Internet Security - Dang Thanh Binh's Page

58 INTERNET SECURITY
Since the terms of the standard stipulate that it be reviewed every five years, on
6 March 1987 the NBS published in the Federal Register a request for comments on the
second five-year review. The comment period closed on 10 December 1992. After much
debate, DES was reaffirmed as a US government standard until 1992 because there was
still no alternative for DES. The NIST again solicited a review to assess the continued
adequacy of DES to protect computer data. In 1993, NIST formally solicited comments
on the recertification of DES. After reviewing many comments and technical inputs, NIST
recommend that the useful lifetime of DES would end in the late 1990s. In 2001, the
Advanced Encryption Standard (AES), known as the Rijndael algorithm, became an FIPSapproved
advanced symmetric cipher algorithm. AES will be a strong advanced algorithm
in lieu of DES.
The DES is now a basic security device employed by worldwide organisations. Therefore,
it is likely that DES will continue to provide network communications, stored data,
passwords and access control systems.
3.1.1 Description of the Algorithm
DES is the most notable example of a conventional cryptosystem. Since it has been well
documented for over 20 years, it will not be discussed in detail here.
DES is a symmetric block cipher, operating on 64-bit blocks using a 56-bit key. DES
encrypts data in blocks of 64 bits. The input to the algorithm is a 64-bit block of plaintext
and the output from the algorithm is a 64-bit block of ciphertext after 16 rounds of
identical operations. The key length is 56 bits by stripping off the 8 parity bits, ignoring
every eighth bit from the given 64-bit key.
As with any block encryption scheme, there are two inputs to the encryption function:
the 64-bit plaintext to be encrypted and the 56-bit key. The basic building block of DES is
a suitable combination of permutation and substitution on the plaintext block (16 times).
Substitution is accomplished via table lookups in S-boxes. Both encryption and decryption
use the same algorithm except for processing the key schedule in the reverse order.
The plaintext block X is first transposed under the initial permutation IP, giving
X0 = IP(X) = (L0,R0). After passing through 16 rounds of permutation, XORs and substitutions,
it is transposed under the inverse permutation IP −1 to generate the ciphertext
block Y. If Xi = (Li,Ri) denotes the result of the ith round encryption, then we have
Li = Ri−1
Ri = Li−1 ⊕ f (Ri−1,Ki)
The ith round encryption of DES algorithm is shown in Figure 3.1. The block diagram
for computing the f(R,K)-function is shown in Figure 3.2. The decryption process can
be derived from the encryption terms as follows:
Ri−1 = Li
Li−1 = Ri ⊕ f (Ri−1,Ki) = Ri ⊕ f (Li,Ki)
If the output of the ith round encryption be Li||Ri, then the corresponding input to the
(16–i)th round decryption is Ri||Li. The input to the first round decryption is equal to