Security - Telenor

L i = R i-1 , R i = L i-1 ⊕ F(R i-1 , K i ) (4)
where K i is the round-key of round i. DES is an
example of a Feistel cipher.
3.3.5 Round Keys (Key Scheduling)
In the round function, the output of the last
round is mixed with the current round-key.
Typically, these entities are approximately
equal in length, i.e. equal to the block length.
The encryption key must be expanded (typically
r-fold). Ideally, all round-key bits should be
dependent on all encryption key bits to maintain
maximal entropy. The expansion of the encryption
key to round keys is known as key scheduling.
3.3.6 S-boxes
An m × n substitution box or S-box is a mapping
that takes an m-bit input and returns an n-bit output.
A one-to-one n × n S-box is a permutation.
S is non-linear if for two numbers a and b, where
a ≠ b, S(a) ⊕ S(b) is not equal to S(a ⊕ b). Sboxes
are typically used to provide non-linearity
(often they are only non-linear operations in an
encryption algorithm), and are thus very important.
A number of criteria for selection (generation)
and testing of S-boxes have been proposed, i.e.
the strict avalanche criterion (SAC), which states
that flipping one input bit should cause a change
in (on average) 50 % of the output bits.
S-boxes are generally visualized and implemented
as look-up tables, but some may additionally
be computed arithmetically. Smart-card
implementations of look-up tables are vulnerable
to power attacks (attacks that measure power
consumption on the chip when performing encryption).
Countermeasures to power attacks
include duplicating the look-up tables in RAM;
thus large S-boxes are more difficult to protect
than small ones. If an S-box can be implemented
arithmetically, protection against power attacks
becomes much easier.
3.4 Public Keys
In 1976, Diffie, Merkle, and Hellman described
the principles for asymmetric or public key cryptography.
The principle is to use different keys
for encryption and decryption, thereby avoiding
some key management problems. In addition,
asymmetric cryptography presents the ability
to make digital signatures, with approximately
the same features as ordinary hand-written signatures.
It has turned out that researchers at the
British Communications-Electronics Security
Group (CESG) discovered these principle as
Telektronikk 3.2000
early as 1970; see [2]. This work was, however,
not made available to the non-governmental
crypto-community until 1997.
In a traditional (symmetric) cipher, the sender
and the receiver must have access to a common,
secret key. This key must be distributed in a
secure way before the communication takes
place. In an asymmetric cipher, each user has a
private and a public key. Asymmetric ciphers
are therefore often called public key ciphers. In
principle there is a distinction here, as it is conceivable
to have an asymmetric cipher without
public keys. The distinction is, however, somewhat
academic, and no secret-key asymmetric
cipher has been published, so we will treat these
as synonyms. The private key is only known to
the user (it is called “private” rather than
“secret” in order to avoid confusion with symmetric
ciphers), while the public key is broadcast
to all parties the user wants to communicate
securely with.
A message that is encrypted with a public key
can only be decrypted with the corresponding
private key, and vice versa. Knowledge of a private
key shall not make it possible to reconstruct
the corresponding private key.
3.4.1 Usage
Assume that Alice wants to send a confidential
message to Bob. Alice encrypts the message
with Bob’s public key. Now only somebody who
has access to Bob’s private key (presumably
only Bob) can decrypt and read the message.
Assume on the other hand that Alice does not
care about secrecy, but she wants every reader of
the message to be sure that Alice is the source.
She then encrypts the message with her own private
key. Now everybody with knowledge of
Alice’s public key can read the message. In addition,
since the message can be decrypted with
Alice’s public key, only Alice can have encrypted
it. This is a kind of electronic signature.
Alice can combine these features by first encrypting
the message with her own private key,
and then encrypt the result with Bob’s public
key. Now only Bob can decrypt and read the
message, and he can be convinced that Alice
is the source.
Asymmetric ciphers are typically much slower
than symmetric. Hybrid systems are common,
where messages are encrypted with a symmetric
cipher, while the (symmetric) key(s) are protected
with an asymmetric cipher. An efficient
variation of the digital signature above, is to
generate a hash value (or checksum) of the message,
encrypt it with one’s private key and send
it together with the message. A recipient can
7