Security - Telenor

6
In 1997, NIST initiated the process of finding a
successor to DES, known as the Advance Encryption
Standard (AES). The selection process
for AES is the theme of an article by Lars Knudsen
in this issue of Telektronikk.
3.2 Stream Ciphers and
Block Ciphers
Symmetric algorithms are usually divided into
block and stream ciphers.
A block cipher breaks the plaintext message into
strings (blocks) of a fixed length (the block
length and encrypts one block at a time. With a
given key, a pure block cipher will always produce
the same ciphertext from a given plaintext.
In many applications this is not a favourable feature,
and some kind of feedback must be introduced.
A stream cipher produces a key stream k 1 k 2 k 3 ...
The key stream is combined with plaintext
stream p 1 p 2 p 3 ... using a simple transformation E
and producing the ciphertext C = c 1 c 2 c 3 ..., with
c i = E(p i , k i ). Usually, E is the XOR operation, i.e.
c 1 = p 1 ⊕ k 1 , c 2 = p 2 ⊕ k 2 , c 3 = p 3 ⊕ k 3 ...
In a synchronous stream cipher, the sender and
the receiver must be synchronized to allow for
correct decryption. This means that they must
use the same key stream and operate at the same
position in that key stream. If the synchronization
is lost, decryption will fail, and re-synchronization,
e.g. re-initialization of the stream
cipher is necessary.
In contrast, in a self-synchronizing stream cipher
the key stream is generated as a function of the
encryption key and a fixed number of previous
key stream bits. If ciphertext bits are deleted or
inserted, only a fixed number of plaintext bits
will come out garbled before the synchronization
is re-established.
Most stream ciphers are based on linear feedback
shift registers, a structure very well suited
for fast hardware implementations. The ciphers
that protect the confidentiality of the radio communication
in GSM and UMTS are both stream
ciphers.
The difference between stream ciphers and block
ciphers is a bit “academic”. Observe that a
stream cipher may be considered a block cipher
with block length 1. On the other hand, there are
standardized modes of operation that turn a
block cipher into a stream cipher.
3.3 Building a (Symmetric)
Block Cipher
Obviously, an encryption function E must be
complex, preventing unauthorized reversal of the
transformation. Modern block ciphers achieve
this goal by combining simple functions in
clever ways.
3.3.1 Confusion and Diffusion
Ciphers are based on two basic techniques (operations);
transpositions and substitutions. A
transposition changes the order of the symbols
(permutation), without changing the symbols
themselves. In a substitution, each symbol is
replaced by another symbol (from the same
or some other alphabet).
3.3.2 Product Ciphers
Almost all modern block ciphers are product
ciphers. The idea is to build a complex encryption
function by composing several simple functions,
each offering some, but not adequate, protection.
The simple functions are then combined
in such a way that the combination is more
secure than the individual components. Basic
operations include transpositions, linear transformations,
arithmetic operations, modular multiplications
and simple substitutions.
3.3.3 Iterated Ciphers
An iterated block cipher involves a sequential
repetition of an internal function called a round
function. Let F be the round function, r the number
of rounds, and let T i be the temporary output
of the round function. Then we get these equations:
T 1 = F(T 0 , K 1 )
T 2 = F(T 1 , K 2 )
.
.
.
T r = F(T r-1 , K r )
The plaintext is the input to the first round (T 0 ),
and the ciphertext is the output from the last (r th )
round (T r ). The K i are the round-keys that are
derived from the encryption key K according
to the key scheduling. In order to make unique
decryption possible, the round function must
be a bijection for all round-keys K i .
3.3.4 Feistel Ciphers
A Feistel cipher is an r-round iterated block
cipher with block length 2t. The plaintext is the
ordered pair (L 0 , R 0 ), where the t-bit values L 0
and R 0 represent the left and right half-block,
respectively. In each round i, 1 ≤ i ≤ r, (L i-1 , R i-1 )
is mapped to (L i , R i ) as follows:
Telektronikk 3.2000