Solutions_HW4_547 (1)

# 510 a each round of des is now given by the following

This preview shows page 1. Sign up to view the full content.

This is the end of the preview. Sign up to access the rest of the document.

Unformatted text preview: 5. Now store the pairs (k1 , k2 ) in S , if (z1 , k1 ) and (z2 , k2 ) are such that z1 = z2 . At the end of this algorithm S will contain all the possible pairs that satisfy ￿ y = DESk (x). Given another two plaintext/ciphertext pairs and trying all the elements of S with respect to these pairs will enable the adversary to identify the correct (k1 , k2 ) with high probability. 5.10 (a) Each round of DES is now given by the following rule: Li Ri 1 Mote = = that z = (L8 , R8 ) R i− 1 L i− 1 ⊕ f k i ( R i− 1 ) = L i − 1 ⊕ ( R i − 1 ⊕ k i ) Fall 2010 Comp 547: Cryptography and Data Security 4 Thus, for i = 1 we have: L1 = R0 R1 = L 0 ⊕ R0 ⊕ k 1 ⇒ L 1 ⊕ R1 = L 0 ⊕ k 1 For i = 2, we have: L2 = R2 = = R 1 = L 0 ⊕ R0 ⊕ k 1 L 1 ⊕ R1 ⊕ k 2 L0 ⊕ k1 ⊕ k2 ⇒ L 2 ⊕ R 2 = R0 ⊕ k 2 For i = 3, we have: L3 = R3 = = R2 = L 0 ⊕ k 1 ⊕ k 2 L 2 ⊕ R2 ⊕ k 3 R0 ⊕ k 2 ⊕ k 3 ⇒ L 3 ⊕ R3 = L 0 ⊕ R0 ⊕ k 1 ⊕ k 3 and so on. At the 16th round we get: L16 = R0 ⊕ k15 ⊕ k14 ⊕ k12 ⊕ ... ⊕ k5 ⊕ k3 ⊕ k2 R16 = L0 ⊕ R0 ⊕ k16 ⊕ k15 ⊕ k13 ⊕ ... ⊕ k4 ⊕ k3 ⊕ k1 that we write more concisely as L16 = R0 ⊕ K1 and R16 = L0 ⊕ R0...
View Full Document

## This document was uploaded on 02/24/2014.

Ask a homework question - tutors are online