LECTURE 4: BLOCK CIPHER ENCRYPTION

INTRODUCTION

The objective of this chapter is to illustrate the principles of modern symmetric ciphers. For this
purpose, we focus on the most widely used symmetric cipher: the Data Encryption Standard
(DES). Although numerous symmetric ciphers have been developed since the introduction of
DES, and although it is destined to be replaced by the Advanced Encryption Standard (AES),
DES remains the most important such algorithm. Furthermore, a detailed study of DES provides
an understanding of the principles used in other symmetric ciphers.

Key Points of this Lecture

 A block cipher is an encryption/decryption scheme in which a block of plaintext is treated
as a whole and used to produce a ciphertext block of equal length.
 Many block ciphers have a Feistel structure. Such a structure consists of a number of
identical rounds of processing. In each round, a substitution is performed on one-half of
the data being processed, followed by a permutation that interchanges the two halves.
The original key is expanded so that a different key is used for each round.
 The Data Encryption Standard (DES) has been the most widely used encryption
algorithm until recently. It exhibits the classic Feistel structure. DES uses a 64-bit block
and a 56-bit key.
 Two important methods of cryptanalysis are differential cryptanalysis and linear
cryptanalysis. DES has been shown to be highly resistant to these two types of attacks.

The Block Cipher Principle

Stream Ciphers and Block Ciphers
A stream cipher is one that encrypts a digital data stream one bit or one byte at a time. Examples of
classical stream ciphers are the autokey Vigenère cipher and the Vernam cipher.
A block cipher is one in which a block of plaintext is treated as a whole and used to produce a ciphertext
block of equal length. Typically, a block size of 64 or 128 bits is used.

The Feistel Cipher

Feistel proposed that we can approximate the ideal block cipher by utilizing the concept of a product
cipher, product cipher- is the execution of two or more simple ciphers in sequence in such a way that the
final result or product is cryptographically stronger than any of the component ciphers. The essence of the
approach is to develop a block cipher with a key length of k bits and a block length of bits, allowing a
total of possible transformations, rather than the 2n! transformations available with the ideal block cipher.
In particular, Feistel proposed the use of a cipher that alternates substitutions and permutations, where
these terms are defined as follows:
  Substitution: Each plaintext element or group of elements is uniquely replaced by a
corresponding ciphertext element or group of elements.
 Permutation: A sequence of plaintext elements is replaced by a permutation of that sequence.
That is, no elements are added or deleted or replaced in the sequence, rather the order in which
the elements appear in the sequence is changed.
In fact, Feistel’s is a practical application of a proposal by Claude Shannon to develop a product cipher
that alternates confusion and diffusion functions.
Feistel Cipher Structure
The left-hand side of Figure 1 depicts the structure proposed by Feistel. The inputs to the encryption
algorithm are a plaintext block of length bits and a key. The plaintext block is divided into two halves,
and. The two halves of the data pass through rounds of processing and then combine to produce the
ciphertext block. Each round has inputs derived from the previous round, as well as a subkey derived
from the overall. In general, the subkeys are different from and from each other. In Figure 1, 16 rounds
are used, although any number of rounds could be implemented.
All rounds have the same structure. A substitution is performed on the left half of the data. This is done
by applying a round function F to the right half of the data and then taking the exclusive OR of the output
of that function and the left half of the data.
Following this substitution, a permutation is performed that consists of the interchange of the two halves
of the data. This structure is a particular form of the substitution-permutation network (SPN) proposed by
Shannon.
 Figure 1: Feistel Encryption and Decryption
The exact realization of a Feistel network depends on the choice of the following parameters and design
features:
 Block size: Larger block sizes mean greater security (all other things being equal) but reduced
encryption/decryption speed for a given algorithm. Greater security is achieved by greater
 diffusion. Traditionally, a block size of 64 bits has been considered a reasonable tradeoff and was
nearly universal in block cipher design. However, the new AES uses a 128-bit block size.
 Key size: Larger key size means greater security but may decrease encryption/ decryption speed.
The greater security is achieved by greater resistance to brute-force attacks and greater confusion.
Key sizes of 64 bits or less are now widely considered to be inadequate, and 128 bits have
become a common size.
 The number of rounds: The essence of the Feistel cipher is that a single round offers inadequate
security but that multiple rounds offer increased security. A typical size is 16 rounds.
 Subkey generation algorithm: Greater complexity in this algorithm should lead to the greater
difficulty of cryptanalysis.
 Round function F: Again, greater complexity generally means greater resistance to
cryptanalysis.
There are two other considerations in the design of a Feistel cipher:
 Fast software encryption/decryption: In many cases, encryption is embedded in applications or
utility functions in such a way as to preclude hardware implementation. Accordingly, the speed of
execution of the algorithm becomes a concern.
 Ease of analysis: Although we would like to make our algorithm as difficult as possible to
cryptanalysis, there is great benefit in making the algorithm easy to analyze. That is, if the
algorithm can be concisely and clearly explained, it is easier to analyze that algorithm for
cryptanalytic vulnerabilities and therefore develop a higher level of assurance as to its strength.
DES, for example, does not have an easily analyzed functionality.
Feistel Decryption Algorithm
The process of decryption with a Feistel cipher is essentially the same as the encryption process. The rule
is as follows: Use the ciphertext as input to the algorithm, but use the subkeys in reverse order. That is,
use in the first round, in the second round, and so on, until is used in the last round. This is a nice feature
because it means we need not implement two different algorithms; one for encryption and one for
decryption.
THE DATA ENCRYPTION STANDARD (DES)
The most widely used encryption scheme is based on the Data Encryption Standard (DES) adopted in
1977 by the National Bureau of Standards, now the National Institute of Standards and Technology
(NIST), as Federal Information Processing Standard (FIPS). The algorithm itself is referred to as the Data
Encryption Algorithm (DEA). For DES, data are encrypted in 64-bit blocks using a 56-bit key. The
algorithm transforms 64-bit input in a series of steps into a 64-bit output. The same steps, with the same
key, are used to reverse the encryption.
DES ENCRYPTION
The overall scheme for DES encryption is illustrated in Figure 2. As with any encryption scheme, there
are two inputs to the encryption function: the plaintext to be encrypted and the key. In this case, the
plaintext must be 64 bits in length and the key is 56 bits in length.
 Figure 2: General Depiction of DES Encryption
Looking at the left-hand side of the figure, we can see that the processing of the plaintext proceeds in
three phases. First, the 64-bit plaintext passes through an initial permutation (IP) that rearranges the bits
to produce the permuted input. This is followed by a phase consisting of sixteen rounds of the same
function, which involves both permutation and substitution functions. The output of the last (sixteenth)
round consists of 64 bits that are a function of the input plaintext and the key. The left and right halves of
the output are swapped to produce the pre-output. Finally, the pre-output is passed through a permutation
that is the inverse of the initial permutation function, to produce the 64-bit ciphertext. With the exception
of the initial and final permutations, DES has the exact structure of a Feistel cipher, as shown in Figure 2.
The right-hand portion of Figure 2 shows the way in which the 56-bit key is used. Initially, the key is
passed through a permutation function. Then, for each of the sixteen rounds, a subkey ( Ki) is produced
by the combination of a left circular shift and a permutation. The permutation function is the same for
each round, but a different subkey is produced because of the repeated shifts of the key bits.