF(2)n/2. The algorithm of the Feistel scheme is the following:

Click To expand

Figure 4.2: One round of transformations in the Feistel scheme
Click To expand
Figure 4.3: One round of transformations in the Feistel scheme using a controlled operational substitution

where i∊ {1, …, r}, Ki∊GF(2)n/2 is the current round key, E(X(i−1), Ki) is a round transformation, F(XL(i−1), Ki) is a round function, "‖" is the concatenation operation, and X(i)∊GF(2)n, {XL(i)}∊GF(2)n/2, X = XL ‖ XR = XL(0) ‖ XR(0) = X(0) is an original data block.

where Y ∊ GF(2)n is an output data block of the transformation function].

Some peculiarities of the Feistel scheme are that, first of all, the inverse transformation is performed according to the same scheme, but with the reverse order of using the round keys. Second, the transformation doesn't need the F round function to be inversible.

Using a COS in the aforementioned and similar iterated schemes poses a number of requirements:

  • For any fixed X and A, a vector Boolean function Y = σA(V)(X) must be inversible on X to provide for the inversibility of the block cipher.

  • In some cases, it is desirable that the V(V)X(A) and μX,A mappings be bijective on A and V, respectively, in addition to being inversible on X (Section 4.3.1). This creates conditions conducive to the statistical evenness of the output characteristics over different arguments of the transformation (Sections 4.2.1).

  • Where possible, each COS modification GV(X, A) must be a regular or (m, n, k)-resilient mapping GF(2)n × GF(2)n → GF(2)n in order to prevent direct statistical attacks on block ciphers (Sections 4.2.2 and 4.2.7).

  • The mechanism of controlling a COS with a V vector must ensure the generation of a large number of unique modifications; it is also desirable that the COS is complete or even effectively complete if possible (Section 4.3.1).

  • In most cases, the σ(V)A(X) mapping must have a mapping inverse by X with a low complexity.

  • For each generated COS modification GV(X, A), the number of collisions on two operands X and A must be as small as possible (Section 4.3.1).

  • The vector Boolean function Y = σ(V)A(X) must possess the necessary cryptographic properties related to high non-linearity and good correlation and autocorrelation (Sections 4.2.4–4.2.6).

  • The vector Boolean function Y = σ(V)A(X) must have a relatively high computational complexity and provide for the high performance of a hardware and/or software implementation.

For a further refinement of the general model Mσ in accordance with the listed requirements, we'll take a look at the COS inversibility property.

When an implementation of the Mσ model is inversible on X, it performs a substitution over the {X} set with the A and V values fixed. In the terms of the Mσ model, according to Definition 4.36, this means that, for every such substitution σ(V)A, there is only the inverse substitution σA(V)−1, i.e., if [image] , then there are inverse Boolean functions {f′i(v)} such that xi = f′i(v)(X, A).

According to the definition of a bijective mapping (Section 4.2.1) and the inverse substitution, the following evident statement is true:

Theorem 4.1

If a COS modification is inversible on X, the σA(v)(X) mapping is bijective, and the corresponding vector Boolean function Y = GV (X, A) doesn't have a collision on X.

Proof

Suppose the statement is false. Then there are X, X′ ≠ X, and Y such that Y = σA(v)(X) and σA(v)(X′). Since, according to the theorem, there is the inverse substitution σA(v)−1 for σA(v), then σA(v)−1(Y) = X and σA(v)−1(Y) = X′, where X′ ≠ X. This is impossible because of the one-to-one property of the inverse substitution σA(v)−1, i.e., the Y = GV(X, A) mapping doesn't have collisions on X. This proves the theorem.

Definition 4.40

A COS modification inversible by X is called inversible by X without changing the transformation scheme, or in other words, parametrically inversible, if each vector Boolean function GV depends on one more inversibility parameter e (GV,e) that takes one of two values: 0 — "direct transformation" and 1 — "inverse transformation". For any fixed {A, V}, e∊{0, 1}, and ∀X, the following condition is true: Y = GV(X, A) = GV,0(X, A) and X = GV−1(Y, A) = GV,1(Y, A).

In the terms of the general model Mσ, this means that the direct and inverse substitutions are symmetric and connected by the following condition:

Click To expand

Thus, the general model Mσ of a parametrically inversible COS takes the following form: .

The notion of parametric inversibility is of great importance when creating cryptographic primitives, since it makes it possible to perform the direct and inverse transformation in block ciphers with the same electronic circuit just by changing the inversibility parameter e.

4.3.3. The Serial Model of a Controlled Operational Substitution

In the general COS model, there is a class of mappings that are bijective by X, in which it is possible to implement parametrically inversible transformations. This class is called the serial COS model.

Definition 4.41

An Sσ serial model is a special model of the general model Mσ (Sσ ⋐ Mσ) for which the following condition is true:

Thus, for the Sσ model, the following notation is valid:

Click To expand

Within this model, the requirements to the COS specified in Section 4.3.2 are implemented well enough.

To further refine the properties of the Sσ serial model, we introduce the following designations: Click To expand (in particular, X = X(n), A = A(n), and Y = Y(n)).

In these terms, the parametrically inversible serial model Sσ becomes an Sσ, e model, having the following form:

Click To expand
Theorem 4.2

For implementations of an Sσ serial model, the residual condition of the bijectivity (inversibility) of the σ(v)A mapping by X is the following relationship:

Click To expand

where x0 is the initial condition. The set of such implementations comprises a bijective (inversible) model S′σ ⋐ Sσ.

Proof

Let's consider an arbitrary Y and build an X for it such that Y = σ(V)A(X):

Click To expand

For the obtained X, the Y = σ(v)A(X) equality holds true. Suppose that ∃X ≠ X such that Y = σ(v)A(X′). Then y1 = x′1 ⊕ φ(v)1(x0, A) and y1 = x1 ⊕ φ(v)1(x0, A). Therefore, x1′=x1. If we then consider all yi where i takes values from 2 to n, we obtain that xi′=xi for all i ∊ {1, …, n}, i.e., X′ = X. Thus, the transformation obtained above is an algorithm of unambiguous generating of the inverse substitution σ(v)A−1. This proves the theorem.

Theorem 4.2 has corollaries.

Corollary 4.3

If the

relationship is true for ∀i∊{1, …, n}, then the Y = Gv(X, A)=σ(v)A(X) transformation is inversible on X and A separately, and therefore, it is bijective and doesn't have collisions on X and A separately.

The proof follows from Theorems 4.2 and 4.1 if the COS is considered a Y = V(v)x(X) substitution.

Corollary 4.4

If the COS control mechanism has the following function form:

then, according to Definition 4.34, the COS is effectively complete.

The proof follows from Theorems 4.2 and 4.1 if the COS is considered a Y = μX,A(V) substitution.

Corollary 4.5

If the

Click To expand

relationship is true for ∀i∊{1, …, n}, then the COS is effectively complete, and all GV modifications are inversible by X and A separately, and therefore, they are bijective and don't have collisions on X and A separately.

Theorem 4.3

A mapping Y = GV(X,A)=σ(v)A(X), for which the (4.4) condition of Theorem 4.2 is true, is regular according to Definition 4.6.

Proof

Consider an arbitrary linear combination of components of the vector

Click To expand

Let k be the maximum value for which αk=1, therefore, α•σA(V)(X) = xk ⊕ χ(X(k−1), A). Since xk is a balanced function, then, according to Statement 4.1, the α•σA(V)(X) function is also balanced. Therefore, according to Statement 4.2, the σA(V)(X) mapping is regular, which proves the theorem.

Corollary 4.6

In any implementation of a serial model S′σ, an equiprobable output for every component of a vector Boolean function Y = σA(v)(X) is provided, i.e., ∀i∊{1, …, n}, P{yi = 1} = P{yi = 0} = 1/2.

Theorem 4.4

To provide for the parametric inversibility of a σA(v,e)(X) substitution in a serial COS model S′σ,e, it is sufficient to sequentially use the following functions as transformation functions, from i = 1 to n:

Click To expand

where x0 = W0 is an initial condition, and we(i−1) is determined by a delta function δ e having the form:

Proof

Indeed, from the conditions of the theorem for e = 0, we obtain:

Click To expand

Then, in the (4.5) relationship, we substitute xi with yi and replace e = 0 with e = 1:

Click To expand

Sequentially selecting i values from 1 to n in the (4.7) relationship and using the (4.6) relationship, we obtain

etc., until x′n = xn — i.e., for the σA(v)(X) substitution, we build a parametrically inverse substitution σA(v−1)(Y = σA(v,0)(X), X = σA(v,1)(Y)). This proves the theorem.

One feature of this transformation is the necessity of a special hardware or software implementation of the series of (n − 1) switches {δe(X(i−1), Y(i−1))}.

Definition 4.42

A COS modification is known as parametrically schematically inversible if it is parametrically inversible according to Condition (4.5). A set of such implementations comprises a parametrically schematically inversible model S′σ, eS, and the implementations themselves are called controlled schematic transformers (CSTs).

A corollary follows from this definition and Theorem 4.3:

Corollary 4.7

Any implementation of an S′σ, e serial model has an implementation in the S′σ, eS model.

We should mention that the main feature of COS implementations of the S′σ,eS a model is the possibility of simultaneously performing direct transformation on all the components of the X vector, whereas the inverse transformation is done with a time delay, sequentially from the least significant (i = 1) to the most significant (i = n) component of the X vector in accordance with the algorithm given in the proof of Theorem 4.4.

Note that, in addition to schematically inversible implementations, there are mathematically (functionally) inversible implementations of the serial COS model (adders), which are the subject of the next section.

Definition 4.43

A COS implementation is known as parametrically functionally inversible if its parametrical inversibility is provided by changing the e ∊ {0, 1} parameter in the mathematical notation of the transformation performed by this COS.

4.3.4. The Recursive Model of a Controlled Operational Substitution

A certain disadvantage of the S′σ, e model is the increasing complexity of the generating functions yi = fi(V,e)(X(i), A) as i grows, which doesn't allow the designer to provide for the dependence of each ith bit of the COS output on all i values of the arguments. This shortcoming is eliminated in specific implementations of the recursive COS representation in the S′σ model. Besides which, the recursive COS subclass significantly expands the possibilities of the serial model Sσ due to its parametrical functional inversibility, i.e., the inversibility provided by changing the e ∊ {0, 1} parameter in the mathematical notation of the transformation (see Definition 4.43).

Definition 4.44

A recursive COS model is a specific from of the serial model Sσ, for which the following conditions hold true:

Click To expand

where Click To expand

Obviously, the recursive model (4.8) can be considered as a non-deterministic automaton that depends on a random parameter V and has the form:

where {X, A} is an input alphabet, Y is an output alphabet, {U(i)} =(u1, u2, …, ui)} ⊆ ⊆ GF(2)i is an alphabet of internal states, {fi(v)X} are output functions, and {ψj(v)} are transition functions.

In connection with this, the recursive model (4.8) can be designated as follows:

where {fi(v)} and {ψj(v)} are the generating functions of the Ωσ model.

It should be noted that the recursive model can be also represented in a more general form, using a set of the transition functions rather than one function on each recursion step, i.e., a generalized recursive model can be written down as follows:

Click To expand

However, for simplicity's sake, we're going to use the initial definition for the basic recursive model Ωσ with a single transition function, taking into account that the proofs and reasoning given below are easily extended to the generalized model Ωσ*.

Statement 4.18

According to Theorem 4.2, the following limitations imposed on the output functions are sufficient conditions for the bijectivity (inversibility) of implementations of the Ωσ ⋐ Sσ recursive model:

Click To expand

Such implementations comprise a bijective (inversible) recursive model Ω′σ ⋐ Ωσ

Hence, the class of parametrically inversible implementations of the recursive model can be represented in the form of the following model:

Click To expand

Let's consider a specific parametrically inversible recursive model Ω′′σ, e ⋐ Ωσ, e, in which the inverse transformation is only performed using the e inversibility parameter in the transition functions {ψj(v,e)}:

Click To expand

Within this recursive model shown in Fig. 4.4, COSs that are parametrically functionally and schematically inversible are quite effectively implemented. In connection with this, the following statements are true, which makes it possible to completely define the Ω′′σ, e model.

Click To expand
Figure 4.4: The general scheme of the parametrically inversible recursive COS model Ω″σ,e (e = 0 − "addition", e = 1 − "subtraction")
Lemma 4.1

If, in a recursive model ω++σ, e ω ω+σ, e, every function φi(V)(U(i−1), A) essentially depends on ui−1, any implementation of this model will be parametrically inversible if and only if the values of the transition functions are invariant relative to the direct and inverse transformations, i.e., ∀i∊{1, …, n−1}, ui = ui+, where ui = Ψi(V, e) (xi, U(i−1), A), ui+ = Ψi(V, e⊕1)(yi, U+(i−1), A).

Proof

Consider the general form of the σA(V, e) substitution:

Click To expand

To obtain the inverse transformation, replace e with e ⊕ 1 in the {φi(V, e)} functions and substitute xi with yi from (4.9):

Click To expand

To provide for the xi′ = xi equality, it is necessary and sufficient that the following condition is true:

Click To expand

Since, according to this condition, {φ(V)i} functions don't depend on the e parameter, Condition (4.10) takes the following form: φi(V)(U(i−1), A), φi(V)(U+(i−1), A).

To prove the lemma, we'll consider the functions in algebraic normal form and use the induction method.

For i = 1, we have φ1(V)(u0, A) = φ1(V)(u0, A) and u0 = u0 — i.e., the lemma is true.

Suppose the lemma is true for i = j (uj−1=u+j−1). Let's prove that it is true for i = j + 1 (uj = u′j). In this case, we have the following equality:

From the polynomials of the algebraic normal forms of these functions, we extract the members containing uj and u′j:

The difference between these polynomials must be equal to 0 for any values of the arguments: ϕ(V)j+1 = (ui ⊕ ui+) H (U(j−1), A) ≡ 0. Since φ(V)j+1 essentially depends on uj, the H (U(j−1), A) ≡ 0 identity can not be true. Therefore, Δϕ(V)j+1 ≡ 0 if and only if uj = u′j. This proves the lemma.

Theorem 4.5

If, in a recursive model Ω⊂,e″ Ω Ω⊂, e′, each function ϕi(V)(U(i−1), A) essentially depends on ui−1, any implementation of this model will be parametrically functionally inversible if and only if the transition functions and the output functions are connected by the following determining recurrence:

Click To expand

where Li(V)(U(i−1), A), Li+(V)(U(i−1), A) are generating polynomials, and u0 is the initial condition.

Proof

According to Lemma 4.1, any implementation of the recursive model Ω″σ, e will be parametrically inversible if and only if ∀i∊{1, …, n − 1}, ui, u+i, i.e.,

Consider the polynomials of the algebraic normal form of the transition functions {ψi(V, e)} and {ψi(V, e⊕1)}. Let's represent these polynomials in a certain form, which we'll call canonical, by extracting the members containing e and xi, and then find the difference between these polynomials:

Click To expand

Further, we have:

Click To expand

Hence, the necessary and sufficient condition of parametrically functional inversibility takes the form: ∀i∊ {1, …, n − 1}, Δψi(V, e) = 0.

Since, to provide these conditions for every e, the Δψi(V, e) functions mustn't depend on the e parameter, and the conditions must hold for any pair {U(i−1), A}, then the ∀i∊ {1, 2, …, n − 1} identities must hold for Mi(V)(U(i−1), A) ≡ 0. Hence:

Click To expand

The {Δψi(V, e)} set of functions for all i ∊ {1, …, n − 1} is called the parametrical inversibility kernel of the Ω″σ, e recursive model.

Thus, for the parametrically functional inversibility of the Ω″σ, e recursive model implementation, it is necessary and sufficient that for i ∊ {1, …, n − 1} in the canonical representation of the transition functions

Click To expand

i ∊ {1, …, n − 1} the Mi(V) ≡ 0 identity and the (4.11) condition are true.

It follows from (4.11) that Mi+(V)(U(i−1), A), = φi(V)(U(i−1), A)Mi++(V)(U(i−1), A). By substituting this expression in the (4.12) canonical representation, we obtain the required determining recurrence:

Click To expand

(i.e., Li(V) = Mi++(V), Li+(V) = Mi+++(V)), which proves the theorem.

Criterion 4.1

An algorithm generating the set of all parametrically functionally inversible implementations of the Ω″σ, e model is the following:

  1. For all i from 1 to n, we arbitrarily fix Boolean functions {μi(V)(U(i−1), A} in the algebraic normal form.

  2. For all i from 1 to n − 1, we also arbitrarily fix the generating polynomials {Li(V)(U(i−1), A}, {Li+(V)(U(i−1), A}.

  3. According to the determining recurrence (4.13), we fix transition Boolean functions in the algebraic normal form for all i from 1 to n − 1, and obtain one of the possible implementations of the Ω″σ, e model:

Click To expand

If in this algorithm we use Boolean functions having the

form, all the COS modifications will not only be parametrically functionally inversible by X, but also collision-free on A, the COSs themselves being effectively complete (see Definition 4.34).

Criterion 4.2

To verify an arbitrary implementation of a recursive model Ω″σ, e as to its parametrically functional inversibility, it is sufficient to:

  1. For all i ∊ {1, …, n − 1}, write down the polynomials of the transition functions ψi(V, e)(xi, U(i−1), A) in canonical form, having extracted the members separately, including e and xi (if such notation is impossible, there is no inversibility within the Ω″σ, e model) ψi(V, e)(xi, U(i−1), A) = eMi+(V)(U(i−1), A)⊕ xiMi++(V)(U(i−1), A)⊕Mi+++(V)(U(i−1), A).

  2. Create the kernel {ΔΦi(V)} for the parametrically functional inversibility, and verify it for equality to zero for each i ∊ {1, …, n −1}: Δψi(V) = M′i(V)(U(i-1), A) ⊕φi(V)(U(i−1), A)M″i(V)(U(i−1), A) =0.

Corollary 4.8

Implementations of a Ω″σ, e model for which the conditions of Theorem 4.4 are true comprise a parametrically functionally inversible recursive model Ω″σ, ef ⊂ Ω″σ, e, whose scheme of a one-bit transformer is shown in Fig. 4.5.

Click To expand
Figure 4.5: A scheme of a one-bit transformer θef for the Ω″σ, ef model — see Fig. 4.4 (e = 0 — "addition", e = 1 — "subtraction")

According to Lemma 4.1, the necessary and sufficient condition for the parametrical inversibility of COS implementations in the Ω″σ, e recursive model is the invariance of ui carry values relative to direct and inverse transformations. This condition is functionally provided in the Ω″σ, ef model. However, the condition of Lemma 4.1 can be also provided for with a hardware (schematic) implementation.

Theorem 4.6

The condition of parametrically schematic inversibility for the Ω″σ, e model has the following form:

Click To expand
Proof

According to Lemma 4.1, it is necessary to prove that the values of the transition functions are invariant relative to the direct (e = 0) and inverse (e = 1) transformations.

To prove this, we'll use the method of induction. Consider the inverse transformation from the condition of the Theorem for i = 1, i.e., substitute x1 with y1 and replace e = 0 with e = 1:

Click To expand

i.e., the requirement of invariance for u1 is met.

Suppose the theorem is true for i = k. Let's prove it for i = k + 1:

Click To expand

because U(k) = U′(k).

Further, we have

Click To expand

This proves the theorem.

Corollary 4.9

Implementations of a Ω′σ, e model for which the conditions of Theorem 4.5 are met comprise a parametrically schematically inversible recursive model, whose scheme of a one-bit transformer is shown in Fig. 4.6.

Click To expand
Figure 4.6: A scheme of a one-bit transformer θes from the scheme for the Ω″σ, es model — see Fig. 4.5 (e = 0 — "addition", e = 1 — "subtraction")

Parametrically functionally inversible models Ω″σ, ef belong to the Sσ serial model at the same time (4.2), and, according to Theorem 4.3, variants of parametrically schematically inversible implementations must exist for them. In connection with this, it is interesting that the implementation of such a COS according to Condition (4.5) takes a trivial form, that is:

Click To expand

since, according to Lemma 4.1 and Theorem 4.4, the invariance of the transition functions is functionally provided for, i.e., U(i−1) = U′(i−1), and therefore,

Taking into account the triviality of schematic implementations of the Ω″σ, ef model, the following corollary is true.

Corollary 4.10

A parametrically inversible recursive model Ω″σ, e is the union of the implementations of the Ω″σ, ef and Ω″σ, es models, i.e., Ω″σ, e = Ω″σ, ef ∪Ω″σ, ef and [image] .

4.3.5. Synthesis of Elementary Controlled Adders

In a COS recursive model Ω″σ, ef, if we choose functions that don't depend on the control vector V and have the form

Click To expand

as output and transition functions, we'll obtain a deterministic automaton implementing an adder modulo 2n (Figs. 4.7 and 4.8). Such an adder performs the addition of the operands X and A, and conforms to the requirement of parametrically functional inversibility (see Criterion 4.2), because

Click To expand
Click To expand
Figure 4.7: The scheme of an adder modulo 2n (e = 0 — "addition", e = 1 — "subtraction")
Click To expand
Figure 4.8: The scheme of a σe adder (e = 0 — "addition", e = 1 — "subtraction")

This algorithm can be used as a prototype for synthesis of COSs that are called elementary controlled adders (ECA). ECAs are controlled with binary vectors V ∊ GF(2)n (m=n), and are defined according to the following rules:

Click To expand
Click To expand

where "*" is a Boolean operation, and u0 is an initial value that specifies the type of the ECA implementation. The values of vector V = (v1, …, vn) determine the set of modifications for every ECA implementation. Thus, the sequence {yi} = {ui−1∗vi} and the u0 element, where ui are called carry bits, are synthesizers of various implementations and modifications of ECA (Fig. 4.9). Because of this, elementary adders are designated as ΣV("∗", u0).

Click To expand
Figure 4.9: The scheme of an elementary controlled adder ΣV("∗", u0)∊Ω″σ, ef (e = 0 — "addition", e = 1 — "subtraction")

It follows from the method of building ECAs that they can be considered conventional modulo 2n adders, in which the carry bits are "enabled" or "disabled" according to the rules determined by the control vector and the type of "*" operation. Such ECA representation means that, according to a pseudo-random law, some bits of the X and A vectors are added using the "⊕" operation, and some are added modulo 2n (Fig. 4.10). In this sense, an ECA is a combined non-deterministic operation that is statistically "varied" between the two operations mentioned above. For any value of the "*" element, this operation as a whole won't be a group operation, which is considered an advantageous feature when designing block ciphers. Actually, the third control operand V specifies (pseudo-randomly selects) different binary operations. This is why ECAs are called binary controlled operations.

Click To expand
Figure 4.10: The operating diagram of an ECA ΣV("∧", u0) for γi = ui−1vi

In addition to the aforementioned method of representation, ECA can be considered a portion of a stream cipher n bits long, within which a stream of elements (gamma) {γi} = {ui−1∗vi)} is "laid over" the vector sum X ⊕ A xi ⊕ ai, this stream being built sequentially from the least to the highest bit, according to the (4.15) recurrence.

According to Conditions (4.14) and (4.15), and also to Corollary 4.3, all the types of ΣV("∗", u0) ECAs are collision-free on X and A separately, and according to Criterion 4.2, they are parametrically functionally inversible, since the canonical representation of the transition functions {Ψ(vi, e} has the form:

Click To expand

where

and the kernel of the parametrically functional inversibility is identical to 0:

Since any Boolean operation "*" (u*v) is a GF(2)2→GF(2) mapping, to avoid confusion between the names of these operations, they can be formally presented as elementary polynomials having the following form: α0 ⊕ α1v ⊕ α2u ⊕ α3uv, where α= (α0, α1, α2, α3) ∊ GF(2)4. In total, there are 24 − 2 = 14 Boolean operations (the number of polynomials essentially depending on the v and/or u variables). Boolean operations are classified into unary and binary, i.e., into operations essentially depending on one (v or u) or two (v and u) variables. In total, there are 4 unary and 10 binary operations. Since the type of ECA only depends on the type of the "*" binary operation and the value of the u0 initial condition, there are altogether 20 different implementations of ECA.

It follows from the definition of the ECA ΣV("*", u0) that its generating elements are the values from the gamma {γi} = {ui−1∗vi)}. It is theoretically possible that there are ΣV("*", u0) pairs for which ECA implementations are built that contain equivalent modifications. Besides which, it isn't unlikely that different ECA implementations generate the same sets of modifications. In connection with this, consider the following assertion.

Theorem 4.7

If the "*" Boolean operation is binary (u*v essentially depends on both operands u and v), and the ECA ΣV("*", u0) is complete, i.e., it implements 2n unique modifications.

Proof

Consider an arbitrary V and V′ ≠ V and a pair {X, A}. There is a minimum value i such that vi ≠ vi′.

Since ∀j < i, vj = v′j, then ui−2 = u′j−2. It follows from Condition (4.15) that, given vi−1 and ui−2, the ui−1 = Ψvi−1, e)i−1 function essentially depends on the (xi−1, ai−1) pair.

Therefore, there are two pairs, (xi−1, ai−1) and (x′i−1, a′i−1), such that

If the (ui−1*vi) element synthesizing an ECA essentially depends on ui−1 and vi, then we obtain (ui−1* vi) for one of the aforementioned pairs (xi−1, ai−1) or (x′i−1, a′i−1). Since, according to (4.14), yi = xi ⊕ ai ⊕ (ui−1* vi) and y′i = xi ⊕ ai ⊕ (ui−1* v′i), then yi ≠ yi′.

Therefore, if V ≠ V′, it is possible to build a vector pair {X, A} such that GV(X, A) ≠ GV′(X, A). Thus, each of the 2n values of the control vector V has its corresponding unique modification. This proves the theorem.

Theorem 4.8

For an arbitrary fixed initial value u0, each ECA ΣV("*", u0) implements different sets of modifications, i.e., there are two sets, {ΣV("*", 1)} and {ΣV("*", 0)}, corresponding to 10 Boolean operations, each having 10 ECA implementations.

Proof

Obviously, if the "*" and "°" operations are different, the ∃ {u, v} pair is such that u*v ≠ u°v. If, for a value of the transition functions ui and ui′, the ΣV("*", u0) and ΣV("°", u0) equalities are true for the ui = u and u′u ECAs, then Click To expand , and [image] , i.e., the ΣV("*", u0) and ΣV("°", u0) ECAs aren't equivalent. If we prove that the given condition of existence of the ui = u and ui′ = u pair is always met, the theorem will be proved. If this condition isn't met, then two variants are possible: (1) Click To expand , [image] . In the former case, it follows from (4.15) that

which is impossible, since the second factor xi ⊕ e ⊕ ai depends on the e parameter, and it can take the 0 value. The latter of these cases is impossible, because it follows from (4.15) that the ui sequences aren't constants. This proves the theorem.

Let's discuss some probabilistic properties of the ΣV("*", u0) ECA. First of all, note that, according to Corollary 4.6, the types of ECAs provide an equal probability of 0 or 1 at the operation output.

In the ΣV("*", u0) ECA, the transformation is performed according to the formula ∀i∊{1, …, n} yi = xi ⊕ ai ⊕ (ui−1* v′i) which, as we mentioned earlier, corresponds to "laying" the yi = (ui−1* v′i) gamma over the "xi ⊕ ai" sum. Consider the property of the recurrent sequence of carry bits {ui}, which is the generating sequence for γi.

Let's compute the Pr{ui = 1} probability. It follows from (4.15) that ui = 1 in the following cases: ai = 1, ui−1*vi = 1; ai = 1, ui−1*vi = 0, xi ⊕ e = 1; ai = 0, ui−1*vi = 1, xi ⊕ e = 1.

It follows from the Pr{ai = 1} = Pr{ai = 0} = 1/2 assumption that:

Click To expand

If we consider the ΣV("∨", 0) ECA as an example, then

Taking into account that Pr{vi = 1} = Pr{vi = 0} = 1/2, we obtain:

Click To expand

and

Substituting the obtained values of probabilities into Formula (4.16), we have the following recurrence:

For Pr{xi = 1} = Pr{xi = 0} = 1/2, we have Pr{ui = 1} = 1/2 + (1/4)Pr{ui−1 = 1}. It follows from the solution of this recurrence that, for u0 = 0,

i.e., for the ECA of this type ("*" = "∨" and u0 = 0), the carry bit ui prevails over the zero bit.

Similarly, for other types of ECAs synthesized with various "*" Boolean operations and [image] initial conditions, it is possible to obtain the table of limiting probabilities [image] (Table 4.1). We suggest that the interested reader prove this as an exercise.

Table 4.1: The [image] Limiting Probabilities
u0 = 0 | 2/3 | 2/5 | 1/3 | 3/5 | 1/2 | 1/2 | 3/5 | 1/3 | 2/3 | 2/5
u0 = 1 | 2/3 | 2/5 | 1/3 | 3/5 | 1/2 | 1/2 | 3/5 | 1/3 | 2/3 | 2/5

Reasoning from the above, ECA transition functions with the (U(i−1) ⊕ vi) and [image] synthesizers possess the best probabilistic properties. Such adders, in addition to parametrically functional inversibility by X and the absence of collisions on A, are effectively complete, which follows from Corollary 4.4.

Disadvantages common to all ECAs are their insufficient differential properties and high linearity.

According to the method of their construction, ECAs occupy the lowest position in the classification of the CST recursive model. Obviously, if, according to Criterion 4.1, we consider more complex types of generating polynomials {M″i(V)}, {M″′i(V)}, and functions {φ(V)i} conforming to the ΔΨ(V, e)i = 0 condition, we'll be able to synthesize new families of controlled adders that possess various properties. Such adders are called combined controlled adders (CCA).

4.3.6. The Non-Bijective Model of a Controlled Operational Substitution

In the previous sections, special attention was paid to bijective models of COSs as basic cryptographic primitives for block ciphers. The requirement of bijectivity poses certain limitations on other cryptographic properties, particularly on their general non-linearity and differential characteristics. However, in some cases, such as when designing a round function in a Feistel scheme, bijectivity is desirable but not necessary. In such a case, it makes sense to use non-bijective transformations with a low complexity, which provide high values of non-linearity and error propagation, though insignificantly narrowing the space of binary vectors at the transformation output.

Such transformations are quite effectively implemented within a serial non-bijective COS model [image] which is implemented by the rotation cyclic shift of arguments of the generating Boolean functions according to the following rules:

where ki ≦ n, X(i, i−ki+1 = (xi, i−ki+1, xi, i−ki+2, … xi, and the arithmetic operations on superscripts are performed on modulo n.

Experiments on the implementation of such a model have revealed that these cryptographic primitives make the space of output X binary vectors less than half as narrow (from 15 to 40%). The proof of this and the discussion of other properties of the non-bijective serial model [image] is beyond this book. Prototypes of such transformations are cellular automata, widely known in physics and mathematics [101].

Taking into account the results obtained in Sections 4.3.1–4.3.5, we give you a diagram of the models of controlled operational substitutions (Fig. 4.11).

Click To expand
Figure 4.11: The classification diagram for the models of controlled operational substitutions

4.3.7. Synthesizing Combined Controlled Adders and Controlled Schematic Transformers

Combined controlled adders (CCA) and controlled schematic transformers (CST) (see Definition 4.42) more flexibly use control mechanisms in substitution operations, and provide increased linearity and other useful features of cryptographic primitives as compared to elementary controlled adders (ECA). In this case, they are the most promising elements providing significantly increased security against modern cryptographic attacks for block ciphers created based on them. It seems especially reasonable to create CCAs within a parametrically functionally inversible model Ω″σ, ef and a parametrically schematically inversible recursive model Ω″σ, es , and to create CSTs within a bijective serial model S′Σ and a non-bijective serial model [image] .

When synthesizing various COSs, one should keep in mind that both the types of the fV, ei output functions and the types of the ΨV, ei transition functions can be basically different, which provides a sufficiently flexible mechanism of complicating the whole transformation performed by the COS. However, tasks related to decreasing the complexity and time taken up by transformation implementations can become the dominant ones. The solutions to these tasks are achieved by:

  • Fully or partially unifying the output and transition functions

  • Limiting the number of their variables

Sets of such functions are called prototypes of Boolean functions generating COSs. The necessary mathematical properties of CCA and CST that relate to the modification's uniqueness, completeness, absence of collisions, parametrical inversibility, regularity, etc., can be obtained as a result of designing these operations according to the principles presented in Sections 4.3.2–4.3.5.

The following schemes can be proposed as basic optimized schemes that will take into account various aspects of the requirements placed on COSs:

  1. When fast parametrically inversible transformations with a low complexity are needed, it makes sense to use ΣV("*", u0) ECAs of the Ω″σ, ef model, or elementary CSTs of the S″σ, es, model.

  2. When you need a fast non-linear bijective or non-bijective transformation without inversibility, for example, in a round function F of a Feistel scheme, we suggest that you use CSTs of the S′σ and [image] models with truncated and uniformed functions Ψi(V) having the following form:

    Click To expand

    where X(i−1, i−k = (xi−k, xi−k+1, … xi−1 and, for the S′σ model, X(0, 1-k = (x0, x−1, … x1-k are the initial conditions or k values obtained as a result of expanding the GF(2)n→GF(2)n+k transformation of the X vector. These implementations of the S′σ and [image] models don't require a hardware solution, and they have a high performance, since all transformations yi = xi ⊕ φ(V) (X(i−1), A) can be performed simultaneously, in parallel (Section 4.5.2).

  3. When an inversible transformation that provides a significantly increased security of block ciphers against modern methods of mathematical analysis is needed, we suggest that you use CSTs of the S′σ, es model and CCAs of the Ω″σ, ef and Ω″σ, es models with truncated and uniformed output and transition functions having the following form:

    • The S″σ, es model: ∀i∊{1…, n}, yi = xi ⊕ φ(V)(δe(X(i−1, i−k), Y(i−1, i−k)), A)

    • The Ω″σ, ef model: ∀i∊{1…, n}, yi = xi ⊕ φ(V)(U(i−1, i−k), A)

    • The Ω″σ, es model: ∀i∊{1…, n}, yi = xi ⊕ φ(V)(U(i−1, i−k), A)

    where U(0, 1-max{k, l}) and X(0, 1-k) are the initial conditions or values obtained as a result of an "expanding" transformation of the X vector.

To conclude the section, we'd like to note that, in order to increase the operating speed of CCAs and CSTs, the principles of designing such operations are commonly used. In connection with this, you should keep in mind that in COSs, only the use of more complicated and not completely unified generating functions with a high deg(f) degree makes it possible to perform highly non-linear substitutions in full measure. In a simplified form, such CCAs and CSTs can only perform fast auxiliary operations requiring further transformations in combination with other cryptographic primitives.

4.3.8. Properties of Boolean Functions Generating Controlled Operational Substitutions

In addition to the aforementioned structural properties of CCA and CST, of great importance are the special mathematical properties of the Boolean functions themselves that comprise these COSs, and in many respects determine the security of transformations against various cryptanalytic methods. These properties are fully determined by the requirements for cryptographic primitives and their generating Boolean functions (Section 4.2.11). The following characteristics can be listed among these properties:

  • The degree of a function's non-linearity N(f) or N*(f) (Sections 4.2.4 and 4.2.9)

  • The algebraic degree of a Boolean function deg(f) (Section 4.2.2)

  • Conforming to the strict avalanche criterion (SAC(k)) or the propagation criterion (PC(l, k)) (Sections 4.2.5 and 4.2.6)

  • Correlation immunity (CI(1), CI(1, X*)) or (n, m, k)-resilience R(n, m, k) (Section 4.2.7)

The properties listed above are interrelated, and can conflict to some extent. For example, the most linear Boolean functions — bent functions (Section 4.2.8) — conform to the PC(n) criterion, but they can not conform to the PC(l, k) criterion. At the same time, bent functions don't possess perfect correlation immunity properties, since, according to the definition, the condition ∀ α∊ GF(2)n, U*α(f)=±2n/2 is always true, i.e., these functions have a correlation with each linear Boolean function. Besides which, bent functions can contain only an even number of n variables and have limitations on the degree of the algebraic normal form deg(f)≤n/2.

Hence, it is impossible to build ideal generating functions that maximally conform to all these requirements. Thus, when choosing such functions for a COS, it is necessary to take into account the specific demands and peculiarities of the block ciphers being designed. The significance of certain properties of generating Boolean functions becomes visible after analyzing the influence of the COS on the cipher's security against various cryptanalytic methods, in particular, against the most powerful ones — differential and linear cryptanalysis.

At the same time, we concede that bent functions play a special role in cryptographic transformations, because they are maximally non-linear and possess minimal general autocorrelation and equally low correlation with each linear Boolean function. In connection with this, it seems reasonable to take a closer look at using bent functions as basic elements when designing COSs.

4.3.9. Optimizing Controlled Operational Substitutions Based on Special Boolean Functions

In regard to the optimal design of COS generating functions, of great importance is the fact that, according to Statement 4.17 (Section 4.2.9), if a Boolean function f(X)(X∊GF(2)n) is represented as f(X) = haff(X1)⊕ h(X2), where X1∊ GF(2)l, X2∊ GF(2)n-l, and haff(X1) is an affine function, then the maximum linearity for f(X) is achieved at h(X2) = hbent(X2) and determined by the formula N(h) = 2n−1 −2 ½(n+l)−1.

Note that the output functions for the CCA of the bijective model Ω′σ can only have one of the following four forms (Sections 4.3.3 and 4.3.4):

  • f(V)i = xi ⊕ φ(V)i (U(i−1), A)

  • f(V)i = xi ⊕ ai ⊕ φ(V)i (U(i−1), A(i−1))

  • f(V)i = xi ⊕ vi ⊕ φ(V(i−1)i (U(i−1), A)

  • f(V)i = xi ⊕ ai ⊕ vi ⊕ φ(V(i−1)i (U(i−1), A(i−1))

For the CST of the bijective model S′σ, there are the following generating functions, respectively:

  • f(V)i = xi ⊕ φ(V)i (X(i−1), A)

  • f(V)i = xi ⊕ ai ⊕ φ(V)i (X(i−1), A(i−1))

  • f(V)i = xi ⊕ vi ⊕ φ(V(i−1)i (X(i−1), A)

  • f(V)i = xi ⊕ ai ⊕ vi ⊕ φ(V(i−1)i (X(i−1), A(i−1))

Since the prototypes of the generating functions of the bijective models S′σ and Ω′σ have the aforementioned form from Statement 4.17, i.e., f(X) = haff(X1)⊕ φ(X2) and the l parameter takes the minimum values (l=1, l=2, and l=3), then, for φ(X2) = φbent(X2), the f(X) functions will have maximum non-linearity within these models. Besides which, functions of this type have PC(n) propagation characteristics close to optimum.

Indeed, the function h(X) = h(X1 ∥ X2) = haff(X1)⊕ hbent(X2) conforms to the PC(n) criterion over all GF(2)n except for the vector set GF(2)l × {0}n-l, where {0}n−l is the zero vector with the n − l dimension. Therefore, the PC(n) criterion is met on a set of 2n − 2l elements which approximates the maximum values 2n when l = 1 (or 2, or 3). This approach to designing COS is the main prerequisite for increasing the security of block ciphers based on COS — first of all against linear cryptanalysis, and second, against differential cryptanalysis.

From the viewpoint of differential cryptanalysis, when optimizing COS, it is first of all necessary to adhere to somewhat different principles. Functions that conform to the PC(l, k) criterion of a high degree l and order k are more promising as Boolean functions φ i. According to the propositions in Section 4.2.6, in addition to high non-linearity, they possess good autocorrelation properties for fixed values of some variables. One peculiarity of using such functions is that, by their nature, they provide a minimum dependence between the components of avalanche vectors (Section 4.2.6) of the GV(X, A)= {f(V, e)1, f(V, e)2, … f(V, e)m} function that implements COS. The presence of this property plays a decisive role when it comes to increasing the security against differential cryptanalysis by averaging the PrX (GV⊕Δ V X⊕Δ X, A⊕Δ A)⊕ GV(X, A) = β) probabilities (see Statement 4.9).

Unlike CST, a basic feature of CCA optimization that significantly influences the transformation quality is the requirement of providing for equal probabilities and the independence of the components of the U(i−1) vectors generated by the {Ψ(V, e)j} transition functions that are the arguments of the {f(V, e)i} output functions. The necessity of this requirement is related to the fact that a high non-linearity of the output functions whose arguments are the {Ψ(V, e)j} transition functions can be fully ensured only if equal probabilities and the independence of the values of the transition functions is provided. According to the propositions in Section 4.2.7, these properties are provided by using balanced Boolean functions uj = Ψ(V, e)j (xj, U(j−1)), A) that are resilient or correlationally immune relative to U(j−1) sets. Thus, when designing transition functions for a CCA, the main thing is to select them from the variety of correlationally immune Boolean functions that possess a high non-linearity and an increased degree of the algebraic normal form deg(f). Examples of bent functions, correlationally immune functions, and those having high values of propagation and that are suitable as generating functions for CCA and CST are given in Sections 4.2.6–4.2.8. However, when creating a parametrically functionally inversible CCA of the Ω″σ, ef model, it should be taken into account that, in such models, transition functions are analytically expressed using output functions, as is required by Criterions 4.1 and 4.2, which significantly limits the possibilities of synthesizing transition functions with high correlationally immune parameters.

4.3.10. General Notes on Controlled Operational Substitutions

Taking into account the advantages of COS presented in this chapter, it is all the same necessary to clearly explain their limits as non-linear cryptographic primitives. These limitations are related to the fact that, despite the quite high complexity of transformations, COSs are dual in nature, i.e., they hold an intermediate position between two "poles"—non-linear mathematical operations and large S-boxes. The degree of approximation to one or the other "pole" depends on the COS model, as well as the diversity and complexity of the prototypes of the Boolean functions generating the COS. Thus, when synthesizing a COS, you can choose various cryptographic characteristics, from low to rather high values. Taking into account the dual nature of COS, the potentialities of these cryptographic primitives are limited by the following things:

  • When estimating the COS' non-linearity, it is necessary to keep in mind that, due to the design methods, COSs generating Boolean functions {f(V, e)i} either don't depend on all the components of the X vector being transformed (the S′σ model), or such a dependence is only provided in recursive form (the Ω′σ model). This is why the resulting transformation GV(X, A) cannot reach the maximum possible values of non-linearity and propagation (Sections 4.2.8 and 4.2.10), which are only available to vector bent functions having a complex implementation and a number of cryptographic shortcomings.

  • With a small number of various generating functions {f(V, e)i} in linear combinations of the [image] form, the absorption of some members sometimes takes place, which, according to Definitions 4.15 and 4.16, can lead to a decrease in the general and mean non-linearity of the COS.

  • The avalanche effect of the GV(X, A) transformation specifying a COS propagates changes only within a portion of the output vector whose length is equal to the number of variables in the corresponding f(V, e)j Boolean functions.

  • In many cases, there is a certain interdependence between the components of each avalanche vector of the GV(X, A) transformation (Section 4.2.6), which can decrease the uniformity of their probability distribution, thus degrading the differential properties of the vector transformation as a whole.

These disadvantages of COSs could reduce their advantages to zero in many respects. However, this would be true only if special S-boxes with sizes from 32 to 128 bits were created, which is practically impossible due to the high mathematical complexity of such transformations. Indeed, fast and effective implementation of S-boxes in block ciphers is only possible if they are tabularly specified or by using simple functional representation that limits the sizes of S-boxes to 4÷3 bits. Such transformations are comparable in their non-linearity with transformation performed by COS generating Boolean functions, though other cryptographic features of S-boxes are weaker. Besides which, despite high values of non-linearity and the avalanche effect within a small length of one S-box, the resulting vector transformation consisting of several parallel S-boxes cannot have high cryptographic characteristics. Thus, if we consider a 32 to 128-bit transformation of a data block as a whole, the cryptographic properties of the applicable small S-boxes simply cannot be optimum. If we take into account the advantages of COSs mentioned in Sections 4.2.3 and 4.2.4, as well as some other disadvantages of S-boxes, we can conclude that COSs as a new cryptographic primitives are in many cases more effective than S-boxes.

To conclude this section, we would like to remind the reader that a strategic area of operationally designing controlled substitutions is creating fast non-linear transformations with a low complexity that are suitable for hardware and, in some cases, software implementation. This approach doesn't make it possible to get the most out of COSs as non-linear cryptographic primitives, and requires adjusting the "speed-quality" balance. In connection with this, as we mentioned in Section 4.3.7, to increase the effectiveness of the general transformation within one round of the Feistel scheme and other algorithms of block encryption, it is necessary to use controlled operational substitutions in flexible combination with other cryptographic primitives.

4.3.11. Summary

To summarize Section 4.3:

  • The propositions of this section illustrate a non-standard approach to the design of new cryptographic primitives. The suggested controlled operational substitutions can be a certain alternative to traditional S-boxes and standard mathematical operations.

  • In the context of the conducted modeling of various types of controlled operational substitutions, a serial model was isolated that provides the following properties of new cryptographic primitives:

    • Bijectivity of mappings, including parametrical inversibility, which makes it possible to implement a direct and inverse transformation without changing the scheme of the block cipher

    • Regularity of mappings, which provides security against direct statistical attacks

    • Uniqueness and completeness (including effective completeness) of transformations on key elements, and also the absence of collisions on data being transformed

    • A high correlation immunity level of transformations, which defines a low statistical independence of the values of each output function on the values of the arguments at the input of the controlled operational substitution

  • According to the presented classification of the models of controlled operational substitutions, two main model classes were isolated:

    • Parametrically schematically inversible

    • Parametrically functionally inversible

  • It was determined that, within the parametrically schematically inversible model, its most effective implementations are those in the form of a controlled schematic transformer, and, for the round function of the Feistel scheme, the most promising are transformers that only perform fast direct transformations.

  • It was also noted that, among parametrically functionally inversible controlled operational substitutions, a special position is held by the parametrically inversible recursive model, within which we defined the general conditions of parametrical inversibility, and gave a classification of the elementary and combined controlled adders, implementing a wide range of non-linear transformations.

  • Among the variants of controlled schematic transformers and combined controlled adders, the most applicable operations are chosen, and the main principles of their optimization based on Boolean functions of a special type are formulated.

  • Block ciphers based on controlled operational substitutions have the potential to increase security against differential and linear cryptanalysis due to their use of Boolean functions based on bent functions and functions that conform to the PC(l, k) criterion as output functions, and using balanced correlation immune CI(l) functions of high non-linearity as transition functions.

  • Controlled operational substitutions intended for a high-speed hardware implementation have non-linearity, correlation immunity, and errors propagation parameters that are adjustable within a certain range.

  • To provide a high effectiveness of block ciphers within one transformation round, it makes sense to use controlled operational substitutions in combination with other controlled transformations, such as boxes of controlled permutations.

For a more comprehensive estimation of the principles of effectively synthesizing controlled operational substitutions, Section 4.4 discusses the mechanisms of the influence of these operations on securing block ciphers against the most powerful cryptographic attacks.


4.4. The Influence of Controlled Operational Substitutions on the Security of Block Ciphers against Cryptanalysis

4.4.1. General Information on Analytical and Technological Attacks on Block Ciphers

When designing block ciphers based on controlled operational substitutions (COS) and other cryptographic primitives, providing for the security of these ciphers against analytic and technological attacks is of prime importance. The practice of recent years has revealed that the most powerful analytic methods of cipher cryptanalysis are differential cryptanalysis (DCA) [8] and linear cryptanalysis (LCA) [50], and also methods that derive from them that basically determine the security level of block algorithms. Among the technological attacks on block ciphers, we can note differential fault cryptanalysis [10] and differential power cryptanalysis [43].

In block ciphers, the use of new cryptographic primitives — controlled permutations and operational substitutions — creates a number of prerequisites necessary for creating fast algorithms that are secure against modern cryptanalytic methods. The reasons for the security of such ciphers are related to the peculiarities of building controlled operations, certain mechanisms of control over them, and methods of using these operations in cryptoschemes.

An analysis of the proposed block ciphers based on controlled operations has revealed their high security against the classical DCA and LCA methods as the main criteria of the cryptographic security of algorithms. In addition to the mentioned methods, block ciphers based on the new operations demonstrated their security against other cryptanalytic methods.

In particular, a high degree and significant complexity of the resulting Boolean functions of round transformation of such ciphers hamper interpolation attacks [37] and high order differential cryptanalysis [42].

The dependence of the control vector of a controlled operation on all the bits of a data block, and the fact that the block being transformed is not divided into parts, make it impossible to effectively apply the methods of truncated differentials [41, 42], in contrast to other ciphers that use controlled rotations (RC5, RC6) and S-boxes.

The absence of rare differentials of the data being transformed makes such methods as differential cryptanalysis basing on impossible differentials ineffective [6].

The uniformity of the transformation within the whole cipher makes it impossible to obtain the needed effect when using such a type of differential cryptanalysis as a boomerang attack [96].

Despite the absence of preliminary procedures for computing working round keys, and the direct use of secret keys in the cipher, the availability of a special schedule for using them in the algorithm as well as some special procedures secure the cipher against various types of so-called slide attacks [11, 12] and related-key attacks [40], which give certain results, for example, when analyzing the GOST block cipher.

Using a large number of keys in each round makes such a powerful cryptanalytic method as differential fault analysis ineffective, which is highly effective when analyzing other ciphers (DES, GOST, etc.).

The high statistical robustness of controlled operations in the context of the controlled transformations potentially increases the security of block ciphers against not only existing but also future cryptographic attacks.

Since microelectronic technologies are developing rapidly, the introduction of block ciphers built on controlled operations into high-speed data protection systems on a wide scale makes them more promising than other block ciphers which don't take into account modern advances in cryptanalysis and computer technologies.

A detailed description of all the listed methods of cryptanalysis of block ciphers based on controlled operations is beyond the scope of this book. In the following sections, the technique for investigations in this quite diversified area of mathematics is illustrated, along with the main cryptanalytic methods — the basic differential and linear cryptanalysis, and issues of the security of these ciphers against technological attacks are also discussed.

The DCA and LCA methods are considered as separate directions in the cryptographic analysis of algorithms, but there is a deep interrelation between them, as indicated by their features, which will be discussed later. At the same time, there are examples where block algorithms are secure against one of these methods, but not against the other.

The essence of DCA is the analysis of how the changes in the plaintext propagate in the ciphertext (propagation properties).

Such characteristics are closely related to the autocorrelation properties of Boolean functions that generate round transformations of block ciphers. According to Sections 4.2.5 and 4.2.6, the autocorrelation properties of these transformations are mainly determined by the following:

  • The propagation criterion PC(n, l) for each Boolean function generating a cryptographic primitive

  • The joint distribution of avalanche vectors of the whole transformation in the encryption round

LCA is based on the linear approximation of a non-linear round transformation. Such linear properties are closely related to the correlation of the Boolean functions generating these transformations with a set of affine functions. The quality of linearizations is determined by such properties as the linearity and non-linearity of the Boolean functions generating these transformations with a set of affine functions. The quality of linearizations is determined by such properties as the linearity and non-linearity of the Boolean functions generating the cryptographic primitive (L(f), N(f)) and of the entire round transformation (L(F), N(F)) (Sections 4.2.8–4.2.10).

Thus, from a mathematical point of view, DCA should be considered an autocorrelational analysis of algorithms, LCA being correlational. In both cases, the main techniques of investigating the properties of cryptographic primitives is the Walsh-Hadamard transformation, which is a special case of a discrete Fourier transform (Section 4.2.3). The common nature of DCA and LCA [16, 23] is testified to by the fact that the only transformations that attain ideal security against these types of cryptanalysis are vector bent functions (Section 4.2.8), i.e., the only functions that possess the maximum non-linearity N(F) and the highest propagation degree PC(n). Unfortunately, it isn't reasonable to use transformations based only on bent functions in block ciphers. Moreover, it is sometimes impossible to do so, since such transformations are unbalanced and non-bijective. In connection with this, when actually designing cryptographic primitives such as COS, one should first of all use bijective mappings based on a combination of Boolean functions that possess different cryptographic properties (Section 4.2), including the use of bent functions. Using DCA or LCA is always appropriate for such mappings.

Testing block ciphers for their security against DCA and LCA involves a whole package of complex mathematical methods, and requires certain skills in solving this problem. The fact is that when carrying out such a cryptanalysis, it is necessary not only to consider the differential and linear properties of individual cryptographic primitives that comprise a round transformation of block ciphers, but also to take into account their arrangement, and therefore their influence on each other. When the entire system of cryptographic primitives is highly complex, solving the general cryptanalytic problem can be a rather difficult mathematical task. And finally, it isn't inconceivable that a set of complex transformations will result in a cryptographically weak cipher. It might be that adding seemingly complicating elements to a secure round transformation will weaken the algorithm. This is why, when designing block ciphers, designers try to use theoretically computable constructions that allow you to definitely estimate the security of block algorithms against modern cryptanalytic methods.

Because of the complexity of cryptanalytic issues, a full discussion of these problems is beyond the scope of this book. In the next sections, only the basic principles of DCA and LCA, along with general mechanisms of the influence of controlled operations on the security of block ciphers against these cryptattacks, will be covered to some extent. In Chapter 6, examples of a practical differential cryptanalysis of some block algorithms based on controlled operations are given as an illustration.

4.4.2. The Theoretical Fundamentals of Differential Cryptanalysis

To determine the mechanisms of the influence of cryptographic primitives such as COS on the security of block ciphers against DCA, we're going to introduce some notions and discuss the main principles of performing DCA for DES-like block algorithms that have an even data block size n and that perform an r-round transformation. Remember that the algorithm of the Feistel scheme has the following form:

  1. For I = 1 to I = r − 1 do

    Click To expand

  2. For i = r do

    Click To expand
Definition 4.45

The differences between two blocks X and X* or Y and Y* are the expressions having the following form [48]: Δ X= X· (X*)−1, Δ Y= Y· (Y*)−1, where "·" is a group operation (a set of operations) on the vectors from GF(2)n, and (X*)−1 and (Y*)−1 are the inverse elements for X* and Y* in this group.

As a rule, the above operation corresponds to the method of action of the round key Ki on the original block XL in the round function F(XL(i−1), Ki). As it follows from the earlier example, for DES and other block ciphers, such an operation is most often the "⊕" operation, for which the differences take the following form: Δ X= X⊕ X* = Δ XL ∥ Δ XR, Δ Y= Y⊕ Y* = Δ YL ∥ Δ YR. For the sake of simplicity, the "⊕" operation is hereafter used as the group operation. To specify that the differences belong to a particular transformation round, we're going to use the following designation: Δ Y(i)= Y(i)⊕ Y*(i) = Δ YL(i) ∥ Δ YR(i). When there is only one transformation round, the F(XL,K) designation for the round function is used, and the one-round transformation itself is designated as E(X, K).

Definition 4.46

The s-round characteristic of a block cipher is the following sequence: {Δ X, Δ Y(1), Δ Y(2), … Δ, Y(s)}), where Δ X, Δ Y(i)∊GF(2)n, s≤r.

Definition 4.47

The s-round difference (differential) is the pair {Δ X, Δ Y(s)} where Δ X, Δ Y(s) ∊GF(2)n, s ≤ r.

Definition 4.48

An s-round difference {Δ X, Δ Y(s)} (s-round characteristic {Δ X, Δ Y(1), Δ Y(2), … Δ, Y(s)} is called completed (right) for the blocks X and X* and the KS = {K1, …, Ks} round keys if, in the course of intermediate round transformations, Δ X is mapped to Δ Y(s), taking the values Δ Y(1), Y(2), … Δ, Y(s) sequentially.

It follows from the definition of the difference that for Δ X = 0, ∀s∊{1, …, r}, Δ Y(s) = 0, and this zero difference doesn't contain any information about the round keys. From here on, we'll assume that the initial zero differences are excluded from consideration. The probability of completing an s-round difference {Δ X, Δ Y(s)} when using K round keys can be respectively considered conditional probabilities according to X with the following form:

which, according to the formula of complete probability, are connected with the following relationship:

Click To expand

According to [48], the stochastic equivalence hypothesis is of great importance when launching DCA. This hypothesis is considered true if ∀s∊{1, …, r}, PrXΔ Y(s)/Δ X,Ks)≈PrX,K Δ Y(s)/Δ X) for most round keys KS (we examine a joint probability distribution on X and on the KS key set, provided that Δ X). Thus, for most keys, this probability doesn't depend on the values of the round keys, which can be written as an approximate equality — PrXΔ Y(s)/Δ X)≈PrX,KΔ Y(s)/Δ X). Since this hypothesis is true for most currently existing block algorithms, we're only going to look at these ciphers.

Definition 4.49

A round transformation E(X(i−1), Ki) is called weak if the round key Ki can be computed from the known values Y(i), Y*(i), and Y(i), Y*(i), and Δ X(i−1).

The possibility of performing DCA is related to the availability of a (r − 1)-round difference {Δ X, Δ Y(r−1)} (or a {Δ X, Δ Y(1), Δ Y(2), … Δ Y(r−1)} characteristic), for which the following condition is true: PrXΔ Y(r−1) / Δ X)< 1/2n.

When the stochastic equivalence hypothesis is true, and a weak round transformation is available, the following basic DCA algorithm, which is a modification of a chosen plaintext attack, is used:

  1. An (r−1)-round difference {Δ X, Δ Y(r−1)} is selected, or a corresponding characteristic is selected with the pr−1 = PrXΔ Y(r−1) / Δ X)< 1/2n conditional probability being the maximum or close to the maximum. As a rule, cryptanalysis try to use Δ X vectors with a small Hamming weight in order to simplify the calculations.

  2. An original text X∊GF(2)n is chosen randomly and equiprobably (or in a special manner), and the X* X⊕Δ X text is generated.

  3. The X and X* texts are transformed with the block cipher to ciphertexts Y(r), Y*(r) with the unknown round keys K = {K1, …, Kr}.

  4. Using the weakness of the round transformation E(X(r−1), Kr) and assuming that Δ Y(r − 1) is known with the pr−1 probability, the K(X, Δ X, Δ Y(r−1)) set of all possible values of the Kr round key is analytically determined from the available texts Y(r), Y*(r). For each chosen X, these values are accumulated in the set [image] .

  5. Steps 1 to 4 are repeated until the local maximum appears in the K*(Δ X, Δ X, Δ Y(r−1)) set for one value or a confined set of values of the Kr round key, among which its true value is present.

  6. Next, after the influence of the last, rth round is removed, steps 1 to 5 are repeated for the weakened (r − 1)-round transformation until the Kr−1 key is obtained, and so on until K1. In some cases, such as DES, the other round keys are obtained by trying every possible key, taking into account the method of their generation.

If difference characteristics are used in DCA, they are usually built as periodical chains of small sequences of one-round characteristics. Such chains are called iterated characteristics. To a certain degree of approximation, the probability of these characteristics pr−1 is a product of the probabilities of their component one-round characteristics, assuming they are independent. If, as a measure of the complexity MD(r) of the DCA of a block cipher consisting of r rounds, we take the number of pairs of input and output data blocks necessary to determine the round key Kr, the following estimation is valid [23]:

Click To expand

Therefore, for a p(max)r−1 close to 1/2n, the values of the MD(r) complexity will be commensurable, or greater than 2n, which is the total number of binary texts that are n bits long, thus making differential cryptanalysis ineffective.

A more precise estimation of the DCA's complexity can be obtained using the so called signal-to-noise (S/N) ratio [8], in which the signal is taken to mean the average number of repetitions of the correct key, the noise meaning the average number of random keys in the K*(Δ X, Δ Y(r − 1)) set. Quantitatively, this relationship is determined as follows: S/N = (mp)/(m αβ/2k) = (2kp)/(αβ), where k is the number of bits being computed, m is the number of plaintext pairs (X, X ⊕ Δ X) being investigated, p is the probability of the used characteristic (Δ X, …, Δ Y), α is the average number of the obtained keys in the K(X, Δ X, Δ Y(r−1)) set for every (X, X ⊕ Δ X) pair, and β is the ratio of the number of the (X, X ⊕ Δ X) pairs that result in a non-conflicting difference Δ Y (in other words, that aren't rejected) to the total number m of plaintext pairs being analyzed. According to Definition 4.48, pairs that fully conform to the characteristic at the (r−1)th round are called right pairs. The pairs that aren't rejected after r rounds, but only partly correspond to the (r−1)th round characteristic, are called wrong pairs. An important result of this reasoning is that the total number of right pairs necessary for a successful DCA directly depends on the S/N ratio. It was experimentally determined for a DES block cipher reduced to 15 rounds [8] that with S/N ≈ 1, only 3 or 4 right pairs are needed for an effective DCA.

Estimations of the DCA's complexity that are valuable in practice are obtained for a large class of block algorithms [66], called Markov ciphers.

Definition 4.50

A block algorithm is called a Markov cipher [48] if for ∀ X ∊ GF(2)n and with random and uniform distribution of the round keys K = {K1, …, Kr} the PrK Δ Y(1)/Δ X, X) = PrX,K Δ Y(1)/Δ X) relationship is true.

If the stochastic equivalence hypothesis is true, the equality given in the definition takes the following form: Pr(Δ Y(1)/Δ X, X) = PrX(Δ Y(1)/Δ X).

Thus, a distinguishing feature of Markov algorithms is the fact that the distribution of the probabilities of one-round differences does not depend on the plaintext chosen. For example, DES, GOST 28147-89, IDEA, and some others are Markov ciphers.

Obviously, the Markov property and the stochastic equivalence hypothesis are closely related to each other, since they reflect the close characteristics of block ciphers relative to the original texts in the former case, and to the keys in the latter case.

Definition 4.51

The sequence of differences Δ X, Δ Y(1) …, Δ Y(r) makes up a Markov chain if, for ∀s∊{1, …r}, the following relationship is true:

The Markov chain for a block cipher is determined by the following parameters:

  • The initial distribution of probabilities of the original states p(0)i = PrX(Δ X = Δ Y(0) = αj), where α1, … α2n, is a lexicographically ordered sequence of all possible values of binary vectors having a length of n (the chain states).

  • A one-round matrix of differences (transition probabilities) P = ∥pi,j ∥ 2n × 2n where pi,j = PrX Δ Y(1) = αj/ Δ Y(0) = αi) PrX(E(X,K) ⊕ E(X ⊕ αi K = αj).

According to Section 4.2.5, the transition probabilities are related to the autocorrelation characteristics of a one-round transformation in the following way [23]:

In terms of the P matrix, the security of a cipher against DCA depends on the [image] value. For bijective mappings, the p(max)≤1/2n−1 equality is always true [23].

For Markov ciphers comprising a Markov chain of a sequence of s-round characteristics, the following relationship is true [48]:

Click To expand

Taking into account Relationship (4.17), we have the following relationship for s-round differences:

Click To expand

Theoretically, these formulas make it possible to obtain the distribution of probabilities of s-round characteristics and s-round differences for the entire Markov cipher, based on one-round distributions. However, formulas of this kind can appear quite complicated in practice for actual computations.

In connection with this, of great practical importance is the p(max)r−1 < 2 p(max))2 inequality when r ≥ 4 [66], from which it follows that, to provide for security against DCA, it will suffice to build a round function in such a way that the p(max) probability for a one-round difference is as low as possible. In this case, according to Condition (4.18), a high work effort MD(r) of DCA for the whole block cipher is guaranteed.

As a rule, a sufficient condition indicating that a block cipher is a Markov one is the use of the "⊕" operation when "applying" the key to the data being transformed (X ⊗ K) [48]. To summarize, it is easy to demonstrate that the equivalently sufficient condition for a block cipher of being a Markov cipher is usually that the (Y = f(X, K)) function "applying" the round key K to the data being transformed (X) is bijective by K and X separately (Section 4.3.1). (The proof of this statement is beyond the scope of this book.) According to the proposition in Section 4.3.3, such a function can be fully implemented with COS, which is another advantageous feature of this cryptographic primitive.

To conclude the section, we want to remind you that the reasoning concerning the security of block ciphers against DCA was attained under the assumption that the stochastic equivalence hypothesis is true. When it isn't, the estimations of the probabilities of differences or characteristics must be made not only from the values of the original texts X ∊ GF(2)n, but also from the whole set of keys K ∊ GF(2)rn/2, which significantly complicates the estimation of the security of the designed block ciphers against DCA.

We must also pay attention to the fact that the estimations given in this section only provide sufficient conditions of the security of Markov block ciphers against DCA. In actual practice, there can be a wealth of block algorithms, including non-Markov ones, for which the given conditions aren't met, but whose ciphers are nevertheless secure against this kind of cryptanalysis. Such conclusions are often quite hard to obtain, even for one enciphering round. A cryptanalyst who tries to find the weaknesses of a cryptalgorithm against DCA is in a similar situation.

In this case, the problem is solved in a special form, i.e., only those characteristics or differences whose probabilities can be actually estimated are taken into consideration. As we mentioned earlier, the practically applicable characteristics of the whole cipher are usually chains of iterative characteristics, i.e., small, periodically repeating sequences of one-round characteristics. As a rule, one-round characteristics have a small Hamming weight or a special form. The job of the cryptanalyst is to search for iterative characteristics or differences that have the greatest probability sufficient to launch an attack on the cipher. On the other hand, the goal of developers of block ciphers is to prove the security against DCA in the general form, or to investigate the probabilities of the entire variety of actually computable characteristics in order to demonstrate the impossibility of distinguishing a block cipher from a random substitution. In Chapter 6, specific examples of estimating the security against DCA are given for new block ciphers based on controlled operations using two-and three-round iterative characteristics.

4.4.3. The Influence of Controlled Operational Substitutions on the Security of Block Ciphers against Differential Cryptanalysis

As mentioned earlier, the problem of estimating the security of block ciphers against DCA is generally quite a complicated mathematical problem. This is why this section only presents an illustration of how new cryptographic primitives—controlled operational substitutions (COS)—affect the security of block ciphers against DCA. The mathematical techniques used for this purpose reveal a certain flexibility of COS, making it possible to vary their structure and adjust the cryptographic properties of these operations according to specified requirements. As an example of estimating block ciphers based on COS against DCA, we're going to consider the case of using such an operation instead of the "⊕" operation in the Feistel scheme mentioned in Section 4.3.2 (see Figs. 4.2 and 4.3). Suppose the block cipher being considered is a Markov one, and the stochastic equivalence hypothesis is true for it (Section 4.4.2). To simplify our further reasoning, we'll only use the mathematical notation of the encryption process (e = 0), leaving out the e parameter when writing down the formulas.

To represent the COS, we'll take the substitution σ(V)F (XR) as a variant of writing of the serial parametrically invertible COS model S′Σ es (Section 4.3.3). Since the COS only transforms half of the data block in the Feistel scheme, the substitution takes the following form:

where ∀i∊{1, …, n/2}, f(V)i = x(R)i ⊕ φ(V) (X(i−1, i−k)R, F) and F = F(XLK), X(i−1, i−k)R, R = (xi−k, …, xi−1), X(0, 1−k) = (x0, x−1, …, x1-k) are the initial values or k values obtained as a result of expanding the transformation GF(2)n/2 → GF(2)n/2+k of the XR vector.

Taking into account the conclusions given in Section 4.4.2 concerning the possibility of estimating the security of the entire block cipher from one-round security characteristics, let's compare the probabilities of differences in the traditional and modified Feistel schemes for one round of transformations, i.e., when r = 1.

Since YL = F ⊕ XR in the traditional Feistel scheme, for transition probabilities of the one-round transformations of the P(⊕) = ∥ p(⊕)i,j ∥ matrix, we have:

where Δ F = F(XL,K) ⊕ F(XL ⊕ FXL,K).

For the modified Feistel scheme, in which the σ(V)F(XR) substitution is used instead of the "⊕" operation, a round transformation has the following vector representation:

where V = V(XL, K), and

Click To expand

Therefore, the conditional probabilities of a one-round difference of the P(σ) = ∥ p(σ)i,j ∥ matrix in the modified scheme can be represented as follows:

Further, we have p(σ)Δ X, Δ YL = PrX (Δ F ⊕ Δ XR ⊕ Δφ(V) = Δ YL/Δ X), where Δφ(V) = φ(V) (XR, F) ⊕ φ(V⊕Δ V) (XR ⊕Δ XR, F⊕Δ F) and Δ(V) = V(XL, K) ⊕ V(XL ⊕ XL, K).

Thus we obtain the following analytical relationship between the probabilities of a one-round difference of the modified and traditional Feistel schemes:

Click To expand

i.e., there is an averaging of the conditional probabilities of differences p(σ)Δ X, Δ YL over the distribution of the p(⊕)Δ X, Δ YL probabilities, which creates favorable conditions for the p(⊂)maxp(Σ)max < p(⊕)max inequality being true, and therefore, can lead to increasing the MD(r) complexity of DCA (Section 4.4.2). This means that the modified transformation function can increase the algorithm security against DCA while the security parameters directly depend on the choice of the φ(V) vector Boolean function. An important factor in increasing security against DCA is that when using COSs instead of S-boxes, the dimension of the space in which it is necessary to analyze differences increases up to the size of the whole block of data being transformed, thus significantly complicating an attack.

To obtain more accurate estimations, use, say, bent function (Section 4.2.8) as components of the vector Boolean function φ(V). In this case, each Δφ(V)i component of the vector Boolean function Δφ(V) will be a balanced Boolean function for any non-zero values of that portion of the components of the extended vector Δ=Δ X∥Δ F∥Δ V which is included in Δφ(V)i. Hence, the probability distribution of each Δφ(V)i component of the Δφ(V) vector function doesn't depend on the Δ F ⊕ Δ XR values in Expression (4.19), which takes the following form:

Click To expand

Thus, each Δ y(L)i component of the Δ YL vector will be a balanced Boolean function relative to all non-zero values of the arguments of the Δφ(V)i function. However, the components of the Δφ(V) vector function are generally dependent. Therefore, their joint distribution over X can be non-uniform, and this must be taken into account when performing a cryptanalysis of a complex COS. To provide for the independence of the components of the vector Boolean function Δφ(V), let's consider, for example, the simplest output functions for the following implementation of the S′σ es model (Section 4.3.3):

Click To expand

where V = V(XL, K) (V ∊ GF(2)n) is a Boolean function extending the key, and F = (a1, …, an/2) ∊ GF(2)n/2.

According to the results obtained in Section 4.3, such a substitution provides the XR× F→ YL mapping, which is collision-free on F, bijective on X, and has 2n unique modifications. The ith component of the vector function Δφ(V) takes the following form for the Σ(V)F(X) substitution:

Click To expand

where Δ aj and Δ x(R)j are the jth components of the Δ F and Δ XR vectors, which have the n/2 dimension, and Δ vj is the jth component of the Δ V vector, which has the n dimension. The following can be taken as a simple example of the φ i bent functions: ∀i∊{1, …, n/2}, ∊i = x(R)i−1ν2i−1 ⊗ai−1ν2i. In this case, if the round function F possesses good diffusive properties, all the components of the vector Boolean function Δφ(V) can be considered independent and balanced Boolean functions of four variables. Each resulting component Δ yi(L) = Δ xi(R) ⊗ Δ ai ⊗ Δϕi(x(R)i−1, ai−1, ν2i, ν2i−1) will be an unbalanced Boolean function for just three of 63 possible non-zero vectors

Click To expand

In this case, for ∀i∊{1, …, n/2}, the probability of "1" values at the output of each Δ yi(L) function is determined by the following relationship:

Hence, for ∀Δ X∊GF(2)n(Δ X≠0) and ∀Δ YL∊GF(2)n/2, we have:

Click To expand

where WH(Δ YL ⊗ Δ YL′) is the Hamming weight of the Δ YL ⊗ Δ YL′ vector.

This means that the σF(V)(XR) substitution built with the above method based on bent functions provides a high degree of averaging the initial probabilities of the p(⊗)Δ X, Δ YL difference to the p(σ)Δ X, Δ YL values close enough to 1/(2n/2), since [image] . This is an illustration of the mechanism of increasing the security of block ciphers against DCA on the basis of specially built COSs. The transformation simultaneously provides for the bijectivity of the Δ X → Δ YL mapping and the absence of collisions on F in a one-round transformation.

Similar estimations can be obtained for more complicated ϕ(V) vector functions with dependent components if, for example, the following Boolean functions are taken as generating functions for ϕ(V):

Click To expand

where ϕi are bent functions, and ϕi′′ are bent functions or Boolean functions with a high degree of non-linearity and other mathematical properties, such as PC(l, k) and CI(l) (Sections 4.2.6 and 4.2.7).

In conclusion, however, it is necessary to note that practically applicable results of DCA can only be obtained based on a special investigation of the interoperation between all the components of round transformations, and particularly the peculiarities of combining the F round function with a COS.

4.4.4. The Theoretical Foundations of Linear Cryptanalysis

As with differential cryptanalysis, using controlled operational substitutions in block ciphers also makes it possible to increase the security of these algorithms against linear cryptanalysis (LCA).

Some LCA issues were already touched on in Chapter 3, when we discussed the linear properties of controlled permutations (Section 3.4). In this section, we're going to look at LCA problems from another viewpoint, and try to generalize the results obtained earlier. Having no pretensions of making an exhaustive presentation of this mathematically complex topic that has elements of an art, we'll try to determine the basic technique of LCA.

From the following reasoning and simple examples, one can imagine the problems that arise when carrying out linear cryptanalysis in its general form.

Definition 4.52

A linear approximation of a round function F(XL, K) is an expression having the form b′•F(XL, K) = a′•XL, where a′, b′∊GF(2)n are called input and output mask vectors, respectively, and "•" designates the scalar bitwise multiplication of two vectors [50].

Definition 4.53

A linear approximation of a block cipher after r round is an equation having the form b′• Y(r) ⊗ a•X ⊗ a•X ⊗ c•K = 0, where a,b∊GF(2)n are input and output mask vectors, K = (K1, K2, …, Kr), and c=(c1, c2, …, cl)∊ GF(2)l(l= rn/2) is the mask vector of the key. The linear approximation corresponds to the linear characteristic of the cipher (a, b, c, p), when p is the value of the bias from 1/2 of the probability that this approximation is true (Section 3.4.1) [50, 65].

According to the general definition in Section 4.2.4, the linearity of a round function F(XL, K) is the value of the following expression:

Click To expand

According to the propositions in Section 4.2.4, the linearity and non-linearity of the F(XL, K) function are connected by the following relationship:

The LCA method is a rather complicated probability-algebraic technique, the use of which depends on a number of features of the particular block cipher. An outline of one of the popular variants of LCA for DES-like block algorithms is in the following procedure:

  1. Linear approximations of the round function (masks b′ and a′) are selected such that their probability PrXL,K(b′•F(XL, K) =a′•XL) differs from 1/2 as greatly as possible.

  2. r − 2 linear round approximations are sequentially arranged (coordinated) in a chain to obtain a linear approximation of the block cipher after r − 2 rounds, starting from the second and up to the next to last. In the process, the input masks of every subsequent round of the chain must be equal to the output masks of the previous rounds. For the chain obtained, the resulting probability PrX(a, b, c, Kr−2) is considered, which is the probability of the following event:

    Click To expand

    and the probability of the this event is built according to the rules of correlating the round linear characteristics (see Section 3.4.1). It must significantly differ from 1/2, i.e., the resulting linear characteristic must have a large bias.

  3. From the condition of the weakness of the round transformation, the Y(1) and Y(r − 1) values are analytically expressed through X, K1 and Y(r), Kr, respectively, and substituted into equation (4.21).

Suppose that, using the peculiarities of block algorithm, we manage to "involve" just some bits of K1 and Kr in Equation (4.21). Then, if the assumption about the bits of K1 and Kr is correct (for DES, these are 12 bits), trying various Xs provides us with the PrX(a, b, c, Kr−2) probability of Equation (4.21) being true; otherwise, Equation (4.21) is true with a probability close to 1/2. This fact makes it possible to statistically determine the true values of the bits of K1 and Kr that are "involved" in the equation, by trying each of them.

The simplest, or in other words, most basic LCA method is the one which considers linear approximations having the form a•X ⊗ b•Y(r) ⊗ c•(K1, K2, …, Kr) = 0) and their probabilities gr = PrX(a, b, c, K). If the (a, b, c, qr = gr − 1/2) linear characteristic of such an approximation has a significant r-round bias qr, this method makes it possible to determine the oddness of the key bits participating in the approximation.

If, as a measure of the complexity ML(r) of the basic LCA method, we take the number of pairs of original and encrypted texts X and Y(r) that are necessary to statistically determine the oddness of the key bits, the following estimation is true [65]: ML (r) ≥ 1/(q(max))2r, where [image] . Hence, for a qr(max) close to 1/2n/2, the values of the measure of complexity ML(r) will be comparable to or greater than the total number (2n) of binary texts n bits long, and therefore, linear cryptanalysis will be ineffective.

Note that the [image] relationship follows from the definition of the transformation linearity, and therefore, ML(r) ≧ 4(L(Y(r))−2.

As for DCA, when r ≥ 4, the following inequality is true for Markov block ciphers [51]: where [image] . This and the [image] relationship entail another estimation of the LCA complexity:

It follows from the above estimations that, to provide for security against LCA, it will suffice to build a round transformation of the cipher in such a way that the one-round bias q(max) is low, which guarantees a high LCA work effort ML(r). This condition is equivalent to building a round transformation with a low linearity L(F) or, correspondingly, high non-linearity properties N(F).

It follows from the above results that the linear properties of iterated ciphers (like the differential properties in DCA with the transition probability matrix P) can be described using a correlation matrix C = ‖cij‖ determined as follows (Section 4.2.4):

Click To expand

where α1, …, αn2 is a lexicographically ordered sequence of all 2n values of the masks (α1, αj∊GF(2)n). Besides which,

Click To expand

Similar to the limitations on the maximum value of the elements of the P matrix in DCA, there is an estimation for the elements of the C matrix for bijective mappings [23]: c(max) ≥ 1/2n−2 and, correspondingly, q(max) ≥ 1/2n−1.

The relationship between the P and C matrices describing differential and linear properties of block ciphers, and thus describing their security against DCA and LCA, is specified by the following equations (Section 4.2.3):

Click To expand

These formulas demonstrate the dualism and a deep interrelation between DCA and LCA.

Since the elements of the P matrix are related to the squares of the C matrix elements, the latter is often replaced by the C′ = ‖c2ij‖ matrix. Taking into account these notes, for GF(2)n → GF(2)m cryptographic transformations, the following practically important relationships between the matrices P, C′, and the autocorrelation matrix R (Section 4.2.5) are true [100]:

C′ = HnPHm, C′ = HnR, R = PHm, where Hn and Hm are Walsh-Hadamard matrices from Section 4.2.3.

For block ciphers corresponding to the structure of substitution-permutation networks (SPN-structure) such as the Rijndael cipher that won the AES contest, the following results concerning their security against DCA and LCA [35] are of great importance for application.

Let a round transformation of a block cipher have a substitution layer S consisting of a series of S-boxes Sk×m — i.e., it consists of k S-boxes each m bits long — and also let it contain the diffusion layer D, providing modification propagation or an avalanche effect.

By differentially active S-boxes, we mean boxes at whose input non-zero differences (differentials) are supplied when performing DCA. Similarly, linearly active S-boxes are those at whose outputs non-zero masks are used when performing LCA.

The differential (or linear) Hamming weight Hd(X) (or Hl(X)) of an x vector passing through the S layer is the number of differentially (or linearly) active S-boxes corresponding to this vector.

Let's consider a structure consisting of two layers SD, taking into account its periodic repetition during block enciphering. Let's say that Δ X = X ⊕ X* and Δ Y = D(X) ⊕ D(X*). We designated the input and output masks of the SD structure as aX and bY, respectively. By the differential (or lienar) weight of the SD structure, we mean the value of the function Click To expand .

Then, if the round keys of such block ciphers are independent and uniformly distributed, and the nd(D) = K + 1 (nl(D) = K + 1) condition is met, the probability of any different characteristic of the SD structure is no greater than (pS)k (and the probability of any linear approximation is no greater than (qS)k), where pS and qS are, respectively, the probabilities of the most probable differential characteristics and linear approximations among all the possible S-boxes. For a block cipher containing r SD structures, these probabilities have the (pS)rk and (qS)rk values, respectively.

Thus, the suggested estimations determine how the quality of S-boxes and the degree of modification propagation in block ciphers comprising substitution-permutation networks influence the security of these ciphers against DCA and LCA.

The above reasoning concerning general estimations of the security of block algorithms against LCA allow us to understand the difficulties which a cryptanalyst or a designer of block ciphers with complex cryptographic primitives can encounter. This is why, as with DCA, estimating the block cipher security against LCA is usually carried out based on a set of actually computable linear characteristics.

The actually applicable linear characteristics of the entire cipher are usually chains of iterative linear characteristics, that is, small periodically repeated sequences of one-round linear characteristics. Like differential characteristics in DCA, the masks of these characteristics usually have a small Hamming weight or a special form. The links of these chains are correlated and probability-estimated according to the coordination rules given in Section 3.4.1.

4.4.5. The Influence of Controlled Operational Substitutions on the Security of Block Ciphers against Linear Cryptanalysis

As with differential cryptanalysis (Section 4.4.3), we're going to illustrate the mechanism of the influence of controlled operational substitutions on the security of block ciphers against linear cryptanalysis (LCA) by replacing the "⊕" operation in the Feistel scheme with a COS, i.e., with the σ(V)F (XR) substitution (see Figs. 4.2 and 4.3). The modified scheme can be conveniently presented as a traditional Feistel scheme with the "⊕" operation, but with a new round function, having the form Fσ = Fσ(X, X) = F⊕(XL, K) ⊕ ϕ(V), where F⊕ = F⊕(XL, K) = F(XL K) is a round function of the original algorithm. If the components of the ϕ(V) vector function are bent functions, or they conform to condition (4.20), then, due to the maximum or simply high non-linearity of these functions, the Fσ round function can be configured so that N(Fσ) > N(F⊕), which entails L(Fσ) < L(F⊕). Hence, according to (4.22), the work effort for LCA — ML(r) — increases. Therefore, using the σ(V)F (XR) substitution instead of the "⊕" operation can significantly increase the security of the original Feistel scheme against LCA, the security level depending on the construction of the ϕ(V) vector function.

As an example, consider the generating Boolean functions from Section 4.4.3, that is, ∀i ∊ {1, …, n/2}, ϕi = x(R)i−1v2i−1 ⊕ai−1v2i, where V = V(XL K) (V ∊ GF(2)n) is a key extending function, and F⊕ = (a1, …, an/2 ∊ GF(2)n/2. To estimate the non-linearity of the Fσ(X, K) function according to the general definition of the non-linearity of vector Boolean functions (Section 4.2.4) for ∀β ∊ GF(2)n/2, consider an arbitrary combination of its components:

The resulting Boolean function [image] is a bent function (provided at least one coefficient β2, …, βn/2 is non-zero) since it is generated by the sum of quadratic bent functions of independent arguments. Thus, if the initial conditions are x(R)0 = 1 and a0 = 1, then λ(β) = β • F⊕ ⊕ v1 ⊕ v2 ⊕ λ(β)bent for β1 = 1, or λ(β) = β • F⊕ ⊕ λ(β)bent for β1 = 0. The non-linearity of the λ(β)bent function depends on the number of non-zero coefficients β2, …,βn/2. If their number is m∊{1, …,(n/2) − 1}, then, according to Statement 4.6 from Section 4.2.4, the following estimation of the non-linearity of the λ(β) function is true for β1 = 1:

Click To expand

where ρβ is the number of different variables in the β•F⊕ polynomial. Besides which, the N(m)1(λ(β)) ≥ N(β•F⊕)24m+2 inequality follows from Statement 4.6.

When β1 = 0, the non-linearity estimation takes the following form:

Click To expand

Also, the N(m)0(λ(β)) ≥ N(β•F⊕)24m inequality is true.

Since only non-zero values of the β vectors are considered in LCA, it follows from the estimations presented above that there is only one case in which all the β2, …,βn/2 coefficients are equal to zero and β1 = 1 that the non-linearity of the λ(β) function doesn't change if a COS is used rather than the "⊕" operation, i.e., N(m)1 (λ(β)) ∊ N(f(1)⊕), where f(1)⊕ is the first component of the F⊕ vector. In all the other cases, the non-linearity of the new round function will be greater than that of the original function.

To eliminate the undesirable case mentioned earlier, it is necessary that the initial conditions x(R)0 and a0 are generated as the result of a key extending procedure V = V(XL, K), rather than being constant. In this case, the estimation of the non-linearity of the λ(β) function will always be as follows:

Click To expand

where m∊{1, …,(n/2)−1} is the number of non-zero coefficients β = (β1, β2, …, βn/2).

According to Definition 4.15 of the non-linearity of a vector Boolean function (Section 4.2.4), we have:

Then

Click To expand

where β(σ) is the vector on which the minimum non-linearity N(λ(β)) is reached. According to Definition 4.16, the average non-linearity of the N′(Fσ) transformation has the following value:

Click To expand

Thus, if the "⊕" operation in the Feistel scheme is replaced with the σF(XR) COS where the components of the ϕ(V) vector function are the simplest bent functions having the ϕi = x(R)i−1v2i−1 ⊕ ai−1v2i form, the following relationship is true: N(Fσ) ≫ N(F) (N′(Fσ) ≫ N′(F⊕)), and therefore, L(Fσ) ≪ L(F⊕) (L′(Fσ) ≫ L′(F⊕)). In other words, according to the propositions of Section 4.4.4, the whole block algorithm becomes more secure against LCA.

As with DCA, similar results can be obtained for more complex ϕ(V) vector functions with dependent components. For example, functions conforming to Condition (4.20) can be taken as generating Boolean functions for ϕ(V).

To conclude the section, we must again underline that, as with DCA, the practically applicable results of LCA can only be obtained based on investigating all the individual components of round transformations — i.e., the peculiarities of combining all cryptographic primitives with a COS.

4.4.6. The Influence of Controlled Operational Substitutions on the Security of Block Ciphers against Technological Attacks

One of the main shortcomings of modern block cipher standards is their vulnerability to actual technological cryptanalytical methods — in particular, differential fault analysis. The essence of this method is in using heat, high-frequency, ionization, or other types of external actions on the protection hardware in order to distort the bit information in certain points of the transformation algorithm. The methods of analysis of such distortions allow a cryptanalyst to compare the data before and after introducing the distortions and obtain the value of the round key at the last round, and so on at all the rounds of the algorithm. Recent investigations of the DES and GOST 28147-89 block ciphers revealed their insecurity against this type of attack [10].

Attempts to complicate the original DES algorithm have led to the creation of Triple DES, which somewhat increased its security against mathematical methods of cryptanalysis, but didn't deliver it from its vulnerability to differential fault analysis. These shortcomings are also inherent to other block ciphers that have been created recently. Thus, at the end of the 1990s, the weakness of the available block ciphers in some properties became evident, and the urgent need for new block algorithms secure against differential fault analysis emerged.

According to the basic method of differential fault analysis, the security of a cipher against this type of attack is in many respects determined by the computational complexity of trying every possible value of the round key Kr at the last round of the algorithm. Indeed, encryption at the last round of a block cipher designed on the basis of the Feistel scheme is determined by the following relationships:

  • XR = XR ⊕ F(XL, Kr) for a transformation without faults

  • X′R = XR ⊕ F(X′L, Kr) for a transformation with generated faults

By adding the two equations, we obtain the following one:

It is possible to build a system of such equations, each of which corresponds to different blocks of the plaintext and ciphertext. No matter what kind of function the F function is, finding the only solution to the system — i.e., breaking the round key Kr by trying every possible key — is quite feasible. It is sometimes possible to create a more effective method, as in the case of the RC5 block cipher thoroughly discussed in Section 6.7.1.

The estimation for the upper limit of the computational complexity of breaking the round key Kr by trying every possible key is the following: Mkr = 2mh MF, where h is the number of equations in the system, MF is the complexity of computing the value of the round transformation, and m is the key length.

The values of the other round keys are found in a similar fashion. The upper limit of the computational complexity of breaking the whole table of r rounds keys is estimated as the following: M = 2mh MFr.

Thus, the work effort needed to break any block cipher built according to the Feistel scheme is in direct proportion to that of trying the values of one round key (2m). The foregoing makes it possible to draw a conclusion about the necessity of introducing the following requirements to a round transformation of a block cipher built based on the Feistel scheme:

  • Increasing the size of the data block being transformed by the cipher up to 128 bits or more

  • Increasing the total size of the round key

  • Providing for the inseparability of the round key elements within one algorithm round

  • In block ciphers, using special methods that hamper mathematical and technological analysis, for example, introducing additional transformations at the beginning of the algorithm and after the end of the last round

The preliminary analysis of some algorithms presented at the AES contest revealed that round keys that are 128 bits long are divided into parts in these ciphers, and the problem of breaking them is reduced to trying shorter keys from 32 to 64 bits long, which is dictated by the implementation convenience and requirements to the performance.

New block ciphers based on controlled operations satisfy these requirements in full, and provide the necessary level of security against technological cryptanalytic methods. For new mechanisms of information transformation in such algorithms, a more flexible selection of round keys is used depending on the transformed data, based on new transformation primitives such as boxes of controlled permutations and controlled operational substitutions. In line with the recommendations on differential fault analysis, the suggested ciphers have the following features:

  • Data blocks have sizes of 64, 128, or more bits.

  • No less than three inseparable keys having a total length of 192 bits are used in one round, rather than one key.

  • Special initial and final data transformations are used.

Actual issues of differential fault analysis of block ciphers are discussed in more detail in Section 6.7.

Another type of attack on block ciphers is the differential power analysis of encrypting hardware. The goal of this attack is to obtain information on the keys stored in the computer memory registers or in microcircuits during the block cipher's operation. The suggested new block algorithms based on controlled operations usually imply a hardware implementation, in which the keys are entered only once during the algorithm initialization, and the subsequent changes of the radiation power only occur in the area of the data being transformed, which hampers you from obtaining information about the keys used. Besides which, the hardware implementation itself makes it possible to create special screening devices that hamper or strongly reduce both the collateral radiation from the hardware and the external influence on the enciphering system.

4.4.7. A Review of the Results of the Cryptanalysis of the GOST 28147-89 Block Cipher According to Open Literature

The Russian block encryption standard GOST 28147-89 (hereafter simply GOST), adopted in 1989 [84], is an example of a DES-like cryptosystem created according to the classical iterated Feistel scheme.

Let's recall the features of the GOST block cipher:

  • The size of the data block is 64 bits.

  • The number of rounds is 32.

  • The secret key is 256 bits long, and consists of a sequence of eight 32-bit words K = (K1, K2, …, K8).

  • The work key generating algorithm doesn't use a special procedure, and is specified by the cyclic repetition of the eight 32-bit words of the secret key K at the first 24 rounds. At the last 8 rounds, these eight words of the secret key K are used in the reverse order.

  • In each round, the Ki work keys are mixed with the 32-bit block of the text being transformed using the addition modulo 2n operation.

  • In each round, a non-linear transformation is provided for, using eight secret bijective 4x4 S-boxes. (In GOST, S-boxes are a persistent key.)

  • In each round, rotation left by 11 positions is used as a permutational transformation.

The cryptographic properties of the GOST 28147-89 algorithm were analyzed in a number of publications [11, 17, 40]. Among the main results of the analysis of GOST, the following points and conclusions can be highlighted.

The papers [17, 40] pay attention to the fact that the secrecy of the GOST algorithm is based not only on the secrecy of the key, but also on the secrecy of the substitutional elements of the cipher (S-boxes), which can lead to cryptographically weak modifications of the algorithm. For example, this may happen if highly linear transformations and/or transformations that are weak against differential cryptanalysis are used as S-boxes.

When using secret S-boxes of the GOST algorithm, one should take into account that, even with highly non-linear S-boxes, there is the possibility of them being poorly combined with the addition modulo 2n operation, which can decrease the non-linearity of a round transformation, thus decreasing the security of the GOST algorithm's modification against linear cryptanalysis [17].

Based on the weaknesses of the GOST algorithm's structure, [40] suggests a combination of a related-key attack and differential cryptanalysis, which makes it possible to distinguish between a 32-round transformation of the algorithm and a random substitution, provided secret S-boxes are specially chosen. For a 24-round algorithm modification of GOST, this attack makes it actually possible to determine the secret keys of the cipher.

[11] suggests a new approach to analysis of GOST and other block algorithms that use a periodically repeated sequence of secret keys as working round keys. This cryptanalytic method, known as a slide attack, doesn't depend on the number of rounds, and is based on the so-called "birthday paradox".

Since the XOR operation only differs from the addition modulo 2n operation in the absence of the carry bit whose influence damps out exponentially, the attack suggested in [11] considers the GOST modification containing the XOR operation (GOST-XOR) instead of the addition modulo 2n operation. Another GOST modification analyzed was a cipher (GOST-H) in which the working key used at the last 8 rounds is built according to the same rule as that at the first 24 rounds.

It has been demonstrated that GOST-XOR-H has 2128 special keys, having the form K = (A, B, C, D, A, B, C, D), which make it possible to effectively attack such a cipher with a classic slide attack, regardless the number of rounds and the kind of S-boxes, by using 232 known pairs of plaintexts and ciphertexts, or 216 chosen texts. The presence of these special keys is sufficient for an effective cryptanalysis of the last 20 rounds of GOST-XOR by using an improved "slide attack" with key inversion [11]. In this case, successfully breaking the secret key of the algorithm requires 233 known pairs of plaintexts and ciphertexts.

The results of the cryptanalysis of various modifications of GOST using variants of the "slide attack" are evidence of serious weaknesses of this cipher. In [11], a direction for further improvement of the "slide attack" methods is proposed, based on its combination with classic methods of differential cryptanalysis. It is supposed that this method could significantly advance the results of cryptanalysis of the GOST algorithm.

It is also noted in [11] that the GOST block cipher has 2128 weak keys, having the K = (A, B, C, D, D, C, B, A) form. In this case, the algorithm is invariant to reversing the key order, i.e., the encryption and decryption processes are the same (the algorithm performs involution). With these keys, the repeated encryption of a ciphertext results in the plaintext. Besides this, for each of these 2128 keys, there are 232 texts invariant to transformation with the GOST cipher. These facts indicate that creating secure hashing functions based on the GOST algorithm is problematic, since there are objectively favorable conditions for obtaining collisions traditionally used in attacks on hashing functions.

The GOST is vuenerable against differential fault analysis [10] based on the introducing random hardware faults during the algorithm's execution (Section 4.4.6). According to the estimations presented in this paper, such an attack on the entire key system of the GOST block cipher has a computational complexity of no more than 233 simple operations, which, under conditions favorable for such a type of attack, can lead to a disaster.

We should mention that the GOST block algorithm was developed as an encryption standard in the '70s and '80s, and was intended for a software and hardware implementation corresponding to the low level of microelectronic technology of that time. Such data transformation principles as dividing the data blocks into smaller subblocks, the use of cryptographically imperfect operations, and a large number of rounds, cannot provide the necessary, up-to-date performance (more than 2 Gbit/sec) while maintaining a low cost of implementation. Because of these facts and the aforementioned cryptographic weaknesses of the GOST algorithm one can hardy characterisc GOST as a pomising block cipher intended for use in modern high-speed data protection devices that work in real-time mode.


4.5. The Practical Use of Controlled Operational Substitutions

4.5.1. Controlled Operational Substitutions and General Requirements for Block Ciphers

The result of the action of an arbitrary block cipher can be presented as a set of fixed substitutions Y = CK(X), chosen depending on the secret key and specified on the set of all input data blocks with a fixed length n (Y, X∊GF(2)n). The number of different input boxes is 2n, and the number of all reciprocal substitutions is 2n!. The tabular description of just one such substitution - which may include, for example, more than 264 elements - is impractical. In connection with this, choosing substitutions depending on the secret key must be done algorithmically in a block cipher. The inverse transformation is carried out by the algorithm X = DK(Y). The most promising ones are ciphers for which direct and inverse transformations are done with the same algorithm, but with different key orders. Such ciphers can be represented as parametrically reciprocal substitutions with the form Y = CKe(X), where the e∊{0, 1} parameter determines different orders of the keys for the direct (e = 0) and inverse (e = 1) transformation. When developing the Y = CK(X) algorithm, the main problem is that each substitution specified by all possible secret keys should be pseudo-random. This means that knowing a large number of matching pairs of input data blocks (plaintexts) and output data blocks (ciphertexts) doesn't make it possible to compute the secret key or to determine the value of the plaintext from the ciphertext with a significant probability.

To solve this task, special procedures are used that are usually iterative and error-propagating. In such procedures, changing a single input bit entails changing several or all bits in the output block. Successive use of a large number of transformations that possess such properties makes it possible to build block ciphers in which changing an arbitrary bit at the input entails changing every output bit with a probability close to 0.5. To implement this property, called the error propagation effect (Sections 4.2.5 and 4.2.6), along with such properties as non-linearity and the correlation immunity of ciphers (Sections 4.2.4 and 4.2.7), substitutions on small data blocks and certain other operations are widely used. For example, in the GOST Russian standard 28147-89 [84], fixed substitutions on 4-bit data and the addition modulo 2n operation are used.

Currently, the approach of using substitutions with small sizes is considered somewhat obsolete. Modern developers of block ciphers use a wide range of various cryptographic primitives: substitutions with lager sizes, multiplication modulo 2n, mapping on Galois fields according to modulo irreducible polynomials, linear transformations, circular shift operations performed depending on the data being transformed, etc. Such a variety of cryptographic primitives is related to the multitude of requirements put on block ciphers. The element base of the algorithms being developed and the choice of the complexity parameters of the cryptographic primitives depend on the target use of the block cipher, and in particular, they are related to the orientation of the algorithms to a hardware or software implementation.

As recent practice shows, new block ciphers designed to replace the existing standards are first oriented towards a software implementation, and issues of their optimization for a hardware implementation are only considered later. In this book, in addition to the traditional approach to block cipher design, an alternative approach is suggested, in which algorithms are first of all oriented towards a hardware implementation. At present, such an approach is considered quite promising. In addition to the cryptographic primitives already known from open literature, this section presents variants of the practical use of controlled operational substitutions in block ciphers, these substitutions being new non-linear data transformation primitives. According to the results of the investigations conducted in Sections 4.3 and 4.4, using COS in combination with other transformations, and with controlled permutations in particular, makes it possible to significantly increase the quality of block algorithms, thanks to the increase in their statistical uncertainty (robustness), which thus increases their security against various cryptattacks. It should be mentioned that increasing the robustness of algorithms was one of the main requirements put on the contenders for the new block ciphering standard in the AES contest organized by the National Institute of Standards and Technology (NIST), USA. This approach is motivated by the fact that the requirement of increasing the uncertainty of transformations is related to the necessity of providing for a high security of ciphers not only against known cryptanalytic methods, but also against new ones, with research projects in this area being very active.

4.5.2. Estimations of the Implementation Complexity of Controlled Operational Substitutions

One advantage of whole classes of COSs is the possibility of their fast hardware and, in some cases, effective software implementation while retaining good cryptographic properties. We should mention that the complexity of the transformation performed by COS directly depends on the variety and complexity of the Boolean functions that generate the COS. As we noted in Section 4.3.10, COSs have a dualistic nature, i.e., they hold an intermediate position between large S-boxes and non-linear operations. This property is dramatically manifested by the example of the following three basic COS models, which are the ones that are most promising for a practical implementation:

  • The bijective serial model S′σ (Section 4.3.3)

  • The non-bijective serial model [image] (Section 4.3.6)

  • The parametrically reciprocal recursive model Ω′σ, e, and in particular, its most extensively investigated submodel Ω″σ e (Section 4.3.4)

If we consider COS variants of the S′σ and [image] models, all of whose prototypes of generating functions are different and have a rather complex analytical representation, the complexity of such COSs will correspond to a series of S-boxes, each of which has a length equal to the average number of variables in the Boolean functions generating the COS. As a rule, a series of k S-boxes with the ns length (n = k × ns) are actually implemented in tabular form and require MS = k2ns bits of memory. A similar COS implementation will take, on the average, MCOS ≈ m2n′ bits of memory, where m is the number of different prototypes of the generating Boolean functions (1 ≤ m ≤ n), and n′ is the average number of variables in these functions. If a COS of the S′σ and [image] models - i.e., a controlled schematic transformer (CST) - has generating functions of only one type (m = 1), then, in addition to a simple tabular specification, this COS can be represented in a form favorable to a hardware implementation. The main feature of such an implementation is the TCST value, which is the delay time required to perform the CST measured in the time units for performing the "⊕" operation (t⊕). This can be illustrated in the following example.

Let the CST Y = GV(X, A): (GF(2)32 × GF(2)32 × GF(2)32 → GF(2)32 have only one prototype of generating functions (Section 4.3.3), and the functions themselves have the form:

Click To expand

where xj, aj, vj are the components of the X, A, V∊GF(2)32 vectors, respectively, and (x−3, x−2, x−1, x−0) = (1, 1, 1, 1), (a−2, a−1, a0) = (1, 1, 1), (v−1, v0) = (1, 1) are the fixed initial conditions, or the bits of the extended key. The transformation performed by such a COS can be represented in the following vector form:

Click To expand

where the "→ i" operation denotes the right shift of the vector to i positions, and the XA notation means bitwise vector multiplication on modulo 2. For bijective models of COS, the low-order bits of the vectors being shifted are filled with the bits of the initial conditions, or the bits of the extended key. In the case of the non-bijective COS model with circular shift of the original data (Section 4.3.6), the low-order bits of the vectors being shifted are filled with the high-order bits of these vectors. Despite the quite high complexity of the functions generating this COS, the hardware transformation is performed on the whole data block in just 5 ticks (TCST = 5t⊕) in the following way:

  • 1st step:

  • 2nd step: Click To expand

  • 3rd step:

  • 4th step:

  • 5th step:

The software implementation of this COS is done based on the tabular specification of one Boolean function of 12 variables (n′ = 12, MCST = 4096 bits).

Let C ϖ(F) designate the combination complexity of the F(X) function, i.e. the minimum number of elements from the ϖ = {∨, &, ⊕, −} basic set that is sufficient for implementing the F(X) function with a logical scheme, and let Dϖ(F) designate the depth of the Boolean function, i.e., the number of logical elements of the ϖ basic set that are located on the longest route from the input to the output (the minimum delay required to perform the logical scheme of the F(X) function).

Generally, the duration of the hardware implementation of a CST (TCST) with one prototype function directly depends on:

  • The total number of positions for variables in the algebraic normal form (ANF) of the prototype function (LANF)

  • The number of variables in each member of the ANF

If LANF = 2k, and the number of variables in each ANF member is equal to a power of 2, then the value TCST = Dϖ(CST) ≈ kt⊕ and Cϖ(CST) ≤ 2k−1. For other values of LANF, the TCST value is determined with the following estimator: TCST = Dϖ(CST) ≈ ≈ ([log2(LANF)] + 1)t⊕, and Cϖ(CST) ≤ LANE.

As the number of prototype functions increases, the controlled operational substitution of the S′σ and [image] models approaches a series of S-boxes with a large size in its complexity, and at the same time possesses a number of constructive and cryptographic advantages compared to them (for more detailed information, see Section 4.3).

For a COS of the parametrically reciprocal recursive model Ω′σ, e, an implementation based on creating special commands (instructions) of the computer processor should be considered the most promising. At the same time, a hardware implementation of such a COS, based on large-scale integration (LSI) seems quite effective as well. When estimating the mathematical complexity of the COS of the Ω′σ, e model (ECA and CCA), one can start reasoning from the complexity of the most elementary representative of this family of operations - a modulo 2n adder. For a vector Boolean function Y = Σ(X, A) (GF(2)32 × GF(2)32 → GF(2)32) implementing addition modulo 2n for n = 2m in the ϖ = {∨, &, ⊕, −} basic set, the following estimators are true [*]:

It follows from Section 4.3.5 that the elementary controlled adders Y = ΣV(X, A) differ from the Y = Σ(X, A) adder by only a change in the carry bits ui for the values (ui * vi), where "*" is a Boolean operation, and vi is a control bit. Hence, to implement special variants of controlled adders, it will suffice to add one delay step (≈ t⊕) for performing the (ui * vi) operation to schemes implementing the Y = Σ(X, A) function at those points of concurrently performed functions where the ui carry bits are. Thus, for these controlled adders, the following estimators are true:

To obtain effective estimations for all ECA and other implementations of COS of the recursive model Ω′σ, e, additional investigations are needed. A preliminary analysis revealed that the Cϖ (CCA) complexity of the combined controlled adders (CCA) of this model is linearly dependent on n, and the time of its execution TCCA is significantly less than the time of the multiplication on modulo 2n operation.

It should be mentioned that, to simplify the estimation of the complexity and performance parameters of a COS implementation, the algebraic normal form of Boolean functions was considered to be a variant of transformation representations. It is obvious that when optimizing the representation of generating Boolean functions, the parameters of the COS implementation can be improved to some extent.

4.5.3. Iterated Block Ciphers Based on Controlled Operational Substitutions

Iterated block ciphers can be represented as a series of identical procedures, or in another way, E round transformations, arranged as shown in Fig. 4.12.

Click To expand
Figure 4.12: The iterative encryption scheme of a block cipher

When synthesizing block ciphers based on controlled operations, the main mechanism of control over transformations is creating a control vector V from the secret key K and/or the data being transformed D (V = V(K, D)). Such a technique provides the probabilistic nature of controlled operations, since the modifications of the transformation operations on the given algorithm steps aren't fixed, but depend on a random (variable) parameter V. This variant of a block cipher corresponds, for example, to the algorithm already examined in Sections 4.3 and 4.4, which is built on the improved Feistel scheme (Fig. 4.3). Unlike the traditional Feistel scheme (Fig. 4.2), this variant does not use the "⊕" operation, but a parametrically reciprocal controlled substitution whose inversion is done with the e parameter of reciprocity, which specifies a direct (e = 0) or inverse (e = 1) order of the round keys {Ki}.

As demonstrated in Section 4.4, such a modification makes it possible to significantly increase the cipher's security against differential cryptanalysis. Indeed, this kind of analysis is based on the presence of typical differences corresponding to the F function relative to a fixed operation, which is the "⊕" operation in the classic Feistel scheme. As we demonstrated in Section 4.4.3, when this operation is replaced with a substitution controlled by the V vector, the choice of the operation for finding differences is indeterminate, since at each round of the algorithm a different operation is randomly specified depending on the pseudo-random parameter V. According to Section 4.4.5, increasing the security of a Feistel scheme based on a COS against LCA is connected with the fact that the linear operation "⊕" is replaced with non-linear transformations (within the suggested COS models), which depend only on the random parameter V, and possess good cryptographic properties.

When synthesizing the round function F itself, basic primitives based on controlled substitutions and permutations can also be used. Such cryptographic primitives specify non-linear transformations on relatively large operands (n = 32, 64, 128), and can be easily implemented as modern high-performance electronic circuits. In some cases, their fast software implementation is also possible. In the terminology of Section 4.2, the combined use of these controlled operations makes it possible to increase the non-linearity and improve the modification propagation properties of the entire round transformation.

In subsequent representation of the synthesizing methods of new block ciphers, we're going to designate COS, controlled circular shift (CCS), and boxes of controlled permutation (BCP) (defined earlier in Chapters 3 and 4) as GV, SV, and PV, respectively, and CCS can be treated as a special case of BCP. When building various iterative schemes based on COS, most of our attention will be given to basic round functions, without taking into account special elements used in modern block algorithms to provide increased security against various cryptanalytic methods. In particular, we'll leave out such issues as the preliminary and final transformations at the first and last rounds of the algorithm [84], as well as the key transformation (extension) procedures that are discussed in other sections of this book. However, one should keep in mind that, in some cases, where the data blocks of the block ciphers are large (n ≥ 128), and a large number of controlled elements are found within one transformation round, the suggested schemes may require increasing the size of the key information obtained from a secret key with a limited length (from 128 to 256 bits). A discussion of this issue (the key extending procedure) is beyond the scope of this section. Thus, all the key elements Ki used in the iterative schemes discussed below will be considered to be determined and to have a size sufficient for carrying out the corresponding round transformations.

4.5.4. Block Ciphers Variants Based on Controlled Operational Substitutions

Let [GP]W denote an arbitrary substitution-permutation box consisting of a set of interrelated COSs, BCPs, and CCSs that are controlled by different vectors Vi built from the components of an extended control vector W, which is a function of the keys and data being transformed. Parametrically reciprocal substitution-permutation boxes will be designated respectively as [G(0)P(0)]W for the direct transformation and [P(1)G(1)]W for the inverse one. Different boxes are designated using additional scripts, for example, [G(e) P(e)](i)W. As an example of building block ciphers within a Feistel scheme, consider the general scheme of the E round transformation based on COS, BCP, and CCS, which is shown in Fig. 4.13.

Click To expand
Figure 4.13: A general scheme of using substitution-permutation transformations in one round E of the improved Feistel scheme

In this scheme, the e parameter determines the direct (e = 0) or inverse (e = 1) transformation in the boxes, and in the whole round of the algorithm as well. It also specifies a direct or inverse order of using the keys. As a result, the e parameter determines the direct and inverse process of the entire transformation in the block algorithm.

If q keys are used in one round (in the general scheme shown in Fig. 4.13, q = 4), then, to implement the whole cipher, qr different keys are generally required. Since the size of the original secret key is limited to 128-256 bits, it is usually necessary to make up a schedule for using the limited set of secret keys, or to carry out a special procedure to generate working keys for every round of encryption (the key extending procedure). The principles of organizing such a schedule or procedure are a separate topic, which isn't discussed in the subsequent sections of this chapter. From this point on, we'll assume that there is an adequate system of organizing key data for the proposed schemes.

In accordance with the properties of the Feistel scheme, the F round function can consist of a set of substitution-permutation operations carrying out a data transformation that doesn't need the inverse transformation when generating the inverse algorithm. In connection with this, the round function in the scheme shown in Fig. 4.13 can be defined as an F = [GP]W box. According to the recommendations in Section 4.3.7, the most promising operations for this box are fast COSs within the bijective serial model S′σ and the nonbijective serial model [image] , which can be effectively implemented both in hardware and software. For permutation elements in the [GP] box in a hardware implementation, it makes sense to use various BCPs, whereas in a software implementation it is possible to use CCSs and/or elementary BCPs.

Two variants of transformations can be considered to be B(e)3 boxes:

  • The B(e)3 = "⊕" operation typical for the traditional Feistel scheme

  • The B(e)3 = GW3, e(XR, A) COS corresponding to the improved Feistel scheme

For each of these two variants, the following four schemes of direct and inverse transformations B(e)1 and B(e)2 are possible:

One peculiarity of the first variant is that the process of the direct and inverse transformation is performed using different orders of the keys, without logically changing the block cipher scheme itself.

For other variants, individual schemes of the direct and inverse transformations are needed.

According to the recommendations given in Section 4.3.7, when designing a hardware implementation, for COS in the [G(e)P(e)](i)W1, [P(e⊕1)G(e⊕1)](i)W2, and GW3, e boxes, it is best to use implementations of the parametrically schematically reciprocal serial model S′σ, es or a version of the parametrically reciprocal recursive model Ω″σ, e. For permutation elements in these boxes (as well as in the [GP]W box) it makes sense to use various BCPs in a hardware implementation, and CCSs and/or elementary BCPs in a software implementation. Because of the features of the Feistel scheme, the round function F (the [GP]W box) doesn't require inversion in the reverse transformation, which provides the possibility of significantly complicating it, unlike the other elements of the E round transformation. An alternative approach that implies complicating the E transformation with the B(e)1 and B(e)2 boxes is possible, though less promising. In connection with this, based on COS and BCP, it is possible to design variously complicated combined schemes of round transformations that provide for a high effectiveness of the transformations. Due to the aforementioned features of the Feistel scheme, when synthesizing block ciphers, two main directions of generating round transformations are possible. The first of them is related to creating a simplified round transformation E and performing an increased number of iterations during the algorithm's execution, and the second implies creating a rather complicated round transformation with significantly fewer iterations. As examples of the first approach, Figs. 4.14 and 4.15 show the simplest round functions F (the [GP]W boxes) and the other elements of the E round transformation that correspond to them.

Click To expand
Figure 4.14: Examples of the simplest [GP]W boxes (W = V1 ∪ V2) (a - for a hardware implementation, b - for a software implementation)
Click To expand
Figure 4.15: Examples of the simplest [G(e)P(e)]W1 boxes (W1 = V′1 ∪ V′2) (a - for a hardware implementation, b - for a software implementation)

The [P(e⊕1)G(e⊕1)]W2 boxes corresponding to [G(e)P(e)]W1 boxes have the form shown in Fig. 4.16.

Click To expand
Figure 4.16: Examples of the simplest [P(e⊕1)G(e⊕1)]W2 boxes (W2 = V″1 ∪ V″2) (a - for a hardware implementation, b - for a software implementation)

According to the results in Section 4.3, transformations based on these boxes perform fast transformations that are bijective according to XR when there are no collisions on input data in the COS. The security level of the block ciphers based on these simplest elements of the E round transformation can vary, depending on the number of rounds in the entire algorithm.

4.5.5. Implementing Combined Round Functions Based on Controlled Operational Substitutions

The alternative approach to the simplified synthesis of round functions in block ciphers is connected with the creation of combined round functions. Fig. 4.17 shows an example of a complicated round function F, i.e., [GP]W boxes from the general scheme in Fig. 4.13. The round function F is collision-free separately on XL (∀XL ≠ X′L F(XL, K(1)e) ≠ ≠ F(XL′, K(1)e)) and K(1)e (∀ K(1)e ≠ K′(1)e F(XL, K(1)e) ≠ F(XL, K′(1)e)). These round functions can be used when designing 128-bit block ciphers with algorithms that are strongly secure against various cryptattacks.

Click To expand
Figure 4.17: An example of a complex round function F based on COS and BCP

As we demonstrated in Section 4.4, the security of such transformations against DCA and LCA is provided by the parallel-serial execution of a COS and BCP that have good joint non-linearity and propagation parameters and a high degree of errors propagation within the entire XL box being transformed.

4.5.6. A Practical Implementation of Controlled Operational Substitutions in Block Ciphers

On the basis of COS and BCP, a scientific experiment was carried out that involved software implementations of mockups of various block algorithms - in particular, of the SPECTR-H64 block cipher, whose round transformation corresponds to the parametrically reciprocal first variant of the improved Feistel scheme (Fig. 4.13). A comprehensive specification of this algorithm is given in Chapter 5. As we mentioned earlier, the same algorithmic scheme is used for the direct and inverse transformations in block ciphers of the SPECTR-H64 type.

The E(e) round transformation of the SPECTR-H64 block algorithm, which has several modifications, contains the controlled operational substitution GV of the serial bijective model S′σ, based on similar generating functions with one prototype function as one of the basic cryptographic primitives (for more detailed information see Section 4.3.7).

Two types of Boolean functions were used as prototype functions in two different modifications of the block cipher:

  • f = f(x1, ……, x8) = x7 ⊕ x8 ⊕ ϕ(x1, ……, x6), where ϕ(x1, ……, x6) = x1x2x3 ⊕ x1x4 ⊕ x2x5 is a bent function (Section 4.2.8).

  • f = f(x1, ……, x12) = x11 ⊕ x12 ⊕ ϕ(x1, ……, x10), where ϕ(x1, ……, x10) = x1x2 ⊕ x3x4 ⊕ x5x6 ⊕ x7x8 ⊕ x9x10 ⊕ x1x5x9 ⊕ x1x3x7x9 is a bent function.

To make sure, we'll look at the second variant of the prototype corresponding to Example 4.3 from Section 4.2.8 and estimate its cryptographic properties. With this goal in mind, we'll use the spectrum of the Walsh-Adamar transformation (Section 4.2.3) of the f function, which consists of 1024 |Uα| values = 128 for α = (x1, …x10,0,0) vectors, and 3072 Uα values = 0 for α = (x1, x2, …, x12) vectors, where x12 ≠ 0 and/or x11 ≠ 0.

Taking into account these facts and other special features of bent functions (Section 4.2.8), we have the following characteristics of the f function:

  • The non-linearity of the f function for m = 12 is determined by the value N(f) = 2m−1 - −2(1/2)(m+2)−1 = 211−26 = 1984, which is quite close to the maximum possible non-linearity for Boolean functions of 12 variables Nmax = 2m−1 - 2(m/2)−1 = 211 - 25 = 2016 (see Statement 4.17).

  • f is a correlationally immune function relative to all vectors α = (x1, x2, …, x12), where x12 ≠ 0 and/or x11 ≠ 0, which makes up 75% of all 4096 vectors (Section 4.2.7).

  • The Boolean function f has good autocorrelation properties (the avalanche effect and the error propagation effect, Sections 4.2.5 and 4.2.6) since the propagation criterion PC(12) is satisfied for all non-zero vectors (Δ x1, Δ x2, …, Δ x12 except for the following three: (0, 1, 0, …, 0), (1, 0, 0, …, 0), and (1, 1, 0, …, 0).

  • The Boolean function f has quite a high degree of the algebraic normal form deg(f) = 4 (Section 4.2.2).

In accordance with the scheme of the cipher, we have K = K1 ‖ K2 and K1 = (k(1)1, k(1)2, …, k(1)32), K2 = (k(2)1, k(2)2, …, k(2)32).

Let's now turn from the prototype function f to specific COS-generating functions with the following substitution of variables:

  • For the first variant of the prototype function:

  • For the second variant of the prototype function:

    Click To expand

In the second case, for ∀i∊{1, …, n} we have a set of generating functions with the following form:

Click To expand

where xi are the components of the transformed data vector XL∊GF(2)n/2, k(2)i are the components of the key K2 ∊ GF(2)n/2, and x−10, …, x0, k(2)−1, k(2)0 are the initial conditions.

A COS based on the generating functions given above and that performs the mapping X → Y: GF(2)n/2 × GF(2)n/2 → GF(2)n/2 also possesses regularity on X, K2 - i.e., Y takes all 2n/2 different values from GF(2)n/2 exactly 2n/2 times, while the general vector X ‖ K2 takes 2n values from GF(2)n. As a result, the COS is bijective on X for various fixed values of the K2 key, and it is collision-free on the K2 key for various fixed Xs.

In accordance with the scheme of SPECTR-H64 block ciphers (Chapter 5), the linear transformation xi = xi ⊕ k(1)i is performed at the COS input, which doesn't change the initial values of the non-linearity and degree of algebraic normal form of the generating functions (see Statement 4.16). An additional advantage of the resulting COS is the regularity on X, K1, K2 ∊ GF(2)n/2 (see Theorem 4.3). As a consequence of this feature, the COS is also collision-free on the second key K1 ∊ GF(2)n for fixed values of X (see Corollaries from Theorem 4.2). As a result of the transformation, the generating functions depend on two keys and take the following form:

Click To expand

Thus, the equivalent transformation obtained as the result of the linear transformation of the input data block XL corresponds to the controlled operational substitution Y = GK2(XL, K1). In vector representation (Section 4.5.2), this COS takes the following form:

Click To expand

Despite the outward complexity, the COS is hardware implementable in just TCOS = 6t⊕ time (Section 4.5.2).

With fixed values of the K1, K2 keys, the generating functions are generally transformed into three possible types of functions:

Hence, with the fixed keys, the generating functions retain their structure and have quite a high non-linearity - 224, 112, and 56, respectively (see Statement 4.17) and other properties listed above, just for a smaller number of variables. This fact is, yet, another advantage of a COS of such a type, since it provides security against cryptanalysis if some information about the keys is known.

The given example of the actual creation and analysis of a COS is an illustration of the possibilities of designing new cryptographic primitives of block encryption that posses specific cryptographic properties and an adjustable complexity of implementation. When creating a COS, using various prototype functions that have a wide range of special cryptographic properties provides a flexible mechanism of designing a whole set of new block ciphers with adjustable parameters of security against modern cryptanalysis.

[*]From the book The Complexity of Computing by John E. Savage (Brown University, John Wiley & Sons, 1976).


4.6. Summary

The description of controlled operational substitutions as non-linear cryptographic primitives of block ciphers given in this chapter is just one aspect of the widely developing concept of controlled operations, which is a promising field in the area of data protection. The essence of this concept is in creating substitutional and permutational elements of block ciphers that provide for high-speed non-linear transformations with a large number of modifications that are suitable for a hardware and, in some cases, software implementation. Such transformations are performed over an entire large-size data block (32 bits or more) and dynamically controlled by the data being transformed and the algorithm keys. COSs are an alternative to traditional S-boxes and common mathematical operations that are generally used in block cipher design. In a definite sense, COSs hold an intermediate position between large S-boxes and the pair of algebraic operations consisting of XOR and addition modulo 2n. COSs posses the advantages of these basic primitives, but they are free from some of their inherent shortcomings. The mechanisms provided for COS and the methods of their use ensure the high security of such algorithms against attacks based on modern cryptanalytic methods.


Chapter 5: Designing Fast Ciphers Based on Controlled Operations

This chapter deals only with the block cipher algorithms developed by the authors of the book. All terms and designations used in the present chapter basically correspond to those in the two previous chapters, unless otherwise specified.

5.1. Basic Cryptoschemes and the Key System

Let's take a look at the {M, C, K, E, D} quintet, where M and C are sets of fixed-length data blocks that are, respectively, being transformed and already transformed, K is a set of keys, and E and D are sets of direct and reverse mappings. In other words,

and ∀ K ε K, ∃! EK ε E, and ∃ DK ∃ D are such that ∀ X ε M, DK(EK(X)) = X.

Such an aggregate {M, C, K, E, D} is called a block algorithm of data transformation, or simply, a block cipher.

In general, the potency of a C set can not be less than that of an M set [93]. In block ciphers, M and C sets, as a rule, coincide with a set of binary vectors with a length of n (M = C = GF(2)n), and the K set ⊆ GF(2)m. In this case, EK and DK implement mutual univocal (bijective) mapping, where the designation EK−1 is used instead of DK, and a block cipher is designated by the quartet {M, C, K, E}.

The main point of block transformation is in the option of selecting an arbitrary mapping EK (EK ε E) that will enable each person knowing the K key to perform direct and reverse transformations over basic and transformed data blocks, respectively. However, if the K key is unknown, then it is practically impossible to figure out which transformation was used, even if there are several basic and transformed values. The E set should be rather big as well, so that it is impossible to try all possible EK mappings. Nowadays, it is recommended that you use keys with lengths exceeding 80 bits, since with a length of m, the key bit chain can be assigned no more than 2m various EK mappings. In particular, it was suggested to the organizers of the AES contest to provide for the future use of three standard lengths: 128, 192, or 256 bits, which fully excludes any possibilities of trying all keys, thus meeting business requirements for using algorithms, with respect to the "rate, cost, and reliability" factors.

An ideal variant is when a unique EK mapping corresponds to each K key. However, since it is impossible to place and store such a set of mappings in the computer, and algorithmic method is used to develop them.

As a rule, a "composition" principle is employed when the entire EK mapping is a series of rather simple E(i)K (i = 1, 2, …, r) mappings that depend on the K key. That is to say,

Building block ciphers based on comparatively simple operations was first introduced theoretically by Shannon in [90], where permutations and substitutions were used as simple operations. The block algorithm built on such a scheme were called SP-networks (Substitution-Permutation networks) [39]. The first operation of those listed above permutes the elements of the data block being transformed, whereas the second one replaces certain elements of the block - e.g., symbols - with others, usually selected from one and the same alphabet. It is presumed that it is the key that determines the operation selection. In such an interpretation, each operation is unambiguously specified by the key value, and is not changed until the next key entry.

The permutation and substitution operation provide two important properties that secure block ciphers should have: diffusion and confusion. There is a primordial condition in the notion of a "secure block cipher", since any block cipher with fixed key length is not absolutely secure. Theoretically, the key to it can be found using the method of trying all possibilities, called "brute force" in certain scientific papers. Moreover, there may be more than one such key. Further development of the Shannon theory turned out to the use of the data being transformed to control the selection of specific transformations, which was first implemented in the DES algorithm.

5.1.1. Iterated (Compositional) Block Ciphers

Usually, in practice, a basic E′ mapping called a "round" or cycle is formed, which is performed a specified number of times. We should mention that, generally speaking, various round keys K(i) formed on the basis of the base key K are used in each round. The aggregate transformation EK looks like this:

Such an algorithm is called an iterative (compositional) or iteration algorithm.

The choice to use an iterative encryptor is based not only on the higher technological level of the production of the cryptoscheme for a hardware implementation, but also by the necessity of substantiating both the optimality of using each formed mapping separately, and the optimality of their interaction as concerns providing proper cipher security. This is why iterated ciphers have become common. Moreover, it is more difficult to hide possible "trapdoors" (weak sides of a cryptosystem created by the developer) in such ciphers, which increases the users' trust in information protection means where such algorithms are used.

A combination of the Q(0) = K(1)‖K(2)‖…‖K(r) round keys is usually called an "extended" key, where the 0 superscript corresponds to the encoding mode (direct data transformation).

Actually, the base key K is a secret element, and therefore called the secret key. The term "master key" is also used in scientific papers. To stress its difference from the extended key, which is also secret, we have introduced the term "main key."

To perform an inverse transformation ("deciphering"), the (E′)−1 mapping and a series of keys written in reverse order is used - namely,

Click To expand

Correspondingly, Q(1) = K(r)‖K(r-1)‖…‖K(2)‖K(1) is an extended key for reverse transformation.

5.1.2. The Procedure to Generate an Extended Key

We can represent the extended key as follows:

where e is the data transformation mode (e = 0 is for direct, and e = 1 for reverse data transformations), and ∀j = 1, 2, …, r, Q(e,j) = K(j + e(r − 2j + 1)). In other words, the Q(e) key is a function of two variables, namely,

where K is the main key.

The H(K, e) function is usually called the extended key generation procedure. If ω′ = ω(K(i)) is the round key dimension, then the extended key dimension is equal to r ω′. That is, the expteded key generation procedure is for forming a bit series of a specified length.

Generally, an extended key can be used not only for specifying round keys, but also for initializing (choosing) cryptographic primitives (as in, for example, the SPECTR-Z, Khufu [84], Blowfish, and SEAL program ciphers).

Depending on the properties the formed series have, the H(K, e) procedure may have a special designation. For example, it may be known as a cryptographically secure (strong) extended key generation procedure or a key schedule. Despite the fact that historically, this same term "key schedule" is used in both cases, there is an essential difference between the two.

For example, the bit series of an extended key formed with a cryptographically secure procedure [40] should meet the following requirements:

  • All bits of each key element of the extended key should be independent from each other and have equiprobable distribution.

  • The bits of each key element of the extended key should be statistically independent from the bits of several neighboring key elements.

  • The total number of zeros in the extended key should not significantly differ from the number of ones.

  • The set of formed series should not be considerably less than the set of the main keys.

At the same time, the key schedule, as a rule, implies that each round key is a regular subset of a main key. A classic example of key schedule use is DES [84] and Russion State Standard 28147-89 (GOST), as well as SPECTR-H64 and SPECTR-128, which are described in this chapter.

Block ciphers can be specially classified by its type of extended key generation procedure, according to which each algorithm can be assigned a two-digit index. The first symbol has only two values (1 or 2), and the second has three (A, B, and C).

The first group usually contains block ciphers in which the round key allows you to determine all or some bits of the main key or the rest of the round keys. Included in the first group are all ciphers where the so-called key schedule is used, where each round key is a subset of the main key bits.

Among those in the second group are the block ciphers whose main criterion is that the round key bits are dependent on all or just some bits of the main key. The majority of contemporary block ciphers that participated in the AES contest fall into this group.

All six groups are described in Table 5.1.

Table 5.1: Classification of Extended Key Generation Procedures
Index | Description | Examples
1A | Knowing the round key enables you to unambiguously restore the main key and the rest of the round keys. | SPECTR-128, NDC
1B | Knowing the round key enables you to restore some bits of the main key and/or of the rest of the round keys. | DES, GOST, SPECTR-H64, Magenta
1C | Knowing the round key enables you to restore some bits of the main key and/or of the rest of the round keys after some simple arithmetic operations are performed. | Rijndael, Crypton, SAFER+, DEAL, IDEA
2A | Not all bits of the main key are used for forming the round key, and knowing the round key prevents the main or extended key from being restored. | DFC, CAST-128
2B | All bits of the main key are used for forming each round key, but knowing the round key prevents the main or extended key from being restored. | Blowfish, LOKI-97, Serpent, CAST-256, Twofish, RC6, E2, Mars, Frog, HPC
2C | Each round key is formed independently of the rest of the round keys, and the dimension of the extended key coincides with that of the main key. | DESI (DES with independent keys)

It is obvious that, according to the above classification, the least dangerous are block ciphers with the indices 2B and 2C. At the same time, developing a secure block cipher with an index of 2C and with a limited length (such as 256 bits) is something to work on, since in this case the product of the round number and the round key length is equal to the length of the main key, and is constant. This is the reason why no algorithms from this group that are used in practice are not noted.

The use of secure (strong) extended key generation procedures is the element called upon to enhance a cipher's security, or at least to simplify the proof of such. Indeed, this procedure allows you to consider round keys as independent, equiprobably distributed random variables. Accordingly, the cryptographic analysis of a scheme, as a rule, comes down to the analysis of one round, including the calculation of the necessary characteristics of one round and further generalization for a specified number of rounds.

We the authors have developed several strong extended key generation procedures using controlled operations. In particular, if controlled permutation boxes are applied as controlled operations, then the formation of one round key with a length of 256 bits will take about the same time as it would to successively perform ten XOR-type operations. This procedure can be used, for example, in the SPECTR-128 algorithm, which, with a hardware implementation, will increase the algorithm's working time, by approximately two rounds.

Contemporary recommendations about the necessity of using a strong extended key generation procedure are justified, first of all, by many years of studying the DES algorithm key system and by the development of special methods of deciphering block ciphers with respect to the revealed weak links in forming or using round keys. In particular, such notions as "weak keys", "semi-weak keys", and "crypto-equivalent keys" all exist. When block ciphers are developed, you need to take into account such recommendations, especially in cases where the dimension of the round key is comparatively small, i.e., when it is subject to being found by trial and error.

5.1.3. Using Key Schedules

On the other hand, using a strong extended key generation procedure leads to a reduction in the rate of data transformation, in some cases a rather noticeable one too, since additional time is required to generate another key. This circumstance is especially important for information protection systems that use the frequent key change mode, and where the volume of transformed information is rather small. In this case, a key schedule is preferable for extended key generation.

In any case, using a key schedule is justified when the speed of the algorithm is an important parameter, since the additional delay is determined only by the time it takes to enter another key.

The formation of the schedule should be subject to rigid conditions, taking into account the features of the algorithm's structure, as well as the interaction of cryptographic primitives both within the round and between rounds. Moreover, when a block cipher algorithm is developed, you must take into account the fact that a key schedule will be used.

One of the methods of reducing the occurrence of weak keys is increasing the dimension of round keys. When doing this, the task of calculating the round key may be no less difficult than that of calculating the main key. It is this method that was used for the development of fast ciphers of the SPECTR type. You can find variants of such schedules in the corresponding sections of the descriptions of certain block ciphers' algorithm models.

Initial and Final Transformations

Returning to the analysis of Formulas (5.2)-(5.4), we think it'd be good to mention that in most block ciphers offered by developers in the last decade, there was practically no use of Formulas (5.3) and (5.4) "in pure form" recorded. That is, the procedures of initial EK(1) and final EK(r) transformations differ from the rest of the "internal" transformations. It is quite possible that the need for such a difference was a consequence of the development of a special method of linear cryptanalysis for the DES algorithm, which was authored by Matsui. According to this method, you try to find the bit values of some of the round keys for special characteristics in the first and the last rounds (trying all the values of the round key part in the first and the last rounds is considered).

The key dimension in the initial and final transformations may differ from the corresponding dimension of round keys. It is universally accepted that the use of initial and final transformations without the key elements cannot enhance the cryptographic security of an algorithm, since with the initial and transformed data blocks available, it is always possible to determine the values of the data blocks after the initial and before the final transformations are performed. This means that estimating the security of a given cryptosystem comes down to solving the same task, but with fewer rounds. The initial and final transformations, with the obligatory use of key elements, are sometimes called "pre-whitening" and "post-whitening", since the main purpose of these transformations is to decrease the algebraic and statistic regularities between the bits of the input data block, and therefore those of the output one as well. So, the object here is to "approximate" the values of the input and output data blocks to "arbitrary and equi-probably propagated random variables", and therefore, to provide conditions ripe for applying mathematical methods to prove the cryptographic security of an algorithm.

Thus, for a contemporary iterated block cipher, the encryption and decryption formulas look as follows:

Click To expand

and

Click To expand

The extended key can be represented as follows:

Click To expand

where e is the data transformation mode (e = 0 direct and e = 1 reverse data transformation), K is the main key, and ∀j = 0, 1, 2, …, r, r + 1,

That is, the dependence between the round encryption key and the round decryption key looks as follows:

With a hardware implementation, the choice of a round key is most easily specified in the form of two tables (for e = 0 and e = 1, respectively), where the values of the extended key elements are represented in an explicit form, and the tables' completion depends on the H(K, e) procedure used.

Here is a variant of an efficient hardware implementation of round keys selection. Let's say that a Q(0) series is built with the use of the H(K, e) procedure, and that this series is located in an S register. Namely,

Click To expand

That is, S = H(K, 0) = H′(K). With respect to Formula (5.8), an encryption mode change involves reversing the order of round keys in the S series, i.e., round keys equidistant from the middle should trade places. Such a procedure is efficiently implemented using P2/1 controlled permutation boxes, and the number of them should be equal to half of the dimension of the extended key. For example, if ω is the round key dimension, then box P2ω/1 provides for the permutation of the S(j) and S(r − j + 1) round keys, and the same bits subject to permutation should be combined in one box, P2/1.

Fig. 5.1 shows an example of a box for controlling the round key choice that depends on the (e) data transformation mode for the case r = 12, ω(S(j)) = 32, j = 1, 2, …, 12, and ω(S(0)) = ω(S(13)) = 16. All round keys having the same dimension is not essential, but used for clarity' sake only. The special designation P2×ω/1 for a one-layer controlled permutation box only stresses the special structure of the box intended for two binary vectors of a ω length trading or not trading places, depending on the control bit value e. For this r-round cipher model, the P2×ω/1 transformation looks like this:

where i = 0, 1, …, r + 1, and the values of jth bits of vectors O(i) and O(r + 1 − i) are calculated using the following formulas:

Click To expand

Click To expand
Figure 5.1: An example of a scheme for controlling the choice of round key

In the scheme, the series O = O(0)‖O(1)‖O(2)‖…‖O(12)‖O(13) for e = 0 corresponds to the extended key Q(0), and for e = 1, to the extended key Q(1).

In a hardware implementation, O(j) represents the data buses of round keys.

It is obvious that choosing round keys at the transition from the encryption mode (e = 0) to the decryption mode (e = 1) and back is performed with a delay - τ(P2/1).

Thus, the implementation offered efficiently uses the algorithm when the data transformation mode is frequently changed.

Note

If r is an odd number, then no permutation is needed for the S(j) round key number (r + 1)/2, since here, j = r − j + 1.

Now consider the variant of using a key schedule. In this case, each order of the S register is the value of the register order in which the main K key is stored - i.e., there is a fixed commutation formed between these two registers. Then, however, there is no need to reserve a special S register, since commutation between the K register and one-layer boxes of controlled permutations can be performed directly.

Further details of the encryption formulas depend on the types of encryption schemes considered below. Accordingly, the scheme for choosing round keys depending on the encryption mode will be defined more precisely as well.

5.1.4. The Two Main Types of Block Cipher Encryption Schemes

Encryption schemes of contemporary block ciphers can be conditionally divided into two main types, namely,

  • Encryption and decryption are implemented with the same scheme.

  • Encryption and decryption are implemented with different schemes.

The main drawback of the second type is the necessity of implementing and analyzing two interconnected algorithms: an encryption algorithm and a decryption algorithm. Schemes related to this type are not considered, since we the authors are not involved in the implementation and analysis of such.

Note

The Rijndael algorithm, the winner of the Advanced Encryption Standard (AES) contest, is one of these algorithms. To be fair, we must note that the algorithm is formed in such a way that most transformations and their sequence coincide in the encryption and decryption algorithms. This algorithm is not analyzed in this book, mainly because of the lack of controlled operations in it.

The schemes of the first type, called universal, are most widely used, since their cost-effectiveness is high for a hardware implementation. As a rule, in such schemes, when an inverse transformation is performed, only the order of choosing the key information is changed. Section 5.1.5 deals with a patented scheme of one-round block encryption (Russian patent No. 2140714), which combines the properties of Feistel's scheme and a general iterative scheme. Section 5.1.6 deals with the general elements of block encryption algorithms, where the improved scheme of Russian patent No. 2140714 is used as a basic one-round scheme. Section 5.1.7 deals with two universal iterative schemes of block encryption that are not in the cipher class that uses Feistel's scheme.

5.1.5. An Improved One-Round Block Encryption Scheme (Russian Patent No. 2140714)

The most well known universal cryptoscheme is Feistel's [30], where the basic one-round transformation E′ is implemented using the F function. As with the E′ transformation, the specific appearance of the F function depends not only on the key, but on the data being transformed. The choice of F function, as well as the number of r rounds, greatly affects the security of the whole algorithm.

In a classic Feistel cryptoscheme (Fig. 5.2, a), the right part R′ of the transformed data L′‖R′ in the ith round is the result of an XOR (⊕) grouped operation with the round function value Fki:

where Ki is the round key.

Click To expand
Figure 5.2: One transformation round in Feistel's cryptoscheme (a) and in an iterative cryptoscheme (b)

In the iterative cryptoscheme of general form shown in Fig. 5.2, b, in each round, the right part R′ is the value of the round function FKi:

Each of the presented schemes has its advantages and drawbacks. Therefore, let's consider them in detail.

There are two main approaches to providing the necessary security for an algorithm, namely,

  • Building complex round functions with a small number of rounds

  • Using simple functions with an increased number of rounds

In the first case, the special pDC and qLC parameters of a round function that characterize its cryptographic security relative to methods of differential [8, 9] and linear cryptanalysis [7, 50], respectively, should approach the minimum possible values. In particular, for S boxes with a size of n × n, the lowest estimation for the pDC and qLC parameters is equal to 2−(n−2), i.e., it is impossible to provide values of the pDC and qLC parameters that are less than 2−(n−2) for the specified length n. Increasing n will inevitably entail a drop in the speed parameters and may cause technical difficulties.

When a high-speed block encryption algorithm is created, the second method is usually preferable.

Let's take a look at the {X} → {Y} transformation, where X = L ‖ R is the input block, Y = L′‖R′ is the output block, and {X} = {Y} = GF(2)n. For this transformation, consider the characteristic dependence function δij of the output bit yj on the input one, xi, namely, δij = 1, if ∃X, where bit inversion xi causes the inversion of the yj bit.

This characteristic function reflects the essence of the completeness criterion [39], which determines the dependence of the output bits on the input bits. With reference to one round of Feistel's scheme (see Fig. 5.2, a) with a round function F, the values of the characteristic function δij can be presented as (0, 1) - matrix ‖A‖ of n × n size, with the following appearance:

where ‖B‖, ‖E‖, and ‖0‖ are matrices of (n/2) × (n/2) size, ‖0‖ being a null matrix, and ‖E‖ a matrix implementing an identical transformation (only eii = 1). For Feistel's scheme, the maximum possible number of λmax ones of the ‖A‖ matrix is equal to n2/4 + n, and is reached when each bit of subblock L affects each bit of subblock R′ i.e., when in matrix ‖B‖, all bij = 1. In particular, in DES the matrix ‖B‖ contains 3n ones (n = 64), and for matrix ‖A‖, λmax = 4n, i.e., it is less than 1/4 of the maximum possible value, n2/4 + n. Switching the places of the right and left subblocks is equivalent to multiplying matrix ‖A‖ by matrix ‖U‖, which looks as follows:

But then in the r-round Feistel scheme, the corresponding matrix is the product 2r - 1 of matrices ‖A‖ and ‖U‖, namely,

Also, for the specified function F, the minimal number of rounds for which each input bit xi affects each output bit yj is calculated theoretically.

For the iterative scheme (see Fig. 5.2, b), the A matrix looks like this:

The maximum possible number of ones is λmax(‖A′‖) = n2/2 + n/2, and this happens when each bit of the input block (X = L‖R) has an influence on each bit of the output sub-block R′ - i.e., when in matrices ‖B‖ and ‖C‖ all bij and cij are equal to one. Accordingly, to have each input bit influence each output bit, a fewer number of rounds are necessary in the ‖W‖ matrix. Such a scheme is used in RC5, although the scheme shown in Fig. 5.2, b is originally considered a half-round. The invertibility requirement of the F function, which limits the set of possible functions, should be considered a drawback of the iterative scheme shown in Fig. 5.2, b.

Let's take a look at the improved iterative scheme of block data transformation (Fig. 5.3, a) offered in Russian patent No. 2140714 [1]. The vector value R′ for the patent scheme is calculated by this formula:

where GV and GU−1 are mutually inverse transformations, with their specific appearance determined by the control vectors V and U. That is, the GV, XOR, and GU−1 transformations are performed one after the other.

In general, the V and U control vectors are the values of procedure E from two variables (Fig. 5.3, b), namely, data block L and round key KV (or KU) - i.e., V = E(L,KV) and U = E(L,KU). The maximum possible number of ones λmax(‖A′‖) for this scheme is also equal to n2/2 + n/2, but in this case independence among the R′ block output bits is much easier to attain.

The presence of two mutually inverse transformations, GV, and GU−1 allows us to perform a direct and inverse transformation of the same scheme, but the order in which the keys are used in this case will be more complicated.

Click To expand
Figure 5.3: One transformation round in the basic (a) and detailed (b) scheme of Russian patent No. 2140714

Indeed, first we will examine the scheme's universality using an example of one round.

The round key Q(e, 1) for the (e = 0) encryption mode will be presented as a combination of three round subkeys KV, KF, and KU - namely,

Then round key Q(e, 1) for the (e = 1) decryption mode looks like this:

This means that for a reverse transformation, round subkeys are to be recorded in reverse sequence.

If the extended key Q(0) is presented as follows, taking into account Formulas (5.7-5.9):

Click To expand

then the extended key Q(1) for the decryption mode will have the following appearance:

Click To expand

This means that reversing the order of round subkeys is sufficient. Obviously, in this case, if the encryption mode is changed, an efficient hardware implementation of choosing the round subkeys is also done with the use of one-stage boxes of controlled permutations P2×ω/1.

Fig. 5.4 shows an example for ω(KF) = 32 and ω(KV) = ω(KU) = 64.

Click To expand
Figure 5.4: An example of the control scheme for choosing round subkeys

Finally we'd like to mention that, when a schedule is made with respect to Russian patent No. 2140714's basic scheme (see Fig. 5.3), the following requirements must be met. If they are not, it may weaken the security of an algorithm:

  • Use different KV(i) and KU(i) keys in one round to exclude V(i) = U(i) variants when mutually inverse modifications PV(i) and P−1U(i) are implemented - i.e., P−1U(i)(PV(i)(R)) = R.

  • Use different KV(i+2 and KU(i) keys to exclude V(i+2) = U(i variants when mutually inverse modifications PU(i)−1 and PV(i+2) are implemented - i.e., PV(i+2)(P−1U(i)(R)) = R.

5.1.6. General Elements of Block Encryption Algorithms Based on Controlled Operations

Structure of a Basic Cryptoscheme Model of an Iterative r-Round Block Encryption Algorithm

For the block ciphers SPECTR-H64, SPECTR-128, and CIKS-128, the scheme shown in Fig. 5.5 was used as a basic model of an r-round algorithm.

Click To expand
Figure 5.5: A basic model of an iterative block cipher algorithm

The data transformation function looks like this:

where Q(e) = H(K, e) is an extended key, a function of the secret key K = (K1, …, Ks) and the data transformation mode e (e = 0 - direct data transformation, e = 1 - inverse data transformation). The extended key - r + 2 - is a combination of working subkeys, namely,

Click To expand

where QIT(e), QFT(e) ε GF(2)n/2, and the structure and dimension of the rest of the keys depend on a certain model.

The F function is implemented as a series of the following procedures:

  1. Initial transformation - IT

  2. r rounds (cycles) of transformations using the Crypt procedure

  3. Final transformation - FT

First, the IT procedure is performed: Y = IT(X, QIT(e)).

Block Y is divided into two subblocks, of the same length, L0 and R0, i.e., (L0, R0) = Y, where L0, R0 ∈ GF(2)n/2. Then r rounds of transformations are performed using the Crypt procedure according to the formulas:

After the r round, the X = (Rr, Lr) block is subject to the final transformation, FT, according to the formula: Y = FT(X, QFT(e)).

Initial and Final Transformations

The initial transformation IT has the following appearance:

where X, Y ∈ GF(2)n, A ∈ GF(2)n/2.

Fig. 5.6 shows the implementation scheme of this transformation, where each pair of the X input block bits with the indices 2j−1 and 2j (j = 1, 2, …, n/2) is either represented (aj = 1), or not represented (aj = 0), after which each even bit is inverted. The bit values of the Y vector are calculated using the following formulas:

Click To expand
Click To expand
Figure 5.6: Initial transformation (s = n/2)

The FT procedure (Fig. 5.7) is a transformation that is the opposite of the IT procedure. The procedure looks as follows:

where X, Y ∈ GF(2)n, A ∈ GF(2)n/2

Click To expand
Figure 5.7: Final transformation (s = n/2)

Initially, each even bit of the input block is inverted (Fig. 5.7), and then each pair of input block X bits with the indices 2j - 1 and 2j (j = 1, 2, …, n/2) are either permuted (aj = 1) or not (aj = 0).

The bit values of the Y vector are calculated using the following formulas:

Click To expand

The use of the initial and final transformations in this basic model is more for "a fachion statement" than an abligatory requirement for enhancing the security of an algorithm.

5.1.7. Universal Block Encryption Schemes Based on Mutually Inverse Controlled Operations

There are two universal iterative schemes of block encryption considered here, which differ from Feistel's scheme in their structure. We mentioned above that the advantage of the widely used Feistel scheme (see Fig. 5.2, a) is the possibility of encrypting and decrypting using the same sequence of operations, and changing the encryption mode is done by changing the order of using round subkeys. This property provides for a cost-effective hardware implementation. On the other hand, a certain drawback of Feistel's cryptoscheme is that, within one round, only one of two input data blocks (L) is used to calculate the round function, whereas the second data block (R) is passive. Such a transformation is rather simple - R′ = R ⊕ F(L, K), since the round function F depends only on two parameters (L and the round key K).

Let's examine some cryptoschemes where the transformation of one of the data blocks has the most general form, namely,

Formula (5.16) corresponds to Fig. 5.2, b with the only requirement to the G function being the availability of an inverse function in the first parameter, namely, R = G−1 (R′, L, K).

Besides this, we will limit ourselves to the consideration of cryptoschemes with universal properties, where controlled operations are used as the G and G−1 functions.

According to the general definition of the function, the second and the third parameters are not obligatory, which can be expressed as follows:

where the figures in angle brackets mean that this part can be absent. There are four possible variants (5.17).

Variant 1:

This is using monadic operation, examples of which include fixed permutations (Y = Pπ(X)) or substitutions (Y = σ(X)).

Variant 2:

When you consider the function from the point of view of three variables, the third parameter (V) is always a control vector, the function itself implementing a controlled binary operation. That is, the dimensions of the first (X) and second (U) parameters are the same, whereas the dimension of the third parameter (V) may differ from that of the first two parameters. With respect to form (5.16), you can determine the second and third parameters as follows:

Click To expand

The presence of the same K designation for the second parameter should not raise any questions as to the dependence of variables, since it is always possible to present the K key as a combination of subkeys:

The basic difference between the F and E functions lies in the fact that the E function implements an expansion procedure of the L vector, whereas the F function can have an arbitrary appearance.

The following operations are examples of the F function:

  • Bitwise addition L ⊕ K

  • Modulo 2n addition (L + K mod 2n

  • Modulo 2n subtraction (L − K mod 2n)

  • Round function in DES

Variant 3:

This variant is analogous to the F(L, K) function, with the difference that "first-parameter reversibility" is an obligatory requirement for the G function.

Variant 4:

In this variant, the G function implements a one-place controlled operation, including controlled permutation blocks (P(X, V)) and controlled substitution operations.

Below we consider two universal cryptoschemes built with the use of controlled operations represented in general form by Formula (5.17).

Model 1

A constructive feature of the considered scheme is the use in one round (Fig. 5.8, a) of an even number of the Gi and G′i controlled operations, when each of two data subblocks is subject to transformation an equal number of times.

Click To expand
Figure 5.8: General (a) and special (b) cryptoschemes for implementing the Crypt procedure of one round

For an r-round iterated block cipher, the encryption algorithm is determined by a sequence of the following operations:

  1. Block X is divided into two subblocks of the same length, Xlo and Xhi - i.e., (Xlo, Xhi) = X, and an assignment operation is performed - (A0, B0) := (Xlo, Xhi).

  2. Using a Crypt procedure of one round, r rounds of transformations are performed according to the formulas:

    where j = 1, 2, …, r.

  3. The Y = (Ar, Br) value is the transformed data block.

If you represent the round key Q(e)j as a series of subkeys (Q(e)j = (Q(1, e)j, Q(2, e)j, …, Q(2 s, e)j)), and the series coincides with the order of their use in the Crypt procedure, then the correspondence between round keys of encryption and decryption looks as follows:

Click To expand

With such a cipher structure, the Crypt procedure should have an invertibility property of one round - namely,

Besides which, for the given structure of one round (Fig. 5.8), an aggregate of controlled operations G1, G2, …, Gs and G′1, G′2, …, G′s, for i = 1, 2, …, s, should have the following mutual correspondence property:

The same F′i, and E′i, functions should be used here, namely,

Actually, for any L and K, the following equality should be implemented:

A one-round algorithm goes like this:

  1. Perform an assignment operation (A(0), B(0)) := (Aj−1, Bj−1), and set a counter value i := 1.

  2. Calculate the vectors U′i := Fi (B(i−1), Qj(2i−1, e)) and V′i := Ei (B(i−1), Qj(2i−1, e)).

  3. Transform A(i) := Gi (A(i−1), Ui′, Vi′).

  4. Calculate the vectors Ui″ := Fi′(A(i), Qj(2i, e)) and Vi″ := Ei′(A(i), Qj(2i, e)).

  5. Transform B(i) := Gi′ (B(i−1), Ui″, Vi″).

  6. Increase the counter value i := i + 1. If i > s, then go to step 2.

  7. Perform an assignment operation (Aj, Bj) := (B(r), A(r)).

  8. STOP.

Let's use the example of this model to build an 8-round 64-bit block cipher with a secret key length equal to 256 bits.

Algorithm 5.1

With respect to the one-round scheme (Fig. 5.8, b), in the jth round, two 32-bit subkeys - Qj(1, e) and Qj(2, e)-are used, and so the length of the extended key is equal to 16 32-bit words. Let such an extended key for the encryption mode be formed with the use of the extended key generation procedure H(K), namely,

Click To expand

The following formula is to be used for the decryption mode:

where j = 1,2,…,8; that is,

Click To expand

The following operations are used in the scheme (Fig. 5.8, b):

  • Operations G1 and G2 are controlled binary operations reversible by the first parameter, considered in [16].

  • Operations P and P−1 are boxes of controlled permutations P32/80 and P−132/80[32].

  • Fixed permutation Pπ is the cyclic rotation operation by 11 bits to the lower order bit side.

  • E(B) is a control vector extension procedure that looks as follows: V = B‖B‖Bhi, where B = Blo‖Bhi.

The block cipher implementation algorithm goes as follows:

  1. Select an encryption mode (e = 0 - encryption, e = 1 - decryption), form an extended key Q(e) according to Formulas (5.22) and (5.23), and perform an assignment operation - (A0, B0 := (Xlo, Xhi), where (Xlo, Xhi) is a 64-bit initial data block.

  2. Set the round number counter value j := 1.

  3. Perform assignment operations (A(0), B(0)) := (Aj−1, Bj−1), and

  4. (W(1), W(2)) := (Q(1, e)j, Q(2, e)j).

  5. Calculate the vector V1 := B(0) ⊕ W(2).

  6. Transform A(1) := G1(A(0), W(1), V1).

  7. Calculate the vector V2 := Pπ(A(1)).

  8. Transform B(1) := G2−1(B(0), A(1), V2).

  9. Calculate the vector V3 := E(B(1)).

  10. Transform A(2) := P(A(1), V3).

  11. Calculate the vector V4 := E(A(2)).

  12. Transform B(2) := P(B(1), V4).

  13. Calculate the vector V5 := Pπ(B(2)).

  14. Transform A(3) := G2(A(2), B(2), V5).

  15. Calculate the vector V6 := A(3) ⊕ W(1).

  16. Transform B(3) := G−11 (A(3), W(2), V6).

  17. Perform an assignment operation (Aj, Bj) := B(3), A(3)).

  18. Increase the counter value j := j> + 1. If j < r, then go to Step 3.

  19. STOP.

The value Y (Ar, Br) is the transformed data block.

Model 2

A constructive feature of the considered scheme is the use of an odd number of controlled operations, Gi and G′i in one round (Fig. 5.9, a), when the right data block is subject to transformation with one operation less than the left one.

Click To expand
Figure 5.9: General (a) and specific (b) cryptoschemes of implementing a Crypt procedure of one round

For an r-round iterated block cipher, the encryption algorithm is determined by the sequence of the following operations.

  1. First, block X is divided into two subblocks of the same length - Xlo and Xhi i.e., (Xlo, Xhi) = X, and an assignment operation is performed: (A0, B0 = (XloXhi).

  2. Then, using a Crypt procedure of one round, r rounds of transformations are performed according to the formula:

    where j = 1, 2, …, r.

  3. The value Y = (Ar, Br) is the transformed data block.

That is, unlike in the first model, no swapping of the Ar, and Br, values is performed in the final round.

Everything that we said about the extended key Q(e) for the first model applies to this case as well, with the difference that the total number of subkeys in one round is odd: Q(e)j = (Q(1, e)j, Q(2, e)j, …, Q(2s−1, e)). That is:

Click To expand

As for the first model, the Crypt procedure should have the invertibility property, namely,

Besides which, for the specified structure of one round (Fig. 5.8), an aggregate of controlled operations G1, G2, …, Gs, and G′1, G′2, …, G′s−1 for i = 1, 2, …, s should have the following mutual correspondence property:

Click To expand

In particular, operation Gj with the index value j = (s + 1)/2 is an involution, for example, a bitwise addition operation by modulo two (⊕).

For mutually inverse functions specified by formula (5.24), the same functions, Fi and Ei, as well as F′i and E′i, should be used, namely,

and

A one-round algorithm looks as follows:

  1. Perform an assignment operation (A(0), B(0)) = (Aj−1, Bj−1), and set the counter value i := 1.

  2. Calculate the vectors U′i := Fi(B(i−1), Q(2i−1, e)j) and V′i := Ei(B(i−1), Q(2i−1, e)j).

  3. Transform A(i) := Gi(A(i−1), U′i, V′i).

  4. If i = s, then go to Step 8.

  5. Calculate the vectors U″i := F′i(A(i), Q(2i, e)j) and V″i := E′i(A(i), Q(2i, e)j).

  6. Transform B(i) := G:=i(B(i−1), U″i, V″i).

  7. Increase the counter value i := i + 1, and go to Step 2.

  8. Perform the assignment operation (Aj, Bj) := (A(r), B(r)).

  9. STOP.

Let's use the example of this model to build a 16-round, 64-bit block cipher with a secret key length equal to 256 bits.

Algorithm 5.2

With respect to the one-round scheme (Fig. 5.9, b), in the jth round, two 32-bit subkeys Q(1, e)j and Q(2, e)j are used, and so the length of the extended key is equal to and 32-bit words. Let the extended key for encryption be formed using an extended key generation procedure H(K), namely,

Click To expand

The following formula is to be used for decryption mode:

where j = 1, 2, …, 16 - that is,

Click To expand

The following operations are used in the scheme (Fig. 5.9, b):

  • Operation G1 is a controlled binary operation reversible by the first parameter, considered in [36].

  • Operations P and P−1 are boxes of controlled permutations P32/80 and P−132/80[32].

  • Operation P∗ is a controllable permutable involution considered in Chapter 3.

  • E(B, W) is a control vector extension procedure having, for example, the following appearance: V = B‖B ⊕ W‖((B ⊕ W)≫>11)hi, where the operation (B ⊕ W)≫>11 means the cyclic rotation operation by 11 bits to the lower order bit side.

The block cipher implementation algorithm can be given as follows:

  1. Select an encryption mode (e = 0 - encryption, e = 1 - decryption), form an extended key Q(e) according to Formulas (5.25) and (5.26), and perform the assignment operation (A0, B0) := (Xlo, Xhi), where (Xlo, Xhi) - 64-bit initial data block.

  2. Set the round number counter value - j := 1.

  3. Perform the assignment operations (A(0), B(0),) := (Aj−1, Bj−1) and

  4. (W(1), W(2)) := (Q(1, e)j, Q(2, e)j.

  5. Calculate the vector V1 := B(0) ⊕ W(2).

  6. Transform A(1) := G(A(0), W(1), V1).

  7. Calculate the vector V2 := E(A(1), W(2)).

  8. Transform B(1) := P(B(0), V2).

  9. Calculate the vector V3 := B(1) ⊕ W(1) ⊕ W(2).

  10. Transform A(2) := P*(A(1), V3).

  11. Calculate the vector V4 := E(A(2), W(1)).

  12. Transform B(2) := P−1(B(1), V4).

  13. Calculate the vector V5 := B(2) ⊕ W(1).

  14. Transform A(3) := G−1 (A(2), W(2), V5).

  15. Perform an assignment operation (Aj, Bj) := (B(3), A(3)).

  16. Increase the counter value j := j + 1. If j < r, then go to Step 3.

  17. STOP.

The value Y = (Br, Ar) is the transformed data block.

Finally, it should be mentioned that the models considered in this section show the variety of schemes for building block ciphers based on reversible controlled operations.


5.2. The SPECTR-H64 Block Cipher

This algorithm is a practical implementation of the main ideas of block cipher synthesis based on controlled operations and aimed at a high-speed information handling with a 32-bit data exchange bus that were considered in the previous chapters. The algorithm is published in [32].

5.2.1. The General Scheme of Block Encryption

For the SPECTR-H64 algorithm, the general encryption scheme (encryption and decryption) is determined by the formula:

where Q(e) = H(K, e) is the extended key, a function of the 256-bit secret key K and the encryption mode e (e = 0 encryption, e = 1 - decryption). In the encryption mode, X is the initial block of binary data (plaintext), and in the decryption mode it is the transformed block of binary data (ciphertext). In the encryption mode, the resulting value Y is cipher text, and in the decryption mode it is plaintext.

The secret key K is represented as a combination of eight 32-bit subkeys, namely, K = K1‖K2‖…‖K8, where K1, K2, …, K8 ∈ GF(2)32.

The encryption algorithm (the F function) is described in Section 5.2.2, and the procedure for building the Q(e) = H(K,e) working key will be found in Section 5.2.3.

5.2.2. The Encryption Algorithm

The F function (Fig. 5.5) is implemented with the following procedures:

  1. Initial transformation - IT.

  2. 12 rounds (loops) of transformations using the Crypt procedure.

  3. Final transformation - FT.

First, the IT procedure is performed: Y = IT(X, Q(e)IT).

The Y block is divided into two subblocks of the same length - L0 and R0, i.e., (L0, R0) = Y, where L0, R0 ∈ GF(2)32. Then, 12 rounds of transformation are performed with the Crypt procedure according to the formulas:

After the 12th round over the X = (R12, L12) block, the final transformation, FT, is performed according to the formula:

Initial Transformation

The initial transformation IT looks as follows:

where X, Y ∈ GF(2)64, A ∈ GF(2)32.

The implementation scheme of this transformation is shown in Fig. 5.6, where each pair of bits of the input block X with the indices 2j−1 and 2j (j = 1, 2, …, 32) is either permuted (aj = 1) or not permuted (aj = 0), after which each even bit is inverted. The bit values of the Y vector are calculated with the following formulas:

The Crypt Procedure

A formal record of the Crypt procedure looks as follows:

where L, R ∈ GF(2)32 and A(1), A(2), …, A(6) ∈ GF(2)32.

The elements A(1), A(2), …, A(6) are the formal parameters of key information, i.e., Q(i, e)j is an element of round key Q(e)j = Q(1, e)j, Q(2, e)j, …, Q(6, e)j, and corresponds to the A(i) parameter. Accordingly, R and L are formal parameters for the left and right parts of the input data block.

One feature of such an implementation of the Crypt procedure is the use of six sub keys with a length of 32 in one round.

The procedure uses:

  • The rotation operation "≫>" by a fixed number of bits

  • Bit-wise addition modulo 2 "⊕"

  • A non-linear vector Boolean function G

  • Controlled permutation boxes P32/80 and P−132/80 of the first order

  • A procedure for expanding control vector E (expansion box)

Two-stage Clos networks C<8,4> and C<4,8>, are used as P32/80 and P−132/80 boxes, respectively, when for the C<8,4> box the smaller boxes are R3 and R2 boxes, and for C<4,8> = C−1<4,8>, they are the R−12 and R−13 boxes. This differs from the classical structure of the C<8,4> Clos network in that the order of R2 boxes is changed (see the box numeration in Fig. 5.10). A commutation between the third and fourth layers in box P32/80 has this involution:

Click To expand

The sequence of transformations and their interaction are shown in Fig. 5.11.

Click To expand
Figure 5.10: The controlled permutations box P32/80
Click To expand
Figure 5.11: The Crypt procedure scheme

The time base of operations in Crypt procedure is presented in Table 5.2.

Table 5.2: The Time Base for Performing an Operation in the Crypt Procedure
No | Time base τ⊕ | Operations
1 | 0 | U = L>>>11 | U′ = L>>>17 | U″ = L>>>11
2 | 0 ÷ 1 | V = EA(1)‖A(2)(U) V′ = EA(3)‖A(4)(U′) V″ = EA(5)‖A(6)(U″) W = L ⊕ A(3)
3 | 0 ÷ 5 | R = P32/80(V)(R) |  | X = P32/80(V′)(A(4))
4 | 1 ÷ 5 |  | X′ = GA(3)‖A(4) (W)
5 | 5 ÷ 6 |  | R = R ⊕ X
6 | 6 ÷ 7 |  | R = R ⊕ X′
7 | 7 ÷ 12 |  | R = P−132/80(V″) (R)

As it follows from Table 5.2, most operations are performed concurrently, and the total time required for the performance of the procedure is equal to the consecutive performance of 12 operations of the XOR type.

Note

This index can be improved if a matrix structure of implementing R2 boxes in boxes P32/80 and P−132/80 is used. Issues of matrix implementation were considered in Chapter 3. In this case, the time for the Crypt procedure's implementation will not exceed the time it takes to consecutively perform 9 operations of the XOR type.

Vector Boolean Function G

A controlled substitution operation is used as the vector Boolean function G, one of the implementations of a sequential bijective model, and formed according to the rules described in Sections 4.3.3, 4.3.7-4.3.10, and 4.5.6. Formally, the G function looks like this:

The formal parameters A and B correspond to the formal parameters A(3) and A(4) of the Crypt procedure. In vector form, the G function is determined by the formula:

Click To expand

The binary vectors M(0), M(1), …, M(5) are expressed recursively via W, namely,

Click To expand

and ∀j = 1, 2,…, 5,

Click To expand

Taking into account the option of concurrent performance of some operations, it is easy to establish that the G function is implemented during four delay time units (4τ⊕) instead of the allowable 5 time units - i.e., there is a reserve kept for its meshing (see Section 4.5.2).

Grounds for Choosing a Non-Linear G Function

Let's define the mapping G: GF(2)32 × GF(2)32 × GF(2)32 → GF(2)32 as a Boolean vector function Y = G(X, A, B) of the following appearance:

where gi are certain generator Boolean functions.

If, for each i, the condition gi(X, A, B) = gi(x1, x2, …, xi, A, B) is true, then such a mapping is a sequential model of a controlled substitution operation. If the functions gi(X, A, B) = xi ⊕ g′i(x1, x2, …, xi−1, A, B) are selected as generator functions in the considered model, then the vector Boolean function G implements bijective mapping by X (see Section 4.3.3). A single unified Boolean function of eight variables is used as a generator functions prototype (see Section 4.3.7) in the G function. It looks as follows:

where φ(z1, z2, …, z6) = z1z2z3 ⊕ z1z4 ⊕ z2z5 ⊕ z3z6 is a bent function (see Section 4.2.8).

A Walsh-Hadamard transformation (see Section 4.2.3) of the g function consists of 64 elements having the value |U∗α(g)| = 32 for all vectors α = (α1, α2, …, α6, 0, 0), and for the rest of the 192 elements they have a value of U∗α(g) = 0. With respect to the selected structure and properties of bent functions, we have the following characteristics of the g function:

  • The non-linearity of the g function is equal to N(g) = 2m−1 − 2((m+2)/2)−1 = 112 (with m = 8), which is quite close to the maximally possible non-linearity of Boolean functions of 8 variables (Nmax = 2m−1 − 2(m/2)−1 = 120 (see Section 4.2.4).

  • g is a correlation immune function on a set of vectors {(z1, z2, …, z8)} ⊂ GF(2)8 where z7 ≠ 0 or z8 ≠ 0, which makes up 75% of the whole GF(2)8 set (see Section 4.2.7).

  • g possesses good autocorrelation properties, because for all non-vanishing avalanche vectors (Δ z1, Δ z2, …, Δ z8) ε GF(2)8 except for three - ((0, …, 0, 0, 1), (0, …, 0, 1, 0), and (0, …, 0, 1, 1)) - the 8th order propagation criterion is fulfilled, that is, the function Δ g = g(z1, z2, …, z8) ⊕ g(z1 ⊕ Δ z1, z2 ⊕ Δ z2, …, z8 ⊕ Δ z8) is a balanced one (see Section 4.2.6).

  • The degree of the algebraic normal form of function g is equal to 3 (deg(g) = 3) (see Section 4.2.2).

A transition from the general form of the g function to certain generator functions of a controlled substitution operation sequential model is performed by the following substitution of variables:

where ∀i ε{1, 2, …, n} and n = 32. See details in Section 4.5.6.

Thus, generator functions look as follows:

Click To expand

where xi, ai, and bi are the components of vectors X, A, B ∈GF(2)32, and the initial conditions correspond to the vector (x−4, x−3, x−2, x−1, x0) = (1, 1, 1, 1, 1).

According to the scheme of the Crypt procedure (Fig. 5. 11), the G function is preceded by a linear transformation X = L ⊕ A which does not change either the initial values of non-linearity or the degree of the algebraic normal form of generator functions (see Statement 4.16), but does complicate the resulting appearance of the generator functions. The function G' = G(L ⊕ A) is bijective by L at various fixed values of the A and B parameters.

The Extension Procedure for Control Vector E (Extension Box)

This procedure is intended for building an 80-bit control vector from a 32-bit one. It formally looks as follows:

where V ε GF(2)80, V1, V2, V3, V4, V5 ε GF(2)16, U, A, B ε GF(2)32.

Actually, the V vector is calculated according to the formulas:

where the transformation Pπ(s) looks as follows: Pπ(s)(Z) = (Zhi)≫>s‖(Zlo)≫>s.

For the P32/80 box, there is a correspondence of the V and U vector bit-numbers shown in Table 5.3. For example, 17 in the first line means that the P2/1 box control input ν(l)1 is fed the value U17, 221 corresponds to a value of v(2)13 = u22 ⊕ a22 and 72 corresponds to a value of v(4)10 = u7 ⊕ b7. The extension procedure E is created in such a way that the 16 lower order bits of the U vector participate in controlling only R2 boxes, whereas higher order bits control only R3 boxes, with all the bit numbers of vector U being different in each R2 and R3 box.

Table 5.3: Control Bit Values for the P32/80 Box
V1 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | Uhi
V2 | 261 | 271 | 281 | 291 | 301 | 311 | 321 | 251 | 181 | 191 | 201 | 211 | 221 | 231 | 241 | 171 | (U⊕A)hi and (U⊕B)hi
V3 | 302 | 312 | 322 | 252 | 262 | 272 | 282 | 292 | 222 | 232 | 242 | 172 | 182 | 192 | 202 | 212 |
V4 | 142 | 152 | 162 | 92 | 102 | 112 | 122 | 132 | 62 | 72 | 82 | 12 | 22 | 32 | 42 | 52 | (U⊕B)lo and (U⊕A)lo
V5 | 101 | 111 | 121 | 131 | 141 | 151 | 161 | 91 | 21 | 31 | 41 | 51 | 61 | 71 | 81 | 11 |

The same E extension procedure is used for the box P−132/80 but, due to the special numeration of box P−132/80 control bits, Table 5.3 is transformed into Table 5.4.

Table 5.4: Control Bit Values for the P−132/80 Box
V5 | 101 | 111 | 121 | 131 | 141 | 151 | 161 | 91 | 21 | 31 | 41 | 51 | 61 | 71 | 81 | 11 | (U⊕A)lo and (U⊕B)lo
V4 | 142 | 152 | 162 | 92 | 102 | 112 | 122 | 132 | 62 | 72 | 82 | 12 | 22 | 32 | 42 | 52
V3 | 302 | 312 | 322 | 252 | 262 | 272 | 282 | 292 | 222 | 232 | 242 | 172 | 182 | 192 | 202 | 212 | (U⊕B)hi and (U⊕A)hi
V2 | 261 | 271 | 281 | 291 | 301 | 311 | 321 | 251 | 181 | 191 | 201 | 211 | 221 | 231 | 241 | 171
V1 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | Uhi

The E procedure provides for:

  • The uniformity of the participation of all 32 bits of the U vector in controlling the P32/80 box.

  • The fact that there are five (according to the number of layers) different bits of U vector participating in the control for a randomly chosen commutation of one input bit with one output bit, which guarantees such a commutation with any round key values A and B, and, consequently, corresponds to the first order box determination.

  • The control vector V1, being a fixed permutation of 16 bits of the L block, i.e., transformation in the first layer of P32/80 box is performed without any time delay.

Final Transformation

The FT procedure is a transformation that is the opposite of the IT procedure. This transformation looks as follows:

where X, Y ∈ GF(2)64, A ∈ GF(2)32.

Initially, each even bit of the input block is inverted (see Fig. 5.7), and then each pair of the X input block with indices 2j−1 and 2j(j = 1, 2, …, 32) is either permuted (aj = 1) or not (aj = 0).

The bit values of the Y vector are calculated with the use of the following formulas:

Click To expand

5.2.3. The Schedule for Using Round Keys

In a 12-round SPECTR-H64 block cipher, the extended key Q(e) is a combination of 14 subkeys, namely,

where [image] .

when [image] .

The Q(e) extended key is a series of seventy-two 32-bit binary vectors, each of them being one of eight secret subkeys K1, K2, …, K8.

Some elements of the Q(e) extended key have fixed values - Kj, the rest being determined via Oi parameters, which are calculated, in turn, by the formulas:

where K = K1‖K2…‖K8 and i = 1, 2, 3, 4.

The commutation scheme between Oi and Kj is shown in Fig. 5.12.

Click To expand
Figure 5.12: The subkey commutation scheme

The correspondence of subkeys Q(e)IT, Q(e)FT, Q(1, e)j, Q(2, e)j, …, Q(6, e)j (j = 1, 2, …, 12) is specified in Table 5.5.

Table 5.5: Schedule for Using Round Keys
Q(e)IT | j = | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | Q(e)FT
O1 | Q(1, e)j= | K1 | K8 | K5 | K4 | K1 | K6 | K7 | K4 | K2 | K6 | K5 | K3 |
 | Q(2, e)j= | K2 | K6 | K7 | K3 | K2 | K8 | K5 | K3 | K1 | K8 | K7 | K4 | O2
 | Q(3, e)j= | O6 | O1 | O2 | O5 | O7 | O3 | O4 | O8 | O6 | O1 | O2 | O5
 | Q(4, e)j= | O7 | O4 | O3 | O8 | O6 | O1 | O2 | O5 | O7 | O4 | O3 | O8
 | Q(5, e)j= | K3 | K5 | K6 | K2 | K4 | K7 | K6 | K1 | K4 | K5 | K8 | K1
 | Q(6, e)j= | K4 | K7 | K8 | K1 | K3 | K5 | K8 | K2 | K3 | K7 | K6 | K2

For example, for the fifth round (j = 5), the subkey sequence K1‖K2‖O7‖O6‖K4‖K3 corresponds to the formal parameters A(1), A(2), …, A(6) of the Crypt procedure, namely,

Click To expand

That is, Q(e)5 = (K1, K2, K7+e, K6−e, K4, K3).

For the encryption mode - Q(0)5 = (K1, K2, K7, K6, K4, K3),

and for the decryption mode - Q(e)5 = (K1, K2, K8, K5, K4, K3).

For the initial and final transformations, the keys Q(e)IT and Q(e)FT look as follows:

That is,

For the encryption mode,

and for the decryption mode


5.3. The SPECTR-128 Cipher (Algorithm)

This algorithm is a practical implementation of the main ideas for synthesis of a fast block cipher based on controlled operations and considered in the previous chapters, and it is aimed at high-speed information processing with a 64-bit data exchange bus.

5.3.1. A General Scheme of Block Encryption

For the SPECTR-128 algorithm, a general encryption scheme (encryption and decryption) is determined by the formula:

where Q(e) = H(K, e) — is an extended key that is a function of a 256-bit secret key K and the encryption mode e (e = 0 — encryption, e = 1 — decryption), while in the encryption mode X is the initial block of binary data (plaintext), and in the decryption mode it is a transformed block of binary data (ciphertext). In the encryption mode the resulting value Y is ciphertext, and in the decryption mode it is plaintext.

The secret key K is represented as a combination of four 64-bit subkeys, namely, K = K1‖K2‖K3‖K4, where K1, K2, K3, K4 ε GF(2)64.

The encryption algorithm (the F function) is described in Section 5.3.2, and the procedure for building the Q(e) = H(K, e) working key will be found in Section 5.3.3.

5.3.2. The Encryption Algorithm

The F function (Fig. 5.5) is implemented using the following procedures:

  • The initial transformation — IT

  • 12 rounds (loops) of transformations using the Crypt procedure

  • The final transformation — FT

First, the IT procedure is performed: Y = IT (X, Q(e)IT).

Block Y is divided into two subblocks of the same length — L0 and R0, i.e., (L0, R0) = Y, where L0, R0 ε GF(2)64. Then, 12 rounds of transformation are performed using the Crypt procedure according to the formulas:

After the 12th round, the final transformation FT is performed over the block X = (R12, L12) according to the formula:

Initial Transformation

The initial transformation IT looks as follows:

where X, Y ε GF(2)128, A ε GF(2)64.

The implementation scheme of this transformation is shown in Fig. 5.6, in which each pair of bits of the input block X with the indices 2j−1 and 2j(j = 1, 2, …, 64) is either permuted (aj = 1) or not permuted (aj = 0), after which each even bit is inverted. The bit values of vector Y are calculated by the following formulas:

Click To expand

The Crypt Procedure

Formally, the Crypt procedure looks as follows:

where L, R ε GF(2)64 and A(1), A(2), A(3), A(4) ε GF(2)64.

The elements A(1), A(2), A(3), and A(4) are formal parameters of the key information, i.e., Q(i,e)j is an element of the round key Q(e)j = (Q(1, e)j, Q(2, e)j, Q(3, e)j, Q(4, e)j), and corresponds to parameter A(i). Accordingly, R and L are the formal parameters for the left and right parts of the input data block.

One feature of such an implementation of the Crypt procedure is the use of four subkeys with a length of 64 in one round — i.e., all the bits of 256-bit secret key K are used. In addition, a more complicated vector Boolean function G is used.

The procedure employs:

  • The rotation operation ">>>" by a fixed number of bits

  • Bit-wise addition modulo 2 — "⊕"

  • A non-linear vector Boolean function G

  • Controlled permutations boxes P64/192 and P64/192−1 of the first order

  • The control vector E extension procedure (expansion box)

A two-stage Clos network C<8,8> is used as P64/192 and P64/192−1 boxes (Fig. 5.13) when the first layer is made up of R3 boxes, and the second is made up of R−13 boxes with the structure described in Chapter 3 (see Fig. 3.22). Since the structure of the P64/192 and P64/192−1 boxes are the same, in Fig. 5.13, column (I) corresponds to a control vector for the direct transformation, and column (II) to a reverse transformation.

Click To expand
Figure 5.13: Controlled permutations box P64/192

The sequence of transformations and their interaction are shown in Fig. 5.14.

Click To expand
Figure 5.14: The Crypt procedure scheme

The time base of operations in the Crypt procedure is presented in Table 5.6.

Table 5.6: The Time Base for Operations in the Crypt Procedure
No | Time base τ⊕ | Operations
1 | 0 | U = L>>>21 U′ = L>>>43 U″ = L>>>21
2 | 0 ÷ 1 | V = EA(1)(U) V′ = EA(3)(U′) V″ = EA(2)(U″)
3 | 0 ÷ 6 | R = P64/192(v(R) X = P64/192(V′) (A(4))
4 | 0 ÷ 5 | X′ = GA(3)‖A(4)(L)
5 | 6 ÷ 7 | R = R ⊕ X
6 | 7 ÷ 8 | R = R ⊕ X′
7 | 8 ÷ 14 | R = P−164/192(V″(R)

As it follows from Table 5.6, most of the operations are performed concurrently, and the total time required for the performance of the procedure is equal to the consecutive performance of 14 operations of the XOR type.

Vector Boolean Function G

A controlled substitution operation — which is one of the implementations of a sequential bijective model and formed according to the rules described in Sections 4.3.3, 4.3.7–4.3.10, and 4.5.6 — is used as a vector Boolean function G. Formally, the G function looks as follows:

The formal parameters A and B correspond to the formal parameters A(3) and A(4) of the Crypt procedure. In vector form, the G function is determined by the formula:

Click To expand

where vectors Lj(j = 0, 1, 2, …, 9) are expressed recursively via L, namely,

Click To expand

and ∀j = 0, 1, …, 5,

Click To expand

Vectors A(j) and B(j) for j = 0, 1, 2 are determined in a similar manner.

Taking into account the option of concurrently performing some operations, it is easy to establish that the G function is implemented during five time delay units 5τ⊕ (see Section 4.5.2).

Grounds for Selecting a Non-Linear G Function

We'll define the mapping of G: GF(2)64×GF(2)64×GF(2)64 →GF(2)64 as a Boolean vector function Y = G(X, A, B) with the following appearance:

Click To expand

where gi represents certain generator Boolean functions. If gi(X, A, B) = = gi(x1, x2, …, xi, A, B) is true for each i condition, then such a mapping is a sequential model of a controlled substitution operation. If the function gj(X, A, B) = xi⊕ g′j(x1, x2, …, xi−1, A, B) is selected as a generator function in the considered model, then the vector Boolean G function implements bijective mapping by X (see Section 4.3.3). A single unified Boolean function of twelve variables is used as a generator functions prototype (see Section 4.3.7) in the G function. It looks as follows:

where φ(z1, z2,…, z10) = z1z2 ⊕ z3z4 ⊕ z5z6 ⊕ z7z8 ⊕ z9z10 ⊕ z1z5z9 ⊕ z1z3z7z9 is a bent function (see Section 4.2.8). A Walsh-Hadamard transformation (see Section 4.2.3) of the g function consists of 1024 elements possessing the value |Uα∗(g)| = 128 for all vectors α = α1, α2,…, α10, 0, 0) and for the rest of the 3072 elements, they have the value Uα∗(g) = 0. With respect to the selected structure and properties of bent functions, we have the following characteristics of the g function:

  • The non-linearity of the g function is equal to N(g) = 2m−1 −2((m+2)/2)−1 = 1984 (with m = 12), which is quite close to the maximum possible non-linearity of Boolean functions of 12 variables (Nmax =2m−1 −2(m/2)−1 = 2016 (see Section 4.2.4).

  • g is a correlation immune function on a set of vectors {(z1, z2, …, z12)} ⊂ GF(2)12 where z11 ≠ 0 or z12 ≠ 0 (see Section 4.2.7), which makes up 75% of the whole GF(2)12 set.

  • g possesses good autocorrelation properties, since for all non-vanishing avalanche vectors δ z1, Δ z2, …, Δ z12) ε GF(2)12 except for three — ((0, …, 0, 0, 1), (0, …, 0, 1, 0), and (0, …, 0, 1, 1)) — the propagation criteria of the 12th order is fulfilled, that is, the function Δ g = g(z1, z2, …, z12) ⊕ g(z1 ⊕ Δ z1, …, z12 ⊕ Δ z12) is a balanced one (see Section 4.2.6).

  • The degree of the algebraic normal form of function g is equal to 4 (deg(g) = 4) (see Section 4.2.2).

A transition from the general form of the g function to certain generator functions of a sequential model of a controlled substitution operation is performed by the following substitution of variables (see details in Section 4.5.6):

Click To expand

where ∀i ε {1, 2, …, n} and n = 64.

Thus, generator functions look like:

Click To expand

where li, aj, bj are the components of vectors L, A, B εGF(2)64, and the initial conditions correspond to the vector x−4, x−3, x−2, x−1, x0 = (1, 1, 1, 1, 1).

The Procedure for Extending Control Vector E (Extension Box)

This procedure is intended for building a 192-bit control vector from a 64-bit one. Formally, the E procedure looks as follows:

where V ε GF(2)192, V1, V2, V3, V4, V5, V6, ε GF(2)32, U, A ε GF(2)64.

The V vector is calculated according to the formulas:

Click To expand

where the Pπ(s) transformation looks like Pπ(s) (Z) = (Zhi)>>>s ‖(Zlo)>>>s.

For the P64/192 box, you see the correspondence of the V and U vectors' bit-numbers, which is shown in Table 5.7. For example, 19 in the fourth line, corresponding to vector V4, means that the value u19 is used as the control bit ν10(4), i.e., ν102 of V.22 corresponds to the value u22, and 7 to the value u7.

Table 5.7: The Correspondence between the U and V Vector Bits for the P64/192 Box
V1 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64
V2 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 49 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 33
V3 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41
V4 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
V5 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 17 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 1
V6 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32

Similarly, Table 5.8 shows the correspondence of bit numbers for vectors V and A; the table's analysis proves that V1 does not depend on A.

Table 5.8: The Correspondence between the A and V Vector Bits for the P64/192 Box
V1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
V2 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 49 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 33
V3 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40
V4 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8
V5 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 17 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 1
V6 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32

The extension is done in such a way that the 32 high order bits of vector A control only R3 boxes, and those of the lower order control only boxes R3−1, whereas in each box R3 and R3−1 all bit numbers of vectors U and A are different. Moreover, there are no two P2/1 boxes with control bits of the same expression of the Ui ⊕ aj type.

The E procedure provides for:

  • The uniformity of the participation of all 64 bits of the U vector in controlling the P64/128 box

  • The fact that, for a randomly chosen commutation of one input bit with one output bit, there are six different bits of the U vector and five different bits of the A key participating in the control, which guarantees the implementation of all commutation variants

  • The control vector V1, being a fixed substitution of 32 bits of the U vector, i.e., transformation in the first layer of the P64/192 box is performed without a time delay

Final Transformation

The FT procedure is a transformation that is the reverse of the IT procedure. This transformation looks as follows:

where X, Y ε GF(2)128, A ε GF(2)64.

Initially, each even bit of the input block is inverted (see Fig. 5.7), and then each pair of the X input block with indices 2j−1 and 2j(j = 1, 2, …, 64) is either permuted (aj = 1) or not (aj = 0).

The bit values of the Y vector are calculated using the following formulas:

Click To expand

5.3.3. The Schedule for Using Round Keys

In a 12-round SPECTR-128 block cipher, the extended key Q(e) is a combination of 14 subkeys, namely,

where Q(e)j = (Q(1, e)j, Q(2, e)j, Q(3, e)j, Q(4, e)j) ∀j = 1, 2, …, 12,

when Q(e)IT, Q(e)FT, Q(h,e)j ε GF(2)64, ∀h = 1,2,3,4.

The extended key Q(e) is a series of fifty 64-bit binary vectors, each of them being one of four secret subkeys — K1, K2, K3, K4.

The elements of the extended key Q(e) are determined via Oi parameters, which are calculated, in turn, by the formulas:

where K = K1‖K2‖K3‖K4 and i = 1, 2.

The commutation scheme between Oi and Kj is shown in Fig. 5.15.

Click To expand
Figure 5.15: The subkey commutation scheme

The subkey correspondence Q(e)IT, Q(e)FT, Q(1, e)j, Q(2, e)j, Q(3, e)j, Q(4, e)j (∀j = 1, 2, …, 12) is given in Table 5.9.

Table 5.9: Schedule for Using Round Keys
Q(e)IT | j = | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | Q(e)FT
O4 | Q(1, e)j = | O1 | O3 | O2 | O4 | O3 | O1 | O4 | O2 | O1 | O3 | O2 | O4 | O3
 | Q(2, e)j = | O3 | O1 | O4 | O2 | O1 | O3 | O2 | O4 | O3 | O1 | O4 | O2
 | Q(3, e)j = | O4 | O2 | O1 | O3 | O2 | O4 | O3 | O1 | O4 | O2 | O1 | O3
 | Q(4, e)j | O2 | O4 | O3 | O1 | O4 | O2 | O1 | O3 | O2 | O4 | O3 | O1

For example, for the fifth round (j = 5), the subkey sequence O3, O1, O2, O4 corresponds to formal parameters A(1), A(2), A(3), A(4) of the Crypt procedure, namely,

That is,

For the encryption mode

and for the decryption mode

For the initial and final transformations, the keys Q(e)IT and Q(e)FT look like:

That is,

For the encryption mode,

and for the decryption mode,


5.4. The CIKS-128 Cipher (Algorithm)

The CIKS-128 algorithm is a type of iterated block cipher that uses the scheme of Russian patent No. 2140714 as the basic scheme for one round. Compared to SPECTR-128, the round structure function is changed. In particular, instead of a controlled P64/192 permutation box and a non-linear vector Boolean G function, two identical non-linear vector Boolean G functions are used.

Like SPECTR-128, the CIKS-128 algorithm is a practical implementation of basic ideas of synthesizing a fast block cipher based on controlled operations, which we considered in the previous chapters. It is aimed at high-speed information processing with a 64-bit data exchange bus.

5.4.1. A General Scheme of Block Encryption

For the CIKS-128 algorithm, a general encryption scheme (encryption and decryption) is determined by the formula:

where Q(e) = H(K, e) is an extended key, which is a function of a 256-bit secret key K and encryption mode e (e = 0 - encryption, e = 1 - decryption). In the encryption mode, X is the initial block of binary data (plaintext), and in the decryption mode it is a transformed block of binary data (ciphertext). In the encryption mode, the resulting value Y is ciphertext, and in the decryption mode it is plaintext.

The secret key K is represented as a combination of four 64-bit subkeys, namely, K = K1‖K2‖K3‖K4 where K1, K2, K3, K4 ε GF(2)64.

The encryption algorithm (F function) is described in Section 5.4.2, and the building procedure for the Q(e) = H(K, e) working key can be found in Section 5.4.3.

5.4.2. The Encryption Algorithm

The F function (Fig. 5.5) is implemented using the following procedures:

  • Initial transformation - IT

  • 12 rounds (loops) of transformations using the Crypt procedure

  • Final transformation - FT

First, the IT procedure is performed: Y = IT (X, Q(e)IT).

Block Y is divided into two subblocks of the same length - L0 and R0, i.e., (L0, R0) = Y, where L0, R0 ε GF(2)64. Then, 12 rounds of transformation are done using the Crypt procedure according to the formulas:

After the 12th round, the final transformation FT is performed over the block X = (R12, L12) according to the formula:

Initial and Final Transformations

The simplest operation of bitwise addition with the key is used here, namely,

and

where X, Y, A, B ε GF(2)128.

The formal A parameter corresponds to the QIT(e) key, and the B parameter corresponds to the QFT(e) key.

The Crypt Procedure

Formally, the Crypt procedure looks like this:

where L, R ε GF(2)64. and A(1), A(2), A(3), A(4) ε GF(2)64.

The elements and A(1), A(2), A(3), and A(4) are formal parameters of key information, i.e., Q(i,e)j is an element of the round key Q(e)j = (Q(1, e)j, Q(2, e)j, Q(3, e)j, Q(4, e)j) corresponding to the A(i) parameter. R and L are formal parameters for the left and right parts of the input data block.

A feature of such an implementation of the Crypt procedure is the use of two vector Boolean G functions, four subkeys with a length of 64 in one round, i.e., all bits of the 256-bit secret key K are used, and an involution between the P64/192 and P64/192−1 boxes when the right part of the input data is transformed.

The procedure employs:

  • The rotabion operation ">>>" by a fixed value of bits

  • Bit-wise modulo 2 addition "⊕"

  • Two non-linear vector Boolean G functions with the same structure

  • P64/192 and P64/192−1 controlled permutation boxes of the first order

  • A one-layer box of controlled permutations P2×64/1 (to provide universality for a scheme with a non-commutative structure for information transformation)

  • Fixed 64-bit commutators set by the permutation π and the involution I

  • The extension procedure for control vector E (extension box)

A two-stage Clos network C<8,8> is used as P64/192 and P64/192−1 boxes (Fig. 5.13), where the first layer is compiled of R3 boxes, and the second is made up of R3−1 boxes with the structure described in Chapter 3 (see Fig. 3.22). Since the structure of boxes P64/192 and P64/192−1 is the same, in Fig. 5.13, column (I) corresponds to a control vector for direct transformation, and column (II) corresponds to one for a reverse transformation.

The sequence of the transformations and their interaction are shown in Fig. 5.16.

Click To expand
Figure 5.16: The Crypt procedure scheme

The time base for performing operations in the Crypt procedure is presented in Table 5.10.

Table 5.10: The Time Base for Performing Operations in the Crypt Procedure
No | Time base (τ⊕) | Operations
1 | 0 | L′ = P+(L)
2 | 0 − 1 | V = EA(1)‖A(4)L (W ‖W′ = P2×64/1(e)(L‖L′) V′ = EA(3)‖A(2)(L)
3 | 0 − 6 | R = P64/192(V)(R)
4 | 1 − 6 | X = GA(1)‖A(4)(W) X′ = GA(3)‖A(2)(W′)
5 | 6 − 7 | R = I(R ⊕ X)
6 | 7 −8 | R = R ⊕ X′
7 | 8 −14 | R = P−164/192(V″)(R)

It follows from Table 5.10 that most operations are performed concurrently, and the total time required for the procedure's performance is equal to the consecutive performance of 14 operations of the XOR type.

Fixed Commutators Pπ and I

The main purpose of the π permutation is in changing the mutual bit position of a data block simultaneously fed to the input of two non-linear Boolean G functions that have an identical appearance but that use different round keys. The permutation consists of four loops with a length of 16, and looks as follows:

Correspondingly, the Pπ substitution transformation implemented by this permutation is specified by the formula Y = Pπ (X), where X,Y ε GF(2)64.

Namely,

For example, y50 = x1, y9 = x50, y1 = x57, etc.

The I involution looks like:

Click To expand

where X = (X1, X2, X3, X4, X5, X6, X7, X8) and X1, X2,…, X8ε GF(2)8. In other words, there is a byte permutation, and each byte shifts by 4.

In order to make sure that it is really involution that is specified, it is sufficient to perform the I2 transformation. Namely,

Click To expand
A P2×64/1 One-Layer Box of Controlled Permutations

A mapping implemented by the P2×ω/1 box looks like this:

when the values of jth bits of vectors W and W′ (j = 1,2, …, 64) are calculated by the following formulas:

Vector Boolean G Function

A controlled substitution operation is used as a vector Boolean G function. It is one of the implementations of a sequential model, and is formed according to the rules described in Sections 4.3.3, 4.3.7-4.3.10, and 4.5.6. Formally, the G function looks like this:

In vector form, the G function is determined by the formula:

Click To expand

where the vectors Uj (j = 0,1,2,…,6) are expressed recursively via W, namely,

Click To expand

Vectors A(j) and B(j) for j = 0, 1, 2 are determined in a similar manner.

Taking into account the option of concurrently performing certain operations, it is easy to establish that the G function is implemented in five delay time units (5τ⊕).

Grounds for Selecting a Non-Linear G Function

Define the mapping of G: GF(2)64×GF(2)64×GF(2)64→ GF(2)64 as the Boolean vector function Y = G(X,A,B) having the following appearance:

where gi are certain generator Boolean functions. A single unified Boolean function of twelve variables will be considered a generator functions prototype (see Section 4.3.7). It looks as follows:

where Click To expand is a bent function (see Section 4.2.8). A Walsh-Hadamard transformation (see Section 4.2.3) of the g function consists of 1024 elements possessing the value of [image] for all vectors α = (α1,α2,…,α10, 0, 0), and for the rest of the 3072 elements it has a value of [image] . With respect to the selected structure and properties of bent functions, we have the following characteristics of the g function:

  • The non-linearity of the g function is equal to N(g) = 2m−1−2((m+2)/2)−1 = 1984 (with m = 12), which is quite close to the maximum possible non-linearity of Boolean functions of 12 variables (Nmax = 2m−1 −2(m/2)−1 = 2016) (see Section 4.2.4).

  • g is a correlation immune function on a set of z* = {(z1, z2, …, z12)} ∪ GF(2)12 vectors, where z11 ≠ 0 or z12 ≠ 0, which makes up 75% of the whole GF(2)12 set (see Section 4.2.7).

  • g possesses good autocorrelation properties, since for all non-vanishing avalanche vectors (Δ z1, Δ z2, …, Δ z12) εGF(2)12 except for three - (0,…,0,0,1), (0,…,0,1,0), and (0,…,0,1,1) - propagation criteria of the 12th order are implemented, that is, the function Δ g = g(z1, z2, …, z12) ⊕ g(z1 ⊕ Δ z1, z2 ⊕ Δ z2, …, z12) is a balanced one (see Section 4.2.6).

  • The degree of the algebraic normal form of the g function is equal to 4 (deg(g) = 4) (see Section 4.2.2).

A transition from the general form of the g function to certain generator functions of the sequential model of the controlled substitution operation is done using the following substitution of variables (see detailed information in Section 4.5.6):

Click To expand

where ∀i ε{1,2,…, n} and n = 64.

Thus, we have a generator function set that looks like this:

where lj, aj, and bj are the components of vectors L, A, B ε GF(2)64, and the initial conditions correspond to the vector (x−4, x−3, x−2, x−1, x0) = (1, 1, 1, 1, 1).

The Extension Procedure for Control Vector E

This procedure is intended for building a 192-bit control vector from a 64-bit one using the following formal E procedure:

where V ε GF(2)192, V1, V2, V3, V4, V5, V6, ε GF(2)32, U, A, B ε GF(2)64

The V vector is calculated according to the formulas:

Click To expand

where for the P64/192 box, the transformation Pπ1, Pπ2, …, Pπ6 implement the fixed permutations of bits specified in Table 5.11.

Table 5.11: Control Bit Values for the P64/192 Box
V1 | 31 | 32 | 2 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 20 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 1 | 2
V2 | 10 | 24 | 25 | 26 | 29 | 13 | 27 | 16 | 1 | 2 | 31 | 32 | 3 | 4 | 19 | 6 | 7 | 8 | 9 | 23 | 11 | 12 | 28 | 15 | 14 | 30 | 17 | 18 | 5 | 20 | 21 | 22
V3 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 12 | 10 | 11 | 9
V4 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64
V5 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54
V6 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44

For example, 32 in the first line, corresponding to vector V1, means the value u32 is used as the control bit ν(1)2 of V1, i.e., ν2 of V.22 in the second line corresponds to the control bit ω(2)32 = u22 ⊕ a22, and 53 in the sixth line corresponds to the control bit ω(6)9 = u53 ⊕ b53.

The E extension procedure is done in such a way that the 32 higher order bits of the U vector participate in controlling only R−13 boxes, whereas the lower order bits control only R3 boxes, all bit numbers of vectors U, A, and B being different in each R−13 and R3 box.

The control vector extension procedure provides for:

  • The uniformity of the participation of all 64 bits of U, A, and B vectors in controlling the P64/128 box

  • The fact that, for a randomly chosen commutation of one input bit with one output bit, there are six different bits of the U vector and two different bits of keys A and B participating in the control, which guarantees the implementation of all commutation variants

  • Control vector V1 being a fixed substitution of 32 bits of the U vector, i.e., transformation in the first layer of the P64/192 box is performed without any time delay

5.4.3. The Schedule for Using Round Keys

As in the 12-round SPECTR-128 block cipher, the Q(e) extended key in a CIKS-128 block cipher is a combination of 14 subkeys, namely,

where Q(e)j = (Q(1, e)j, Q(2, e)j, Q(3, e)j, Q(4, e)j), ∀j= 1, 2, …, 12

when Q(e)IT, Q(e)FT ε GF(2)128, but Q(h,e)j ε GF(2)64, ∀h = 1,2,3,4.

The Q(e) extended key is a series of fifty-two 64-bit binary vectors, each of them being one of four secret subkeys - K1, K2, K3, K4.

The elements of the Q(e) extended key are determined via the Oi parameters, which are calculated, in turn, by the formulas:

where K = K1‖K2‖K3‖K4 and i = 1, 2.

The commutation scheme between Oi and Kj is shown in Fig. 5.17.

Click To expand
Figure 5.17: Subkey commutation scheme

The key correspondence Q(e)IT, Q(e)FT, Q(1,e)j, Q(2,e)j, Q(3,e)j, Q(4,e)j (∀j = 1,2, …, 12) is specified in Table 5.12.

Table 5.12: Schedule for Using Round Keys
Q(e)IT | j = | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | Q(e)FT
O1‖O3 | Q(1, e)j | O2 | O3 | O1 | O4 | O2 | O1 | O2 | O1 | O3 | O2 | O4 | O1 | O2‖O4
 | Q(2, e)j = | O4 | O1 | O3 | O2 | O4 | O3 | O4 | O3 | O1 | O4 | O2 | O3
 | Q(3, e)j = | O1 | O4 | O2 | O3 | O1 | O2 | O1 | O2 | O4 | O1 | O3 | O2
 | Q(4, e)j = | O3 | O2 | O4 | O1 | O3 | O4 | O3 | O4 | O2 | O3 | O1 | O4

For example, for the fifth round (j = 5), the subkey sequence O2, O4, O1, O3 corresponds to the formal parameters A(1), A(2), A(3), A(4) of the Crypt procedure, namely,

That is,

For the encryption mode Q5(0) = (K2, K4, K1, K3),

and for the decryption mode Q5(1) = (K1, K3, K2, K4).

For the initial and final transformations, the keys Q(e)IT and Q(e)FT look as follows:

That is,

For the encryption mode,

and for the decryption mode,

Scheme Universality

To prove the universality of the scheme, it is sufficient to demonstrate the universality (reversibility) of one round scheme, or rather, the universality of the transformation highlighted in gray in Fig. 5.16. Below are the formulas for e = 0 and e = 1.

Click To expand

By sequentially performing the (U = R′) encryption and decryption we get:

By sequentially performing the (R = U′) decryption and encryption we get:

Click To expand

In other words, a truly universal scheme is implemented.


5.5. Prospective Program Ciphers Based on Controlled Permutations

Since fiber-optic channels provide for data transfer with very high speed, processor developers consider the issue of integration (on a hardware level) of a cryptographic means of information transformation into the processors, one that implements one of the universally accepted algorithms meeting modern requirements of stability and speed. One drawback of this trend is the fact that the transformation algorithm is forced on customers, limiting the user's freedom of choice, and regardless of whether the user trusts the particular algorithm.

An alternative trend in solving this problem is the extension of the list of commands implementing cryptographic-like transformations with a high speed, and created as special instructions. In particular, the implementation of controlled bit permutation operations is rather interesting, and its efficiency in building hardware ciphers was discussed in Chapter 3.

The dimension of controlled permutation boxes that implement such operations should correspond to the bit capacity of the processor used.

For example, for processors operating with 32-bit binary vectors (figures, words), bit permutations are effectively implemented using a P32/96 box of the second order of controlled permutations (Fig. 5.18).

Click To expand
Figure 5.18: The P32/96 controlled permutations box

In this chapter, we will consider the description of this command and how to efficiently use it in software block ciphers.

5.5.1. Description of the Hypothetical DDP32 Command

Enter the P(U, e)32/32 conditional symbol for the new command, and the identifier DDP32 (Data Dependent Permutation 32 bit).

The input parameters of this command are:

  • X - 32-bit transformed binary vector

  • U - 32-bit control vector forming a permutation modification

  • e - a one-bit control vector with a value that determines the data transformation mode (e = 0 - direct permutation, e = 1 - reverse permutation)

The result of applying the P(U, e)32/32 command is the permutation of the 32-bit binary vector X. In other words, the command DDP32 implements the mapping of GF(2)32 × GF(2)32 × GF(2) → GF(2)32, namely,

Since the second order box P32/96(V) is used as the operation prototype, in which the bit capacity of the control vector is equal to 96, in a new command, you must implement the control vector V = E(U) expansion procedure, as well as the P32/96(V) box, namely,

which provides the commutation of each bit of the U binary vector with three different bits of the 96-bit binary vector V.

In order to perform a reverse transformation P32/96(V)−1 in box P32/96, you have to reverse the order of vectors V1, V2,…V6, i.e., P32/96(V)−1 = P32/96(V′)−1 where V = (V1, V2, …, V6) and V′ = (V6, V5, …, V1). This reversal is effectively implemented using the one-layer P96/1(e) box, shown in Fig. 5.19.

Click To expand
Figure 5.19: The P(e)96/1 box for controlling the data transformation mode in the P(U,e)32/32 command

Thus, the operational box implementing the P(U,e)32/32 command looks like the one shown in Fig. 5.20.

Click To expand
Figure 5.20: The P(U,e)32/32 controlled permutations box

Thanks to such a structure, the P(U,e)32/32 box performs either a direct controlled permutation operation (e = 0), or a reverse permutation operation (e = 1).

When program ciphers are developed based on controlled permutations, it is assumed that the value of the U = (U1, U2, …, U32) vector is a block of transformed data where each bit of vector U determines three different bits of the binary vector V. We need to mention that the P32/96 box is a second order box, and therefore there are just two variants of commutation between random input and random output bits, and there are six elementary P2/1 switches controlled by the V vector in each such commutation. Consequently, to provide any such commutation by the U vector when a mapping is formed between the bits of the U and V vectors in the E procedure, it is best to be governed by the following criterion:

Six various bits of the U vector should participate in the control of six P2/1 boxes, implementing a commutation between randomly chosen input and output bits.

In particular, Table 5.13 shows an example of the correspondence between the U and V vectors that meets such a criterion, and can be used in building an E extension procedure.

Table 5.13: Correspondence between the Bits of Vectors U and V for the P32/96 Box
V1 | 9 | 10 | 11 | 12 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 13 | 14 | 15 | 16
V2 | 16 | 15 | 14 | 13 | 6 | 5 | 8 | 7 | 1 | 2 | 3 | 4 | 12 | 11 | 10 | 9
V3 | 4 | 3 | 2 | 1 | 11 | 12 | 15 | 16 | 14 | 13 | 9 | 10 | 8 | 7 | 6 | 5
V4 | 27 | 28 | 19 | 20 | 31 | 32 | 23 | 24 | 17 | 18 | 21 | 22 | 25 | 26 | 29 | 30
V5 | 31 | 32 | 17 | 18 | 29 | 30 | 21 | 22 | 25 | 26 | 27 | 28 | 23 | 24 | 19 | 20
V6 | 24 | 23 | 22 | 21 | 28 | 27 | 26 | 25 | 32 | 31 | 30 | 29 | 20 | 19 | 18 | 17

For example, in the first row corresponding to vector V1, 10 means that the value U10 is fed to the input ν(1)2 controlling the second box P2/1, whereas 10 in the second row corresponds to the value ν(2)15 = U10, and 26 in the sixth row corresponds to the value ν(6)7 = u26.

In a hardware implementation, an elementary switch that uses no more than 12 transistors is implemented. Accordingly, to implement a P(U,e)32/32 operational box, no more than 1800 transistors will be needed. Therefore, if you include the DDP32 command into the set of the standard operations of a contemporary processor, it will not considerably complicate the schemo-technical implementation of such processors. The availability of such a command will help to enhance the speed of software ciphers using this operation (up to 1 Gbit/s and more). This will make it possible to solve many urgent problems in developing computer security systems that provide real-time information security in contemporary, highly efficient automation systems.

5.5.2. The SPECTR-SZ Software Cipher

Let's take a look at the SPECTR-SZ program cipher, in which a new command of controlled permutations, DDP32, is used. Initially, this cipher was called DDP-S, but the name has been changed due to the following circumstances.

  • In its structure, the cipher being considered is an updated variant of the SPECTR-Z software cipher, in which a looped shift operation is replaced by the new DDP32 command.

  • The algorithm description has been amended, which was necessary not only in order to correctly use the DDP32 command, but also to simplify the understanding of the algorithm's operation.

  • This chapter also deals with two block ciphers (DDP-S64 and DDP-S128), which significantly differ from the SPECTR-Z software cipher in their structure, and thus, using the name DDP-S for the cipher being considered is not quite correct.

Designations and Input Data

The following additional designations were used in the description of the SPECTR-SZ cipher:

  • Bytes (binary vectors with lengths of 8) will be designated by lowercase letters without italics. For example:

    Click To expand

  • The designation B will be used for a set of all bytes, namely,

  • The term "word" designates 32-bit binary vectors marked by uppercase letters in italics. For example, U = (u0, u1,…, u31), where ∀i = 0, 1, …. 31, ui ε {0, 1}. It is obvious that U = (u0, u1, u2, u3), where ∀j = 0, 1 …, 3, uj ε and U ε B4.

  • To designate byte sequences larger than 4, uppercase letters in bold italics will be used, for example Q ε B2051, Q = (q0, q1,…, q2050).

  • The operations "+m" and "−m" are designated, respectively, as "2m congruence addition" and "2m congruence subtraction".

  • The operation "W↔V" designates a value exchange operation for words W and V.

Note

As a rule, discrete mathematics considers numbers represented by binary vectors of a specified size (e.g., m). For example, regular addition with the transfer of two numbers X and Y (X ≥ 2m−1 and Y ≥ 2m−1) ceases to make sense, since it is impossible to represent the resulting value as one binary vector with a size of m. Therefore, we usually speak of the "2m congruence addition" operation, and (X + Y) mod 2m is used. When composite formulas are written, it entails an increase in the number of brackets, and as a result, it is very difficult to quickly understand such formulas. It is often predetermined in articles that X + Y means "2m congruence addition", and the "mod 2m" designation is not used. This, however, is done only if m is a fixed value. If operations with several different values (m1, m1, …, mk) are performed, difficulties in the visual representation of formulas and expressions emerge. So, instead of the conventional (X + Y) mod 2m we ask that you use X +m Y. That is

The designations "+m" and "−m" have not yet been generally adopted, but we think that such expressions are a natural development of index symbols for sets of variables, etc.

There is no doubt that the expressions "+2m" and "−2m" are more common, since they allow you to consider any p module, and not only a power of 2 (e.g., "+p" and "−p"). This difference, however, is less important than the representations of the expressions (X + Y)mod 2m and X +m Y.

The following hexadecimal constants α, β, γ, δ are used in the algorithm:

  • α = 0Dx, α ε B

  • β = FFFF07FFx, β ε B4

  • γ = B25D28A7 1A62D775x, γ ε B8

  • δ = 98915E7E C8265EDF CDA31E88 F24809DD B064BDC7 285DD50D 7289F0AC 6F49DD2Dx, δ ε B32

The index "x" means that the hexadecimal number representation is used, and the lower order bit is to the right. For example, the byte α = 0Dx can be represented in the vector form as:

Such a feature of number representation is a the consequence of an ancient dispute between mathematicians and programmers as to the side whether the lower order significant bit is on (right or left).

When several sequential bytes {u0, u1, …, us−1} are represented by a binary number, the Us−1 byte in all cases is related to the higher order bits of the number. If, for example, the 64-bit constant γ = B25D28A7 1A62D775x is represented as a sequence of bytes u0, u1, …, u7, then u0 = 75x, U1 = D7x, …, u7 = B2x.

The SPECTR-SZ cipher is aimed at use in computers with a 32-bit processor, and is a block stream cipher in its structure. This peculiarity of the cipher structure stems from the fact that in the Encrypt and Decrypt procedures of data transformation, the first and last rounds implement the stream cipher scheme, and the rest of the rounds (internal ones) implement the iterative scheme of a block cipher.

Cipher Structure

The SPECT-SZ software cipher is usually implemented as two modules (Fig. 5.21):

  • The Initialization module (used for program settings and the formation of all necessary parameters, including the Q extended key)

  • The Resident module, which serves other applications' requests for data encryption and decryption

Click To expand
Figure 5.21: The SPECTR-Z software cipher scheme

The Q (Q ε B2051) extended key, designed using the secret key K, is formed by the initialization module in two cases:

  • In the application initialization stage

  • When the secret key is changed

The resident module consists of two Encrypt and Decrypt subprograms, which are intended for the encryption and decryption of information represented as data blocks with m 32-bit words in each, respectively.

The Extended Key Generation Procedure

Initially, the sequence Q′ = (q0′, q1′, …, q′2050) (Q′ ε B2051) is formed by repeating the secret key K = (k0, k1, …, ks) the necessary number of times, where 8 ≤ s ≤ 2050.

Note

Such a "strange" length of sequence Q' is stipulated by the necessity of working with 2048 32-bit words. Indeed, the byte sequence u0, u1, …, un−1 can be used for forming 32-bit Uj = {uj, uj+1, uj+2, uj+3} words, where j = 0, 1, …, n − 4. Therefore, if 2048 (211) 32-bit words formed by this method are used, the length of the initial sequence should be equal to 2051 bytes (n = 2051).

The next step is the use of the Table_H(Q′) procedure to form the H (H ε B2051) auxiliary key.

The Table_H(Q′) Procedure

The algorithm of the Table_H(Q′) procedure goes as follows.

  1. Set the counter value i := 0.

  2. Calculate the 32-bit number H′i: = (α23+i mod γ)17 mod δ, (H′i ε B32).

  3. Increase the counter value i := i + 1. If i ≠ 64, then go to Step 2.

  4. Create a sequence H:= ‖ H′0 ‖ H′1‖ … H′63 ‖ h′0‖ h′0 ‖ h′1 ‖ h′2, where (h′0 ‖ h′1 ‖ h′2) are the first three bytes of the H′0 = (h′0, h′1, h′2, …, h′63) number.

  5. Perform the transformation H: = Q′ ⊕ H.

  6. Represent H as the byte sequence H = (h0, h1, …, h2050).

  7. STOP.

The extended key Q is finally formed with the use of the Form_Key procedure, namely, Q = Form_Key(Q′, H), when the sequence Q′ is interpreted as a combination of four 512-byte sequences (data blocks) - Q′(1), Q′(2), Q′(3), Q′(4) - and three bytes, namely,

One of two programs of the resident module is used in the FormKey procedure, namely, the Encrypt procedure. The latter depends on three parameters, the first one determining the length of the data block being transformed (expressed in 32-bit words), the second determining the transformed data block itself, and the third determining the extended key.

The FormKey Procedure

The algorithm of the FormKey procedure looks as follows.

  1. For the Encrypt procedure, specify the parameter value m := 128, and use the H sequence as an encryption key.

  2. Transform Q′(1): Q′(1): = Encrycpt(m, Q′(1), H).

  3. Transform Q′(2): Q′(2): = Encrycpt(m, Q′(2) ⊕ Q′(1), H).

  4. Transform Qr(3): Q′(3): = Encrycpt(m, Q′(3) ⊕ Q′(2), H).

  5. Transform Q′(4): Qr(4): = Encrycpt(m, Q′(4) ⊕ Q′(3), H).

  6. Form an extended key: Q :={Q′(1), Q′(2), Q′(3), Q′(4), q′2048, q′2049, q′2050}.

  7. STOP.

Thus, the expanded encryption key Q is a sequence of 2051 bytes: Q = {q0, q1, q2, …, q2047, q2048, q2049, q2050}.

The Encrypt Procedure

The Encrypt (m, T, Q) procedure is one of two programs of the resident module used for data transformation (encryption). The Encrypt procedure depends on three parameters, the first one determining the length of the data block being transformed (expressed in 32-bit words), the second determining the transformed data block itself, and the third determining the extended key.

So, the length of the data block subject to transformation is determined by the m parameter (m ≥ 4). The value of m is chosen depending on the area in which it is used. For example, this value may be determined by the hard disk sector size, or the size of the clipboard. In particular, for m = 128, the length of the transformed data block (in bytes) is equal to 4m, i.e., 512 bytes.

32-bit words (subkeys) with the following appearance are used during encryption:

where j = 0, 1, …, 2047.

The Encrypt procedure includes two full and four reduced transformation rounds (Fig. 5.22). If m = 4, the full and reduced rounds are identical.

Click To expand
Figure 5.22: Order of the transformation of 32-bit words in the SPECTR-SZ cipher

For a specified m, the data block being transformed is a sequence m of 32-bit words, namely,

where m ≥ 4 and T ε B4m.

The consecutive transformation of the words T0, T1, …, Tm−1 is performed in each round. After each round, except for the last one, two operations are performed: T0↔T3 and T1↔T2.

The two following standard procedures are performed in round transformations:

Click To expand
The First (Full) Encryption Round

The algorithm of the first (full) encryption round looks like this.

  1. Perform the Initialize procedure.

  2. Perform the Change NV procedure.

  3. Transform: Ti := P32/32(R, O)(Ti − 32V).

  4. Transform variable R: R := P32/32(V, 1)(R + 32Ti).

  5. Transform: Ti := Ti +32N.

  6. Increase the counter value: i := i + 1.
    If i ≠ m, go to Step 2.

  7. If m > 4, transform words T2 and T3 by one another:
    T2 := T2 ⊕ Tm−2; T3 := T3 ⊕ Tm−1.

  8. Perform the operations T0 ↔ T3 and T1 ↔ T2.

  9. STOP.

The Four Reduced Rounds

The algorithm for the four reduced rounds looks like this.

  1. Set the initial value for reduced rounds' number counter j := 0.

  2. Perform the Initialize procedure.

  3. Perform the Change NV procedure.

  4. Transform: Ti := P32/32(R, O)(Ti − 32V).

  5. Transform variable R: R := P32/32(V, 1)(R + 32Ti).

  6. Transform Ti := Ti +32N.

  7. Increase the counter value: i := i + 1.
    If i ≠ 4, go to Step 3.

  8. Perform operations T0 ↔ T3 and T1 ↔ T2.

  9. Increase the counter value:j := j + 1.
    If j ≠ 4, go to Step 2.

  10. STOP.

The Sixth (Full) Encryption Round

The algorithm of the sixth (full) encryption round looks like this.

  1. Perform the Initialize procedure.

  2. If m > 4, transform the words T3 and T2 by one another:

  3. Perform the Change NV procedure.

  4. Transform: Ti := P32/32(R, O)(Ti − 32V).

  5. Transform variable R: R := P32/32(V, 1)(R + 32Ti).

  6. Transform word Ti: Ti := Ti + 32N.

  7. Increase the counter value: i := i + 1.
    If i ≠ m, go to Step 2.

  8. STOP.

The Decrypt Procedure

The Decrypt (m, T, Q) procedure is the second program of the resident module, used for decryption of the transformed data. This procedure performs a transformation that is the reverse of the Encrypt procedure. The procedure is not described, but an interested reader can form such a procedure on his or her own, taking into account the fact that the word transformation sequence is the same as for encryption (see Fig. 5.22).

Speed Parameters and the Cryptographic Security of a Cipher

Since generally, only part of the input data block is transformed in two full rounds, the encryption speed depends on the size of the input block. If m = 4, it is minimal - about 200 Mbit/s (for a processor of Celeron 500 type, assuming that the DDP32 command is implemented inside as a special instruction). As the block size is increased, the speed increases as well, up to 600 Mbit/s, if m ≥ 32.

The SPECTR-SZ cipher possesses a higher encryption speed than the program algorithms considered in Chapter 2, not only because of the smaller number of operations performed, but also due to a fewer number of times accessing the memory (from 5 to 3).

The necessary practical security of the algorithm is gained thanks to the following features:

  • A long extended key Q (Q ε B2051).

  • Using Ti words of 32 bits at every step for three 32-bit variables N, V, and R, each of them depending on both the extended key Q and on the already transformed input data.

  • Meeting the criterion of a strict avalanche effect, both by performing operations selecting Qj subkeys and by using the input data (data to be transformed) to form the control vectors for the new DDP32 command.

The second item needs a little explanation. The Encrypt procedure is such that for two data blocks T and T′ that differ in the ith word (Ti ≠ T′i) the values of the R and R′ variables are different in the first round already, during the transformation of the words Ti and T′i. In the next step, the difference between the R and R′ variables generates a difference between the variables N and N′ and between V and V′, and consequently, between Ti+1 and T′i+1. Accordingly, all subsequent values of the 32-bit words Tj and T′j are different, and such a difference has an avalanche-like character when moving on to the next words to be transformed. Transformations of subsequent rounds propagate differences at each 32-bit word of the data being transformed.

Thanks to the many transformation steps performed in one round, a strong avalanche effect can be gained by performing only two full encryption rounds.

Reduced encryption rounds are aimed at implementing a strong avalanche effect when differences occur only in the last word Tm−1.

The DDP32 operation, controlling the vector depending on the data block being transformed, contributes much to the avalanche effect's propagation when the words Ti and variable V are transformed.

According to the estimations for the combinatory probabilistic model considered in Chapter 2, the security of the SPECTR-SZ cipher is no less than 2190 (295) operations, on the condition that the attacker has a specially chosen input text with a volume of no less than 2100 (250) bytes and corresponding ciphertext.

The option of parametriccally specifying the transformed data block size enhances the range of practical uses of the SPECTR-SZ block cipher and makes its universality clear.

When speaking about the prospects of the new DDP32 command, we must mention that it can be used to create high-speed software hashing functions. The hashing speed becomes much higher than that of the SPECTR-SZ cipher, since the hashing algorithms can be created in such a way that you need only access the memory once. Using the DDP32 operation, you can provide a hashing speed of 1-2 Gbit/s. Just to compare: there are three memory access operations used for one 32-bit transformed word in SPECTR-SZ, namely,

  • Reading the current transformed word

  • Reading one subkey

  • Recording the transformed word

Since the DDP32 operation is for use in cryptographic applications, there are objective conditions for the creation of high-speed encryption and hashing algorithms that possess the necessary practical security.

5.5.3. The COBRA-F64a and COBRA-F64b Block Ciphers

Let's consider the variants of building firmware block ciphers with a small input data block. Such ciphers can be used, for example, in microcontrollers and intellectual electronic cards, where it is necessary to maximize the ratio of encryption efficiency to the number of active electronic circuit elements used.

Below is a description of two iterated block ciphers, COBRA-F64a and COBRA-F64b, with a 64-bit input and a 128-bit secret key, both aimed at firmware implementation. The algorithms are described according to the designations accepted for block ciphers.

The General Encryption Scheme

In the COBRA-F64a and COBRA-F64b block ciphers, an encryption scheme is used which is not universal according to the previously accepted terms. Remember that a scheme is universal when changing the encryption mode (encryption and decryption) entails only changing the order of round keys. However, the encryption scheme of the COBRA-F64a and COBRA-F64b algorithms can be called semi-universal, since the only difference is the use of a new command - P(U, e)32/32, which depends on the e parameter. Using the superscript "(e)", the general encryption scheme can be expressed by the following formula:

where Q(e) = H(K, e) is an extended key, and a function of the 128-bit K key and the encryption mode e (F(0) - encryption, F(1) - decryption), when in the encryption mode X (X ∈ GF(2)32) is the incoming block of binary data (plaintext), and in the decryption mode it is the transformed block of binary data (ciphertext). In the encryption mode, the resulting value Y (Y ∈ GF(2)32) is a ciphertext, and in the decryption mode it is plaintext.

Taking into account contemporaryx principles of developing block ciphers, an extended key, Q(e) = H(K, e), should be formed using a cryptographically secure extended key generation procedure. Actually, it is sufficient simply to create a pseudo-random sequence S = Q(0) = H(K, 0) with a length that depends on the number of rounds and the total length of one round key.

The extended key Q(1) is a permutation of the Q(0) extended key's elements, the permutation determined by the constructive features of the scheme, including the initial and final transformations.

A generalized scheme of transformations is shown in Fig. 5.23, and a one-round scheme for the COBRA-F64a and COBRA-F64b algorithms is shown in Fig. 5.24.

Click To expand
Figure 5.23: A general encryption scheme in the COBRA-F64 (a and b algorithms)
Click To expand
Figure 5.24: The Crypt(e) procedure in: a - COBRA-F64a and b - COBRA-F64b

The absence of an initial transformation is a feature of the general encryption scheme. Encryption and decryption, however, are performed using the same algorithm, since the structure of each round is such that the final transformation is one of its components.

The Schedule for Using Round Keys

In the COBRA-F64a and COBRA-F64b algorithms, both in one round and in the final transformation, two 32-bit subkeys are used, namely,

where 1 ≤ j ≤ r + 1 and r is the number of encryption rounds.

Taking into account where the algorithms will be applied - microcontrollers and intellectual electronic cards where the occupied memory size is a critical parameter - using a secure extended key generation procedure is hardly justified. A more efficient variant would be to use a key schedule.

For example, let secret key K be represented as a combination of four 32-bit words, namely, K = K0 ‖ K1 ‖ K2 ‖ K3, where K0, K1, K2, K3 ε GF(2)32. Let the extended key Q(0) = S be represented in Table 5.14.

Table 5.14: Schedule for Using Round Keys
j = | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12
S(1)i = | K1 | K2 | K3 | K4 | K2 | K1 | K4 | K3 | K1 | K2 | K4 | K3
S(2)j = | K4 | K3 | K1 | K2 | K3 | K2 | K1 | K4 | K2 | K3 | K1 | K2
j = | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24
S(1)i = | K1 | K4 | K2 | K3 | K1 | K4 | K3 | K1 | K2 |  |  |
S(2)j = | K3 | K1 | K3 | K4 | K2 | K1 | K4 | K2 | K3 |  |  |

Then, the values of the round keys Q(e)j = (Q(1, e)j, Q(2, e)j), for both encryption and decryption modes, are determined by Table 5.14 and the following formula:

where i = 1, 2 and j = 1, 2, …, r.

Taking into account the cryptographic properties of the operations performed and the constructive features of one round, 16 encryption rounds is the optimal number for the COBRA-F64a algorithm, whereas for COBRA-F64b it is 20. Nevertheless, you can increase the number of encryption rounds if you need to raise the lower border of cryptographic security of a cipher.

The Encryption Algorithm

The F function (see Fig. 5.5) is implemented as a series of the following procedures:

  • r rounds (loops) of transformations using the Crypt(e) procedure

  • Final transformation - FT

Initially, the block X is divided into two subblocks of the same length - L0 and R0, i.e., (L0, R0) = X, where L0, R0 ∈ GF(2)32. Then r rounds of transformations are performed using the Crypt(e) procedure according to the formulas:

After the rth round, the final transformation FT is performed over block X = (Rr, Lr) according to the formula:

The final transformation FT for the algorithm COBRA-F64a looks like this:

And for the COBRA-F64b algorithm, the FT transformation looks like this:

Speed Parameters and the Cryptographic Security of Ciphers

The advantage of the COBRA-F64a and COBRA-F64b algorithms is the small length of binary code if they are software-implemented, which is very important in designing cryptosystems integrated into the secure initialization procedure of a computer. The microprogrammatic implementation of these algorithms using microcontrollers working at a clock speed of 33 MHz provides for an efficiency exceeding 20 Mbit/s.

With a software implementation of the COBRA-F64a and COBRA-F64b algorithms (for a processor of Celeron 500 MHz type, assuming that the DDP32 command is implemented inside it as a special instruction), the estimated speed of encryption will be approximately 400 and 300 Mbit/s, respectively.

These examples prove that software ciphers, which use controlled permutations executed depending on data, when compared to the fastest known ciphers, may potentially increase the speed by several times.

Estimating a cipher's cryptographic security against all known cryptanalysis methods is a complex and expensive procedure. Therefore, investigations are also performed to find the most efficient methods of cryptanalysis. The differential cryptanalysis method is considered one of these.

In the differential cryptanalysis method (which is considered in detail in Chapter 6) the difference in the pairs of transformed data blocks X and X′, - namely, Δ(X, X′) - are studied, and so are the corresponding differences in the transformed blocks δ(Y, Y′). Usually, a case is chosen when Δ(X, X′) = (X ⊕ X′) = Δ = const. The value Δ is called the input difference. Non-zero bits of the considered Δ difference are called active bits. The task of differential cryptanalysis is to find Δ and δ values for which the inequality p(δ, Δ) > 2−n holds, where n is the length of the input block in bits, and p(δ, Δ) = Pr (δ, Δ) is a conditional probability. Usually, "significant probabilities" p(δ, Δ) - i.e., those differing from the average values as much as possible - are the differences with a small number of active bits for the considered differential cryptanalysis. In Chapter 6, the differential cryptanalysis of the COBRA-F64a, COBRA-F64b, DDP-S64, and DDP-S128 ciphers is described in more detail, the present chapter dealing just with brief results for each of the above ciphers.

As a result of a cryptographic security investigation for the COBRA-F64a and COBRA-F64b ciphers, it was added to the differential cryptanalysis method that the most significant probabilities correspond to differential characteristics with differences containing only one "active bit." Remember that the term "active bit" is used in the sense that the Hamming weight of the difference of two considered vectors is equal to one. So, for the COBRA-F64a algorithm, the best characteristic among those found is a three-round characteristic, for which a one-bit output difference δ1 with a probability of pa(3) = 2−21 best corresponds to a one-bit input difference of Δ1. Accordingly, for the COBRA-F64b algorithm, the best among the characteristics found is a two-round one, for which, after two transformation rounds, a one-bit output difference of δ1 with a probability of pb(2) = 2−12 corresponds to an input difference of Δ1 with one active bit in the right (or left) data block. However, the iterative application of these characteristics for 15 rounds in the first case and for 20 rounds in the second does not allow us to form efficient 15- and 20-round characteristics, since the values of the probabilities pa(15) = 2−105 and pb(20) = 2−120 do not exceed the value of the corresponding probability in an arbitrary 64-bit block cipher. The development of differential characteristics with a large number of active bits does not give the desired result of efficient characteristics, which proved the high cryptographic security of these ciphers against differential cryptanalysis.

High indices for the speed and cryptographic security of ciphers, where the DDP32 command is used, allow us to hope that microprocessor developers will include this command into the set of standard operations of multipurpose processors.

The advantages of program ciphers were already considered in previous chapters. Therefore, here we will just mention the feasibility of the procedure of program cipher creation. Indeed, integration of an encryption algorithm (even a generally recognized one) into a processor on the circuit level actually gives users no choice. Such unification additionally stimulates potential violators to develop effective methods of cracking the cipher, since, in case of success, unauthorized access to information stored in computer systems and secured by this cipher would then be possible on a wide scale. It is more profitable to analyze one cipher instead of ten or a hundred, right?

A software implementation of a new command (cryptographic primitive) requires only minimal circuit costs and does not lead to a rise in the cost of modernized processors. However, the possibility of creating a whole series of high-speed algorithms is thus heightened. However, if an algorithm is discredited, it is very easy to change it for another one, which is impossible with a hardware implementation.

We already mentioned above that controlled bit permutations of a general type can be used for solving other urgent information security tasks, such as developing high-speed integrity algorithms and hashing functions. Another promising trend in the area of applied bit permutations is their integration on a microprogramming level, which provides minimum use of circuit resources, but retains a high speed for the cryptographic transformations performed both for data integrity control and for information security (hashing and encryption).

5.5.4. The DDP-S64 and DDP-S128 Algorithms

The COBRA-F64a and COBRA-F64b ciphers considered above are aimed both at a software and at a microprogramming implementation, which is achieved using a simple transformation structure. If the purpose is only software implementation, it is possible to apply more complex transformations.

Let's take a look the at 64-bit and 128-bit program ciphers DDP-S64 and DDP-S128, where the DDP32 command of controlled permutation is also used.

General Encryption Scheme

Just as the COBRA-F64, a and b block ciphers, the DDP-S64 and DDP-S128 software ciphers also use a semi-universal encryption scheme, whose difference from a universal scheme is in the use of the new P32/32(U, e) command.

The general encryption scheme can be expressed by the following formula:

where Q(e) = H(K, e) is an extended key that is a function of the 256-bit K key and the encryption mode e (F(0) - encryption, F(1) - decryption). In the encryption mode, X is the incoming block of binary data (plaintext), and in the decryption mode it is the transformed block of binary data (ciphertext). In the encryption mode, the resulting value Y is ciphertext, and in the decryption mode it is plaintext.

Everything that was said above relating to the necessity of using a cryptographically secure extended key generation procedure is applicable to the ciphers considered in this section. We just need to create a pseudo-random sequence S = Q(0) = H(K, 0) with a length depending on the number of rounds and the total length of one round key, and the extended key Q(1) will turn out to be a permutation of the Q(0) extended key elements. This permutation is determined by the constructive features of the scheme, including the initial and final transformations. You can also use the algorithms built based on controlled permutations for the extended key generation procedure.

When describing the algorithms, a case of using a key schedule that is especially efficient for the frequent key change mode is considered.

The DDP-S64 64-Bit Cipher

The general encryption scheme is shown in Fig. 5.25.

The F(e) function (Fig. 5.25b) is implemented with the following procedures:

  • Initial transformation - IT

  • r rounds (loops) of transformations using the Crypt(e) procedure

  • Final transformation - FT

Click To expand
Figure 5.25: The general encryption scheme (b) and one transformation round (a) in the DDP-S64 algorithm

Initially, block X is divided into two subblocks of the same length - Xlo and Xhi, i.e., (Xlo, Xhi) = X where Xlo, Xhi ε GF(2)32 and the IT procedure is performed:

Then, r = 10 rounds of transformations are performed using the Crypt(e) procedure, according to the formulas:

After the rth round, the final transformation FT is performed over block X = (Br, Ar) according to the formula:

One transformation round is shown in Fig. 5.25, a.

In the Crypt(e) procedure, a controlled permutation operation P32/32(U, e) is designated as P(U,e), the algorithm itself having the following appearance:

  1. U := B+32 Qi(2e).

  2. A := A+32 P(U, e)(B).

  3. V := P(U, e)(A).

  4. B := P(V, e)(U).

  5. A := V−32 Q(1, e).

  6. B := B−32 P(V, 0)(A).

  7. (A, B) := (B, A).

  8. STOP.

The schedule of using subkeys in the DDP-S64 cipher is shown in Table 5.15.

Table 5.15: Schedule for Using Subkeys in the DDP-S64 Cipher
i = | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11
Qi(1, 1) = | K6 | K1 | K2 | K3 | K4 | K8 | K7 | K5 | K6 | K7 | K8 | K7
Qi(2, 1) = | K4 | K5 | K6 | K7 | K8 | K3 | K5 | K2 | K1 | K4 | K3 | K5
Qi(1, 0) = | K7 | K3 | K4 | K1 | K2 | K5 | K3 | K8 | K7 | K6 | K5 | K6
Qi(2, 0) = | K5 | K8 | K7 | K6 | K5 | K7 | K8 | K4 | K3 | K2 | K1 | K4

Estimating the Security of the DDP-S64 Cipher

In differential cryptanalysis for this model, the most efficient characteristics are those related to the input differences Δ1 (with one active bit in the left data subblock) in two rounds. After two rounds, these differences transform into the difference δ1 (where the active bit also belongs to the left subblock) with a probability of 2−23. At the output of the first round, the δ2′ difference is formed (each of the subblocks containing one active bit), which at the second round turns into the one-bit difference δ1. Considering the structure of a round transformation for DDP-S64, we estimate the probability for the first round as p1(δ2 ′/Δ1) ≈ 2−9, and for the second round as p2(δ1/δ2 ′) ≈ 2−14. Accordingly, for two rounds, the probability is p(2) = p(δ1/Δ1) = p1 p2 ≈ 2−23. However, continuing by building six- and eight-round characteristics will not lead to the desired result, since the probabilities p(6) = p(δ1/Δ1) ≈ 2−69 and p(8) = p(δ1/Δ1) ≈ 2−92 do not exceed the value of the corresponding probability in random 64-bit block cipher. Developing differential characteristics with a large number of active bits did not give the desired result of efficient characteristics, which proved the high cryptographic security of the DDP-S64 block cipher against differential cryptanalysis.

The DDP-S128 128-Bit Cipher

The general encryption scheme is shown in Fig. 5.26, b.

Click To expand
Figure 5.26: The general encryption scheme (b) and one transformation round (a) in the DDP-S128 algorithm

There are 12 encryption rounds (r = 12) provided in the DDP-S128 128-bit cipher, and, for a software implementation, the 128-bit data block is split into four 32-bit sub blocks - A, B, C, and D, which are subject to further transformation.

The increase in the number of encryption rounds (compared to DDP-S64) is due to the larger size of data subblocks. One distinctive feature of the DDP-S128 algorithm is that in the Crypt(e) procedure (Fig. 5.26, a), two controlled permutations are performed over subblocks A and D, one of such permutations depending on subblock B, and the other on subblock C. This structure provides for the implementation of a large number (about 264) of permutations to be performed over the subblocks A and D within one round. The superposition of controlled permutations P32/32(B, e) and P32/32(C, e) is a block of maximum order.

The DDP-S128 block cipher algorithm (Fig. 5.26, b) is implemented using the following procedures:

  • Initial transformation - IT

  • r rounds (loops) of transformations with the use of Crypt(e) procedure

  • Final transformation - FT

In the Crypt(e) procedure, the controlled permutation operation P32/32(U, e) is designated as P(U, e).

Initially, block X is divided into four subblocks of the same length - A, B, C, and D, i.e, (A, B, C, D) = X, where A, B, C, D ∈ GF(2)32, and the IT procedure is performed:

Then, r = 12 rounds of transformations are performed using the Crypt(e) procedure, according to the formulas:

After the rth round, the final transformation FT is performed over block X = (Br, Ar) according to the formula:

The Crypt(e) procedure is shown in Fig. 5.26, a:

  10. V := B

  11. A := P(B, 0)(A); B := P(C, 1)(B); D := P(C, 0)(D).

  12. C := C −32 Qi(2, e).

  13. A := A ⊕ (B +32 C).

  14. B := B +32 Qi(1, e).

  15. C := P(B,0)(C).

  16. D := D ⊕ (V +32 C).

  17. A := P(C, 0)(A); D := P(C, 1)(D).

  9. (B, C) := (C, B).

  10. STOP.

As in the previous algorithms, the key use schedule is employed. In the jth round (i ≤ j ≤ r) two 32-bit subkeys are used, namely,

The extended key Q(0) = S is shown in Table 5.16, where the 32-bit keys K0, K1, …, K7 are the subsettings of the secret key K (K = K0 ‖ K1 ‖…‖ K7, and the values of round keys Qj(e) = (Qj(1, e), Qj(2, e) for the encryption and decryption modes are determined according to the following formula:

Table 5.16: Schedule for Using Subkeys in the DDP-S128 Cipher
j = | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12
Sj(1) = | K0 | K1 | K2 | K3 | K4 | K5 | K6 | K7 | K0 | K2 | K4 | K6
Sj(2) = | K7 | K5 | K6 | K4 | K2 | K3 | K0 | K1 | K5 | K7 | K3 | K1

In the initial and final transformations of the DDP-S128 algorithm, four 32-bit subkeys are used in each, namely,

where r is the number of encryption rounds.

It is necessary to mention that Crypt(e) is characterized by the following features:

  • Controlled permutations over each A and D subblock are performed depending on the B and C subblocks.

  • The B subblock is transformed using operations that are the reverse of those performed over subblock C.

  • The sums of the values of subblocks B and C used in bitwise addition with subblocks A and D are different.

  • The value exchange operation of subblocks B and C is an element of the Crypt(e) procedure.

The structure of the DDP-S128 cipher round transformation successfully combines the ideas of building iterative cryptoschemes considered in Section 5.1.

Estimating the Security of the DDP-S128 Cipher

For the DDP-S128 cipher, the best differences in the differential cryptanalysis are Δ2's that have two active bits going in turn along the outermost and middle branches of a cryptoscheme. The unit differences go along the outermost branches without duplication, with a probability of p1 = 1. Two unit differences may also go along the middle branches without a difference occurring in the outermost branches when, at the moment of each sum calculation, (B +32 C) (see the algorithms for the Crypt(e) procedure) unit differences will appear in the same bits of blocks B and C. In this case, when calculating each sum with a probability of 0.5, the difference for blocks B and C are mutually eliminated. If the probability of this event is designated as p2, then justifying the value p2 ≈ 2−32 can be easily done. The difference indicated above pases two rounds with a probability of p(2) = p1p2 ≈ 2−32, and eight rounds with a probability of p(8) = p1p2 ≈ 2−128.

For ten and twelve rounds, such probabilities have values of p(10) ≈ 2−160 and p(12) ≈ 2−192, respectively. Thus, if the number of rounds is r ≥ 8, it is possible to state that the DDP-S128 block cipher is secure against differential cryptanalysis.


5.6. Statistical Properties of Algorithms

5.6.1. Criteria for Estimating the Properties of the "Avalanche Effect"

In order to check the statistic properties of block algorithms, it is advised that you test them according to the method offered by the New European Project for creating base primitives with the purpose of future standardization (NESSIE, New European Schemes for Signature, Integrity, and Encryption) [75].

For example, for each developed algorithm, it is necessary to analyze the results of statistical processing according to the following criteria:

  • The average number of output bits changed when changing input bit - 1

  • The degree of completeness - 2

  • The degree of avalanche effect - 3

  • The degree of strict avalanche criterion - 4

Let U(i) = U ⊕ Ei, i.e., a binary vector obtained by inversion of the ith bit in vector U. Then, binary vector Y(i) = F(U(i)) ⊕ F(U)) is called an avalanche vector for the ith component. For a block cipher, U = X‖K. Let the dimension of vector U be equal to n, and vector Y equal to m.

In Criteria 2 and 4, a dependency matrix of ‖aij‖n×m is used, namely,

The ‖aij‖n×m matrix reflects the dependence of the jth bit of the output vector on the ith bit of the input vector. The degree of completeness (Criterion 2) is estimated by the formula:

and the degree of strict avalanche criterion (Criterion 4) can be estimated using the formula:

where N = #U = #{U}.

To obtain an accurate estimation, a complete set of samples of all U vector values is needed. However, taking into account the integral character of these estimations, in order to obtain approximated values, you need just use the Monte Carlo method, i.e., a rather small set of samples of input values.

Criteria 1 and 3 use the ‖bij‖n×m distance matrix, namely,

which is a marking of the Hamming weight of the avalanche vectors.

The average number of output bits changed when changing 1 input bit (Criterion 1) is estimated by the formula:

and the degree of avalanche effect (Criterion 3) can be estimated by the formula:

The next two sections contain the results of testing the SPECTR-128 block cipher. The results of the rest of the testing algorithms are obtained in a similar manner.

5.6.2. Estimating the Influence of Incoming Text Bits on the Transformed Text

The criteria for estimating the influence of the plaintext text bits on the transformed text are intended for detecting possible weak sides of an algorithm that might be used in cryptanalysis based on a chosen plaintext, or by using the differential cryptanalysis method. For the criteria described in Section 5.6.1, we consider the case when avalanche vector Y(i) is formed by the input vectors U = X‖K and U = X(i)‖K, where X(i) = X ⊕ Ej.

The following values are specified as parameters: q for keys, t for incoming texts. N = qt. The values of q and t depend on the values of n and m and the computational resources available. The ‖aij‖n×m dependence matrix and the ‖bij‖n×m distance matrix look like this:

Keys and incoming texts are built using a random number monitor.

For the SPECTR-128 algorithm, integral estimates both for a declared number of rounds and for a reduced number of rounds were obtained. Similar to the test results of the five candidates shown in [75] - the finalists of the contest for New American Standard of block encryption held by the USA National Institute of Standards and Technologies - the "one key and 10,000 texts" variant was implemented, as well as "100 keys and 100 texts" (Table 5.17).

Table 5.17: Values of Influence Criteria 1-4 of the Incoming Text on the Transformed Text (for Various Numbers of Rounds)
Number of rounds | #K = 1, #X = 10000 |  |  |  | #K = 100, #X = 100
 | (1) | (2) = dc | (3) = da | (4) = dsa | (1) | (2) = dc | (3) = da | (4) = dsa
12 | 64.00145 | 1.00000 | 0.99922 | 0.99208 | 64.00385 | 1.00000 | 0.99937 | 0.99198
11 | 63.99543 | 1.00000 | 0.99922 | 0.99206 | 64.00783 | 1.00000 | 0.99929 | 0.99214
10 | 64.00466 | 1.00000 | 0.99933 | 0.99204 | 64.00295 | 1.00000 | 0.99930 | 0.99197
9 | 63.98921 | 1.00000 | 0.99932 | 0.99205 | 64.00405 | 1.00000 | 0.99921 | 0.99205
8 | 63.99262 | 1.00000 | 0.99935 | 0.99200 | 63.99932 | 1.00000 | 0.99928 | 0.99194
7 | 64.00420 | 1.00000 | 0.99927 | 0.99206 | 64.00502 | 1.00000 | 0.99926 | 0.99203
6 | 64.00168 | 1.00000 | 0.99929 | 0.99205 | 63.99895 | 1.00000 | 0.99937 | 0.99203
5 | 63.99244 | 1.00000 | 0.99931 | 0.99208 | 63.99628 | 1.00000 | 0.99930 | 0.99206
4 | 63.64805 | 1.00000 | 0.99421 | 0.98838 | 63.62012 | 1.00000 | 0.99369 | 0.98805
3 | 52.35455 | 1.00000 | 0.81804 | 0.81594 | 52.45568 | 1.00000 | 0.81962 | 0.81759
2 | 26.45824 | 0.98535 | 0.41341 | 0.41330 | 26.55646 | 1.00000 | 0.41494 | 0.41490
1 | 6.24359 | 0.48852 | 0.09755 | 0.08970 | 6.22903 | 0.50781 | 0.09732 | 0.09663

The results of testing the SPECTR-128 algorithm correspond to the test results for the contest finalists, and prove that the given transformation algorithm possesses good scattering properties, even with a small number of rounds, and may be treated as a good generator of pseudo-random substitutions, even with a small number of rounds. In particular, the completeness criterion, according to which "each input bit should influence each output bit", is implemented already after two encryption rounds. For example, in the DES and GOST algorithms, this criterion is implemented in no less than four encryption rounds, which is determined only by the Feistel scheme used.

5.6.3. Estimating the Influence of Key Bits on the Transformed Text

In this case, the avalanche vector Y(i) is formed by the input vectors U = X‖K and U = X‖K(i), where K (i) = K ⊕ Ei. In the criteria, the ‖aij‖n×m dependence matrix and the ‖bij‖n×m distance matrix look like this:

The test data for the SPECTR-128 algorithm (Table 5.18) prove that a rather strong scattering influence of each key bit upon all bits of the transformed text is provided for, even without a secure procedure for generating an extended key.

Table 5.18: The Values for Criteria 1-4 on the Influence of Key Bits on Transformed Text (for Various Numbers of Rounds)
Number of rounds | #K = 400, #X = 25 |  |  |  | #K = 100, #X = 100
 | (1) | (2) = dc | (3) = da | (4) = dsa | (1) | (2) = dc | (3) = da | (4) = dsa
12 | 63.99562 | 1.00000 | 0.99931 | 0.99202 | 64.00289 | 1.00000 | 0.99931 | 0.99206
11 | 63.99997 | 1.00000 | 0.99923 | 0.99202 | 64.00450 | 1.00000 | 0.99928 | 0.99203
10 | 64.00301 | 1.00000 | 0.99932 | 0.99204 | 63.99632 | 1.00000 | 0.99930 | 0.99202
9 | 63.99707 | 1.00000 | 0.99930 | 0.99204 | 63.99466 | 1.00000 | 0.99923 | 0.99202
8 | 64.00112 | 1.00000 | 0.99930 | 0.99200 | 64.00076 | 1.00000 | 0.99926 | 0.99195
7 | 63.99715 | 1.00000 | 0.99932 | 0.99200 | 63.99873 | 1.00000 | 0.99932 | 0.99201
6 | 64.00123 | 1.00000 | 0.99928 | 0.99200 | 64.00549 | 1.00000 | 0.99927 | 0.99201
5 | 63.94757 | 1.00000 | 0.99885 | 0.99195 | 63.95256 | 1.00000 | 0.99891 | 0.99202
4 | 63.94757 | 1.00000 | 0.99070 | 0.98590 | 63.41481 | 1.00000 | 0.99072 | 0.98592
3 | 54.33583 | 1.00000 | 0.84899 | 0.84733 | 54.36625 | 1.00000 | 0.84947 | 0.84783
2 | 27.21150 | 1.00000 | 0.42518 | 0.42510 | 27.22301 | 1.00000 | 0.42536 | 0.42528
1 | 4.59536 | 0.50390 | 0.07180 | 0.07173 | 4.59477 | 0.50390 | 0.07179 | 0.07171

We must mention that these criteria are efficient tools for detecting weak sides in separately developed procedures and transformations, in making up the schedule for using round keys, and when an optimal number of rounds is chosen.

With respect to contemporary recommendations, the number of rounds in block encryption algorithms should be greater than the minimum secure level by two, which is implemented, e.g., in the SPECTR-H64 and SPECTR-128 algorithms.

5.6.4. Using the χ2 Criterion for Revising Integral Estimates

This section deals with only one criterion from the statistical criteria family, which enables you to establish a correspondence between theoretical and practical models.

As with Criteria 1 and 3, estimates of Criteria 2 and 4 are also integral. Using the ‖bij‖n×m matrix, however, it is possible to differentially estimate the influence of each bit of the input vector. To do this, we must separately consider each line of the ‖bij‖n×m matrix. If a block cipher implements a pseudo-random permutation - i.e., possesses good diffusion properties - then the popularity distribution of the Hamming weight of avalanche vectors for each line should correspond to the theoretical distribution of the Hamming distance between randomly chosen vectors A and B of the same length. If Y ∈ GF(2)m, then the probability of the Hamming distance between vectors A and B, being equal to j is calculated by the formula:

where 0 ≤ j ≤ m.

To estimate the sampling's correspondence to the theoretical distribution, it is possible to use χ2 as a fitting criterion for two simple hypotheses.

For a fixed i, let Ψ i(N) be the value sampling bij obtained as a result of N tests. Hypothesis H0 states that the distribution Ψ i(N) corresponds to the theoretical distribution χ2 with v − 1 degrees of freedom (v = m + 1). For each i value, χ2i is calculated by the formula:

For the specified significance level χ2p, hypothesis H0 is accepted if χ2i < χ2p, and rejected otherwise. Therefore, as a result of applying this criterion, it is possible to build a binary vector M χ2p where the value of the ith bit is equal to 1 if the H0 hypothesis is accepted, and zero otherwise. The result of this criterion is a binary vector M χ2p of length n (input bit capacity), where no zeros should be present.

During the implementation of the criterion, you need to take into account the conditions under which it is applicable. For example, if Npj ≤ 10, then these j values are to be grouped. The number of degrees of freedom is always less than the number of groups per unit. Testing was performed by this criterion, for instance, for the SPECTR-H64 algorithm, but here we don't give you the results.

Main Results

The following can be considered the main results of our discussion on designing fast ciphers based on controlled operations.

  • We presented basic schemes for building universal iterated block ciphers based on controlled operations.

  • We gave concrete models of block ciphers, both for a hardware and a software implementation.

  • We considered the prospects of using controlled permutational and substitutional operations as cryptographic primitives. In particular, we offered a new command to processor developers, implementing a controlled permutation operation that can be efficiently used in developing program ciphers if implemented as a special instruction.

  • We presented specific schemes and constructions of applying one-stage controlled permutation blocks not only for round key selection control, but also in forming control vectors for inverse transformation implementation in controlled permutation blocks of a special type.

  • Since block ciphers might possess only practical security (and not theoretical), it is necessary to strictly observe their contemporary development principles. The statistical test described in this chapter are a well-tested tool, allowing you to detect obvious weak sides of an algorithm.


Chapter 6: Elements of the Cryptanalysis of Ciphers Based on Controlled Operations

6.1. Estimating Flexible Ciphers

As a rule, cryptanalysis is based on the use of algebraic and/or statistical mechanisms of ciphers. If mechanisms are found that enable you to destinguish a determinate transformation implemented by a cipher controlled by a secret key from a random one, then actual prerequisites for cipher breakability appear. Therefore, the general task of cryptanalysis is the detection of such mechanisms and the development of methods of using them in breaking the whole cipher or its elements.

The best known universal statistical method of cryptanalysis is frequency cryptanalysis. It is based on using the irregularity of the occurrence of different alphabetic symbols or their combinations in the plaintext, which is leveled out (though not completely) by applying an encryption transformation. For example, if a simple substitution cipher is used (each alphabetical symbol of the plaintext corresponds to a unique symbol of the cipher text alphabet), then the transformed text (ciphertext) fully retains the structure of the occurrence of the source text symbols. Provided that a cipher text of a size sufficient for detecting considerable differences in the occurrence of various symbols is available, such a mechanism helps to decrypt the cipher, since you have the option of establishing a correspondence between the symbols of the ciphertext and those of the plaintext.

It is common knowledge that one of the main modes of using block ciphers is the simple substitution mode (e-code book). Contemporary block ciphers, however, are practically invulnerable to the frequency cryptanalysis method, due to a very large number of possible data blocks (264 or 2128). In other words, it is practically impossible to find the actual frequency of the occurrence of the input data blocks, and especially to find a significant sampling for the transformed texts. Therefore, cryptanalysis methods being developed for contemporary block ciphers take into account the mechanisms for the detection of which you need not only use transformed texts, but also incoming ones, including those that are specially collated. These ways of attacking allow you to create more varied statistical methods of analysis.

There are two main tasks of cipher cryptanalysis.

The first task is the computation of the secret key, or finding a way to keylessly read ciphertexts, which is solved by a violator (decipherer, cryptanalyst) with the purpose of accessing information. This is the so-called decryption problem. Note that in the process of solving the first task, in order to determine the prospects of a cipher's development, a cryptanalyst should obtain a high level of cipher security for each cryptanalysis method he or she knows, with respect to conditions of practically applying them, and then choose the most efficient method of decryption. Therefore, for the each particular method, the cryptanalyst should determine, for example, the maximum number of elementary operations (if such an estimation is determined by the number of elementary operations) that must be performed in order to solve a cryptanalysis task.

The cryptanalyst can obtain this estimation with respect to the labor expenditures needed to differentiate the encryption algorithm from a random transformation, as well as the labor spent for computing the key using the detected statistical mechanisms. When security is estimated, apart from the labor spent to solve a cryptanalysis task, the memory necessary for implementation of the assault method is often determined as well. As a rule, when a large amount of memory is used, the number of operations necessary is considerably reduced. A general requirement for contemporary ciphers is the high computational complexity of the cryptanalysis (for example, 1040 operations) when a large amount of memory is used (for example, 1020 bytes).

The second task, cipher security estimation, is usually done by the developer. As a rule, the conditions for solving the first task are less pleasant than those of the second task. The latter, however, is no less complicated, since the cipher developer has to find the lowest security level for the cipher being developed for each cryptanalysis method he or she knows, including methods that are currently impossible to implement but that are theoretically justified. The cryptosystem developer tries to obtain an estimation corresponding to the minimal number of operations needed to solve a cryptanalysis task using the best cryptanalysis algorithm. Since it is not always possible to determine the best cryptanalysis algorithm, a minimum estimation is given to the best of the known cryptanalysis algorithms. The developer can also estimate the cipher's security as the labor expenditure needed to determine how it is different from a random cipher.

Thus, the estimations gained in the course of solving the first task should be higher than those gained in the course of solving the second task. In practice, however, this condition is not always observed, since much depends on the subjective conditions of solving each task.

During cryptanalysis, it is usually assumed that the integrity of the encryption device is sufficient when the algorithm is not modified during the encryption process, and the violator has no way to read the key information from any kind of leakage (feed circuit inducing, side electromagnetic radiations, computation time measurement, machine errors, etc.). Lately, however, attack on encryption device integrity are considered more often. This is due to the expanding application of encryption, in which these devices are used to solve various tasks in various operating conditions. Be aware that the cryptographic analysis of special purpose ciphers always used to include the study of the violation of the encryption device's integrity. The active study of such forms of attack started when encryption began to be widely used as an element of information security in computer-aided systems.

Estimating the security of flexible ciphers — those where the use of a concrete cryptalgorithm is determined by the secret key — is of special interest. Note that in this type of cipher, the Kerkhoff principle, according to which the only unknown element is the secret key, can be implemented by using pre-computations that include a building procedure for the encryption algorithm that depends on the user's secret key. In this case, a concrete encryption algorithm is an easily changeable element. It is automatically changed when the secret key is changed. If the number of possible modifications of the cryptalgorithm is large (e.g., 1020), then it is rather difficult to analyze each of them. Therefore, when flexible ciphers are built, a base mechanism is developed in which certain principles that determine the general properties of all modifications are fixed. As a rule, the developer estimates the level of security for a limited set of algorithms by assuming that the cryptanalyst knows the particular modification. To obtain the lowest security level of a cipher, it is advisable to find the same estimate for the "weakest" modification. Another important way of analyzing flexible algorithms assumes that the encryption key is known, with only the cryptalgorithm modification remaining unknown. It makes sense to only use flexible ciphers with high security against all variants of cryptanalysis mentioned above.

The confidentiality of the cryptalgorithm modification in flexible ciphers should not be treated as the main factor of high security, but rather as a mechanism to determine the additional security reserve. Indeed, if a cryptanalyst does not know the modification of the cryptalgorithm, the cryptographic task will be considerably more complex.

The universal method of cryptanalyzing flexible ciphers is by keyless reading and trying the entire possible key space. These methods do not require knowledge of the concrete modification of a cryptalgorithm, but the first one is efficient only when decrypting relatively weak ciphers, and the second one only when using small keys.

For the flexible program ciphers described in Chapter 2, using these universal methods does not allow you to actually decrypt a cryptoscheme. Using more efficient methods based on the availability of statistical mechanisms in the samplings gained during studies of certain transformations requires much more labor expenditure if the modification of a cryptalgorithm is unknown, compared to the labor needed to decrypt well known transformation procedures.

To gain the minimal security estimation for ciphers based on the data-dependent sub-key selection, the combinatory-probabilistic model was introduced. This model and methods of its use were described in Chapter 2 when estimating the security of some software-oriented 512-byte algorithms. The reason for using this model to get the minimal security estimation is the fact that one encryption round includes a large number of operations (128k, where k = 2, 4, 6), where at least half are performed in complex dependence on each bit of the plaintext and each bit of the secret key. The selected keys are not used directly in the transformation of the current data subblock, but rather are elements of the procedure for forming accumulating key variables.

These variables are transformed within one round in concatenation mode, which determines the influence of the current (including the initial) value of each of these variables upon all its subsequent values. The concatenation method explains the inclusion of each accumulating variable in the transformation and, consequently, in the transformation of each data subblock — long chains of subkeys selected pseudo-randomly. Trying to compute such chains based on source and transformed texsts using algebraic relationships leads to the formation of a non-linear Boolean equation system with many unknowns, which is really very hard to solve.

Generating equations that can be solved using reasonable computing resources necessitates the inclusion of some pseudo-random values of accumulating variables in such equations. Assuming some pseudo-random parameters in the relationships used for cryptanalysis is generally done for many statistical types of attacks, including both linear and differential methods recognized as the most general and efficient methods used in block cryptosystem analysis. Currently, except for the combinatory-probabilistic model, no other methods of 512-byte algorithm security estimation have been introduced, although they have been discussed for about 10 years in various scientific papers.


6.2 Differential Characteristics of Controlled Permutation Boxes

One of the universal methods of block cipher cryptanalysis used for estimating security is differential cryptanalysis (DC). The basic principles of DC are set forth in Section 4.4.

Below is a brief explanation of differential cryptanalysis.

Let's say there is a rather complex one-to-one mapping Y = F(X) depending on the key, where the cardinal number X is a very big number (e.g., 264). As a rule, it is impossible to predict the value of Y for a randomly chosen X. Let's say there is already a rather large number of non-recurrent pairs (X1, Y1), (X2, Y2), …, (Xr, Yr). If, for any X not belonging to a set {X1, X2, …, Xr}, it is impossible to predict Y with a probability exceeding (2n − r)−1, i.e., if values of Y that have not yet occurred are equiprobable, then this proves the pseudorandom character of this mapping. Otherwise, the mapping is not pseudo-random.

Now let's consider two vectors simultaneously - X1 and X2. Using a binary operation, a third vector can be made to correspond to each pair of binary vectors, and this vector will be called the difference. Usually, an XOR (X1 ⊕ X2) operation is used as such a binary operation, and the difference is commonly designated with the symbol ΔX. Thus, the incoming difference ΔX looks as follows: ΔXX1 ⊕ X2. Accordingly, the difference in the values of the F function, called the output difference, looks as follows: ΔYY1 ⊕ Y2. Usually, the same binary operation is used when input and output differences are determined, although such a coincidence is not mandatory. In the considered example, even with the absence of a statistical dependence between the samplings of the transformed texts and those being transformed, a statistical dependence may exist between the sampling differences of the transformed texts and those being transformed. That is, there may be an irregularity of output difference ΔY values as a result of the transformation of a set of binary vector pairs interconnected by a certain difference.

The idea of differential cryptanalysis lies in the task of finding a difference that, after the entire encryption transformation, would generate a difference with a frequency of occurrence that considerably differs from the average value. Finding such input and output differences is the main task of DC. If such differences are found, this means that the conditions under which an encryption transformation is recognized as a non-random one have been found. After this, a way of using this circumstance to compute a secret key must be found. Since DC deals with the encryption of specially selected pairs of texts, this type of cryptanalysis is related to attacks based on specially chosen texts.

Thus, in using the DC method, we consider the propagation of differences of certain type through separate operations, a round, or the entire encryption transformation. When it is implemented, the encryption of a large number of data block pairs is required, with the fixed difference.

In other words, the DC method searches for an efficient differential characteristic that can be used to decrypt a cipher. Remember that the differential characteristic is a triad of values (ΔX, ΔY, p(ΔX, →ΔY)) where p(ΔX, →ΔY) = p(ΔY/ΔX) - the probability of the occurrence of the ΔY difference if the input difference ΔX is available. That characteristic for which the probability value p(ΔX, →ΔY) for a full number of encryption rounds considerably exceeds 2−n, where n is the length of vectors X and Y, is known as efficient.

Let's say that an efficient characteristic ΔX, ΔY, p(ΔX, →ΔY) is found, where 2-n+20 ≈ p(ΔY/ΔX)≫2-n. For key computation, however, the encryption of a very large number of data block pairs is required. As a rule, for such a number N, the inequality N≥1/p2(ΔY/ΔX) exists (see Section 4.4.2). In the example considered, in order to prove that the encryption transformation is not pseudo-random - i.e., that it is indistinguishable from a random one - it is sufficient to encrypt about 2n−20 pairs of data blocks. To compute the key, however, 22n−40 incoming data blocks will be required, which is problematic at n = 64, and practically unrealizable at n = 128.

Thus, it is possible to show that some block ciphers implement an encryption transformation that is different from a random one, but that the key computation is a very difficult task. If such a situation is revealed at the stage of a cipher design, then the developer needs to modernize the current version of the cipher in such a way so as to make it a pseudo-random substitution (keeping in mind that every block cipher is a substitution). The DC performed by the developer may not include the key computation stage or an estimation of the labor expenditures needed to implement its variants. It is sufficient to build a cipher that is undistinguishable from a random transformation for all possible differential characteristics.

Important differential characteristics are iterative characteristics with identical input and output differences. For ciphers based on permutations that depend on the data being transformed, differential characteristics with input and output differences that belong to the same class and have the same (usually small) Hamming weight are also important.

At first, operations of controlled permutations seem too complicated for DC. However, with a gradual transition from the analysis of the differential characteristics of an elementary switch to more complicated blocks of controlled permutations, it is possible to find rather simple general dependencies connected with the most important cases of DC. Such cases are related to determining the probability of the propagation of differences with a small number of active bits. It is these differences that have the greatest probabilities for cryptoschemes based on using controlled permutation blocks. Indeed, it was shown in the description of specific ciphers in Chapter 5 that two permutation operations are normally used in one encryption round, these operations depending on the data being transformed and their superposition forming a permutation of the maximal order. The active then bits become arbitrary. This is the reason why increasing the number of active bits leads to a considerable reduction in the probability of obtaining the expected difference at the outcome of one round. This is shown in the DC of specific ciphers in Chapter 5.

It is rather easy to establish the main differential characteristics of an elementary box P2/1, which have non-zero probabilities. These characteristics are shown in Fig. 6.1, where the superscript of a difference Δ indicates its correspondence to input (x), output (y), or control input (v), and the subscript indicates the number of non-zero bits in the difference. Using these properties of an elementary switch that is the base element of more complex boxes of controlled permutations, and taking into account the bit distribution of the control data subblock, it is easy to compute the probabilities of differential characteristics for the most important types of controlled permutation boxes.

Click To expand
Figure 6.1: Probabilities of passing differences through elementary switch P2/1

Let's consider a case of using expansion box E, which provides for the influence of each bit of control data subblock L on q (q = 2, 3) different bits at output E, and the strictly one-time influence of each control bit on all input bits of the controlled permutations box.

The general scheme shown in Fig. 6.2 can contain boxes P16/32 (q = 2), P32/96 (q = 3), or P64/192 (q = 3) as box Pn/m. Designate the number of non-zero bits of the difference going through the control data subblock L as z, and the number of elementary events related to the generation of a pair of active bits in an elementary box P2/1, whose control input is fed with a non-zero difference (Fig. 6.2, c), as w. These P2/1 boxes will be called active.

Click To expand
Figure 6.2: The general scheme of the passing of differences through a controlled permutations box (a), zero difference passing through the P2/1 active boxes without active bit generation (b), and with active bit generation (c)

If the input of an expansion box is fed with the difference ΔL1 with one active bit, then the difference ΔVq with q active bits appears at the control input of the controlled permutations box. If a zero difference ΔX0 is fed to the input of the controlled permutations box, then - depending on the specific bit values entering the inputs of the elementary switches corresponding to active bits of difference ΔVq - a zero difference ΔY0 or a non-zero difference ΔY2w (w ≤ q) with an even number of active bits may occur at the output of the controlled permutations box. Taking into account the probability of a zero difference transformation while passing through an active elementary switch P2/1, it is easy to get the following formula:

If z = 1, then this formula is exact, and if z ≥ 2, it provides a good approximation. When q = 3, 4, 5, the formula provides a rather exact probability value. You can also use it at higher q values, but differences with a large number of active bits do not contribute much to differential characteristics with maximum probabilities.

Another important case is related to the passing of difference ΔX1 with one active bit through the controlled permutations box in the presence of a non-zero difference ΔLZ, where z ≠ 0 at the control input. The active bit of the input difference may pass all active elementary switches with the probability p′ ≈ n−2qz)/−n, and pass through one of the last active elementary switches P2/1 with the probability p″ ≈ 2qz/n. Then, for z = 1, the indicated expressions of the probabilities are exact, and for z = 2, 3, 4, they provide a rather good approximation. Taking into account the fact that each active elementary switch P2/1 can generate two active bits of output difference with a probability of 0.5, it is easy to derive the following approximation for the probability value of the considered event:

When a difference with two or more active bits passes through the controlled permutations box, there is the possibility of the "annihilation" of the even number of active bits. The maximum probability corresponds to the zeroing of two active bits. Consider how this happens for the differences ΔX2 and ΔLz. With a probability close to 2qz/n, one of the active bits of the ΔX2 difference goes to the input of one of the active elementary switches. With a probability of 1/(n − 1), the second active bit moves to the input of the same box P2/1. With a probability of 0.5, these active bits are simultaneously zeroed. The remaining qz − 1 of the P2/1 active elementary switches with a probability of 2−qz+1 will not generate new pairs of active bits in the output difference.

After multiplying the probabilities of all these independent events, we derive:

This formula is derived for the case of averaging all possible values of the number of active bits i and j of the input difference ΔX2|i, j (assuming that both i and j are random equiprobable values). The considered mechanism of active bit "annihilation" proves that the simultaneous zeroing of two and more pairs of active bits has a considerably smaller probability. Some values of the probability p (ΔX, →ΔY / ΔLz are shown in Tables 6.1 and 6.2.

Table 6.1: Probability Values p(ΔX → ΔY/Δ1L) for the P64/192 Box
z = 1 | ΔY0 | ΔY2 | ΔY4 | ΔY6
ΔX0 | 2−3 | 1.5.2−2 | 1.5.2−2 | 2−3
ΔX2 | 1.52.2−13 | 1.11.2−3 | 1.42.2−2 | 1.27.2−2
z = 1 | ΔY1 | ΔY3 | ΔY5 | ΔY7
ΔX1 | 1.1.2−3 | 1.55.2−2 | 1.45.2−2 | 0.91.2−3
Table 6.2: Probability Values p(ΔX → ΔY/Δ2L) for the P64/192 Box
z = 2 | ΔY0 | ΔY2 | ΔY4 | ΔY6
ΔX0 | 2−6 | 1.5.2−4 | 1.88.2−3 | 1.25.2−2
ΔY2 | 1.52.2−15 | 1.1.2−6 | 1.51.2−4 | 1.72.2−3
z = 2 | ΔY1 | ΔY3 | ΔY5 | ΔY7
ΔX1 | 1.19.2−6 | 1.69.2−4 | 2−2 | 1.25.2−2

It is worth mentioning that the above formulas for computing the probability for events related to either class of differences and that are characterized mainly by different Hamming weights provide integral estimations within a rather large class of differences. If additional active bits are generated, then there is no binding of active bits to specific numbers of bits. However "annihilation" includes the binding of the second bit to a specific position, since it is the fact of two active bits going to the input of the same active elementary switch that is considered. Assuming that the above estimations are correct for both direct and inverse layered boxes of controlled permutations, the "annihilation" events can be examined by changing the bit movement from output to input, which leads to a case similar to active bit generation in a reverse box of controlled permutations. Therefore, it is easy to understand why "annihilation" probabilities have considerably smaller values. It is because the generation of an active bit pair does not require that two specific bits move to the input of the same active elementary switch - i.e., such a case deals with much more numerous classes of events. The "annihilation" event has probability values that correspond to a case of active bit generation in the specified output classes. We will encounter this circumstance later on, during the DC of specific ciphers that use controlled permutations as a base cryptographic primitive.

Studying the differential properties of cryptosystems based on controlled operations also includes the preliminary consideration of the probabilities of passing various differences through a G operation. Probability values can be easily derived from formulas describing the Boolean functions corresponding to this operation. Since different operations of such type are used in different ciphers, their properties will be considered directly during the DC of the specific cryptosystems.


6.3 Analysis of the SPECTR-H64 Cryptosystem

Using multi-layer boxes of controlled permutations in the SPECTR-H64 block cipher leads to the fact that the largest probabilities have differential characteristics with a small number of active bits.

In the considered scheme, the difference with one active bit in the right branch (with a zero difference in the left branch) passes through one transformation round with a probability equal to 1. In the same scheme, if one active bit is available in the left branch and a zero difference is available in the right branch, there is a rather large probability of obtaining a zero difference in the right branch. That is, in this case, the general output difference will be the same as the input difference. Let's consider this case in more detail, which, with respect to the previous one, will allow us to form 2-, 4-, and 2k-round characteristics.

However, in the considered case, the difference in the right arm is equal to the difference at the output of one round, and within the round, the active bit passing through the left branch of the cryptoscheme considerably influences the generation of new active bits in the right branch. In the controlled permutations box, active bits are generated at random, and during the performance of the G operation, by both the probability law and the deterministic one. If there is one active bit at the input of the G operation, there are from two to six active bits generated at its output (two active bits are generated according to the deterministic law). Generation of an even number of active bits (0, 2, 4, 6) is also implemented in each P′ or P″ box. After the XOR operation is performed (before the P−132/80 controlled permutation is implemented), the total number of active bits can not only increase (up to 18), but can also decrease (to 0).

Since we are interested in a situation where a zero difference (the absence of the active bits' "propagation") is implemented at the output of box P−132/80, a case in which the number of such active bits after the XOR operation is performed is equal either to zero or two is of the greatest interest for us. It is for these probability values that the probabilities of obtaining a zero difference at the output of box P−132/80 are especially important.

These arguments enable us to form the two-round differential characteristic shown in Fig. 6.3 with the use of the following designations:

  • ΔL and ΔR - the difference in the left (L) and right (R) subblock

  • ΔF and ΔF - the input and output differences that correspond to the F operation

  • ΔG2|i, i+1 - the difference with a subscript indicating: the total number of active bits first and, after the vertical line, the numbers of active bits

Click To expand
Figure 6.3: A two-round characteristic formation scheme in the SPECTR-H64 cipher for event A1

With such a designation, the Δ2|i, j and Δ2 entries have the following meaning: the first one designates a specific difference with two active bits, and the second one indicates only one of the differences with two active bits.

Taking into account the design philosophy of the P32/80 box, used in one round of the SPECTR-H64 cipher, the li active bits of data subblock L control a different number of P2/1 boxes, depending on the i ordinal number and on the L data subblock's cycle shift value before the expansion procedure is performed. The number of P2/1 boxes controlled by one bit li will be designated as q.

Below are the main variants of one active bit passing in the ith order of the left arm without generating active bits at the output of box P″.

Event A1

  1. The difference ΔG2|i, i+1 is formed at the output of operation G with a probability of p(i)2.

  2. The difference ΔP″2|i, i+1 is formed at the output of box P′ with a probability of p(i, j+1, 1 = 2-q.

  3. The difference ΔP″0 is formed at the output of box P″ with a probability of p(i)1 = 2-q.

  4. After two XOR operations are performed, a zero difference is formed at the input of box P−1, passing through this box with a probability of p(i)4 =2-q.

Event A2

  1. The difference ΔG2|i, j+1 is formed at the output of operation G with a probability of p(i)2.

  2. The difference ΔP′0 is formed at the output of box P′ with a probability of p(i)3 =2-q.

  3. The difference ΔP″2|i, i+1 is formed at the output of box P″ with a probability of p(i, i+1)1.

  4. After two XOR operations are performed, a zero difference is formed at the input of box P−1, passing through this box with a probability of p(i)4 =2-q.

Event A3

  1. The difference ΔG2|i, j+1 is formed at the output of operation G with a probability of p(i)2.

  2. The difference ΔP′0 is formed at the output of box P′ with a probability of p(i)3.

  3. The difference ΔP′0 is formed at the output of box P″ with a probability of p(i)1.

  4. After two XOR operations are performed, the Δ2|i, i+1 difference is formed at the input of box P−1 that is zeroed in this box with a probability of p(i, i+1)4.

Below is a brief explanation of the computation of the probability p(i)2. In it, we will write a general formula for bit computation in the ith order at the output of the G function specifying the Y = G(X, A, B) transformation, where A and B are subkeys used during the implementation of this transformation:

Click To expand

where ai and bi are subkey bits. From this last relationship, it is easy to derive the following formulas that characterize the changes in the yi, yi+1, yi+2, yi+3, yi+4, yi+5 output bits, stipulated by changing the single input bit xi (Δ xi =1), namely,

Click To expand

Based on these formulas, it is easy to compute the following probability values:

and for k = 2, 3, 4, 5

Then, assuming that subkeys A and B are random equiprobable values, the value of p(i)2 is determined by the formula:

Click To expand
Note

In the formula, you must take into account the limits on the maximum possible values of the indices i and i + k of the co-factors with Δ yi+k, which should not exceed 32.

The p(i)2 probabilities for various values of the i index are set forth below.

  • p(i)2 = 0 for i = 1, 2, since in these cases no less than three active bits are formed in the output difference.

  • p(i)2 = 2−4 for 3 ≤ i ≤ 27; this value, derived by the multiplication of all six cofactors, is present in the above formula.

  • With respect to the remark for values i ≥ 28, we have:

To compute the probability of event A1, we can use the table of the influence distribution of the L subblock's bits on the elementary switches of box P′. Such a table can be easily created from the description of the SPECTR-H64 algorithm (Table 6.3), where cells mean P2/1 boxes, and the numbers in them (i) mean the numbers of the corresponding bits in subblock L.

Table 6.3: The Distribution of the Influence of Control Subblock L Bits in the P′Box
28 | 29 | 30 | 31 | 32 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11
5 | 6 | 7 | 8 | 9 | 10 | 11 | 4 | 29 | 30 | 31 | 32 | 1 | 2 | 3 | 28
9 | 10 | 11 | 4 | 5 | 6 | 7 | 8 | 1 | 2 | 3 | 28 | 29 | 30 | 31 | 32
25 | 26 | 27 | 20 | 21 | 22 | 23 | 24 | 17 | 18 | 19 | 12 | 13 | 14 | 15 | 16
21 | 22 | 23 | 24 | 25 | 26 | 27 | 20 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 12

Using this tablexs, you can determine all values of i for which the difference Δ(P′)2|i,i+1 can appear at the output of box P′, and also determine the value of the probability of this event, namely,

For example, at i = 28, the elementary boxes P(1)2/1, P(32)2/1, and P(44)2/1 are active, and at the output of each of them with a probability of 0.5 a pair of active bits can appear (the superscript in designation P(j)2/1 corresponds to the elementary box number). Only for box P(1)2/1 can an output pair of active bits simultaneously enter into orders i and i + 1.

We are interested in the case of active bits appearing at the output of P(1)2/1, with the simultaneous absence of active bits at the outputs of P(32)2/1 and P(44)2/1. The probability of this event is equal to P(i,i+1)3 = 2−32−42−4 = 2−11, since the left and the right output bits of box P(1)2/1 will fall at the 28th and 29th bits, respectively, at the output of box P′ with a probability of 2−4.

Altogether, there are four bits of the left subblock (numbers 4, 8, 18, and 28) that satisfy the situation described above. For i = 4, 8, and 28, we have the probabilities P(4,5)3 = P(8,9)3 = P(28,29)3 = 2−11, and for i = 18, we have a probability of P(18,19)3 = 2−4. Note that it is the order i = 18 that contributes the most in forming the value of the probability of the A1 event.

The probability of the difference ΔR1 falling at the specified ith bit at the output of the first round is equal to p(i) = 2−5. The probability that no active bits in digits i + 2, i + 3, i + 4, i + 5 will be formed at the output of the G function (for 3 ≤ i ≤ 27 and averaging by random round keys) is equal to p(i)2 = 2−4. Accordingly, for i = 28, p(28,29)2 = 2−3. Thus, we have the following integrated probability for the A1 event:

Click To expand

The predominant contribution to the value of P′ is made by the 18th bit in the left subblock, for which the probability values are higher - p(18)1, p(18)4, and p(18,19)3 (p(18)1 = p(18)4 = 2−2 and p(18,19)3 = 2−4).

In the A1 event, for all values of i, we have p(i)1 = 2−3, and for events A1 and A2, we have p(i) = 2−5 and p(i)4 = 2−3.

With respect to the full symmetry of the direct (P′) and inverse (P−1) controlled permutations transforming the right data subblock in one round of the SPECTR-H64 cipher, the probabilities of the A1 and A3 events are the same. That is

Assuming that the key element at the input of box P″ is an equiprobable random value, it is easy to compute the probability of the A2 event using the following formula, which is similar to the previous one:

Click To expand

In the A2 event, for all values of i, we have p(i)3 = 2−3. However, when p(i, i+1)1 values are computed, then Table 6.4 should be used instead of Table 6.3, since before the left subblock enters the E expansion box, it is subject to transformation by a cycle shift operation not by 11, but by 17 bits. The predominant contribution to the value of the probability of P″ is made by the 21st order, for which p(21,22)1= 2−2 and p(21)3 = p(21)4 = 2−2.

Table 6.4: The Distribution of the Influence of Control Subblock L Bits in the P″ Box
2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17
11 | 12 | 13 | 14 | 15 | 16 | 17 | 10 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 2
15 | 16 | 17 | 10 | 11 | 12 | 13 | 14 | 7 | 8 | 9 | 2 | 3 | 4 | 5 | 6
31 | 32 | 1 | 26 | 27 | 28 | 29 | 30 | 23 | 24 | 25 | 18 | 19 | 20 | 21 | 22
27 | 28 | 29 | 30 | 31 | 32 | 1 | 26 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 18

Thus, the probability of the difference (0, Δ1R) passing through two rounds is equal to

In this value of P(2), the contribution of the events corresponding to the appearance of four or six active bits in the output difference of the G function is not taken into account, nor are the events with two active bits leading to the simultaneous formation of three differences Δ(G)2|i, i+1, Δ(P)′2|i, z, and Δ(P)″2|i+1, z that meet the condition:

These events may be neglected, since their integral probability is considerably less than 1.5 × 2−15.

With respect to the mechanisms revealed during the computation of the probabilities of the events being considered (A1 and A2), we can conclude that a cipher's security against differential cryptanalysis depends considerably on the distribution of control bits in expansion box E. In addition, the value of the probability of a two-round differential characteristic can be reduced if expansion box E is optimized. For example, if you swap the numbers 21 and 20 in the lower line of Table 6.3, and swap 18 and 19 in Table 6.4, this permutation enables you to reduce the probability values, namely, P′ ≈ 2−23, P″ ≈ 2−21, and P(2) ≈ 1.5 × 2−21. That is, this permutation leads to the reduction of the probability of the two-round characteristic by approximately 26 times.

After such a change, the most efficient differential characteristic is a three-round one, considered below.

Indeed, there is another differential characteristic available for the SPECTR-H64 cipher that corresponds to differences with a small number of active bits. This characteristic corresponds to the difference (0, ΔR1) passing through three rounds. Its formation is described by the following mechanism. After the first round, the active bit enters the 32nd order with a probability of 2−5. In the second round, the active bit passing through the G operation with a probability of 1 generates an active bit in the difference going through the right branch that, with a probability of 2−5, turns out to be in the 32nd bit at the output of the right branch of the second round. The probability that no additional active bits will appear in the right branch during the performance of three controlled permutation operations is equal to (2−3)3 = 2−9. The differences ΔL1|32 and ΔR1|32 are distributed through the third round. With a probability of 2−5, the active bit of the right difference turns out to be in the 32nd order, after the P′ operation is performed, and is zeroed after the XOR operation with an output difference of ΔG1|32 is performed. In the third round, also with a probability of 2−9, three controlled permutation operations will not generate new active bits. Taking into account the given scheme of the (ΔL0, ΔR1) difference's distribution in three rounds, we have the following probability value for it: P(3) ≈ 2−28 (the "approximately equal" symbol takes into account the fact that we neglect the contribution of events where intermediary differences with several active bits in the right subblock are formed). Accordingly, for six rounds, the probability of the (ΔL0, ΔR1) difference passing with the given three-round characteristic is equal to P″(6)≈(2-28)2 = 2 -56, and with the two-round characteristic, it is P′(6)≈(1,5 × 2 -15)3 ≈ 1,7 × 2-44 ≫ P″(6). Thus, when a six-round characteristic with one active bit is formed, a two-round characteristic is more efficient for analyzing the SPECTR-H64 encryption algorithm.

It is possible to derive the following probability values using a two-round characteristic for building differential characteristics with an even number of rounds:

These last relationships prove that if ten or twelve encryption rounds are used by SPECTR-H64 encryption algorithms, the use of corresponding characteristics based on a two-round characteristic with one active bit is not applicable for cipher decryption, since these characteristics do not allow us to distinguish the SPECTR-H64 cipher from a random cipher. That is, we can say that the SPECTR-H64 algorithm is secure against the considered variant of differential analysis.

Basically, a variant with eight encryption rounds can be decrypted after about 260 pairs of specially selected 64-bit input data blocks are encrypted, although such an attack most likely cannot be practically implemented.

As we mentioned above, the corresponding probability for a two-round characteristic of the SPECTR-H64 cipher can be considerably reduced by optimizing an E expansion box E. For a three-round characteristic, however, the analogous probability is weakly dependent on the type of control bit distribution specified by the E expansion. Therefore, after the SPECTR-H64 cipher is modernized, its security against differential cryptanalysis will be determined by the three-round characteristic. To reduce the probability in the three-round characteristic, it is additionally required that you change the Boolean functions specifying a specific type of G operation.


6.4 Differential Cryptanalysis of the SPECTR-128 Cipher

The structure of the SPECTR-128 iterative cryptosystem is analogous to that of the SPECTR-H64 algorithm, which determines the similarity of the differential properties of both ciphers. For SPECTR-128 algorithms, differential characteristics with a small number of active bits also have the largest probabilities. The largest probability has a characteristic corresponding to the difference (ΔL0, ΔR1) passing through two rounds. The mechanism of its distribution is analogous to that of SPECTR-H64. However, due to the peculiarities of the G operation and the bigger size of the subblocks being transformed, computations are more intricate. When differential cryptanalysis is performed, you must take account of the fact that, if only one input bit of the G operation is changed, one bit will be surely changed at its output, corresponding to the same order as the changed input bit. Besides which, six more bits can be changed with a probability of 0.5. The main variants of a two-round characteristic formation are connected with the appearance of the differences Δ(G)2|i, i+1, Δ(G)2|i, i+3, Δ(G)2|i, i+6, Δ(G)2|i, i+7, Δ(G)2|i, i+8, and Δ(G)2|i, i+9. at the output of the G operation. Each of these differences contributes to the value of the probability of the two-round characteristic. This contribution is computed in a manner similar to that used in the SPECTR-H64 algorithm for the specified i, and when an output difference Δ(G)2|i, i+1 with two active bits is considered. The possibility of the appearance of different differences at the output of the G operation can be taken into account in events A1, A2, and A3, which is done below. Using the dependence of the output bits values expressed as a Boolean function, it is easy to derive formulas expressing the changes in the output bits having numbers i + k, where k = 0, 1, 2, …, 9 (Table 6.5).

Table 6.5: The Probability of Active Bit Generation at the Output of the G Operation in the (i + k)th Order, when the ith Input Bit Is Changed
Formula | Probability
Δ yi = Δ li | p(Δ yi = 1) = 1
Δ yi+1 = Δ li(a(4)i-1⊕ a(3)i-1li−8 ⊕ a(4)ili-5li-8) | p(Δ yi+1=1) = ½
Δ yi+2 =0 | p(Δ yi+2=1) = 0
Δ yi+3 = Δ lili-6) | p(Δ yi+3=1) = ½
Δ yi+4 =0 | p(Δ yi+4=1) = 0
Δ yi+5 =0 | p(Δ yi+5=1) = 0
Δ yi+6 = Δ li(li-2⊕ li-3li+5a(4)i+5) | p(Δ yi+6=1) = ½
Δ yi+7 = Δ lia(3)i+5) | p(Δ yi+7=1) = ½
Δ yi+8 = Δ lili+2 | p(Δ yi+8=1) = ½
Δ yi+9 = Δ li(li+6 ⊕ li+8a(3)i+7 ⊕ li+3li+8a(4)i+8) | p(Δ yi+9=1) = ½

Let's consider events A1, A2, and A3 (Fig. 6.4) for SPECTR-128.

Click To expand
Figure 6.4: The two-round characteristic formation scheme in the SPECTR-128 cipher for event A1

Event A1

  1. The difference Δ(G)2|i, i+k is formed at the output of operation G with a probability of p(i,j+k)2, where k∊{1, 3, 6, 7, 8, 9}.

  2. The difference Δ(P)′2|i, i+k is formed at the output of box P′ with a probability of p(i,j+k)3.

  3. The difference Δ(P)″0 is formed at the output of box P′ with a probability of p(i)1 = 2−3.

  4. After two XOR operations are performed, a zero difference is formed at the input of box P−164/192, passing through this box with a probability of p(i)4 = 2−3.

Event A2

  1. The difference Δ(G)2|i, i+k is formed at the output of operation G with a probability of p(i,j+k)2.

  2. The difference Δ(P)′0 is formed at the output of box P′ with a probability of p(i)3 = 2−3.

  3. The difference Δ(P)″2|i, i+k is formed at the output of box P″ with a probability of p(i,j+k)1.

  4. After two XOR operations are performed, a zero difference is formed at the input of box P−164/192, passing through this box with a probability of p(i)4 = 2−3.

Event A3

  1. The difference Δ(G)2|i, i+k is formed at the output of operation G with a probability of p(i,j+k)2.

  2. The difference Δ(P)′0 is formed at the output of box P′ with a probability of p(i)3 = 2−3.

  3. The difference Δ(P)″0 is formed at the output of box P′ with a probability of p(i)1 = 2−3.

  4. After two XOR operations are performed, the Δ2|i, i+k difference is formed at the input of box P−1, which is zeroed in this box with a probability of p(i,j+k)4.

As in the case with the SPECTR-H64 algorithm, due to the symmetry of events A1 and A3, they have the same probabilities. So, it will suffice to determine probabilities of events A1 and A2.

Using the description of the SPECTR-128 algorithm to compute events A1 and A2, we will compile the tables of the distribution of the left subblock bits in control of the elementary switches of boxes P′ and P″ (Tables 6.6 and 6.7).

Table 6.6: Distribution of Subblock L Bits in the P′ Box of the SPECTR-128 Cipher
Left part of P′ (corresponds to input bits with numbers from 1 to 32)
54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 1 | 2 | 3 | 4 | 5
7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 6
15 | 16 | 17 | 18 | 19 | 20 | 21 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14
47 | 48 | 49 | 50 | 51 | 52 | 53 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46
39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 38
22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37
Right part of P′ (corresponds to input bits with numbers from 33 to 64)
6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21
55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 1 | 2 | 3 | 4 | 5 | 54
63 | 64 | 1 | 2 | 3 | 4 | 5 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62
31 | 32 | 33 | 34 | 35 | 36 | 37 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30
23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 22
38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53
Table 6.7: Distribution of Subblock L Bits in the P″ Box of the SPECTR-128 Cipher
Left part of P″
12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27
29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 28
37 | 38 | 39 | 40 | 41 | 42 | 43 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36
5 | 6 | 7x | 8 | 9 | 10 | 11 | 60 | 61 | 62 | 63 | 64 | 1 | 2 | 3 | 4
61 | 62 | 63 | 64 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 60
44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59
Right part of P″
28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43
13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 12
21 | 22 | 23 | 24 | 25 | 26 | 27 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20
53 | 54 | 55 | 56 | 57 | 58 | 59 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52
45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 44
60 | 61 | 62 | 63 | 64 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11

The probability of event A1 is computed by the formula:

where p(i) = 2−6 is the probability of the transition of the active bit of the difference into the ith order after the first round. Using the structure of box P−164/192 and Table 6.6 and 6.7, it is easy to determine the probability values included in this sum. In addition, the variant corresponding to the active bit in the 43rd order of the left subblock, for which the probability is p(33,39)3 = 2−3 (about 70% of the value of P′) contributes the most to the probability value. About 15% fall on numbers i = 33 and 34, for which p(33,39)3 = p(33,40)3 = p(34,36)3 = p(34,40)3 = 2−7. The remaining share falls on values where i = 3, 7, 8, 11, 12, 15, 16, 20, and 54.

The probability of event A2 is computed by the formula:

Click To expand

The cases where i = 54 and 57 (p(54,55)1 = p(57,60)1 = 2−5), as well as i = 9, 10, 11, 44 (p(9,15)1 = p(9,16)1 = p(10,13)1 = p(10,16)1 = p(11,14)1 = p(44,45)1 = p(44,47)1 = 2−7), are the main contributors to the probability of P″. The probability of the difference (ΔL0, ΔR1) passing through two rounds is

We should mention that, as with the differential property analysis of the SPECTR-H64 cipher, certain features of the distribution of the influence of the left subblock bits exert a considerable influence upon controlled permutation operations. It is possible to easily reduce the probability of P(2) by introducing insignificant changes in expansion box E.

There is also a three-round characteristic available for the SPECTR-128 cipher that corresponds to the difference (ΔL0, ΔR1) passing through three rounds. Unlike the SPECTR-H64 algorithm, the passing of the (ΔL0, ΔR1) difference is not related to the active bit of the left subblock's number i = 32. Each bit makes its contribution, since, due to the use of a G operation that is different from the one used in the SPECTR-H64 cipher, the availability of the active bit in the L subblock changes only one bit at the output of this operation in a predefined manner. The scheme of a three-round characteristic formation is shown in Fig. 6.5.

Click To expand
Figure 6.5: Three-round characteristic formation scheme in the SPECTR-128 cipher

When computing the probability of a three-round characteristic, P(3), you need to be able to tell the difference between the cases of the left subblock's active bit distribution in various orders. Indeed, the probability of obtaining the difference Δ(G)1|i for different i values at the output of the G operation is equal to:

  • p = 2−6 for i = 1, 2, …, 55

  • p = 2−5 for i = 56

  • p = 2−4 for i = 57

  • p = 2−3 for i = 58

  • p = 2−2 for i = 59, 60, 61

  • p = 2−1 for i = 62, 63

  • p = 1 for i = 64

If i is a uniformly distributed random variable, it is easy to derive the average probability of the occurrence of difference Δ(G)1 with one active bit at the output of the G operation, namely,

In the second and third rounds, one active bit is distributed in the left arm. In each of these rounds, the probability of non-generation of the active bit pairs at the outputs of three controlled permutation boxes is 2−9. In addition, in the second round, an active bit in the right subblock is generated because of the G operation. In the third round, the active bit of the right branch is zeroed by the active bit of the difference Δ(G)1|h with a probability of 2−6 (this is the probability of shifting the right subblock's active bit to the specified hth order by the operation P64/192). With respect to these remarks, it easy to have P(3) ≈ 2−32.

The contribution of the three-round characteristic to the probability of the difference (ΔL0, ΔR1) passing through six rounds is P″(6)<(2-32)2 = 2-64. The two-round characteristic contribution is P′(6)≈(1.1·2 -19)3 ≈ 1.3·2-57 ≫ P″(6). Thus, when the security of the SPECTR-128 cipher is determined, a two-round characteristic is more efficient.

It is possible to derive the following probabilities using the value of the probability P(2):

  • P(8)≈(1.1 × 2-19)4 ≈ 1.5×2-76

  • P(10)≈(1.1 × 2-19)5 ≈ 1.7×2-95

  • P(12)≈(1.1 × 2-19)6 ≈ 2-113

If you compare the probabilities of the two-round characteristics of SPECTR-H64 and SPECTR-128, you are liable to notice that the value of P(2) for SPECTR-H64 is higher than the value of P(2) for SPECTR-128, the first one, however, is undistinguishable from a random cipher with the help of differential cryptanalysis, and the second one is distinguishable due to the large size of the input block.

Indeed, for a random 128-bit cipher, the probability of the occurrence of a random output difference is 2−128, whereas for SPECTR-128, the probability P(12) of the (ΔL0, ΔR1) output difference is approximately equal to 2−113. Therefore, with the use of the (ΔL0, ΔR1) difference considered above, it is possible to distinguish the SPECTR-128 cipher from a random one. But you will have to perform an unrealizable number of encryption operation with 128-bit data blocks. For example, for the 10-round variant of the SPECTR-128 cipher, it would be necessary to perform more than 294 encryption operations with 128-bit data blocks.

This cipher can be reinforced either by adding two supplementary encryption rounds, or by optimizing the E expansion box and the G operation. The second variant enables you to reduce the value of P(2) down to a value of 2−25.

Differential cryptanalysis of the SPECTR-H64 and SPECTR-128 ciphers is one of the steps in designing ciphers based on controlled operations. Depending on the differential characteristic values obtained and the peculiarities of difference distribution revealed, this step requires amendments aimed at improving the considered characteristics, after which a differential cryptanalysis should be performed once again.

6.4.1. The Security of the SPECTR-128 Cryptosystem with a Modified Expansion Box

We mentioned in the previous section that the probability of a two-round characteristic of SPECTR-128 considerably depends on the bit distribution of the control data subblock along the elementary switches of the controlled permutation box. Such a distribution for the P′ box is additionally determined by a rotation operation by 21 bits, and for box P″ by 43 bits, as well as by expansion box E.

Leaving the rotation values unchanged, you can reduce the probability of the two round characteristic by modifying the table that describes expansion box E. When such a modification is performed, it is best to follow the criterion according to which, with any value of the control subblock, each bit of a controlled permutation box is only influenced by a arbitrary control bit once.

Below is the table of a modified expansion box E with amendments that reduce the probabilities of events Al, A2, and A3 to zero.

Table 6.8: Bit Distribution at the Output of the Expansion Box (the Numbers of Bits and of the Binary Vector Entering Expansion Box E's Input Are Indicated)
Left part of E (corresponds to input bits with numbers from 1 to 32)
33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 62 | 63 | 34 | 60
50 | 41 | 52 | 53 | 42 | 61 | 56 | 57 | 61 | 39 | 48 | 55 | 45 | 46 | 47 | 49
58 | 59 | 45 | 58 | 62 | 49 | 64 | 63 | 33 | 51 | 52 | 53 | 54 | 55 | 39 | 54
26 | 27 | 28 | 29 | 1 | 19 | 10 | 17 | 18 | 31 | 20 | 21 | 22 | 23 | 24 | 25
18 | 19 | 20 | 21 | 14 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 17
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16
35 | 36 | 37 | 43 | 44 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64
64 | 49 | 50 | 51 | 38 | 39 | 40 | 41 | 42 | 48 | 53 | 45 | 46 | 47 | 52 | 33
57 | 46 | 44 | 60 | 43 | 47 | 48 | 50 | 34 | 35 | 36 | 37 | 59 | 56 | 40 | 51
32 | 11 | 8 | 9 | 22 | 15 | 16 | 30 | 2 | 3 | 4 | 5 | 6 | 7 | 12 | 13
2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 1 | 12 | 13 | 22 | 15 | 16 | 11
17 | 18 | 19 | 20 | 21 | 28 | 23 | 24 | 25 | 26 | 27 | 22 | 29 | 30 | 31 | 32

The last circumstance leads to the fact that other events, which before modification contributed much less to the probability of the two-round characteristic and could be neglected, are now deciding factors. Let's consider these events and their contribution.

Event B. This event includes the following events:

  1. The difference Δ(G)2|i, i+k is formed at the output of the G operation with a probability of p(i,i+k)2.

  2. The difference Δ(P)′2|i, t is formed at the output of box P′ with a probability of p(i,t)3 and the difference Δ(P)″2|i + k,t is formed at the output of box P″ with a probability of p(i+k,t)1 or, the difference Δ(P)′2|i + k,t is formed at the output of box P′ with a probability of p(i+k,t)3 and the difference Δ(P)″2|i,t is formed at the output of box P″ with a probability of p(i,t)1.

  3. A zero difference that appears as a result of Events B1 and B2, as well as after the performance of two XOR operations, passes through the controlled permutation box P−1 with a probability of 2−3.

The probability of Event B2 is equal to p(i,i+k)1,3 = p(i,t)3p(i+k,t)1 + p(i+k,t)3p(i,t)1. On the whole, the contribution of Event B to the probability of the two-round characteristic is P′ ≈ 1.5 ×2−30.

Event C. This event includes the following events:

  1. The difference Δ(G)2|i, i + k is formed at the output of the G operation with a probability of p(i,i+k)2.

  2. The difference Δ(P)′0 is formed at the output of box P′ with a probability of p(i)3 = 2−3.

  3. The difference Δ(P)″2|i +k, t is formed at the output of box P″ with a probability of p(i+k,t)1, or difference Δ(P)″2|i, t is formed with a probability of p(i,t)1.

  4. After two XOR operations are performed, the differences Click To expand are "transformed" by box P−1 into a zero difference with probabilities of p(i,t)4 and p(i+k,t)4, respectively.

Event C includes the occurrence of two active bits with numbers i and t (or i + k and t) at the input of box P−1, and the "annihilation" of this pair of active bits in one of three active elementary P2/1 boxes within box P−1.

Since Event C is "symmetric" to Event B, then P′ = P(C) = P(B) = P″. That is, the contribution of Events B and C to the probability of the two-round characteristic P(2) is the same.

Event D. This event includes the following events:

  1. The difference Δ(G)2|i, i + k is formed at the output of the G operation with a probability of p(i,i+k)2.

  2. The difference Δ(P)″0 is formed at the output of box P″ with a probability of p(i)1 = 2−3.

  3. The difference Δ(P)′2|i + k, t is formed at the output of box P′ with a probability of p(i+k,t)3, or the difference Δ(P)′2|i, t is formed with a probability of p(i,t)3.

  4. After two XOR operations are performed, the differences [image] and

    are "transformed" by box P−1 into a zero difference with probabilities of p(i,t)4 and p(i+k,t)4, respectively.

Event D is analogous to Event C. One feature of Event D is the fact that not only are two controlled permutation boxes with symmetric structure considered, but the active elementary switches positioned symmetrically are as well. The contribution of Event D to the probability P(2), computed assuming that round subkeys are uniformly distributed random variables, is P″′ ≈ 1.1x2−28.

Taking into account the contribution of Events B, C, and D to the probability P(2), the value of the probability P(2) for the two-round characteristic, after expansion box E is modified, looks like this:

Thus, modification of expansion box E enables us to reduce the probability of the two-round characteristic by approximately 28 times. Correspondingly, the security of the modified SPECTR-128 cipher against differential cryptanalysis is now determined by a three-round characteristic, for which such a modification of the E expansion box is not crucial.

That is, using the three-round characteristic probability value P(3) ≈ 2−32 for the source model of the SPECTR-128 cipher, the probability P(12) of difference (ΔL0, ΔR1) passing through all twelve rounds is the following:

The derived value does not exceed the probability value of the specified occurrence of the difference for a random cipher, and so the application of the considered differential characteristics does not allow us to use differential cryptanalysis to decrypt the modified variant of SPECTR-128.

The considered example, which includes the initial and modified version of the SPECTR-128 algorithm, demonstrates a certain step in cipher design based on controlled permutations, where the structure of expansion box E is of crucial importance. The structure of expansion box E is initially selected with respect to a general criterion, after which the probabilities are computed for the most significant differential characteristics. Then, based on the revealed features of the control data subblock bit distribution, a modification of expansion box E is performed, which leads to the reduction of the probabilities of the indicated characteristics, after which differential cryptanalysis should be performed once again.


6.5. Main Differential Characteristics of the DDP-S64 and DDP-S128 Ciphers

The DDP-S64 and DDP-S128 ciphers have a structure of round transformation that is different from that of the SPECTR-H64 and SPECTR-128 cryptosystems. However, due to use of the controlled permutation box PL,e33/32 as a base primitive for all four ciphers, when variants of differential characteristics are considered, it is possible to establish that characteristics with a small number of bits have the greatest probability. The mechanism for forming such characteristics for the first pair of ciphers differs from that of the second pair, which is due to the fact that no G operations with two active bit differences formed at the output are used in DDP-S64 and DDP-S128. These ciphers also differ in the mechanism of passing differences through two rounds, although in both ciphers the most efficient characteristics are connected with the permutation of one of the active bits in the necessary digit after the difference has passed the controlled permutation box.

6.5.1. Analysis of the DDP-S64 Cipher

This cipher has a one-round characteristic with a difference (ΔA0, ΔB1), where ΔA0 and ΔB1 are the left and right subblocks of input difference. This difference passes through one round in the following way (Fig. 6.6). The right subblock that passed through one of the controlled permutation operations is superposed over the left subblock using a modulo 232 addition operation, introducing at least one active bit into it.

Click To expand
Figure 6.6: A one-round characteristic formation scheme in the DDP-S64 cipher

We are interested in the case of the formation of one active bit in the left subblock. Before the round is completed, the left subblock ΔA1 that passed through operation P(A,0)32/32 participates in the transformation of the right subblock using a modulo 232 subtraction operation. Thanks to the controlled permutation operation over both subblocks, the active bits turn out to have the same number with a probability of 2−5. As a result, after the subtraction operation is completed, the active bit in the right subblock is zeroed with an aver-aged probability close to 0.5. The round is completed with the permutation of subblocks ΔA1 and ΔB1 that form an output difference that coincides with the input one.

In this mechanism, one of the active bits is subjected to arithmetic operations four times. The active bit passes through each of these operations without forming a carry bit with a probability ≈ 2−1. When four controlled permutation operations are performed, the control input of the corresponding controlled permutation box is fed with one active bit. The probability that no active bits are generated during the performance of one controlled permutation operation is approximately equal to 2−3 (the fact that a non-zero difference passes through the controlled permutation box is considered). Also, taking into account the probabilities of all these events related to passing the difference through one round, we compute the probability of the one-round characteristic:

The two-round characteristic (ΔA1, ΔB1) is more efficient, and this should be remembered when the number of encryption rounds is selected in order to obtain a pseudorandom transformation. The scheme of this difference passing through two rounds is shown in Fig. 6.7.

Click To expand
Figure 6.7: The scheme for forming a two-round characteristic in the DDP-S64 cipher

The algorithm of this difference passing through two rounds goes like this.

  1. An active bit of the left subblock generates an active bit in the right one in the end of the first round when a modulo 232 subtraction operation is performed.

  2. Then the difference (ΔA1, ΔB1) enters the input of the second round.

  3. At the start of the second round, the active bit of the left subblock is zeroed after the modulo 232 addition operation is performed.

  4. A zero difference is distributed around the left branch of the second round.

In the first round, the active bit is subjected to three arithmetic operations, and influences the performance of two controlled permutation operations, which determines the formation of the probability of the difference (ΔA1, ΔB1) at the output of the first round as equal to P′≈(2−1)3·(2−3)2 = 2−9. In the second round, three arithmetic operations are performed with the participation of the active bits. Besides which, two controlled permutation operations are performed with one active bit available at the control input. This determines the probability P″ of the formation of difference (ΔA1, ΔB0) at the output of the second round:

Thus, the probability of the two-round characteristic is equal to

The contribution of the one-round characteristic may be neglected, since it is equal to (P(1))2 ≈ 2−42 <<2−3. The number of rounds r for which the DDP-S64 cipher is indistinguishable from a random transformation can be determined during a differential analysis from the following relationship: 2-64≤Pr/2(2) ≈ 2-23r/2, from which it is easy to obtain that r ≥ 6. In order to have a certain margin of security, it is possible to add another two rounds and recommend values of r ≥ 8.

6.5.2. Analysis of the DDP-S128 Cipher

For this cipher, the two-round characteristic with the difference (ΔA1, ΔB0 ΔC0, ΔD1) is the most efficient. This difference passes through two rounds according to Fig. 6.8.

Click To expand
Figure 6.8: The two-round characteristic formation mechanism in the DDP-S128 cipher

With a probability equal to 1, the differences ΔA1 and ΔD1 pass through the first round and, after the subblocks are permuted, turn to the differences ΔB1 and ΔC1, respectively. Thus, the input difference of the first round, (ΔA1, ΔB0 ΔC0, ΔD1), with a probability equal to 1 is transformed into the input difference (ΔA0, ΔB1 ΔC1, ΔD0) of the second round. In the second round, two internal subblocks with one active bit are summed up twice by module 2−32 at different stages in the transformation of subblocks B and C.

When each addition operation is performed, an output difference with a probability of 2−6 will not contain active bits, since with a probability of 2−5, the active bits in different subblocks turn out to have the same number, and no carry bit is generated with a probability of 2−1. In this case, XOR operations performed over subblocks A and D do not add active bits in the differences ΔA and ΔD.

In addition, each of the active bits participates in the performance of three different controlled permutation operations. In other words, you must consider six independent events, each consisting in the fact that no pair of active bits with an approximate probability of 2−3 is generated in the corresponding controlled permutation boxes. It is also necessary to take into account the fact that each of two operations of summing the internal sub boxes with round subkeys with a probability close to 2−1 generates no additional active bit (due to the carry bit).

Taking into account all these elementary events related to the mechanism of two-round characteristic formation, we can derive the following value for its probability:

Determine the number of rounds for which the DDP-S128 cipher is indistinguishable from a random transformation during differential analysis. To do this, use the relationship 2−128 ≥ Pr/2(2) ≈ 2−16r, from which it follows that r ≥ 8.

Summing up the results of the differential cryptanalysis of several ciphers based on controlled permutation, the following common property becomes evident. An active bit entering the input of the controlled permutation operation does not contribute to the avalanche effect. The property of the avalanche effect being introduced by a controlled permutation operation is related to the availability of active bits in the subblocks used for forming control vectors. At the same time, if you consider not the bits of the differences, but rather the data bits, it is easy to see that each bit at the input of controlled permutation box influences all the input bits of this operation.


6.6. Estimating the Security of the COBRA-F64a and COBRA-F64b Ciphers

As in all previously considered ciphers, in COBRA-F64a and COBRA-F64b, the active bits make the biggest contribution to the avalanche effect when they appear at the control input of the controlled permutation box. This leads to the phenomenon that differential characteristics with a small number of active bits have the greatest probability. It is necessary to find such characteristics when intermediary differences also have the minimal number of active bits in their formation schemes. Indeed, the availability of one active bit at the control input of a controlled permutation box gives a multiplier of 2−3 in an expression for the probability, while the availability of one active bit at the input of the controlled permutation box gives a multiplier of 2−5 when an event related to its transition into the specified digit is expected (this is needed to zero a pair of active bits when addition operations are performed, otherwise the number of active bits will be increased avalanche-like). You can build characteristics for the COBRA-F64a and COBRA-F64b algorithms in which all intermediary differences contain no more than one active bit in the left and right subblock. Obviously, such characteristics possess a maximum probability.

The formation schemes for the differential characteristics of the COBRA-F64a and COBRA-F64b ciphers are shown in Fig. 6.9. In both ciphers, the most efficient characteristics are related to the difference (ΔL0, ΔR1) passing through two or three rounds. In one round of the COBRA-F64a cipher, the active bit of difference is carried once from the right branch into the left one when the XOR operation is performed. Therefore, in order to return to the initial difference in the COBRA-F64a cryptoscheme, you must perform three rounds, where the second round is related to the event of the right and left subblocks' active bits entering into the same digit.

Click To expand
Figure 6.9: A three-round characteristic formation scheme in the COBRA-F64a cipher (a) and a two-round characteristic in COBRA-F64b (b)

The feature distinguishing the COBRA-F64b cipher from COBRA-F64a is that in one round, the active bit of difference ΔR1 is carried from the right branch into the left one twice, which provides for the retention of the difference (ΔL0, ΔR1) at the output of the first round. A permutation, however, takes place after the first round, transforming difference (ΔL0, ΔR1) into difference (ΔL1, ΔR0), and so the second round is included in the differential characteristic formation scheme, where with a probability of 2−3, difference ΔL1 passes through the left arm without generating additional active bits in the right and left subblocks. The permutation of subblocks after the second round leads to the formation of the initial difference (ΔL0, ΔR1).

Considering the probabilities of the events related to the three-round characteristic formation for COBRA-F64a for the input difference (ΔL0, ΔR1), it is easy to say that the probability of the formation of difference (ΔL1, ΔR1) at the output of the second round is equal to

This probability is determined by the event of the active bit passing through a subtraction operation in the right branch, generation of an active bit in the left subblock after an XOR operation, and the performance of one controlled permutation operation with the active bit available at the control input. The difference (ΔL1, ΔR1) after the second round (and permutation operation) is carried into the difference (ΔL1, ΔR0), with a probability of

After the third round is performed, including modulo 232 addition and two controlled permutation operations, the difference (ΔL1, ΔR0) is transformed into the difference (ΔL0, ΔR1), with a probability of

Now for the three-round characteristic's probability, we have P(3) =2−21. Using this value, it is possible to establish that, with a round number r ≥ 10, the COBRA-F64a cipher is indistinguishable from a random transformation with differential cryptanalysis using the above characteristic. Thus, the 16-round COBRA-F64a algorithm provides a sufficient security margin against differential analysis. Note that a three-round characteristic for this cryptosystem may also use (ΔL1, ΔR1) and (ΔL1, ΔR0) as input differences. These variants of the three-round characteristic have the same probability as the characteristic considered above. The use of three variants, however, is not fully equivalent. For example, with a round number not divisible by 3, the difference passing through the last or the last and next to last rounds correspond to it passing through an incomplete scheme of differential characteristic formation. Depending on the input difference variant, from the latter is excluded one or two of the last rounds, characterized by different probability values. If one round is excluded, it may relate to a probability of 2−7, 2−10, or 2−4. If two rounds are excluded, then pairs corresponding to probabilities of p1 = 2−7·2−10, p2 = 2−10·2−4 or p3 = 2−4·2−7 can be excluded.

These examples demonstrate that, for different variants, the ratio of the resultant probability values for the whole cipher may be 26. This circumstance is worth noting when the minimal number of rounds is selected with the purpose of accelerating the encryption procedure.

From the COBRA-F64b two-round characteristic formation scheme where the input difference (ΔL0, ΔR1) is used, it is easy to see that probability of the formation of the difference (ΔL1, ΔR0) at the second round input is equal to:

This probability is determined by the active bit passing through the subtraction operation of the first round and the generation of one active bit in the left branch (co-factor ≈ 2−1), the coincidence of the order numbers corresponding to the active bits of the right and left subblocks (co-factor 2−5), and the active bits passing through the addition operation in the left branch leading to the zeroing of the active bit in the left subblock (co-factor 2−1).

When the difference (ΔL1, ΔR0) passes through the second round (including the swapping data subblocks), it is transformed into the difference (ΔL0, ΔR1), with a probability of P″ = P{(ΔL1, ΔR0) → (ΔL0, ΔR1)} = 2-5. The probability of the two-round characteristic is equal to:

Another variant of the two-round characteristic is connected with the difference (ΔL1, ΔR0) passing through two rounds. In reality, both variants employ the same mechanisms within separate rounds. A certain discrepancy in the selection of the input difference matters for the case of an odd number of encryption rounds. The ratio of the probability values obtained for an odd number of encryption rounds, depending on the selection of one of these two difference variants, is 22. A similar remark can also be made for the SPECTR-H64 and SPECTR-128 ciphers, as well as others.

For some ciphers, the probability of viewing a certain expected difference at the output of an encryption algorithm can be enhanced by selecting a certain input difference that differs from those corresponding to the most efficient characteristics. Enhancing the probability is done by forced specification of the necessary difference with active bits in the specified digits when the first round is performed. For example, this can be implemented in the case of the COBRA-F64b cipher, where the input difference (ΔL1|32, ΔR1|32) at the output of the first round is transformed into the difference (ΔL1, ΔR0), with a probability equal to 1. Its further passing is considered in accordance with a two-round characteristic.

It is easy to derive the following formulas for the probability of the occurrence of the difference (ΔL1, ΔR0) at the output of the algorithm:

  • P (r) = P{(ΔL1|32, ΔR1|32) → (ΔL1, ΔR0)} = 2-6r+5 for an even r

  • P (r) = P{(ΔL1|32, ΔR1|32) → (ΔL1, ΔR0)} = 2-6(r-1) for an odd r

From the condition P(r) ≥ 2−64, the minimal recommended number of encryption rounds for the COBRA-F64b algorithm is: rmin = 12. If r ≥ rmin, the transformation specified by this algorithm is indistinguishable from a random one.

Below is the summary table of the differential properties of the considered algorithms (Table 6.9).

Table 6.9: Comparative Data for Differential Characteristics of Block Ciphers Based on Controlled Operations
Cipher | r | Characteristic |  | P(r)[**]
 |  | Difference | Probability |
SPECTR-H64 | 12 | (ΔL0, ΔR1) | P(2) ≅ 1.5.2−15 | 2−87
SPECTR-H64 | 12 | (ΔL0, ΔR1) | P(3) ≅ 2−28 | 2−112
SPECTR-128 | 12 | (ΔL0, ΔR1) | P(2) ≅ 1.1.2−19 | 2−113
SPECTR-128[*] | 12 | (ΔL0, ΔR1) | P(3) ≅ 2−32 | 2−128
SPECTR-128[*] | 12 | (ΔL0, ΔR1) | P(2) ≅ 2−27 | 2−162
COBRA-F64a | 16 | (ΔL1, ΔR1) | p(3) = 2−21 | < 2−105
COBRA-F64b | 20 | (ΔL0, ΔR1) | P(2) = 2−12 | 2−120
DDP-S64 | 10 | (ΔA1, ΔB0) | P(2) ≅ 2−23 | 2−115
DDP-S128 | 12 | (ΔA1, ΔB0, ΔC0, ΔD1) | P(2) ≅ 2−32 | 2−192
[**]Contribution of the characteristic to the probability of the difference passing through r rounds. [*]Modified variant.

The differential cryptanalysis performed is part of the complex investigations carried out during cipher design with the purpose of optimizing certain primitives, as well as substantiating its cryptographic security.

In particular, it was demonstrated that the E control bits distribution table is critical. It is compiled in several steps:

  1. First, the general criteria for the table's compilation are formulated.

  2. The differential characteristics are computed, and as a result, the numbers of the most contributing bits are determined.

  3. The table is modified by changing the position of the appearing bits.

  4. Differential cryptanalysis is repeated.

  5. Experiments are performed in order to determine the probabilities of differential characteristics that correspond to one or more encryption rounds.

  6. The theoretical results are compared with the experimental data.

  7. If theory and experiment agree, then a conclusion is drawn to the effect that the main mechanisms of difference formation are taken into account in the theoretical model, and the resulting estimates of cryptanalysis are trustworthy.

Thus, to complete the differential analysis of the considered ciphers, the last three items should be performed. It may turn out, however, that the experimental probability values considerably exceed the theoretical values. This would mean that certain mechanisms that make a considerable contribution are not taken into account in the characteristic formation models.

There is no doubt that an enterprising reader will be able to complete on his or her own the differential analysis cycle and find the necessary refinements of the above models used to estimate the security of the SPECTR-H64, SPECTR-128, COBRA-F64a, COBRA-F64, DDP-S64, and DDP-S128 ciphers.


6.7. Attacks Based on Hardware Errors

When various encryption algorithms are compared in order to select a cryptosystem for a particular application, it is interesting to consider the attacks that provide the cryptanalyst with more options than just pure knowledge of the encryption algorithm and a large number of ciphertext and plaintext pairs corresponding to each other, including specially selected texts.

One type of attack that provides the cryptanalyst with additional options is based on the encryption device (or microprocessor, in the case of program ciphers) generating errors caused by some external action. This type of assault features a high efficiency against many known and used cryptosystems.

The type of attacks related to the expectation or purposeful generation of hardware errors of an encryption device is rather specific, but, due to the mass use of intelligent electronic cards, their study has taken on important practical significance. It is evident that the expectation of errors differs from their generation only in the fact that spontaneous errors are extremely rare, and those that occur during the cryptographic transformation of the specified input blocks are even more rare. We will dwell on the case in which the cryptanalyst is able to purposefully generate random errors in the encryption device during the transformation of the selected data blocks.

Thus, we will consider a model in which the cryptanalyst is provided with the additional option of externally acting on the encryption device with the entered key in order to cause hardware faults, and compare the resulting output data with those that we obtained without faults. The cryptanalyst may feed the input specially selected texts. It is assumed that access to the memory area containing the key parameters and the encryption algorithm can not be realized without their being erased. This assumption is based on the fact that modern technology enables us to produce microelectronic devices with a secure memory. Thus, the cryptanalyst may have an encryption device with the entered secret key, but can not decrypt it. Neither can he or she make intentional amendments to the encryption algorithm.

The intensity level of the external action (e.g., heating, high frequency, or ionizing radiation) the cryptanalyst uses with the encryption device is such that it causes one or more individual errors in the microprocessor registers during the encryption of one data block. It is impossible to specify the place where the error will be generated beforehand, but after many experiments, errors of specified type will occur in some of them, e.g., the inversion of one of the register's binary digits after the ith encryption round is completed and before the (i + 1)th one. Therefore, an expected error is characterized by both spatial and physical localization. For many known ciphers, there is the option of recognizing the experiments where the expected event occurred, which consists of trying input blocks with a special structure and analyzing the differences in the output block structure caused by errors. The computational complexity of this recognition may vary within a wide range, and depends on the specific encryption mechanism. In some ciphers, many errors are recognized trivially.

Hardare fault during encrypting may be divided into two main types:

  • Data area errors

  • Command area errors

Actually, errors of the second type may lead to the formation of the encryption key at the encryption device output, but the probability of events occurring in which the executable code after a random modification corresponds to an application useful for the cryptanalyst is very low. We will consider cases of error generation in the data area. (The results of the experiments in which error generation of the second type took place may be neglected.) For example, random errors in the 8-bit areas of registers containing values of 32-bit subblocks being transformed may be used, and the errors are expected during a certain stage of the encryption procedure (usually during the execution of one or more commands of the microprocessor).

Let's assume that experiments have helped you choose an external action intensity in which, on average, one error is generated for the full encryption time of one block. Make an approximate estimate of the average number of experiments necessary to generate one expected error, i.e., the one occurring in the specified register containing a data subblock, in the specified transformation stage. Let's also assume that the probability of error generation is proportional to the time of exposure of the corresponding registers that are in a state favorable for error occurrence and that have the number of binary digits within the range of which the error is expected. With such an assumption, it is easy to estimate the probability of the expected error generation p within one experiment, i.e., during the encryption of one block —

where pd is the probability of error generation in the data area during one data block encryption procedure, R is the number of transformation rounds, and Z is the number of elementary transformation steps within one round. Since an error is expected during the time it takes to perform an encryption step, then the probability of the occurrence of the necessary error is inversely proportional to the total number of encryption steps. (That is why, for 512-bit ciphers, the value of p is considerably lower than with 64- and 128-bit ciphers.) The cryptanalyst can use pulse radiation synchronized with the encryption procedure. In this case, it is possible to use a higher radiation intensity and a length of pulse excitation equal to the time for which the transformed data subblocks are in a state favorable to the cryptanalyst.

When impulse excitation and synchronization with the encryption process are used, the indicated probabilities may be enhanced significantly. The expected labor expenditure employed to form a sufficient number of necessary errors does not seem high in any of the cases. There is no basic difference among cases in which impulse and stationary action are used upon the encryption device. The main thing is that the possibility of the purposeful generation of random hardware errors in the data registers is real. From now on, we will assume that stationary action is used on the encryption device.

For a software implementation of a cipher as a set of standard cycle repetitions, you must use the encryption rounds counter. This requires taking into account the possibility of the generation of an error in the register containing the current number of performed cycles. To prevent the completion of encryption after a small number of encryption rounds is performed (e.g., one round), the condition of exiting from the cycle should be properly arranged for. The most reliable method of preventing the pre-term completion of the encryption procedure is the repetition of round encryption R times, even if this increases the size of the encryption application. Let's consider the security of some fast ciphers against this type of assault.

6.7.1. Cryptanalysis of the RC5 Cipher

The RC5 [79] cipher provides a high rate of data encryption, and if 12 or more rounds are used, is secure against known methods of cryptanalysis, on the condition that the integrity of the encryption algorithm is provided for. However, when the cryptanalyst has the option of forming random hardware errors, the RC5 cryptosystem turns out to be sensitive. Let's take a look at the security of the RC5 cipher against this type of assault.

Provided in the RC5 cipher is the option of selecting the input block length (2n) and a different number of encryption rounds (R). There are precomputations used in this cryptosystem that provide for the formation of an extended key by the secret key as a series of n-bit subkeys S0, S1, S2, …, S2r+1.

The RC5 cipher is described by the following pseudocode:

  • A: = A + S0 (mod 2n),

  • B: = B + S1 (mod 2n),

  • for i = 1 to R do

Click To expand
Click To expand

where A and B are the left and the right n-bit data subblocks, and "W<b<" indicates a cycle shift to the left of word W by b bits. Assume that an external action's intensity is experimentally selected, which generates one error on average for the full time of one data block's encryption. After a comparatively small number of experiments, it is possible to generate an error in the register containing subblock A after performing the transformation using Formula (6.1) at i = R. The fact that an error occurred on this step is easily recognized by the block structure of the ciphertext obtained from the given input block without entering errors (C = A||B) and with entering errors

It is very easy to derive the following relationship from (6.2):

Click To expand

In (6.3), the only unknown quantity is S2R+1. With a high probability, it is possible to derive A mod 25 = Ã mod 25. In this case, expression (6.3) is transformed to have the following appearance:

Click To expand

It is easy to compute the part of the subkey S2R+1 using the last relationship. You can determine the full value of the S2R+1 subkey by forming various errors. Then, by forming the errors in subblock B, it is possible to compute the S2R subkey after the transformations specified by Formula (6.2) and corresponding to round i = R − 1 are performed. The formation of these errors is easily recognized with the known subkey S2R+1, which provides the cryptanalyst with the option of restoring the value of subblock B after the (R − 1)th round. If you act sequentially, this is a very good method for easily computing subkeys S2R−1, S2R−2, …, So. For [image] , the labor expenditure for the computation of all subkeys does not exceed 108 operations. Also of interest is the fact that an attack based on the generation of hardware errors is rather efficient for the decryption of flexible ciphers in which an encryption algorithm is formed depending on the secret key — i.e., it is unknown to the cryptanalyst.

6.7.2. Cryptanalysis of Flexible Ciphers

A flexible R-round 64-bit algorithm is described in [62], where, depending on the encryption key, about 1016R non-equivalent modifications of the cryptalgorithm are formed. Each potentially implemented modification of the cryptalgorithm uses the selection of a data-dependent subkey. In order to reflect this fact, we will call this algorithm DDSS-1. This cipher includes precomputations used to transform the initial secret key into the expanded encryption key, represented as a set of 32-bit subkeys Qi, where i = 0, 1, …, 255. Fig. 6.10 shows the structure of one encryption round in the DDSS-1 cryptosystem.

Click To expand
Figure 6.10: One round in the DDSS-1 cipher

The following designations are used in the illustration:

  • ">ci>" — the operation of a cycle shift to the right by ci bits

  • "*j" — one of three possible operations:

    • XOR

    • Modulo 232 addition

    • Modulo 232 subtraction

In the precomputations stage, depending on the secret key in various encryption rounds, the independent values ci and "*j" are specified in identical positions, which creates a large number of various modifications of the cryptalgorithm. The abbreviation SS denotes the subkey selection procedure. The output of the SS function is the value of the 32-bit subkey that is currently selected.

Designate the intermediate values of the data subblocks being transformed as Xi, Yj. Assume that an external action on the encryption device is selected where, on average, a single error is generated during the time of one data block encryption. To obtain an error in subblocks Xi and Yj at the specified steps of transformation, the encryption of a certain number of input blocks will be needed. Some of these blocks may be the same. First, encrypt plaintext P1 and obtain ciphertext C10. Then, providing that there is an external action forming single errors, perform a multiple encryption of block P1. In these experiments, ciphertexts will be recorded in which, with permanent values of subblocks (x73, x72, x71), the value in subblock x74 is erroneous. Designate as C11, C12, …, C1n the ciphertexts corresponding to the first plaintext P1 and the occurrence of a single error only in subblock x74. Now, subkey differences can be computed

Click To expand

where x74 is a subblock without errors, [image] are subblocks containing errors (subblocks [image] are part of ciphertexts C11, C12, …, C1n, subblock x74 is a part of C10), and [image] is a group operation that is the reverse of operation *8).

According to our attack scheme, all the x74 and [image] subblocks correspond to the same plaintext P1.

Designate differences where i = x74 and [image] as Δij. If i is a fixed value, then the total number of such differences is equal to n = 255. There is no need to expect the occurrence of all possible values of j for a given i. In order to determine all the possible subkey differences, you can use other plaintexts P2, P3, …, Pn, and observe the ciphertexts C20, C30, …, Cn0 that correspond to them. Since the encryption algorithm specifies pseudo-random values of x74 in these ciphertexts, then we should take on average [image] plaintexts in order to obtain all the possible values (there are 256 of them) for subblock x74. Now designate the plaintexts corresponding to various values of x74 as P1, P2, …, P256. Encrypt each plaintext P1, P2, …, P256 under the conditions of the generation of n hardware errors, and obtain the sets of ciphertexts C11, C12, …, Cln, where l = 2, 3, …,256, that contain errors only in subblock x74.

The computed differences [image] that correspond to plaintexts P2, P3, …, P256 will contain arbitrary pairs of index values. This enables you to use a group property of operation "*8" and compute 256 various differences corresponding to the same value of index i. For this purpose, use the formula

Click To expand

It is easy to see that with full set of values of subblock x74, Relationship (6.6) enables us to find an i0 that provides a full set of differences δi0j, j = 0, 1, 2, …, 255. This gives us the option of computing all subkeys by trying the values of the Qi0 subkey. There are only 232 variants, which can be quickly tried. However, directly trying variants by known values of the plaintext and ciphertext is impeded by the fact that the "∗1" … "∗8" and "<c1<" …"<c12<" operations are unknown, and it is necessary to find them first. This can be done in parts, using the fact that, while guessing the correct combination of operations, the differences of the computed δij subkey will depend only on the indices (i,j), and not on the incoming text. There are 93 various combinations of operations "*8" and ">c12>" and so it is easy to find the correct values of both operations that meet the above condition.

After operations "*8" and ">c12>" are determined, we can move on to determining the extended key. Select a value Qi0. This specifies all subkeys (Q0, Q1, … Q255), since the differences δi0j, j = 0, 1, 2, …, 255 are already determined. When the extended key is computed, and the operations "*8" and ">c12>" are known, it is possible to compute Y4 (as well as subblock y44) for any given plaintext P, and determine subkey Qy44. Then, encrypt plaintext P for conditions of hardware error generation, and observe ciphertext [image] . If the Qi0 subkey has been guessed correctly, we will find a single error in subblock x44, with a rather high probability. If the current value Qi0 is false, then there is a low probability of a single error occurrence in subblock Y4, since the latter will be computed using a false value of subkey Qx47. This fact may be used as a criterion for selecting the correct Qi0 value.

Knowing the true extended key, it is easy to determine the rest of the unknown operations. To determine operation "*7", generate an error in subblock y44 under the condition of error-free (y43, y42, y41). Such an event can be selected, since subblock Y4 can be computed with a known Y6. If "*7" is guessed correctly, then the value X6 computed with a known X7 and Qy44 is the same both with error availability, and the absence of it for the same plaintext P. This is the criterion for recognizing the true "*7" operation independently of the value of the operations in the previous steps of encryption. Using an analogous method, we can sequentially determine operations "*6", "*5", etc., until all operations in all rounds have been determined (for a multi-round DDSS-1 cryptoscheme, the attack described above is connected with the last round). Note that we do not need to perform an encryption operation with simultaneous error generation, since the required cases can already be found in the available set of experimental data. These are cases that were unnecessary for the previous steps of assault. Now they can be used, since we have the option of computing previous values of subblocks Xi and Yj. It is easily noticed that the most difficult computational step of the attack is finding the right value of the Qi0 subkey, which requires, on average, consideration of 231 variants.

This step requires the implementation of about ≈232l0 operations, where l0 is the number of attempts necessary to obtain an error in the required place. Considerably enhancing the security (e.g., up to 1030 times) against this type of assault by increasing the value l0, means a special implementation of the DDSS-1 algorithm. Therefore, this cipher can not be treated as secure against an assault based on the generation of hardware errors.

6.7.3. Security of the GOST 28147-89 Algorithm

The GOST 28147-89 Russian encryption standard is an example of a widely used block cryptosystem with its security determined by both key secrecy and substitution tables. In its structure, this cryptosystem is similar to DES, and uses a 256-bit secret key and 4×4 secret substitution boxes. The full transformation includes 32 encryption rounds. An assault on the GOST 28147-89 algorithm using hardware error generation presumes the computation of 32-bit keys in every round, and that of secret substitution tables in the last round. The total number of substitution table variants is (16!)8, but they are easily computed, despite the large number of them. The weakness of this algorithm against assaults based on hardware errors lies in using an operation of addition by modulo 232, as well as in the small size of the substitution boxes. This makes an assault based on using the avalanche effect stipulated by a carry bit rather efficient. To perform such an assault, you just need to have two encrypted messages (one with errors, and the other without) worked out from the same initial message with a size of about 105 bytes. The initial message may be unknown to the violator. The work effort for such an assault does not exceed 1010 operations.

6.7.4. Cipher Security Based on Pseudo-Random Subkey Selection

The option of generating random errors enables the violator to make use of the following method. Instead of studying complicated encryption procedures with many unknown subkeys, the difference in the transformation results of some unknown intermediary subblock, obtained both before and after the error was introduced, is studied. This error is introduced into another data subblock, influencing the transformation procedure of the first one. Comparing the transformation results before and after the error was introduced enables the violator to create the necessary statistics which he or she can use to identify all unknown transformation parameters of the selected step of encryption. Since the number of various values of unknown parameters in separate transformation steps is rather small, they can be computed by simply trial and error, and this can be done both for numerical values of subkeys and in order to determine unknown operations and procedures.

In this scheme, cryptanalysis starts from the last encryption step. The errors introduced before the second to last and the last encryption steps were performed are dispersed in great degree by the time the encryption is completed, so they can not be directly used to determine the key parameters corresponding to these steps. Taking this circumstance into account, it is possible to offer an easy method of reinforcing the encryption algorithm against the considered types of assault, which consists of using additional transformation algorithms in the last step, e.g., substitution operations on large subblocks (8, 16, or 32 bit) performed using secret tables (i.e., by those formed at the precomputations step, depending on the secret key).

The examples of the cryptanalysis of the RC5, DDSS-1, and GOST ciphers show that the use of secret substitution tables, key-dependent and data-dependent operations, can not in itself provide high security against an attack based on the generation of random hardware errors. To provide high security against such an attack, you must use algorithms with a special transformation structure. Taking into account the peculiarities of such an assault, we can assume that the 512-byte algorithms described in Section 2.4.4 that use a more efficient mechanism of the data-dependent subkey selection has a high security against assaults based on random hardware error generation. This is connected with the following features of the transformation mechanism:

  • The indices of the selected subkeys are not specified directly by the data subblocks being transformed.

  • The subkeys are not directly used during the transformation of the data subblocks, but serve only to modify accumulating variables.

  • Non-deterministic 512-byte algorithms do not allow you to perform computation of the components of individual unknown operations used in one encryption round.

Therefore, high security against assaults based on hardware errors is obtained by using a special structure of the round transformation function, and not due to the use of additional encryption rounds. One of the methods for providing security against assaults based on hardware error generation is the use of probabilistic encryption, but this leads to an increase in the size of the encrypted data. Using algorithms that are themselves secure against assaults based on error generation is preferable.


Conclusion

This book does not aspire to be an exhaustive account of modern cryptography, which is an extremely diverse and complicated division of contemporary applied mathematics. As our object, we the authors had in mind an understandable statement of the general problems and methods of cryptography, many aspects of which were set forth in the concept of controlled cryptographic transformations that we developed. The book contains the theoretical background on this concept, which is the basis for new methods of synthesizing fast block ciphers. We think that the results we obtained are some of the most promising trends in open investigations in the area of cryptography being currently carried out.

The use of cryptographic transformations depending on transformed data is of great theoretical and practical significance. This significance lies in the substantiation of a new class of cryptographic primitives, and the possibility of expanding and improving the general principles for building iterative schemes of block algorithms. Another theoretically important circumstance is that the mathematical properties of prima facie complex cryptographic primitives related to the system of bit transformations can be rather easily and efficiently determined analytically.

Practical knowledge of the concept of controlled transformations lies in the possibility of creating fast ciphers that are maximally adapted to hardware implementation as custom-designed and programmable logical integrated circuits (crypto-chips). In some cases, these block ciphers also allow for a fast software implementation.

The high efficiency of block ciphers hardware implementation based on a controlled transformation and the variety of tasks solved using bit permutations make the issue of implementing a new controlled permutation command into the standard instructions of a universal processor urgent. As for cryptography, the appearance of such a command will lead to a leap in the efficiency of contemporary program ciphers and hash functions that meet the high requirements of cryptographic security.

The study of the concept of controlled transformations also bears an important methodical significance, since the methods of analyzing and synthesizing new cryptographic primitives illustrate the application of a special mathematical mechanism for investigating the cryptographic properties related to the principles of diffusion and confusion of bit information in block ciphers.

Synthesized block ciphers based on controlled transformations can be used as educational examples for computation of both differential and linear characteristics of not only separate cipher elements, but a whole cryptoscheme as well.

Thus, this book should interest a wide selection of readers - mathematicians performing investigations in the area of one-key cryptography, those working with cryptography in practice, teachers, and students.

We the authors are well aware that this is the first attempt to describe a cryptography trend that is currently being developed, and therefore, the presentation of the material may seem far from optimal and might require improvement. We do not doubt that in the near future, new results in the development of this approach to new block cipher building will be obtained, which will require expansion on this information in subsequent publications, in which we hope to amend all the inaccuracies and misprints of this book.


Glossary

A–B

Adversary
someone or something (special software, an equipped group of specialists, or one person) trying to transform a ciphertext into plaintext without knowing the key, or trying to compute the key using known initial and encrypted texts. Synonyms are the terms "assailant", "violator", and cryptanalyst.
Authentication
the procedure of identifying the user (network subscriber, sender) of an application, device, or data (information, received message, key). A particular variant of authentication is establishing a message's affiliation to a certain author.
Avalanche effect
a property of the distribution of the influence of one input bit upon many output bits (error propagation property).
Blind signature
a protocol of digital signature formation enabling you to form the correct digital signature corresponding to a digital message received by the signing party in encrypted form (i.e., a unavailable to the signing party).
Block cipher
a cipher with input texts that are blocks of fixed size.


C-D

Team LiB

C–D

Checksum algorithm
a computational algorithm of a binary vector of a relatively small size, depending on each bit of a message of arbitrary length. The most important type of checksum algorithms are hash functions.
Cipher (cryptosystem)
a set of algorithms used in encryption and decryption.
Cipher (cryptosystem, cryptalgorithm) decryption
finding a way of solving a cryptanalysis task within a reasonable period of time using contemporary means of computation. A synonym is "cipher cracking."
Cipher with a public key (two-key cipher)
a two-key cryptosystem. Synonyms are the terms "cipher (cryptosystem) with a public encryption" and "asymmetric cryptosystem."
Controlled operations
operations described as a set of simpler operations selected depending on the value of a control code.
Cryptanalysis
a process (algorithm) of obtaining an initial text from an encrypted one without knowing the key, or the process of computing the key from the initial and encrypted texts. Cryptanalysis is performed by an attacker with the purpose of gaining unauthorized access, or by the developer with the purpose of estimating a cipher's security.
Cryptographic primitive
in the wide sense, this is an operation or procedure used as a cipher element. In the narrow sense, these are operations and procedures that determine the required properties of a cryptosystem (security, the option of encryption and decryption using various keys, etc.).
Cryptographic protocol
a protocol providing for the interaction of two or more parties using cryptographic algorithms.
Cryptographic security (cipher security)
the ability of a cryptosystem to withstand various attacks. It is expressed numerically in certain types of operations that must be performed in order to solve a cryptanalysis task. The type of attack against the cryptosystem — i.e., the initial data for cryptanalysis — is indicated. If no initial data is indicated, then security against the best known cryptanalysis algorithm is implied (for an attack based on specially chosen texts).
Cryptographic transformation
a special data transformation procedure used to solve one of the following cryptographic tasks: encrypting data, forming a digital signature, or computing special cryptographic checksums and a message integrity detection code.
Cryptosystem with a secret key
a traditional cryptosystem using a secret key known to more than one user.
Decryption
a process of recovering the plaintext using the ciphertext and a known key. (Note that sometimes the term "deciphering" is used instead of "decryption").
Digital signature
an electronic digital signature.


E-G

Team LiB

E–G

Electronic digital signature
additional information corresponding to the given electronic document (message) that can be formed only by the owner of a secret key, which, using a special algorithm, enables you to establish the correspondence of the signature of the signing person to the secret key. The digital signature is also a cryptographic system (a set of algorithms and rules) that enables you to sign digital messages and check the correctness of the digital signatures formed.
Enciphering
a process of data transformation that uses additional information governing this process, called a "key."
Encryption
a process of data transformation with the purpose of protecting it against unauthorized access. Encryption transforms an initial plaintext into a ciphertext (or a cryptogram). The ciphertext is sometimes called an encrypted text. Encryption is the process of protective data transformation by hiding its meaning. Encryption security (or the security level) is determined by the fact that one or more secret parameters are used during encryption that are supposed to be known only to certain users.
Encryption device
an electronic device or an application implementing encryption algorithms.
Frontal attack (brute force attack)
cryptanalysis by exhaustively trying all possible keys, i.e., the key trial-and-error method. For cryptosystems with a finite key, this method is universal, i.e., it is acceptable for any cipher of such type. However, the probability of this attack succeeding is very small. To create a low probability for the success of such an attack for symmetric cryptoschemes, keys of no less than 80 bits should be used. Nowadays, it is assumed that a guaranteed security against a frontal attack is provided by equi-probably generated random keys with a size of 128 bits.
Flexible cipher
a cipher described as a set of cryptalgorithms selected depending on the secret key.


H-J

Team LiB

H–J

Handshake protocol
a protocol enabling you to perform a mutual authenticity check without revealing the secret held by two remote parties.
Hardware cipher
a cipher aimed at implementation as an electronic device.
Hash function
a cryptographic function (procedure, algorithm) whose arguments are random messages (texts, documents) represented as a bit sequence with values within the range of 0 to 2m − 1, where m is the size of the hash code (the output value of the hashing function). Hash functions are a special class of cryptographic checksums computed without using secret parameters, and that provide for the complex dependence of the output value on each bit of the input message.
Hashing
the process of computing a hash function.
Hybrid cryptosystem
a cryptosystem where key distribution is performed using two-key cryptalgorithms, and the encryption process is done using one-key cryptalgorithms. Hybrid cryptosystems combine the distributional convenience of secret keys and a high rate of encryption.


K-O

Key
a secret parameter governing the encryption process. Synonyms are "secret key" and "encryption key". The key determines the selection of a certain variant of transformation for encryption and decryption from a set of transformations making up a cipher.
Key control
a set of events and procedures providing for the protected generation, distribution, storage, and elimination of keys.
Message integrity check
a method of protecting against the imposition of false messages by transmission with a message some vector of small size containing additional information, called the message integrity detection code.
Message integrity detection code
a cryptographic checksum that depends on each bit of the message and is computed using cryptographic algorithms (e.g., encryption algorithms) and the key.


P-S

Probabilistic encryption
an encryption procedure where random parameters are used.
Program cipher
a cipher aimed at implementation as an application.
Secret electronic vote system
a cryptographic protocol providing for the secrecy of the ballot for each voting person in which the voter can check how his or her vote was cast (pro or contra). Nobody else, including the electoral committee, can figure out how the voter voted.
Steganography
a method of secretly transmitting information, or of forming a secret channel. Often used for ciphertext transmission. The wide application of computer technologies urged forward the development of steganographic methods. At present, a trend of using cryptographic ideas in modern steganography can be observed, for example, in secret keys. One current steganographic trend is the creation of digital watermarks.
Stream cipher
a cipher that transforms separate bits or symbols of the initial text one by one, and is aimed at implementation as an application.
Symmetric cryptosystem
a cryptosystem with a secret key.


T-Z

Team LiB

T–Z

Two-key cryptography
a trend of research in cryptography and cryptosystem development based on using two keys — one public and one secret. The public key should be known both to all users of the cryptosystem and to a potential assaulter. The closed key should be known only to one user. The important factor is that, in order to implement various protocols in two-key cryptosystems, the secret key need not necessarily be known to more than one user. This enables you to implement cryptographic protocols that provide for the interaction of parties that distrust each other. Such a feature of two-key cryptosystems is what underlies digital signature systems.


References

  1. Alexeev L. E., Belkin T. G. A method for iterative encryption of the data blocks. Russian patent # 2140714.

  2. Benes V. E. Algebraic and Topological Properties of Connecting Networks // Bell Systems Technical Journal. Vol. 41, pp. 1249-1274, 1962.

  3. Benes V. E. Mathematical Theory of Connecting Networks and Telephone Traffic. New York.: Academic Press. P. 319, 1965.

  4. Benes V. E. On Rearrangeable Three-Stage Connecting Networks // Bell Systems Technical Journal. Vol. 41, pp. 1481-1492, 1962.

  5. Bennett C. H. Brassard G. Quantum Cryptography: Public Key Distribution and Coin Tossing // Proceedings of the IEEE International Conference on Computers, Systems, and Signal Processing // Banjalore, India. Pp. 175-179, 1984.

  6. Biham E. Biryukov A. Shamir A. Cryptanalysis Skipjack Reduced to 31 Round Using Impossible Differentials // Advances in Cryptology EUROCRYPT'99 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1592, pp. 12-23, 1999.

  7. Biham E. On Matsui's Linear Cryptanalysis // Advances in Cryptology EUROCRYPT'94 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 950, pp. 341-355, 1995.

  8. Biham E. and Shamir A. Differential Cryptanalysis of the Full 16-round DES // Advances in Cryptology CRYPTO'92 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 740, pp. 487-496, 1993.

  9. Biham E., Shamir A. Differential Cryptanalysis of DES-Like Cryptosystems (extended abstract) // Advances in Cryptology CRYPTO'90 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 537, pp. 2-21, 1991.

  10. Biham E., Shamir A. Differential Fault Analysis of Secret Key Cryptosystems // Advances in Cryptology CRYPTO'97 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1294, pp. 513-525, 1997.

  11. Biryukov A., Wagner D. Advanced Slide Attacks // Advances in Cryptology EUROCRYPT'2000 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1807, pp. 589-606, 2000.

  12. Biryukov A., Wagner D. Slide Attacks // Fast Software Encryption, 6th International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1636, pp. 245-259, 1999.

  13. Burwick C., Coppersmith D., D'Avingnon E., Gennaro R., Halevi Sh., Jutla Ch., Matyas Jr.S.M., O'Connor L., Peyravian M., Safford D., Zunic N. MARS a Candidate Cipher for AES // Proc. of 1st Advanced Encryption Standard Candidate Conference, Venture, California, 1998 (http://www.nist.gov/aes).

  14. Camion P., Carlet C., Charpin P., Sendrier. On Correlation-Immune Functions // Advances in Cryptology CRYPTO'91 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 576, pp. 87-100, 1992.

  15. Carlet C. Two New Classes of Bent Functions // Advances in Cryptology EUROCRYPT'93 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 765, pp. 77-101, 1994.

  16. Chabaud F., Vaudenay S. Links Between Differential and Linear Cryptanalysis // Advances in Cryptology EUROCRYPT'94 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 950, pp. 356-365, 1995.

  17. Charnes C., O'Connor L., Pieprzyk J., Safavi-Naini R., Zeng Y. Comments on Soviet Encryption Algorithm // Advances in Cryptology EUROCRYPT'94 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 950, pp. 433-438, 1995.

  18. Chaum D. Blind Signatures for Untraceable Payments // Advances in Cryptology Crypto'82 // Plenum Press. Pp. 199-203, 1983.

  19. Chaum D. Blind Signature Systems // U.S. Patent # 4,759,063. 19 Jul 1988.

  20. Chaum D. Security Without Identification: Transaction Systems to Make Big Brother Obsolete // Communications of the ACM. Vol. 28, No. 10, pp. 1030-1044, 1985.

  21. Chor B., Goldreich O., Hastard J., Friedman J., Rudich S., Smolensky R. The Bit Extraction Problem or T-Resilient Functions // IEEE Symposium on Foundations of Computer Science. Vol. 26, pp. 396-407, 1985.

  22. Clos C. A Study of Nonblocking Switching Networks // Bell System Technical Journal. Vol. 32, pp. 406-424, 1953.

  23. Daemen J. Cipher and Hash Function Design, // Ph.D. Theses, Katholieke Universiteit Leuven, Mar 1995 (http://www.csrc.nist.gov/encryption/aes).

  24. Daemen. J., Govaerts R., Vandevalle J. Correlation Matrices // Fast Software Encryption, Second International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1008, pp. 275-285, 1995.

  25. Daemen. J., Rijmen V. AES proposal: Rijndael. In First AES conference, 1998 (http://csrc.nist.gov/encryption/aes/aes).

  26. Diffie W., Hellman M. E. New Directions in Cryptography // IEEE Transactions on Information Theory. Vol. IT-22, No. 6, pp. 644-654, 1976.

  27. Dillon J. Elementary Hadamard Difference Sets // Proceedings of the 6th Southeastern Conference Combinatorics Graph Theory, and Computing. Pp. 237-249, 1975,

  28. Dobbertin H. Construction of Bent Functions and Balanced Boolean Functions with High Nonlinearity // Fast Software Encryption, Second International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1008, pp. 61-74, 1995.

  29. ElGamal T. A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms // IEEE Transactions on Information Theory. Vol. IT-31, No. 4, pp. 469-472, 1985.

  30. Feistel H. Cryptography and Computer privacy // Scientific American. Vol. 228, No. 5, pp. 15-23, 1973.

  31. Forre R. The Strict Avalanche Criterion: Spectral Properties of Boolean Functions and an Extended Definition // Advances in Cryptology CRYPTO'88 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 403, pp. 450-468, 1989.

  32. Goots N. D., Moldovyan A. A., Moldovyan N. A. Fast Encryption Algorithm SPECTR H64 // Mathematical Methods, Models and Architectures for Computer Networks Security // Lecture Notes in Computer Science. Springer-Verlag. Vol. 2052, pp. 275-286, 2001.

  33. Goots N. D., Izotov B. V., Moldovyan A. A., Moldovyan N. A. An Iterated Method for Block Encryption. Russian patent # 2172075.

  34. Harpers C., Kramer G. G., Massey J. L. A Generalization of Linear Cryptanalysis and the Applicability of Matsui's Piling-up Lemma // Advances in Cryptology EUROCRYPT'95 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 921, pp. 24-38, 1995.

  35. Hong S., Lee S., Lim J., Sung J., Cheon D., Cho I. Provable Security against Differential and Linear Cryptanalysis for the SPN Structure // Fast Software Encryption, 7th International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1978, pp. 273-283, 2000.

  36. Izotov B. V., Moldovyan A. A., Moldovyan N. A. Controlled Operations as a Cryptographic Primitive // Methods, Models and Architectures for Network Security // Lecture Notes in Computer Science. Springer-Verlag. Vol. 2052, pp. 230-241, 2001.

  37. Jakobsen T., Knudsen L. R. The Interpolation Attack on Block Ciphers // Fast Software Encryption, 4th International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1267, pp. 28-40, 1997.

  38. Kaliski B. S.(Jr), Yin Y. L. On Differential and Linear Cryptanalysis of the RC5 Encryption Algorithm // Advances in Cryptology CRYPTO'95 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 963, pp. 171-184, 1995.

  39. Kam J. B., Davida G. I. Structured Design of Substitution-Permutation Encryption Networks // IEEE Transactions on Computers. Vol. 28, No. 10, pp. 747-753, 1979.

  40. Kelsey J., Schneier B., Wagner D., Related-Key Cryptanalysis of IDEA, G-DES, GOST, SAFER, and Triple-DES // Advances in Cryptology CRYPTO'96 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1109, pp. 237-251, 1996.

  41. Knudsen L. R., Berson T. A. Truncated Differentials of SAFER // Fast Software Encryption, Third International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1039, pp. 15-26, 1996.

  42. Knudsen L. R. Truncated and Higher Order Differentials // Fast Software Encryption, Second International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1008, pp. 196-211, 1995.

  43. Kocher P., Jaffe J., Jun B. Introduction to Differential Power Analysis and Related Attacks (http://www.cryptography.com/dpa/technical/index.html)

  44. Kruskal C. P., Snir M., A Unified Theory of Interconnection Network Structure // Theoretical Computer Science. Vol. 48, pp. 75-4, 1986.

  45. Kurosawa K., Satoh T. Design of SAC/PC(l) of Order k Boolean Functions and Three Other Cryptographic Criteria // Advances in Cryptology EUROCRYPT'97 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1233, pp. 434-449, 1998.

  46. Kwan M. The Design of the ICE Encryption Algorithm // Fast Software Encryption, 4th International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1267, pp. 69-82, 1997.

  47. Lai X., Massey J. L. Hash Functions Based on Block Ciphers // Advances in Cryptology EUROCRYPT'92 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 658, pp. 55-70, 1993.

  48. Lai X., Massey J., Murphy S. Markov Ciphers and Differential Cryptanalysis // Advances in Cryptology EUROCRYPT'91 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 547, pp. 17-38, 1992.

  49. Lloyd S. Counting Functions Satisfying a Higher Order Strict Avalanche Criterion // Advances in Cryptology EUROCRYPT'89 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 434, pp. 64-74, 1990.

  50. Matsui M. Linear Cryptanalysis Method for DES Cipher // Advances in Cryptology EUROCRYPT'93 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 765, pp. 386-397, 1994.

  51. Matsui M. New structure of Block Ciphers with Provable Security Against Differential and Linear Cryptanalysis // Advances in Cryptology EUROCRYPT'96 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1267, pp. 205-218, 1997.

  52. McFarland R. A Family of Difference Sets in Non-Cyclic Group // Journal of Combinatorial Theory. Vol. A-15, pp. 1-10, 1973.

  53. Menezes A. J., Van Oorscchot P., Vanstone Scott. A.Handbook of Applied Cryptography. CRC Press. P. 780, 1996.

  54. Moldovyan A. A., Moldovyan N. A., Andronati N. R., Rogozhin Yu. V. Software-Oriented Approach to Computer Processing Protection // Proceedings of the European Simulation Meeting: "Simulation Tools and Applications" // Gyor, Hungary, 1995, pp. 143-149.

  55. Moldovyan A. A., Moldovyan N. A. Fast Software Encryption System Based on Local Pseudo-randomness // Computer Science Journal of Moldova. Vol. 3, No. 3(9), pp. 252-262, 1995.

  56. Moldovyan A. A., Moldovyan N. A. Fast Software Encryption Systems for Secure and Private Communication // Proceedings of the 12th International Conference on Computer Communication // Seoul, Korea, 1995. Vol. 1, pp. 415-420.

  57. Moldovyan A. A., Moldovyan N. A. Flexible Block Ciphers with Provably Inequivalent Cryptalgorithm Modifications // Cryptologia. Vol. XXII, No. 2, pp. 134-140, 1998.

  58. Moldovyan A. A., Moldovyan N. A., Moldovyan P. A. Effective Software-Oriented Crypto-system in Complex PC Security Software // Computer Science Journal of Moldova. Vol. 2, No. 3, pp. 269-282, 1994.

  59. Moldovyan A. A., Moldovyan N. A. Provably Indeterminate 128-Bit Cipher // Computer Science Journal of Moldova. Vol. 5, N. 2, pp. 185-197, 1997.

  60. Moldovyan A. A., Moldovyan N. A. Software Encryption Algorithms for Transparent Protection Technology // Cryptologia. Vol. XXII, No. 1, pp. 56-68, 1998.

  61. Moldovyan A. A., Moldovyan N. A., Sovetov B. Ya. Software-Oriented Ciphers for Computer Communication Protection // Proceedings of International Conference Applications of Computer Systems ACS'97. November 13-14, Szczecin, Poland, pp. 443-450, 1997.

  62. Moldovyan A. A., Moldovyan N. A., Zaikin O. A. Undetermined Software-Oriented Ciphers Based on Data-Dependent Subkey Selection // Proceedings of International Conference of Computer's Methods in Control Systems CMCS'97. December 11-12, 1997. Szczecin, Poland, pp. 157-164.

  63. Naor M., Reingold O. Constructing Pseudo-Random Permutations with a Prescribed Structure // (http://www.Iacr.org/ePrint/2000 Pentium/C/N101/Permutation Networks).

  64. Nyberg K. Differentially Uniform Mappings for Cryptography // Advances in Cryptology EUROCRYPT'93 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 765, pp. 55-64, 1994.

  65. Nyberg K. Linear Approximation of Block Ciphers // Advances in Cryptology EUROCRYPT'94 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 950, pp. 439-444, 1994.

  66. Nyberg K., Knudsen L. Provable Security against Differential Cryptanalysis // Advances in Cryptology CRYPTO'92 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 740, pp. 566-574, 1993.

  67. Nyberg K. On the Construction of Highly Non-Linear Permutations // Advances in Cryptology EUROCRYPT'92 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 658, pp. 92-98, 1993.

  68. Nyberg K. New Bent Mappings Suitable for Fast Implementation // Fast Software Encryption, Second International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1008, pp. 179-184, 1995.

  69. Nyberg K. Perfect Nonlinear S-Boxes // Advances in Cryptology EUROCRYPT'91 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 547, pp. 378-385, 1991.

  70. Nyberg K. S-Boxes and Round Functions with Controllable Linearity and Differential Uniformity // Fast Software Encryption, Second International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1008, pp. 111-130, 1995.

  71. O'Connor L. On the Distribution of Characteristics in Composite Permutations // Advances in Cryptology CRYPTO'93 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 773, pp. 403-412, 1994.

  72. Parker S. Notes on Shuffle/Exchange-Type Switching Networks // IEEE Transactions on Computers. Vol. C-29, No. 5, pp. 213-222, 1980.

  73. Portz M. A Generalized Description of DES-Based and Benes-Based Permutation Generators // Advances in Cryptology AUSCRYPT'92 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 718, pp. 397-409, 1992.

  74. Portz M. On the Use of Interconnection Networks in Cryptography // Advances in Cryptology EUROCRYPT'91 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 547, pp. 302-315, 1991.

  75. Preneel B., Bosselaers A., Rijmen V., Van Rompay B., Granboulan L., Stern J., Murphy S., Dichtl M., Serf P., Biham E., Dunkelman O., Furman V., Koeune F., Piret G., Quisquater J-J.,Knudsen L., Raddum H. // Comments by the NESSIE Project on the AES Finalists // 24 may 2000 (http://www.nist.gav/aes).

  76. Preneel B., Van Leekwijck W., Van Linden L., Govaerts R., Vandewalle J. Propagation Characteristics of Boolean Functions // Advances in Cryptology EUROCRYPT'90 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 473, pp. 161-173, 1991.

  77. Rijmen Vol., Preneel B. A Family of Trapdoor Ciphers // Fast Software Encryption, 4th International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1267, pp. 139-150, 1997.

  78. Rivest R. L., Robshaw M. J. B., Sidney R. and Yin Y. L. The RC6TM Block Cipher // Proceedings of the 1st Advanced Encryption Standard // Candidate Conference, Venture, California, 1998 (http://www.nist.gov/aes).

  79. Rivest R. L. The RC5 Encryption Algorithm // Fast Software Encryption, Second International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1008, pp. 86-96, 1995.

  80. Rivest R., Shamir A, Adleman L. A method for Obtaining Digital Signatures and Public-Key Cryptosystems // Communication of the ACM. Vol. 21, No. 2, pp. 120-126, 1978.

  81. Rothaus O. On Bent Functions // Journal of Combinatorial Theory. Vol. A-20, pp. 300-305, 1976.

  82. Sakurai K., Faruya S. Improving Linear Cryptanalysis of LOKI91 by Probabilistic Counting Method // Fast Software Encryption, 4th International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1267, pp. 114-133, 1997.

  83. Sarkar P., Maitra S. New Directions in Design of Resilient Boolean Functions // Indian Statistical Institute. Technical Report No. ASD/2000/04, 2000 (http://www.elibrary.ru).

  84. Schneier B. Applied Cryptography: Protocols, Algorithms, and Source Code (Second Edition). New York.: John Wiley & Sons. 758 p, 1996.

  85. Schneier B. Description of a New Variable-Length Key, 64-Bit Block Cipher (Blowfish) // Fast Software Encryption, First International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 809, pp. 191-204, 1994.

  86. Seberry J., Zhang X-M., Zheng Y. Non-Linearly Balanced Boolean Functions and Their Propagation Characteristics // Advances in Cryptology CRYPTO'93 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 773, pp. 49-60, 1994.

  87. Seberry J., Zhang X-M., Zheng Y. On Constructions and Non-Linearity of Correlation Immune Functions // Advances in Cryptology EUROCRYPT'93 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 765, pp. 181-199, 1994.

  88. Seberry J., Zhang X-M., Zheng Y. Pitfalls in Designing Substitution Boxes // Advances in Cryptology CRYPTO'94 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 839, pp. 383-396, 1994.

  89. Seberry J., Zhang X-M., Zheng Y. Relations Among Non-linearity Criteria // Advances in Cryptology EUROCRYPT'94 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 950, pp. 376-388, 1995.

  90. Shannon C. E. Communication Theory of Secrecy Systems // Bell Systems Technical Journal. Vol. 28, pp. 656-715, 1949.

  91. Siegenthaler T. Correlation-Immunity of Non-linear Combining Functions for Cryptographic Applications // IEEE Transactions on Information Theory. Vol. IT-30, pp. 776-780, 1984.

  92. Staffelbach O., Meier W. Non-linearity Criteria for Cryptographic Functions // Advances in Cryptology EUROCRYPT'89 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 434, pp. 549-562, 1990.

  93. Stinson D. R. Cryptography. Theory and Practice. New York. CRC Press LLC. P. 434, 1995.

  94. Stone H. S. Parallel Processing with the Perfect Shuffle // IEEE Transactions on Computers. Vol. C-20, pp. 153-161, 1971.

  95. Tarannikov Y. On Resilient Boolean Functions with Maximal Possible Non-Linearity. Department of Moscow State University (http://www.elibrary.ru).

  96. Wagner D. The Boomerang Attack // Fast Software Encryption, 6th International Workshop // Lecture Notes in Computer Science. Springer-Verlag. Vol. 1636, pp. 156-170, 1999.

  97. Waksman A. A Permutation Network // Journal of the ACM. Vol. 15, No. 1, pp. 159-163, 1968.

  98. Webster A. F., Tavares S. E. On the Design of S-Boxes // Advances in Cryptology CRYPTO'85 // Lecture Notes in Computer Science. Springer-Verlag. Vol. 219, pp. 523-534, 1986.

  99. Xiao G., Massey J. A Spectral Characterization of Correlation-Immune Functions // IEEE Transactions on Information Theory. Vol. 34, No. 3, pp. 569-571, 1988.

  100. Zhang X-M., Zheng Y., Imai H. Relating Differential Distribution Tables to Other Properties of Substitution Boxes // Designs, Codes and Cryptography. Boston, Vol. 19, No. 1, pp. 45-63, 2000.

  101. Zeng Y., Mihaljevic M., Imai H. A Cellular Automaton Based on Fast One-Way Hash Function Suitable for Hardware Implementation // International Workshop on Practice and Theory in Public Key Cryptography (PKC'98). 1998. Japan. Yokohama. Pre-Proceedings, pp. 187-200.


Index

A

Active:
adversary, 47
bits, 330
blocks, 351
Adapted text cryptanalysis, 16
Adder modulo 2 n, 208
Advanced Encryption Standard (AES), 71
Algebraic:
degree, 172
normal form (ANF), 171
Algorithm initializing, 12
Autocorrelation, 179
Avalanche:
effect, 182
degree, 339
vector, 182, 338


Index_B

Team LiB

Index

B

Bent function 185
Bias, 140, 235
Bijection, 169
Birthday paradox, 245
Bitwise:
addition, 91
multiplication, 91
Block:
algorithm, 261
cipher, 13, 33, 163, 251
GOST 28147-89, 244
Markov, 228
RC5, 165
RC6, 165
SPECTR-H64, 257
Boolean function, 92, 170
affine, 172
balanced, 92, 171
generating, 92, 167, 170, 201
inverse, 195
linear, 172
perfect nonlinear, 185
resilient, 184
vector, 92, 170
Box:
controlled
permutations, 101
substitutions, 97
h-th order, 111
maximum order, 113


Index_C

Team LiB

Index

C

Canonical form, 204
Carry bit, 209
Cascade structure, 115
Cellular automata, 167
Characteristic:
best, 141
linear, 141
one-round, 141
sequence, 171
total linear, 143
Checksum, 20
Chosen:
ciphertext cryptanalysis, 16
plaintext cryptanalysis, 16
Cipher:
block, 13, 33, 261
computationally secure, 31
conditionally secure, 31
flexible, 16
iterated, 37, 263
nondeterministic, 16, 86
permutation, 95
product, 35
stream, 13
unconditionally secure, 29
security rule, 14
Ciphering round, 37
Ciphertext, 12
Circuit depth, 104
Collision, 191, 246
Combination complexity, 249
Combinatory-probabilistic model, 348
Combined controlled adder, 214
Completeness criterion, 271, 340
Complexity:
combination, 104
computational, 104
Composition mapping, 94
Computationally:
complex problem, 22
secure cipher, 31
Concatenation, 92
Concept of controlled operations, 260
Conditionally secure cipher, 31
Confusion, 33
Conjugate function, 171
Control:
bit, 250
code, 97
extended vector, 252
vector, 97, 190
operand, 210
Controlled:
operation, 40, 210
operational substitution, 40, 97, 166, 190
complete, 191
effectively complete, 191
schematic transformer, 199
transformation, 164
Correlation, 176
immunity (CI), 183
matrix, 237
Cryptanalysis, 8, 14
adapted text, 16
basing on impossible differentials, 222
boomerang attack, 222
chosen:
ciphertext, 16
plaintext, 16
ciphertext, 15
differential, 16, 222, 225
fault, 222, 242
power, 222
frequency, 34
hardware faults, 246
high order differential, 222
interpolation, 222
known plaintext, 15
linear, 16, 222, 234
related-key, 223, 245
slide attack, 223
truncated differentials, 222
Cryptogram, 12
Cryptographic primitive, 163
Cryptography:
public-key, 21
quantum, 14
Cryptology, 8
Cryptoscheme:
Feistel, 225
improved, 254
Cryptosystem:
one-key symmetric, 13
two-key asymmetric, 13


Index_D

Team LiB

Index

D

Decryption problem, 346
Delay time, 104
Dependence matrix, 340
Depth of a Boolean function, 249
Determining recurrence, 203
Differential cryptanalysis, 16, 348
Diffusion, 33
Digital signature, 48
Discrete Fourier transform, 172
Distance:
Hammimg, 92
matrix, 340


Index_E

Team LiB

Index

E

Elementary controlled adder, 209
Energy spectrum, 180
Extended key, 16, 275
generation procedure, 263


Index_F

Team LiB

Index

F

Feistel's cryptoscheme, 270
Final transformation, 276
Fitting criterion, 343
Flexible cipher, 16, 347
Frequency cryptanalysis, 34, 345
Function:
hash, 20
one-way, 18, 43
round ciphering, 37
trapdoor one-way, 43
vector oddness, 93


Index_G

Team LiB

Index

G

Gate, 104
General:
linearity, 178
non-linearity, 178
Generating polynomials, 203


Index_H

Team LiB

Index

H

Hadamard matrix, 173
Hamming:
distance, 176
weight, 92
Handshake protocol, 19
Hardware implementation, 267
Hash function, 20


Index_I

Team LiB

Index

I

Infinite keystream, 30
Initial transformation, 276
Initializing algorithm, 12
Injection, 169
Input difference, 330
Inverse element, 94
Inversibility parameter, 195
Involution, 137, 172
permutation, 137
Iterated cipher, 37, 263


Index_K

Team LiB

Index

K

Kerckhoff principle, 86
Key:
extended, 16, 249
private, 21
public, 21
round, 37, 251
secret, 12, 245, 246, 251
special, 245
transformation, 252
weak, 245
working, 245
extending procedure, 252, 253
schedule, 253, 264
Known plaintext cryptanalysis, 15


Index_L

Team LiB

Index

L

Large-scale integration, 250
Linear:
approximation, 235
characteristic, 178, 235
cryptanalysis, 16, 139
dimension, 187
structure, 187
vector space, 91
Linearity of a Boolean function, 178


Index_M

Team LiB

Index

M

Mapping, 92
bijective, 169
injective, 169
one-to-one, 169
regular, 171
surjective, 169
Mask, 140
united, 140
Matrix:
of differences, 229
structure, 106
Mean:
linearity, 179
non-linearity, 179
Method of full (total) try, 262
Model:
combinational-probabilistic, 88
basic recursive, 201
bijective, 197
recursive, 201
general, 192
generalized recursive, 201
parametrically functionally inversible, 200
parametrically schematically inversible, 199
recursive, 200
parametrically functionally inversible, 201, 206
parametrically schematically inversible, 207
serial, 196
bijective, 196
nonbijective, 214
Modification, 98
controlled operational substitution, 191
equivalent, 98, 191
transformation, 163
unique, 98, 191


Index_N

Team LiB

Index

N

Near-bent function, 188
Network:
Clos, 116
three-level, 117
two-level, 117
layered structure, 108
Omega, 120
permutation, 108
switching, 108
substitution, 262
permutation, 262
Non-deterministic cipher, 16
Non-linearity, 177
relative to linear structures, 187


Index_O

Team LiB

Index

O

One-key symmetric cryptosystem, 13
One-time tape, 30
One-way function, 18, 43
Operational:
S-box, 95
P-box, 99, 107
Opponent, 7
Output function, 201


Index_P

Team LiB

Index

P

Parametrical inversibility kernel, 204
Parametrically inversible, 195
Parseval equality, 177
Passive adversary, 47
Permutation, 95
one to one, 95
Plaintext, 12
Private key, 21
Procedure of expanding the control vector, 158
Product cipher, 35
Propagation criterion (PC), 181
Protocol handshake, 19
Prototype of a Boolean function, 214
Public key, 21
distribution, 44
cryptography, 21


Index_Q

Team LiB

Index

Q

Quantum cryptography, 14


Index_R

Team LiB

Index

R

Recursive model, 118
Resilient function, 184
Right pair, 228
Ring, 91
Robustness, 223
Round:
characteristic, 226
ciphering function, 37
difference, 226
function, 193
key, 37, 193
transformation, 193


Index_S

Team LiB

Index

S

Scalar product, 93
Scheme:
Benes, 128
modernized, 129
Feistel, 193
universal, 126
Waksman, 129
Secret key, 12
Security unconditional, 12
Signal-to-noise ratio, 228
Steganography, 74
Stochastic equivalence hypothesis, 226
Stream cipher, 13
Strict avalanche criterion (SAC), 181
Substitution, 93, 94, 170
cyclic, 94
with bit switching, 99
Surjection, 169
Switch fixed, 99
Switching element, 108
Symmetric group, 94
permutation, 96
substitution, 96


Index_T

Team LiB

Index

T

Table of linear dependencies, 141
Transformation:
bijective, 102
substitutional, 101
identical, 99
parametric, 100
Transition function, 201
Trapdoor, 73
one-way function, 43
Truth table, 170
Two-key asymmetric cryptosystem, 13


Index_U

Team LiB

Index

U

Unconditional security, 12
Unconditionally secure cipher, 29
Unicity distance, 13, 30


Index_V

Team LiB

Index

V

Vector bent function, 185


Index_W

Team LiB

Index

W

Walsh-Hadamard
matrix, 173
transformation, 172
inverse, 173
Whitening, 267
Work factor, 31
Wrong pair, 228


List of Figures

Chapter 1: Cryptography in the Information Age

Figure 1.1: The types of common computer security threats and the analysis of potential losses
Figure 1.2: The classification of external threats and the analysis of their goals
Figure 1.3: The classification of internal threats and the analysis of their goals
Figure 1.4: Security tasks and mechanisms of their implementation
Figure 1.5: Additional protection mechanisms and their goals
Figure 1.6: The structure of a product cipher based on substitutions and transpositions
Figure 1.7: The deciphering procedure scheme in a product cipher
Figure 1.8: Feistel's cryptoscheme: a - enciphering, b - deciphering
Figure 1.9: A controlled adder (e = 0 - "addition", e = 1 - "subtraction")
Figure 1.10: Types of controlled operational substitutions
Figure 1.11: The basic scheme of probabilistic encryption
Figure 1.12: A scheme with a probabilistic mix of random and data bits
Figure 1.13: A pre-encryption scheme with a random vector
Figure 1.14: Two-stage probabilistic encryption
Figure 1.15: The structure of the "COBRA" system and the purpose of its main components

Chapter 3: Controlled Permutation

Figure 3.1: A box of controlled permutations Pn/m
Figure 3.2: A formal synthesis circuit of a box of controlled permutations
Figure 3.3: Implementation of controlled selection of a π(s−1) modification: a - general view, b - an example for a π4/4 box
Figure 3.4: An R-network with 16-bit input and output
Figure 3.5: The general view of a Pn/m box with a layered structure
Figure 3.6: A box of controlled permutations P2/1 (a) and its practical implementation (b)
Figure 3.7: The structure of the P4/4 box
Figure 3.8: A controlled rotation box Tn with the matrix structure
Figure 3.9: The cascade structure of the rotation box Tn
Figure 3.10: A three-stage Clos network
Figure 3.11: The design of the boxes R2n/2m+n (a) and R2n/2m+n (a)′ (b)
Figure 3.12: The structure of R3 (a) and R−13 (b)
Figure 3.13: The structure of the Rk+1 box
Figure 3.14: The modifies structure of the Rk+1 box
Figure 3.15: A two-stage Clos network C<2k+1-i, 2i>/2m+n
Figure 3.16: The structure of the Rk+1 (a) and C<2k, 2>/2m+n(W) (b) boxes
Figure 3.17: The universal implementation scheme for a maximum-order box
Figure 3.18: The recursive Benes scheme Bk+1 (a) and the scheme of the symmetric initial box P2/2(2) (b)
Figure 3.19: The recursive Waksman scheme
Figure 3.20: The structure of the P(2h)2n/2m+2n (a) and P(4h)4n/4m+8n (b) boxes
Figure 3.21: The structure of the P(2)32/96 (a), P(4)32/112 (b), and P(8)32/128 (c) boxes
Figure 3.22: A control permutation box P(4)n/m
Figure 3.23: Controlled boxes S′n/m and In/m with a specified cyclic structure
Figure 3.24: A high-speed box of controlled involutions I2n/m
Figure 3.25: The P4/4 box

Chapter 4: Controlled Operational Substitutions

Figure 4.1: A diagram of controlled operational substitution (X = (x1, x2, …, xn), A = (a1, a2, …, an), V=(v1, v2, …, vm), Y=(y1, y2, …, yn))
Figure 4.2: One round of transformations in the Feistel scheme
Figure 4.3: One round of transformations in the Feistel scheme using a controlled operational substitution
Figure 4.4: The general scheme of the parametrically inversible recursive COS model Ω″σ,e (e = 0 − "addition", e = 1 − "subtraction")
Figure 4.5: A scheme of a one-bit transformer θef for the Ω″σ, ef model - see Fig. 4.4 (e = 0 - "addition", e = 1 - "subtraction")
Figure 4.6: A scheme of a one-bit transformer θes from the scheme for the Ω″σ, es model - see Fig. 4.5 (e = 0 - "addition", e = 1 - "subtraction")
Figure 4.7: The scheme of an adder modulo 2n (e = 0 - "addition", e = 1 - "subtraction")
Figure 4.8: The scheme of a σe adder (e = 0 - "addition", e = 1 - "subtraction")
Figure 4.9: The scheme of an elementary controlled adder ΣV("∗", u0)∊Ω″σ, ef (e = 0 - "addition", e = 1 - "subtraction")
Figure 4.10: The operating diagram of an ECA ΣV("∧", u0) for γi = ui−1vi
Figure 4.11: The classification diagram for the models of controlled operational substitutions
Figure 4.12: The iterative encryption scheme of a block cipher
Figure 4.13: A general scheme of using substitution-permutation transformations in one round E of the improved Feistel scheme
Figure 4.14: Examples of the simplest [GP]W boxes (W = V1 ∪ V2) (a - for a hardware implementation, b - for a software implementation)
Figure 4.15: Examples of the simplest [G(e)P(e)]W1 boxes (W1 = V′1 ∪ V′2) (a - for a hardware implementation, b - for a software implementation)
Figure 4.16: Examples of the simplest [P(e⊕1)G(e⊕1)]W2 boxes (W2 = V″1 ∪ V″2) (a - for a hardware implementation, b - for a software implementation)
Figure 4.17: An example of a complex round function F based on COS and BCP

Chapter 5: Designing Fast Ciphers Based on Controlled Operations

Figure 5.1: An example of a scheme for controlling the choice of round key
Figure 5.2: One transformation round in Feistel's cryptoscheme (a) and in an iterative cryptoscheme (b)
Figure 5.3: One transformation round in the basic (a) and detailed (b) scheme of Russian patent No. 2140714
Figure 5.4: An example of the control scheme for choosing round subkeys
Figure 5.5: A basic model of an iterative block cipher algorithm
Figure 5.6: Initial transformation (s = n/2)
Figure 5.7: Final transformation (s = n/2)
Figure 5.8: General (a) and special (b) cryptoschemes for implementing the Crypt procedure of one round
Figure 5.9: General (a) and specific (b) cryptoschemes of implementing a Crypt procedure of one round
Figure 5.10: The controlled permutations box P32/80
Figure 5.11: The Crypt procedure scheme
Figure 5.12: The subkey commutation scheme
Figure 5.13: Controlled permutations box P64/192
Figure 5.14: The Crypt procedure scheme
Figure 5.15: The subkey commutation scheme
Figure 5.16: The Crypt procedure scheme
Figure 5.17: Subkey commutation scheme
Figure 5.18: The P32/96 controlled permutations box
Figure 5.19: The P(e)96/1 box for controlling the data transformation mode in the P(U,e)32/32 command
Figure 5.20: The P(U,e)32/32 controlled permutations box
Figure 5.21: The SPECTR-Z software cipher scheme
Figure 5.22: Order of the transformation of 32-bit words in the SPECTR-SZ cipher
Figure 5.23: A general encryption scheme in the COBRA-F64 (a and b algorithms)
Figure 5.24: The Crypt(e) procedure in: a - COBRA-F64a and b - COBRA-F64b
Figure 5.25: The general encryption scheme (b) and one transformation round (a) in the DDP-S64 algorithm
Figure 5.26: The general encryption scheme (b) and one transformation round (a) in the DDP-S128 algorithm

Chapter 6: Elements of the Cryptanalysis of Ciphers Based on Controlled Operations

Figure 6.1: Probabilities of passing differences through elementary switch P2/1
Figure 6.2: The general scheme of the passing of differences through a controlled permutations box (a), zero difference passing through the P2/1 active boxes without active bit generation (b), and with active bit generation (c)
Figure 6.3: A two-round characteristic formation scheme in the SPECTR-H64 cipher for event A1
Figure 6.4: The two-round characteristic formation scheme in the SPECTR-128 cipher for event A1
Figure 6.5: Three-round characteristic formation scheme in the SPECTR-128 cipher
Figure 6.6: A one-round characteristic formation scheme in the DDP-S64 cipher
Figure 6.7: The scheme for forming a two-round characteristic in the DDP-S64 cipher
Figure 6.8: The two-round characteristic formation mechanism in the DDP-S128 cipher
Figure 6.9: A three-round characteristic formation scheme in the COBRA-F64a cipher (a) and a two-round characteristic in COBRA-F64b (b)
Figure 6.10: One round in the DDSS-1 cipher


List of Tables

Chapter 3: Controlled Permutation

Table 3.1: Linear Dependencies for the P4/4 Box
Table 3.2: A Fragment of a Table of Linear Characteristics for a P4/4 Box

Chapter 4: Controlled Operational Substitutions

Table 4.1: The [image] Limiting Probabilities

Chapter 5: Designing Fast Ciphers Based on Controlled Operations

Table 5.1: Classification of Extended Key Generation Procedures
Table 5.2: The Time Base for Performing an Operation in the Crypt Procedure
Table 5.3: Control Bit Values for the P32/80 Box
Table 5.4: Control Bit Values for the P−132/80 Box
Table 5.5: Schedule for Using Round Keys
Table 5.6: The Time Base for Operations in the Crypt Procedure
Table 5.7: The Correspondence between the U and V Vector Bits for the P64/192 Box
Table 5.8: The Correspondence between the A and V Vector Bits for the P64/192 Box
Table 5.9: Schedule for Using Round Keys
Table 5.10: The Time Base for Performing Operations in the Crypt Procedure
Table 5.11: Control Bit Values for the P64/192 Box
Table 5.12: Schedule for Using Round Keys
Table 5.13: Correspondence between the Bits of Vectors U and V for the P32/96 Box
Table 5.14: Schedule for Using Round Keys
Table 5.15: Schedule for Using Subkeys in the DDP-S64 Cipher
Table 5.16: Schedule for Using Subkeys in the DDP-S128 Cipher
Table 5.17: Values of Influence Criteria 1–4 of the Incoming Text on the Transformed Text (for Various Numbers of Rounds)
Table 5.18: The Values for Criteria 1–4 on the Influence of Key Bits on Transformed Text (for Various Numbers of Rounds)

Chapter 6: Elements of the Cryptanalysis of Ciphers Based on Controlled Operations

Table 6.1: Probability Values p(ΔX → ΔY/Δ1L) for the P64/192 Box
Table 6.2: Probability Values p(ΔX → ΔY/Δ2L) for the P64/192 Box
Table 6.3: The Distribution of the Influence of Control Subblock L Bits in the P′Box
Table 6.4: The Distribution of the Influence of Control Subblock L Bits in the P″ Box
Table 6.5: The Probability of Active Bit Generation at the Output of the G Operation in the (i + k)th Order, when the ith Input Bit Is Changed
Table 6.6: Distribution of Subblock L Bits in the P′ Box of the SPECTR-128 Cipher
Table 6.7: Distribution of Subblock L Bits in the P″ Box of the SPECTR-128 Cipher
Table 6.8: Bit Distribution at the Output of the Expansion Box (the Numbers of Bits and of the Binary Vector Entering Expansion Box E's Input Are Indicated)
Table 6.9: Comparative Data for Differential Characteristics of Block Ciphers Based on Controlled Operations


List of Examples

Chapter 3: Controlled Permutation

Example 3.1.
Example 3.2.
Example 3.3.
Example 3.4.
Team LiB
Previous Section