This preview shows page 1. Sign up to view the full content.
Unformatted text preview: 5. Now store the pairs (k1 , k2 ) in S , if (z1 , k1 ) and (z2 , k2 ) are such that
z1 = z2 .
At the end of this algorithm S will contain all the possible pairs that satisfy
y = DESk (x).
Given another two plaintext/ciphertext pairs and trying all the elements of S
with respect to these pairs will enable the adversary to identify the correct
(k1 , k2 ) with high probability. 5.10
(a) Each round of DES is now given by the following rule:
Li
Ri
1 Mote =
= that z = (L8 , R8 ) R i− 1 L i− 1 ⊕ f k i ( R i− 1 ) = L i − 1 ⊕ ( R i − 1 ⊕ k i ) Fall 2010 Comp 547: Cryptography and Data Security 4 Thus, for i = 1 we have:
L1 = R0 R1 = L 0 ⊕ R0 ⊕ k 1 ⇒ L 1 ⊕ R1 = L 0 ⊕ k 1
For i = 2, we have:
L2 = R2 =
= R 1 = L 0 ⊕ R0 ⊕ k 1
L 1 ⊕ R1 ⊕ k 2
L0 ⊕ k1 ⊕ k2 ⇒ L 2 ⊕ R 2 = R0 ⊕ k 2
For i = 3, we have:
L3 = R3 =
= R2 = L 0 ⊕ k 1 ⊕ k 2
L 2 ⊕ R2 ⊕ k 3
R0 ⊕ k 2 ⊕ k 3 ⇒ L 3 ⊕ R3 = L 0 ⊕ R0 ⊕ k 1 ⊕ k 3
and so on. At the 16th round we get:
L16 = R0 ⊕ k15 ⊕ k14 ⊕ k12 ⊕ ... ⊕ k5 ⊕ k3 ⊕ k2
R16 = L0 ⊕ R0 ⊕ k16 ⊕ k15 ⊕ k13 ⊕ ... ⊕ k4 ⊕ k3 ⊕ k1 that we write more concisely as L16 = R0 ⊕ K1 and R16 = L0 ⊕ R0...
View
Full
Document
This document was uploaded on 02/24/2014.
 Spring '12

Click to edit the document details