This preview shows page 1. Sign up to view the full content.
Unformatted text preview: his convention with DES and numbers his bits from right to left and from 0 to 63. It’s enough to drive you mad.) The 4 output bits from Sbox 5 are c17 c18 c19 and c20. We can trace b26 backwards from the input to the Sbox. The bit a26 is XORed with a bit from the subkey Ki,26 to obtain b26. And bit X17 goes through the expansion permutation to become a26. After the Sbox, the 4 output bits go through the Pbox to become 4 output bits of the round function: Y3 Y8 Y14 and Y25. This means that with probability ½  5/16 : Figure 12.8 A 1round linear approximation for DES. X17 • Y3 • Y8 • Y14 • Y25 = Ki,26 Linear approximations for different rounds can be joined in a manner similar to that discussed under differential cryptanalysis. Figure 12.9 is a 3round approximation with a probability of ½ + .0061. The individual approximations are of varying quality: The last is very good, the first is pretty good, and the middle is bad. But together the three 1round approximations give a very good threeround approximation. The basic attack is to use the best linear approximation for 16round DES. It requires 247 known plaintext blocks, and will result in 1 key bit. That’s not very useful. If you interchange the role of plaintext and ciphertext and use decryption as well as encryption, you can get 2 key bits. That’s still not very useful. Figure 12.9 A 3round linear approximation for DES. There are refinements. Use a 14round linear approximation for rounds 2 through 15. Guess the 6 subkey bits relevant to Sbox 5 for the first and last rounds (12 key bits in all). Effectively you are doing 212 linear cryptanalyses in parallel and picking the correct one based on probabilities. This recovers the 12 bits plus the b26 and reversing plaintext and ciphertext recovers another 13 bits. To get the remaining 30 bits, use exhaustive search. There are other tricks, but that’s basically it. Against full 16round DES, this attack can recover the key with an average of 243 known plaintexts. A software implementation of this attack recovered a DES key in 50 days using 12 HP9000/735 workstations [1019]. That is the most effective...
View
Full
Document
This note was uploaded on 10/18/2010 for the course MATH CS 301 taught by Professor Aliulger during the Fall '10 term at Koç University.
 Fall '10
 ALIULGER
 Cryptography

Click to edit the document details