U. Glaeser

Symmetric key block ciphers are valuable for data secrecy in a storage scenario (encryption by the
data owner for an insecure data repository, and subsequent decryption by the data owner at a later time),
or in a transmission scenario (across an insecure channel between a sender and receiver that have agreed
on the secret key beforehand).
Perhaps the most popular symmetric key block cipher for the past 25 years has been the Data Encryption
Standard (DES) [9], although it may be near the end of its useful life. NIST recently announced the
Advanced Encryption Standard (AES) block cipher, which we discuss in section “Advanced Encryption
Standard (AES).”
Most modern block ciphers have an “iterated” design, where a “round function” is repeated some fixed
number of times (e.g., DES has 16 rounds). Many modern block ciphers have a “Feistel structure” [10],
which is an iterated design of a particular type. Let ( Lj
−1,
Rj
−1)
denote the output of the ( j − 1)th round,
divided into two halves for notational convenience. Then the output of the jth
round is ( Lj,
Rj),
where
Lj
= Rj
−1,
and Rj
= Lj
−1
xor f(
Rj
−1,
Kj)
for some function f.
Here Kj
is the jth
“round key,” derived from
the secret key according to some fixed schedule. Note that a block cipher with a Feistel structure is
guaranteed to be a permutation even if the function f is not invertible.
Differential Cryptanalysis
Differential cryptanalysis is a powerful statistical attack that can be applied to many symmetric key block
ciphers and unkeyed cryptographic hash functions. The first publication on differential cryptanalysis is
due to Biham and Shamir [11], but Coppersmith [12] has described how the attack was understood
during the design of the DES in the early 1970s.
The central idea of differential cryptanalysis for block ciphers is to sample a large number of pairs of
ciphertexts for which the corresponding plaintexts have a known fixed difference D (under the operation
of bitwise exclusive-or). The difference D leads to a good “characteristic” if the XOR of the ciphertexts (or
of an intermediate result during the computation of the ciphertext) can be predicted with a relatively large
probability. By calculating the frequency with which every difference of plaintexts and every difference of
ciphertexts coincides, it is possible to deduce some of the key bits through a statistical analysis of a
sufficiently large sample of these frequencies.
47
For a differential cryptanalysis of DES, the best attack that Biham and Shamir discovered requires 2
chosen plaintext pairs with a given difference. They note that making even slight changes to the S-boxes
(nonlinear substitution transformation at the heart of DES) can lead to a substantial weakening with
respect to a differential attack.
Linear Cryptanalysis
Linear cryptanalysis is another powerful attack that can be applied to many symmetric key block ciphers
and unkeyed cryptographic hash functions. Consider the block cipher as being a composition of linear
and nonlinear functions. The goal of linear cryptanalysis is to discover linear approximations for the
nonlinear components. These approximations can be folded into the specification of the block cipher,
and then expanded to find an approximate linear expression for the ciphertext output bits in terms of
plaintext input bits and secret key bits. If the approximations were in fact perfect, then enough plaintextciphertext
pairs would yield a system of linear equations that could be solved for the secret key bits;
however, even when the approximations are far from perfect, they enable a successful statistical search
for the key, given enough plaintext-ciphertext pairs. This is a known-plaintext attack, unlike differential
cryptanalysis, which is chosen-plaintext.
Linear cryptanalysis was introduced by Matsui and Yamagishi [13]. Matsui applied linear cryptanalysis
43
to DES [14]. In his best attack, 2 known plaintexts are required to break DES with an 85% probability.
See Langford and Hellman [15] for close connections between differential and linear cryptanalysis.
Advanced Encryption Standard (AES)
In 1997, NIST began an effort to develop a new symmetric key encryption algorithm as a Federal Information
Processing Standard (FIPS). The goal was to replace the DES, which was widely perceived to be
© 2002 by CRC Press LLC