Unit 2

Block Ciphers & Symmetric
Key Cryptography

Introduction
 A block cipher is an encryption/decryption scheme in which a block of plaintext is
treated as a whole and used to produce a ciphertext block of equal length.
 Many block ciphers have a Feistel structure. Such a structure consists of a number
of identical rounds of processing. In each round, a substitution is performed on
one half of the data being processed, followed by a permutation that interchanges
the two halves. The original key is expanded so that a different key is used for
each round.
 The Data Encryption Standard (DES) has been the most widely used encryption
algorithm until recently. It exhibits the classic Feistel structure. DES uses a 64-bit
block and a 56-bit key.

Stream Ciphers and Block Ciphers
 A stream cipher is one that encrypts a digital data stream one bit or one byte at a
time. Examples of classical stream ciphers are the autokeyed Vigenère cipher and
the Vernam cipher.
 A block cipher is one in which a block of plaintext is treated as a whole and used to
produce a ciphertext block of equal length.
 Typically, a block size of 64 or 128 bits is used. As with a stream cipher, the two users
share a symmetric encryption key

Feistel Cipher Structure
 Feistel proposed that we can approximate the ideal block cipher by utilizing the
concept of a product cipher, which is the execution of two or more simple ciphers in
sequence in such a way that the final result or product is cryptographically stronger
than any of the component ciphers.
 The essence of the approach is to develop a block cipher with a key length of k bits
and a block length of n bits, allowing a total of 2k possible transformations, rather
than the 2n! transformations available with the ideal block cipher.

 In particular, Feistel proposed the use of a cipher that alternates substitutions and
permutations, where these terms are defined as follows:
 Substitution: Each plaintext element or group of elements is uniquely replaced by
a corresponding ciphertext element or group of elements.
 Permutation: A sequence of plaintext elements is replaced by a permutation of
that sequence. That is, no elements are added or deleted or replaced in the
sequence, rather the order in which the elements appear in the sequence is changed.

Diffusion and Confusion
 Confusion means that each binary digit (bit) of the ciphertext should depend on
several parts of the key.
 Diffusion means that if we change a single bit of the plaintext, then (statistically)
half of the bits in the ciphertext should change, and similarly, if we change one bit
of the ciphertext, then approximately one half of the plaintext bits should change.

FEISTEL CIPHER STRUCTURE
 The inputs to the encryption algorithm are a plaintext block of length
2w bits and a key K.
 The plaintext block is divided into two halves, L0 andR0. The two halves
of the data pass through n rounds of processing and then combine to
produce the ciphertext block.
 Each round i has as inputs Li-1 and Ri-1, derived from the previous round,
as well as a subkey Ki, derived from the overall K.
 In general, the subkeys Ki are different from K and from each other.

 All rounds have the same structure. A substitution is performed on the left half of
the data. This is done by applying a round function F to the right half of the data and
then taking the exclusive-OR of the output of that function and the left half of the
data. The round function has the same general structure for each round but is
parameterized by the round subkey Ki.
 Following this substitution, a permutation is performed that consists of the
interchange of the two halves of the data.

The exact realization of a Feistel network depends on the choice of the following parameters
and design features:
 Block size: Larger block sizes mean greater security but reduced encryption/decryption
speed for a given algorithm. The greater security is achieved by greater diffusion
Traditionally, a block size of 64 bits has been considered a reasonable tradeoff and was
nearly universal in block cipher design. However, the new AES uses a 128-bit block size.
 Number of rounds: The essence of the Feistel cipher is that a single round offers inadequate
security but that multiple rounds offer increasing security. A typical size is 16 rounds.
 Subkey generation algorithm: Greater complexity in this algorithm should lead to greater
difficulty of cryptanalysis.
 Round function: Again, greater complexity generally means greater resistance to
cryptanalysis.

There are two other considerations in the design of a Feistel cipher:
 Fast software encryption/decryption: The speed of execution of the algorithm
becomes a concern.
 Ease of analysis: Although we would like to make our algorithm as difficult as
possible to cryptanalyze, there is great benefit in making the algorithm easy to
analyze. That is, if the algorithm can be concisely and clearly explained, it is
easier to analyze that algorithm for cryptanalytic vulnerabilities and therefore
develop a higher level of assurance as to its strength. DES, for example, does not
have an easily analyzed functionality.

Feistel Decryption Algorithm
The process of decryption with a Feistel cipher is essentially the same as the
encryption process.
The rule is as follows:
 Use the ciphertext as input to the algorithm, but use the subkeys K in reverse
order.
 That is, use Kn in the first round, Kn-1 in the second round, and so on until K
is used in the last round. This is a nice feature because it means we need not
implement two different algorithms, one for encryption and one for
decryption.

Figure. Feistel
Encryption and
Decryption

 To see that the same algorithm with a reversed key order produces the correct
result, which shows the encryption process going down the left-hand side and the
decryption process going up the right-hand side for a 16-round algorithm.
 For clarity, we use the notation LEi and REi for data traveling through the encryption
algorithm and LDi and RDi for data traveling through the decryption algorithm.
 The diagram indicates that, at every round, the intermediate value of the decryption
process is equal to the corresponding value of the encryption process with the two
halves of the value swapped.
 After the last iteration of the encryption process, the two halves of the output are
swapped, so that the ciphertext is RE16||LE16. The output of that round is the
ciphertext. Now take that ciphertext and use it as input to the same algorithm. The
input to the first round is RE16||LE16, which is equal to the 32-bit swap of the output
of the sixteenth round of the encryption process.

 If you clearly observe that the output of the first round of the decryption process
is equal to a 32-bit swap of the input to the sixteenth round of the encryption
process. First, consider the encryption process.
LE16 = RE15
RE16 = LE15 x F(RE15, K16)
On the decryption side,
LD1 = RD0 = LE16 = RE15
RD1 = LD0 x F(RD0, K16)
= RE16 x F(RE15, K16)
= [LE15 x F(RE15, K16)] x F(RE15, K16)

Data Encryption Standard
 The most widely used encryption scheme is based on the Data Encryption Standard
(DES) adopted in 1977 by the National Institute of Standards and Technology (NIST).
 The algorithm itself is referred to as the Data Encryption Algorithm (DEA).
 For DES, data are encrypted in 64-bit blocks using a 56-bit key. The algorithm
transforms 64-bit input in a series of steps into a 64-bit output. The same steps, with
the same key, are used to reverse the encryption.

DES Encryption
 As with any encryption scheme, there are two inputs to the encryption function: the
plaintext to be encrypted and the key. In this case, the plaintext must be 64 bits in
length and the key is 56 bits in length.
 Actually, the function expects a 64-bit key as input. However, only 56 of these bits are
ever used; the other 8 bits can be used as parity bits or simply set arbitrarily.
 we can see that the processing of the plaintext proceeds in three phases.
 First, the 64-bit plaintext passes through an initial permutation (IP) that rearranges
the bits to produce the permuted input.
 This is followed by a phase consisting of 16 rounds of the same function, which
involves both permutation and substitution functions.
 The output of the last (sixteenth) round consists of 64 bits that are a function of the
input plaintext and the key. The left and right halves of the output are swapped to
produce the preoutput.
 Finally, the preoutput is passed through a permutation (IP-1) that is the inverse of the
initial permutation function, to produce the 64-bit ciphertext. With the exception of
the initial and final permutations, DES has the exact structure of a Feistel cipher.

 The right-hand portion of Figure shows the way in which the 56-
bit key is used.
 Initially, the key is passed through a permutation function.
Then, for each of the 16 rounds, a subkey (K) is produced by the
combination of a left circular shift and a permutation. The
permutation function is the same for each round, but a different
subkey is produced because of the repeated shifts of the key
bits.

DES Decryption
 As with any Feistel cipher, decryption uses the same algorithm as encryption,
except that the application of the subkeys is reversed. Additionally, the initial
and final permutations are reversed.

The Avalanche Effect
 A desirable property of any encryption algorithm is that a small change in either
the plaintext or the key should produce a significant change in the ciphertext.
 In particular, a change in one bit of the plaintext or one bit of the key should
produce a change in many bits of the ciphertext.
 This is referred to as the avalanche effect.

Initial Permutation
 The input to a table consists of 64 bits numbered from 1 to 64. The 64 entries in the
permutation table contain a permutation of the numbers from 1 to 64. Each entry in
the permutation table indicates the position of a numbered input bit in the output,
which also consists of 64 bits. From this the initial permutation and its inverse are
defined.

To see that these two permutation functions are indeed the inverse of each other,
consider the following 64-bit input M:
where Mi is a binary digit.
Then the permutation X = IP(M) is as follows
If we then take the inverse permutation Y = IP-1(X) = IP-1(IP(M)), it can be seen that the
original ordering of the bits is restored.

Inverse Initial Permutation (IP-1)

Expansion Permutation (E)
Permutation Function (P)

 Figure shows the internal structure of a single round.
 Again, begin by focusing on the left-hand side of the diagram. The left and right
halves of each 64-bit intermediate value are treated as separate 32- bit quantities,
labeled L (left) and R (right).
 As in any classic Feistel cipher, the overall processing at each round can be
summarized in the following formulas:
Details of Single Round
Li = Ri-1
Ri = Li-1 x F(Ri-1, Ki)

 The round key Ki is 48 bits. The R input is 32 bits. This R input is first expanded to
48 bits by using a table that defines a permutation plus an expansion that involves
duplication of 16 of the R bits. The resulting 48 bits are XORed with Ki. This 48-bit
result passes through a substitution function that produces a 32-bit output, which
is permuted from permutation function.
 The role of the S-boxes in the function F is illustrated in Figure. The substitution
consists of a set of eight S-boxes, each of which accepts 6 bits as input and
produces 4 bits as output.

THE STRENGTH OF DES
 With a key length of 56 bits, there are 256 possible keys, which is approximately 7.2 x 1016.
 A brute-force attack appears impractical.
 Assuming that, on average, half the key space has to be searched, a single machine
performing one DES encryption per microsecond would take more than a thousand years to
break the cipher.
 Diffie and Hellman postulated that the technology existed to build a parallel machine with 1
million encryption devices, each of which could perform one encryption per microsecond.
This would bring the average search time down to about 10 hours.
The Use of 56-Bit Keys

The Nature of the DES Algorithm
 Possibilities of cryptanalysis is done by finding the characteristics of DES algorithm.
 Learning of S-Box logic is complex.
 Weakness of the S-boxes not been discovered.

Timing Attacks
 A timing attack is one in which information about the key or the plaintext is
obtained by observing how long it takes a given implementation to perform
decryptions on various ciphertexts.
 A timing attack exploits the fact that an encryption or decryption algorithm
often takes slightly different amounts of time on different inputs.
 DES appears to be fairly resistant to a successful timing attack.

Block Cipher Design Principles
 There are three critical aspects of block cipher design: the number of rounds,
design of the function F, and key scheduling.

Number of Rounds
 The greater the number of rounds, the more difficult it is to perform cryptanalysis,
even for a relatively weak F.
 In general, the criterion should be that the number of rounds is chosen so that
known cryptanalytic efforts require greater effort than a simple brute-force key
search attack. This criterion was certainly used in the design of DES.

Design of Function F
 The heart of a Feistel block cipher is the function F, which provides the
element of confusion in a Feistel cipher. Thus, it must be difficult to
“unscramble” the substitution performed by F.
 F must be nonlinear. The more nonlinear F, the more difficult any type of
cryptanalysis will be.

Key Schedule Algorithm
 With any Feistel block cipher, the key is used to generate one subkey for each
round.
 In general, we would like to select subkeys to maximize the difficulty of
deducing individual subkeys and the difficulty of working back to the main key.

Advanced Encryption Standard
 The Rijndael proposal for AES defined a cipher in which the block length and
the key length can be independently specified to be 128 bits.
AES Parameters(in bits)
Keysize 128 192 256
Plaintext block
size
128 128 128
Number of
rounds
10 12 14
Round key size 128 128 128
Expanded key
size
176 208 240

Rijndael was designed to have the following characteristics:
 Resistance against all known attacks
 Speed and code compactness on a wide range of platforms
 Design simplicity

 The input to the encryption and decryption algorithms is a single 128-bit block, this
block is depicted as a square matrix of bytes.
 This block is copied into the State array, which is modified at each stage of
encryption or decryption.
 After the final stage, State is copied to an output matrix.
 Similarly, the 128-bit key is depicted as a square matrix of bytes. This key is then
expanded into an array.

Figure(a). AES Data Structures

Figure(b). AES
Encryption and
Decryption

Detailed structure
 It is not a Feistel structure. In this process the entire data block in parallel during each
round using substitutions and permutation.
 The key that is provided as input is expanded into an array of forty-four 32-bit words, w[i].
Four distinct words (128 bits) serve as a round key for each round; these are indicated in
Figure(b).
 Four different stages are used, one of permutation and three of substitution:
 Substitute bytes: Uses an S-box to perform a byte-by-byte substitution of the block
 ShiftRows: A simple permutation
 MixColumns: A substitution that makes use of arithmetic
 AddRoundKey: A simple bitwise XOR of the current block with a portion of the expanded key

 The structure is quite simple. For both encryption and decryption, the cipher begins
with an AddRoundKey stage, followed by nine rounds that each includes all four stages,
followed by a tenth round of three stages.
 Only the AddRoundKey stage makes use of the key. For this reason, the cipher begins
and ends with an AddRoundKey stage.
 The AddRoundKey stage is, in effect, a form of Vernam cipher and by itself would not
be formidable. The other three stages together provide confusion, diffusion, and
nonlinearity. This scheme is both efficient and highly secure.
 Each stage is easily reversible. For the Substitute Byte, ShiftRows, and MixColumns
stages, an inverse function is used in the decryption algorithm. For the AddRoundKey
stage, the inverse is achieved by XORing the same round key to the block, using the
result that A B B = B.

 Once it is established that all four stages are reversible, it is easy to verify that
decryption does recover the plaintext. At each horizontal point (e.g., the dashed
line in the figure), State is the same for both encryption and decryption.
 The final round of both encryption and decryption consists of only three stages.
Again, this is a consequence of the particular structure of AES and is required to
make the cipher reversible.

Substitute Bytes Transformation
 There are two types of substitute bytes operations. Forward substitute byte operation in
encryption. Inverse substitute byte operation in decryption.
 Uses an s-box to perform byte-by-byte substitution of the block.
 AES has a 16X16 matrix of byte values called as an s-box. It contains all possible 256 8-bit
values.
 Each individual byte of State is mapped into a new byte in the following way:
 The leftmost 4 bits of the byte are used as a row value and the rightmost 4 bits are used as a
column value. These row and column values serve as indexes into the S-box to select a unique 8-bit
output value.
 Goto S-box and take a value from column and row and take the value from s-box and replace this
value with in value in input matrix.
Ex: in4= EA( E means 14, A means 10)
So consider a value s-box in 14th column and row 10th row. Let it be s4.

Shift Rows Transformation
Shift row transformation are two types.
 Forward Shift row transformation which is used in encryption.
 Inverse Shift row transformation which is used in decryption.

FORWARD SHIFT ROW TRANSFORMATION
 The first row of State matrix is not altered.
 For the second row, a 1-byte circular left shift is performed.
 For the third row, a 2-byte circular left shift is performed.
 For the fourth row, a 3-byte circular left shift is performed.
The following is an example of ShiftRows:

INVERSE SHIFT ROWS
 Performs the circular shifts in the opposite direction for each of the last three rows,
with a one byte circular right shift for the second row and soon.

MIX COLUMNS TRANSFORMATION
Mix columns transformation are two types.
 Forward Mix columns transformation which is used in encryption.
 Inverse Mix columns transformation which is used in decryption.

Forward Mix columns transformation
 Forward Mix columns transformation called mix columns, operates on each column
individually. Each byte of a column is mapped into a new value that is a function of
all 4 bytes in that column. The transformation can be defined by the following
matrix multiplication on state.

inverse Mix columns transformation
 The inverse mix column transformation, called InvMixColumns, is defined by the
following matrix multiplication:

AddRoundKey Transformation
 In the forward add round key transformation, called AddRoundKey, the 128
bits of State are bitwise XORed with the 128 bits of the round key.
 The inverse add round key transformation is identical to the forward add
round key transformation, because the XOR operation is its own inverse.

AES Key Expansion
 The 128 bit key value can be expanded into 44 words i.e. 44X32=1408bits
 In each round 4 words will be used i.e. 4x32=128 bits
 In Addroundkey first 4 words w0,w1,w2,w3 are used.
 In first round,w4,w5,w6,w7 are used and soon.

The 128 bit key is expanded as follows
 First 128 bit key is arranged as a 4x4 matrix each value size is 8-bits
 The first 32 bits (k0,k1,k2,k3) is considered as w0.
 Next 4 words w4,w5,w6,w7 are followed as
w4=w0 w3
w5=w1 w4
w6=w2 w5
w7=w3 w6

Block Cipher Modes of Operation
 A block cipher algorithm is a basic building block for providing data security. To apply a
block cipher in a variety of applications, different "modes of operation" have been
defined by NIST.
 In essence, a mode of operation is a technique for enhancing the effect of a
cryptographic algorithm or adapting the algorithm for an application, such as applying a
block cipher to a sequence of data blocks or a data stream.
 The modes are intended to cover virtually all the possible applications of encryption for
which a block cipher could be used.

Electronic Codebook Mode
 The simplest mode is the electronic codebook (ECB) mode, in which plaintext is
handled one block at a time and each block of plaintext is encrypted using the same
key (Figure a & b).
 The term codebook is used because, for a given key, there is a unique ciphertext for
every b-bit block of plaintext.
 For a message longer than b bits, the procedure is simply to break the message into
b-bit blocks, padding the last block if necessary. Decryption is performed one block
at a time, always using the same key. In Figure, the plaintext (padded as necessary)
consists of a sequence of b-bit blocks, P1, P2,..., PN; the corresponding sequence of
ciphertext blocks is C1, C2,..., CN.

Figure . Electronic Codebook (ECB) Mode

 The ECB method is ideal for a short amount of data, such as an encryption key. Thus,
if you want to transmit a DES key securely, ECB is the appropriate mode to use.
 The most significant characteristic of ECB is that the same b-bit block of plaintext, if
it appears more than once in the message, always produces the same ciphertext.
 For lengthy messages, the ECB mode may not be secure.
 If the message is highly structured, it may be possible for a cryptanalyst to exploit
these regularities. For example, if it is known that the message always starts out with
certain predefined fields, then the cryptanalyst may have a number of known
plaintext-ciphertext pairs to work with. If the message has repetitive elements, with
a period of repetition a multiple of b bits, then these elements can be identified by
the analyst. This may help in the analysis or may provide an opportunity for
substituting or rearranging blocks.

Cipher Block Chaining Mode
 To overcome the security deficiencies of ECB, we would like a technique in
which the same plaintext block, if repeated, produces different ciphertext
blocks.
 A simple way to satisfy this requirement is the cipher block chaining (CBC)
mode.
 In this scheme, the input to the encryption algorithm is the XOR of the
current plaintext block and the preceding ciphertext block; the same key is
used for each block.
 In effect, we have chained together the processing of the sequence of
plaintext blocks.
 The input to the encryption function for each plaintext block bears no fixed
relationship to the plaintext block. Therefore, repeating patterns of b bits
are not exposed.

Figure : Cipher Block Chaining (CBC) Mode

 For decryption, each cipher block is passed through the decryption algorithm. The
result is XORed with the preceding ciphertext block to produce the plaintext block.
 To produce the first block of ciphertext, an initialization vector (IV) is XORed with the
first block of plaintext.
 On decryption, the IV is XORed with the output of the decryption algorithm to recover
the first block of plaintext. The IV is a data block that is that same size as the cipher
block.
 The IV must be known to both the sender and receiver but be unpredictable by a
third party.
 For maximum security, the IV should be protected against unauthorized changes. This
could be done by sending the IV using ECB encryption.
 Because of the chaining mechanism of CBC, it is an appropriate mode for encrypting
messages of length greater than b bits.
 CBC mode can be used for authentication.

Cipher Feedback Mode
 The DES scheme is essentially a block cipher technique that uses b-bit blocks.
 However, it is possible to convert DES into a stream cipher, using either the cipher
feedback (CFB) or the output feedback mode.
 Figure depicts the CFB scheme. In the figure, it is assumed that the unit of transmission
is s bits; a common value is s = 8. As with CBC, the units of plaintext are chained
together, so that the ciphertext of any plaintext unit is a function of all the preceding
plaintext. In this case, rather than units of b bits, the plaintext is divided into segments
of s bits.

First, consider encryption.
 The input to the encryption function is a b-bit shift register that is initially set
to some initialization vector (IV).
 The leftmost (most significant) s bits of the output of the encryption function
are XORed with the first segment of plaintext P1 to produce the first unit of
ciphertext C, which is then transmitted.
 In addition, the contents of the shift register are shifted left by s bits and C
is placed in the rightmost (least significant) s bits of the shift register.
 This process continues until all plaintext units have been encrypted.

For decryption, the same scheme is used,
 except that the received ciphertext unit is XORed with the output of the
encryption function to produce the plaintext unit.
Let Ss(X) be defined as the most significant s bits of X. Then
C1 = P1 Ss[E(K,IV)]
Therefore,
P1 = C1 Ss [E(K, IV)]

Figure. s-bit Cipher Feedback (CFB) Mode

Output Feedback Mode
 The output feedback (OFB) mode is similar in structure to that of CFB, as illustrated in
Figure. As can be seen, it is the output of the encryption function that is fed back to
the shift register in OFB, whereas in CFB the ciphertext unit is fed back to the shift
register.
 One advantage of the OFB method is that bit errors in transmission do not propagate.
For example, if a bit error occurs in C1 only the recovered value of is P1 affected;
subsequent plaintext units are not corrupted. With CFB, C1 also serves as input to the
shift register and therefore causes additional corruption downstream.
 The disadvantage of OFB is that it is more vulnerable to a message stream
modification attack than is CFB.

Figure. s-bit Output Feedback (OFB) Mode

Counter Mode
 In CTR mode a counter, equal to the plaintext block size is used. The only requirement is
that the counter value must be different for each plaintext block that is encrypted.
Typically, the counter is initialized to some value and then incremented by 1 for each
subsequent block. For encryption, the counter is encrypted and then XORed with the
plaintext block to produce the ciphertext block; there is no chaining. For decryption, the
same sequence of counter values is used, with each encrypted counter XORed with a
ciphertext block to recover the corresponding plaintext block.
Advantages:
1. Hardware efficiency
2. Software efficiency
3. Preprocessing
4. Random access
5. Provable security
6. Simplicity

Blowfish Encryption Algorithm
 Blowfish was designed in 1993 by Bruce Scheier as a fast, alternative to existing encryption
algorithms such AES, DES and 3 DES etc.
 Blowfish was designed to have the following characteristics:
 Fast: Blowfish encrypts data on 32-bit microprocessor at rate of 18 clock cycles per byte.
 Compact: Blowfish can run in less than 5K of memory.
 Simple: Blowfish’s simple structure is easy to implement and eases the task of determining the
strength of the algorithm.
 Variable secure: The key length is variable and can be as long as 448 bits. default 128 bits key
length
 It is suitable for applications where the key does not change often, like communication link or an
automatic file encryptor.

Subkey and S-box generation
 Blowfish makes use of a key that ranges from 32 bits to 448 bits (1 to 14 32-bit words).
 That key is used to generate 18 32-bit subkeys and four 8x32 S-boxes containing a total
of 1024 32-bit entries. The total is 1042 32-bit values, or 4168 bytes.
The keys are stored in a K-array:
K1K2..Kj , ,, … , 1≤ j ≤ 14
The subkeys are stored in the P-array:
P1P2….. P18
There are four S-boxes each with 256 32-bit entries:
S1,0, S1,1,………. S1,255
S2,0, S2,1,……….. S2,255
S3,0, S3,1,……….. S3,255
S4,0, S4,1,..............S4,255

The steps in generating P-array and S-boxes are as follows:
1. Initialize first the P-array and then the four S-boxes in order using the bits of the
fractional part of the constant π . Then the leftmost 32 bits of the fractional part of π
become P1, and so on.
P1 = 0x243f6a88, P2 = 0x85a308d3, P3 = 0x13198a2e, P4 = 0x03707344, etc.
2. Perform a bitwise XOR of the P-array and the K-array, reusing words from the K-array
as needed. For example, for the maximum length key (14 32-bit words), P1=P1 ⊕ K 1,
P2=P2 ⊕ K 2,… P14=P14 ⊕ K14. P15=P15 ⊕K1… P18=P18⊕K4
3. Encrypt the 64-bit block of all zeros using the current P- and S-arrays; replace P1 and
P2 with the output of the encryption.
4. Encrypt the output of step 3 using the current P- and S arrays and replace P3 and P4
with the resulting ciphertext.
5. Continue this procedure to update all elements of P and then, in order, all elements of
S, using at each step the output of the continuously changing Blowfish algorithm.

Encryption and Decryption
 Blowfish uses two primitive operations:
Addition: Addition of words, denoted by +.
Bitwise exclusive-OR: The operation is denoted by ⊕ .
 The plaintext is divided into two 32-bit halves LE0 and RE0.

INTERNATIONAL DATA ENCRYPTION
ALGORITHM(IDEA)
 IDEA (International Data Encryption Algorithm) was originally called IPES (Improved Proposed Encryption Standard).
 It was developed by Xuejia Lai and James L. Massey of ETH Zuria.
 IDEA was designed to be efficient to compute in software. It encrypts a 64-bit block of plaintext into a 64-bit block
of ciphertext using a 128-bit key.
 It was published in 1991, so cryptanalysts have had time to find weaknesses.
 IDEA is similar to DES in some ways.
 Both of them operate in rounds, and both have a complicated mangler function that does not have to be reversible
in order for decryption to work.
 Instead, the mangler function is run in the same direction for encryption as decryption, in both IDEA and DES.
 In fact, both DES and IDEA have the property that encryption and decryption are identical except for key
expansion.
 With DES, the same keys are used in the reverse order
 with IDEA, the encryption and decryption keys are related in a more complex manner.

Primitive Operations
 Each primitive operation in IDEA maps two 16-bit quantities into a 16-bit quantity.
 IDEA uses three operations
 ⊕-XOR,
 +-Adddition all easy to compute in software, to create a mapping.
Multiplication Operation.

 It has total 17 rounds
 In IDEA, Odd rounds accepts 4 subkeys.
 Even rounds accepts 2 subkeys.

Key expansion
 The 128-bit key is expanded into 52 16-bit keys, K1, K2,...K52.
 The key expansion is done differently for encryption than for decryption.
 Once the 52 keys are generated, the encryption and decryption operations
are the same.
 The 52 encryption keys are generated by writing out the 128-bit key and,
starting from the left, chopping off 16 bits at a time.
 This generates eight 16-bit keys

One Round
 It has 17rounds, where the odd numbered rounds are different from the even
numbered rounds.
 Each round takes the input a 64-bit quantity and treats it as four 16-bit
quantities Xa,Xb,Xc,Xd. Mathematical Operations are performed on it.
 In IDEA, Odd rounds accepts 4 subkeys.
 Even rounds accepts 2 subkeys.

CAST-128
 It is an encryption algorithm.
 It takes 64 bit plain text,128 bit key as input and produces 64-bit cipher text
as output. It has 16 rounds.

Description of Algorithm
 CAST-128 belongs to the class of encryption algorithms known as Feistel ciphers; overall operation
is thus similar to the Data Encryption Standard (DES). The full encryption algorithm is given in the
following four steps.
INPUT: plaintext m1...m64;
key K = k1...k128.
OUTPUT: ciphertext c1...c64.
1. (key schedule) Compute 16 pairs of subkeys {Kmi, Kri} from K
2. Split the plaintext into left and right 32-bit halves L0 = m1...m32 and R0 = m33...m64.
3. It has 16 rounds for i from 1 to 16, compute Li and Ri as follows:
Li = Ri-1;
Ri = Li-1 ⊕ f(Ri-1,Kmi,Kri), where f is function (f is of Type 1, Type 2, or Type 3, depending
on i).
4. c1...c64 <-- (R16,L16). (Exchange final blocks L16, R16 and concatenate to form the ciphertext.)
Decryption is identical to the encryption algorithm given above, except that the rounds (and therefore
the subkey pairs) are used in reverse order to compute (L0,R0) from (R16,L16).

Pairs of Round Keys
 CAST-128 uses a pair of subkeys per round: a 32-bit quantity “Km” is used as
a "masking" key and a 5-bit quantity “Kr” is used as a "rotation" key.

Non-Identical Rounds
Three different round functions are used in CAST-128.
The rounds are as follows
 where "D" is the data input to the f function and "Ia" - "Id" are the most
significant byte through least significant byte of I, respectively).
 All functions uses the operation "+" and "-" are addition and subtraction ⊕
XOR, and "<<<" is the circular left-shift operation.

Type 1: I = ((Kmi + D) <<< Kri)
f = ((S1[Ia] ⊕ S2[Ib]) - S3[Ic]) + S4[Id]
Type 2: I = ((Kmi ⊕ D) <<< Kri)
f = ((S1[Ia] - S2[Ib]) + S3[Ic]) ⊕ S4[Id]
Type 3: I = ((Kmi - D) <<< Kri)
f = ((S1[Ia] + S2[Ib]) ⊕ S3[Ic]) - S4[Id]
Rounds 1, 4, 7, 10, 13, and 16 use f function Type 1.
Rounds 2, 5, 8, 11, and 14 use f function Type 2.
Rounds 3, 6, 9, 12, and 15 use f function Type 3.

Three rounds of
the CAST-128
block cipher

Substitution Boxes
 CAST-128 uses eight substitution boxes:
s-boxes S1, S2, S3, and S4 are round function s-boxes;
S5, S6, S7, and S8 are key schedule s-boxes.

Masking Subkeys And Rotate Subkeys
Let Km1, ..., Km16 be 32-bit masking subkeys (one per round).
Let Kr1,…., Kr16 be 32-bit rotate subkeys (one per round); only the least significant 5 bits are
used in each round.
for (i=1; i<=16; i++)
{ Kmi = Ki;
Kri = K16+i; }

Unit 2

More Related Content

What's hot (20)

Similar to Unit 2 (20)

More from KRAMANJANEYULU1 (8)

Recently uploaded (20)

Unit 2