Symmetric Cryptography

What is symmetric-key cryptography?

Cryptography in which both parties use the same secret key for encryption and decryption.

What does c = e_k(m) mean?

Plaintext m is encrypted by encryption function e using secret key k to produce ciphertext c.

What does m = d_k(c) mean?

Ciphertext c is decrypted by decryption function d using secret key k to recover plaintext m.

What are the two main types of symmetric cipher?

Stream ciphers and block ciphers.

What does a stream cipher encrypt?

An arbitrary stream of bits or bytes.

What does a block cipher encrypt?

Fixed-size blocks of plaintext, one block at a time.

What is the basic stream-cipher encryption equation?

c_i = m_i XOR k_i.

Why can XOR be used for both stream-cipher encryption and decryption?

Because XORing with the same keystream twice cancels it: (m XOR k) XOR k = m.

Why are PRGs used in stream ciphers?

To generate a long pseudorandom keystream from a much shorter secret seed/key.

What does PRG stand for?

Pseudorandom Generator.

What three properties should a cryptographically secure PRG have according to the notes?

Randomness, unpredictability, and unreproducibility.

Why must a PRG seed remain secret?

If the seed is known, an attacker can determine the PRG output and reproduce the keystream.

What is the Linear Congruential Generator formula?

X_(n+1) = (aX_n + c) mod m.

Why is a Linear Congruential Generator not cryptographically secure?

An attacker can reconstruct its sequence after observing a small number of outputs.

What is the Blum Blum Shub update equation?

X_(n+1) = X_n^2 mod m.

How is m chosen in Blum Blum Shub?

m = pq, where p and q are large suitable primes.

What hard problem underlies Blum Blum Shub security?

The difficulty of factoring m = pq.

What is the main practical disadvantage of Blum Blum Shub?

It is slow and generally too inefficient for direct high-speed cipher use.

What is a synchronous stream cipher?

A stream cipher where the keystream depends only on the key.

What happens if a bit is corrupted in a synchronous stream cipher?

Only the corresponding plaintext bit is affected; the error does not propagate.

What happens if a bit is inserted or deleted in a synchronous stream cipher?

Sender and receiver lose synchronisation.

What is an asynchronous stream cipher?

A stream cipher where the keystream depends on ciphertext feedback.

What is the main synchronisation advantage of an asynchronous stream cipher?

It can automatically resynchronise after enough correct ciphertext is received.

What is the block-cipher 'codebook' idea?

For each key, the cipher defines a different mapping from every plaintext block to a ciphertext block.

Why is padding needed in block ciphers?

To complete the final plaintext block when the message length is not a multiple of the block size.

What block-size guidance do the notes give?

The block size should be reasonably large, greater than 64 bits.

What is an iterated block cipher?

A block cipher that repeatedly applies a round function.

What is a round subkey?

A key k_i derived from the main secret key and used in one round.

What is confusion?

Making the relationship between the key and ciphertext complex.

What typically provides confusion?

Substitution, especially nonlinear S-boxes.

What is diffusion?

Spreading the influence of plaintext bits across many ciphertext bits.

What typically provides diffusion?

Permutation and mixing operations.

What is an S-box?

A substitution box that replaces a small input block with another output block.

What is the avalanche effect?

Changing one input bit should change about half of the output bits on average.

What is a P-box?

A permutation box that rearranges bit positions.

What does an S-box mainly change?

Bit values.

What does a P-box mainly change?

Bit positions.

What does DES stand for?

Data Encryption Standard.

What is the DES block size?

64 bits.

What is the DES key size?

56 bits.

How many rounds does DES use?

16 rounds.

What structure does DES use?

A Feistel structure.

What are the Feistel round equations?

L_i = R_(i-1) and R_i = L_(i-1) XOR f(R_(i-1), k_i).

Why can a Feistel round be reversed even if f is not invertible?

Because XORing the same f-output twice cancels it.

How are DES round keys used during decryption?

In reverse order, from k_16 down to k_1.

What happens to the DES right half before the S-boxes?

It is expanded from 32 bits to 48 bits and XORed with a 48-bit round key.

Into how many groups is the 48-bit DES round value split?

Eight groups of 6 bits.

How many S-boxes does DES use?

Eight.

What is the input and output size of each DES S-box?

6 input bits and 4 output bits.

In a DES S-box, which input bits select the row?

The first and sixth bits.

In a DES S-box, which input bits select the column?

The middle four bits.

What happens after the DES S-boxes?

The 32 output bits are permuted using a P-box, then used in the Feistel XOR/swap.

What is the main modern weakness of DES?

Its 56-bit key is too short and vulnerable to exhaustive key search.

Why does Double DES not provide double security?

It is vulnerable to a meet-in-the-middle attack.

What does a meet-in-the-middle attack compare?

Forward values E_k1(P) with backward values D_k2(C).

Why was Triple DES introduced?

To improve security despite DES's short key by applying DES multiple times using two or three keys.

What does AES stand for?

Advanced Encryption Standard.

What algorithm was selected as AES?

Rijndael.

What is the AES block size?

128 bits.

What key sizes does AES support?

128, 192, or 256 bits.

How many rounds does AES use with a 128-bit key?

10 rounds.

How many rounds does AES use with a 192-bit key?

12 rounds.

How many rounds does AES use with a 256-bit key?

14 rounds.

Is AES a Feistel cipher?

No. AES is an iterated substitution-permutation style cipher with invertible rounds.

What is the AES state?

The 16-byte plaintext block represented as a rectangular byte array, normally a 4x4 byte matrix.

What are the four normal AES round operations in order?

SubBytes, ShiftRows, MixColumns, AddRoundKey.

What does SubBytes do?

Transforms each byte using the AES S-box.

What security property does SubBytes mainly provide?

Confusion and non-linearity.

What does ShiftRows do?

Shifts rows of the state by different offsets.

What is the purpose of ShiftRows?

To provide diffusion across columns.

What does MixColumns do?

Combines bytes within each column linearly.

What is the purpose of MixColumns?

To provide strong diffusion across the state.

What does AddRoundKey do?

XORs the state with the round key.

What happens before the first normal AES round?

An initial AddRoundKey operation.

Which AES transformation is omitted from the final round?

MixColumns.

How does AES decryption differ conceptually from DES decryption?

AES uses inverse round transformations, whereas DES uses the same Feistel process with round keys reversed.

How does AES provide confusion?

Primarily through the nonlinear SubBytes operation.

How does AES provide diffusion?

Primarily through ShiftRows and MixColumns repeated across rounds.

How does AES compare with DES in block size?

AES uses 128-bit blocks; DES uses 64-bit blocks.

How does AES compare with DES in key size?

AES uses 128/192/256-bit keys; DES uses a 56-bit key.

How does AES compare with DES in design structure?

AES uses an invertible substitution-permutation style round; DES uses a Feistel structure.

How did the AES design process differ from DES?

AES used an open design and evaluation process; DES had a closed/secret design process.

Why are block-cipher modes of operation needed?

To define how a block cipher encrypts messages longer than one block.

Which five modes are covered in the W3 notes?

ECB, CBC, OFB, CFB, and CTR.

What does ECB stand for?

Electronic Code Book.

What is the ECB encryption equation?

c_i = e_k(m_i).

What is ECB's main weakness?

Equal plaintext blocks produce equal ciphertext blocks, so patterns and repetitions are visible.

Why is ECB susceptible to block replay?

Blocks are independent, so known ciphertext blocks can be copied or reordered with limited effect on other blocks.

What does CBC stand for?

Cipher Block Chaining.

What is the CBC first-block encryption equation?

c_1 = e_k(m_1 XOR IV).

What is the CBC encryption equation for later blocks?

c_i = e_k(m_i XOR c_(i-1)).

What does IV stand for?

Initialization Vector.

Why does CBC hide repeated plaintext blocks?

Each block is combined with the previous ciphertext block, so equal plaintext blocks normally enter the cipher differently.

What does OFB stand for?

Output Feedback.

What does OFB use the block cipher to generate?

A keystream.

Is OFB synchronous or self-synchronising?

Synchronous.

How do transmission errors behave in OFB?

Errors do not propagate; corrupted ciphertext bits only affect corresponding plaintext bits.

What does CFB stand for?

Cipher Feedback.

What is the key difference between OFB and CFB?

OFB feeds back the block-cipher output; CFB feeds back ciphertext.

Is CFB synchronous or self-synchronising?

Self-synchronising.