182

Extended Substitution Cipher Chaining mode (ESCC)

Mohamed Abo El-Fotouh and Klaus Diepold
Institute for Data Processing (LDV)
Technische Universit¨ t M¨ nchen (TUM)
a u
80333 M¨ nchen, Germany
u
[mohamed,kldi]@tum.de

Abstract can provide a block cipher with a secondary key. The sec-
ondary key is used to replace some bits of the cipher’s ex-
In this paper, we present a new tweakable narrow-block panded key. In ESCC, each sector has its unique tweak,
mode of operation, the Extended Substitution Cipher Chain- this tweak and the previous ciphertext block will replace
ing mode (ESCC), that can be efficiently deployed in disk some bits of the expanded key (with the exception to the
encryption applications. ESCC is an extension of Substitu- first block). ESCC is resistant to the attacks in [6, 7].
tion Cipher Chaining mode (SCC) [5]. Unlike SCC, ESCC This paper proceeds as follows: In section 2, we will
is resistant to the attacks in [6, 7, 8]. present the constraints facing the disk encryption applica-
tions. In section 3, we presented our proposed mode of op-
eration. We conclude in section 4.

1 Introduction
2 Disk encryption
In [5], three new disk encryption modes of operations Disk encryption is usually used to encrypt all the data
have been introduced, the Substitution Cipher Chaining on the hard disk, where all the hard disk is encrypted with
mode (SCC) which is a narrow block mode of operation that a single/multiple key(s) and encryption/decryption are done
provides error propagation, and two new variants of ELE- on the fly, without user interference [3]. The encryption is
PHAT (ELEPHANT+ and ELEPHANT× ) that uses SCC, on the sector level, that means each sector should be en-
where ELEPHANT is a synonym for Windows Vista’s disk crypted separately. In the following sub-section, we will
encryption algorithm. All these modes of operations uses define the existing constrains.
the Advanced Encryption Standard (AES) [2] as there block
cipher.
2.1 Disk Encryption Constraints
In [6], SCC-128 (SCC which uses AES with 128-bit key)
was attacked using 5 different attacks. These attacks were Data size: The ciphertext length should be the same as the
able to recover all the unknown keys/masks used by SCC- plaintext length. In this paper, we will use the current
128 with at most 240 cipher executions and 5 × 28 chosen standard (512-bytes) for the plaintext.
plaintext, but the main attack in [6] was not practical on
SCC-256 (as it costs about 2172 cipher executions). Performance: The used mode of operation should be fast
In [8], SCC-256 (SCC which uses AES with 256-bit key) enough, as to be transparent to the users (If using the
was attacked using 7 different attacks. These attacks were mode of operation results in a significant and notice-
able to recover all the unknown keys/masks used by SCC- able slowdown of the computer there will be great user
256, with at most 244 cipher executions and 6 × 232 chosen resistance to its deployment [10]).
plaintext, using some novel ideas from [9].
In this paper, we propose a novel narrow-block disk en- 2.2 General Scheme and Tweak calcula-
cryption mode of operation. We named this mode Extended tion
Substitution Cipher Chaining mode (ESCC). The ESCC
mode is a tweakable block cipher mode of operation, that In our general scheme, the mode of operation takes four
is base on Cipher Block Chaining mode (CBC) [16] and inputs to calculate the ciphertext (4096-bit). These inputs
the Static Substitution Model (SSM) [4]. The SSM model are:

1. The plaintext of size 4096-bit. 3.3 Terminologies
2. Encryption key of size 128 or 256-bit.
The following terminologies are used to describe ESCC.
3. Tweak Key of size 128 or 256-bit.
IN: The input plaintext of size 4096-bit.
4. Sector ID of size 64-bit.
SID: The sector ID encoded as 64-bit unsigned integer.
Usually a block cipher accepts the plaintext and the encryp-
tion key to produce the ciphertext. Modes of operations GetTweak(TK,SID): Encrypts (using AES) SID after
have introduced other inputs. Some of these mode use ini- padding with zeros with TK and returns the result.
tial vectors like in CBC, CFB and OFB modes [16], coun-
ters like in CTR [15] or nonces like in OCB mode [18]. The T: The tweak.
idea of using a tweak was suggested in HPC [19] and used in
ExKey: The expanded AES key.
Mercy [1]. In [13], the formal definition of tweakable block
ciphers has been introduced. In this paper, the term tweak Expand-Key(EK): Expands the EK with the AES key
is associated with any other inputs to the mode of operation setup routine and returns the result.
with the exception of the encryption key and the plaintext.
There are different methods to calculate the tweak from the Xi : The ith block of text X, where a block is 128-bit.
sector ID like ESSIV [11] and encrypted sector ID [10]. We
: Bitwise xor operation.
are going to use the encrypted sector ID approach, where
the sector ID (after being padded with zeros) is encrypted OUT=Encrypt-AES(IN,ExKey): Encrypts IN, using the
by the tweak key to produce the tweak. AES encryption routine with ExKey as the expanded
key, and returns OUT.
3 Proposed mode
Substitute(T,ExKey,i): Replaces the ith round subkeys in
3.1 Goals ExKey with T (note that: the first round of the AES is
round zero and it is the pre-whitening process).
The goals of designing the ESCC mode are: len(X): Returns the length of the string X in bits.
Security: The constraints for disk encryption imply that
the best achievable security is essentially what can be <<: is a left rotation operation, where the rotation value is
obtained by using ECB mode with a different key per written on its right size.
block [17]. This is our aim.
3.4 Design
Performance: ESCC should be at least as fast as the cur-
rent solutions. We decided to build the ESCC mode using the SSM
Error propagation: ESCC should propagate error to fur- model [4] to inherit from its security and high performance
ther blocks (this may be useful in some applications). and use CBC like operations to gain the error propagation
property. The listing of ESCC is in table 1 and it works as
3.2 Keys follows:

The secret key in ESCC is divided into three different • The tweak T is calculated by encrypting the sector ID
keys (each of them can be either 128- or 256-bit): with the tweak key TK, due to this step the value of the
tweak is neither known nor controlled by the attacker.
1. EKey: which is used to generate the expanded key,
used in encrypting the blocks . • The expanded key ExKey is calculated.

2. TK: which is used to encrypt the sector ID to produce • the values of x, y and z are determined by the encryp-
the tweak. tion key size.
3. BK: which is used to generate the BT array, where BT • For the first block:
is an array of sixty four 128-bit blocks. BT is con-
structed once at the initialization of ESCC mode, it is – The secret tweak T replaces the subkeys of the
constructed using the AES in the counter mode [15], yth round.
where the counter is initialized with zero and BK is – The secret 128-bit BT0 ⊕ T replace the subkeys
the encryption key for the counter mode. of the xth round.

pt properties in both the encryption and decryption direc-
tions (i.e any difference between two active tweaks,
Table 1. ESCC listing for disk encryption. will be associated with full confusion and full diffu-
sion in both the encryption and decryption directions,
Encrypt-ESCC(IN,EK,Keylen,TK,SID) eliminating the bit-flipping attack of the CBC mode).
T=GetTweak(TK,SID)
ExKey=Expand-Key(EK)
Note that AES requires only four rounds to obtain full
KL=len(EK) bit confusion (or mixing) and diffusion (each input bit
if(KL==128) affecting each output bit) properties [14].
x=4 y=5 z=6
else • Note that the active tweak TT is the result of xoring:
x=5 y=7 z=10
end if 1. The tweak T (which is unique, secret and not
Substitute(T,ExKey,y)
Substitute(BT0 ⊕ T ,ExKey,x)
controlled by the attacker).
Substitute(BT1 ⊕ T ,ExKey,z) 2. The ciphertext of the previous block (which is
AES-Encrypt(ExKey,INi ,OUTi ) known and controlled by the attacker).
for i=1 to 31
Substitute(BT2×i ⊕ (OU Ti−1 << 32),ExKey,x) 3. From the above two notes, the attacker does not
Substitute(BT2×(i+1) ⊕ (OU Ti−1 << 64),ExKey,z) know the value of TT, but can flip its bits. But
TT=OUTi−1 ⊕ T
Substitute(TT,ExKey,y) by changing any bits of a ciphertext block, this
AES-Encrypt(ExKey,INi ,OUTi ) will result in a difference in 3 different columns,
end for which will destroy any attempt to lunch chosen
return OUT plaintext/ciphertext attacks as in [6, 7], so any
change in TT will be associated with full con-
fusion and full diffusion in both the encryption
– The secret 128-bit BT1 ⊕ T replace the subkeys and decryption directions.
of the zth round.
• Replacing the subkeys of the xth and zth rounds offers
– The first block is encrypted by the new expanded full diffusion and full confusion in the encryption and
key. decryption directions among the blocks of the same
sector. Note that all the values of BT are unique and
• A loop that runs 31 times (where i takes the values key dependent.
from 1 to 31):
Notes:
– The secret 128-bit BT2×i xored with the rotated
ciphertext of the previous block replaces the sub- 1. By introducing the tweak, the attacker can not perform
keys of the xth round. the mix-and-match attack [17] among blocks of differ-
ent sectors, as each sector has a unique secret tweak.
– The secret 128-bit BT(2×i)+1 xored with the ro-
The tweak replaces the subkeys of the middle round
tated ciphertext of the previous block replaces the
of the AES to assure that any difference between two
subkeys of the zth round.
tweaks, will be associated with full confusion and full
– A variable TT is calculated by xoring ciphertext diffusion in both the encryption and decryption direc-
of the previous block with T. tions. Thus, encrypting two equal blocks in different
– TT acts as the active tweak and replaces the sub- sectors will produce two different ciphertexts and de-
keys of the yth round in the expanded key. crypting two equal blocks in different sectors will pro-
duce different plaintexts.
– The ith block is encrypted by the new expanded
key. 2. By introducing the BT array values (that replaces cer-
tain words in the expanded key) the attacker can not
3.5 Discussion of ESCC Mode perform the mix-and-match attack among the blocks
within the same sector. As each sector has two dis-
The goal of ESCC is to encrypt each block on the hard tinct 128-bit in the expanded key. This requirement
drive in a different way. This was achieved by using the is achieved in both the encryption and decryption di-
SSM model, where: rections. As equal plaintext blocks (within the same
sector), will have the same state until the xth encryp-
• The active tweak TT is placed in the middle of the ex- tion round then the state will change. And equal ci-
panded key, to offer full diffusion and full confusion phertext blocks (within the same sector), will have the

[3] M. El-Fotouh and K. Diepold. Statistical Testing for
Table 2. Number of clock cycles reported by Disk Encryption Modes of Operations. Cryptology ePrint
different mode of operation. Archive, Report 2007/362, 2007.
Key length 128-bits Key length 256-bits [4] M. El-Fotouh and K. Diepold. Dynamic Substitution Model.
CBC 12630 16898 In The Fourth International Conference on Information As-
CFB 12585 16935 surance and Security (IAS’08), Naples, Italy, September
LRW 19778 24015 2008.
XTS 24420 28846 [5] M. El-Fotouh and K. Diepold. The Substitution Cipher
ESCC 12660 16867
Chaining mode. In SECRYPT 2008, Porto, Portugal, July
2008.
same state until the zth decryption round then the state [6] M. El-Fotouh and K. Diepold. Cryptanalysis of Substitution
will change. Cipher Chaining mode (SCC). In to appear, in 2009 IEEE
International Conference on Communications (ICC 2009),
Dresden, Germany, June 2009.
3.6 Performance [7] M. El-Fotouh and K. Diepold. Enhanced Cryptanalysis of
Substitution Cipher Chaining mode (SCC-128). In Submit-
The Speed presented in table 2, are obtained form the ted, 2009.
optimized Gladman’s C implementation [12], Running on a [8] M. El-Fotouh and K. Diepold. How to break the Substitution
PIV 3 GHz (Note that the values reported are in processor Cipher Chaining mode with 256-bit Keys (SCC-256). In
clock cycles). Note that the reported values are the mini- Submitted, 2009.
mum of 1000 measurements, to eliminate any initial over- [9] M. El-Fotouh and K. Diepold. The Pushdown attack on
heads or cache misses factors. It is clear that ESCC pos- AES. In SECUREWARE 2009, Athens, Greece, June 2009.
sesses high throughput. [10] N. Ferguson. AES-CBC + Elephant diffuser : A Disk
Encryption Algorithm for Windows Vista. http:
//download.microsoft.com/download/0/2/
3.7 Pros of ESCC 3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/
BitLockerCipher200608.pdf, 2006.
Security: Each sector is encrypted in a different way, so [11] C. Fruhwirth. New Methods in Hard Disk Encryp-
replacing ciphertext between different sectors will not tion. http://clemens.endorphin.org/nmihde/
help the attacker, as they are encrypted with a different nmihde-A4-ds.pdf, 2005.
expanded keys and each block within the sector is en- [12] B. Gladman. http://fp.gladman.plus.com/AES/
crypted in a different way, due to the use of BT (so the index.htm, August 2008.
[13] M. Liskov, R. Rivest, and D. Wagner. Tweakable Block Ci-
attacker will not benefit from changing the positions of
phers. In CRYPTO ’02: Proceedings of the 22nd Annual
the blocks).
International Cryptology Conference on Advances in Cryp-
Performance: ESCC possesses high performance as it tology, 2002.
[14] L. May, M. Henricksen, W. Millan, G. Carter, and E. Daw-
uses only simple and fast operations.
son. Strengthening the Key Schedule of the AES. In ACISP
Error propagation: As each sector depends on its previ- ’02: Proceedings of the 7th Australian Conference on Infor-
ous sector, error propagation is met. mation Security and Privacy, pages 226–240, London, UK,
2002. Springer-Verlag.
ESCC meets all its design goals. [15] D. McGrew. Counter Mode Secu-
rity: Analysis and Recommendations.
http://citeseer.ist.psu.edu/mcgrew02counter.html, 2002.
4 Conclusions [16] A. Menezes, P. V. Oorschot., and S. Vanstone. Handbook of
Applied Cryptography. CRC Press, 1996.
In this paper, we proposed a novel mode of operation for [17] I. P1619. Ieee standard for cryptographic protection of data
disk encryption applications. Our proposed mode possesses on block-oriented storage devices. IEEE Std 1619-2007,
a high throughput. Although, it was designed based on the April 2008.
[18] P. Rogaway, M. Bellare, and J. Black. OCB: A block-
CBC mode, it does not suffer from the bit-flipping attack.
cipher mode of operation for efficient authenticated encryp-
tion. ACM Trans. Inf. Syst. Secur., 6(3):365–403, 2003.
References [19] R. Schroeppel. The Hasty Pudding cipher. The first AES
conference, NIST, 1998.
[1] P. Crowley. Mercy: a fast large block cipher for disk sector
encryption. In Bruce Schneier, editor, Fast Software Encryp-
tion: 7th International Workshop, FSE 2000, 2001.
[2] J. Daemen and V. Rijmen. The Design of Rijndael. Springer-
Verlag New York, Inc., Secaucus, NJ, USA, 2002.

182

More Related Content

What's hot (20)

Viewers also liked (10)

Similar to 182 (20)

More from Balaji Ravi (17)

182