6 t h S E M E S T E R – D a t a Security (BEC613B)

M O DU L E - 1
CLASSICAL ENCRYPTION TECHNIQUES AND BLOCK CIPHER

Classical Encryption Techniques: Symmetric cipher model, Substitution techniques (excluding Hill
cipher)
Block Ciphers: Traditional Block Cipher structure, The AES Cipher. Block Cipher Modes of Operation.

Dr. MANJULA EMMI

Associate professor
DEPARTMENT OF ELECTRONICS AND COMMUNICATION ENGINEERING
[Link] INSTITUTE OF TECHNOLOGY

Dr. Manjula Emmi. Dept. ECE SGBIT

 Module-1 Data Security (BEC613B)

CLASSICAL ENCRYPTION TECHNIQUES

Symmetric Cipher Model:
A symmetric encryption scheme has five ingredients :
■ Plaintext: This is the original intelligible message or data that is fed into
the algorithm as input.
■ Encryption algorithm: The encryption algorithm performs various
substitutions and transformations on the plaintext.
■ Secret key: The secret key is also input to the encryption algorithm. The
key is a value independent of the plaintext and of the algorithm.
■ Ciphertext: This is the scrambled message produced as output. It
depends on the plaintext and the secret key. For a given message, two
different keys will produce two different ciphertexts. The ciphertext is an
apparently random stream of data and, as it stands, is unintelligible.
■ Decryption algorithm: This is essentially the encryption algorithm
run in reverse. It takes the ciphertext and the secret key and produces
the original plaintext.

There are two requirements for secure use of conventional encryption:

1. We need a strong encryption algorithm. At a minimum, we would like the algorithm to be such
that an opponent who knows the algorithm and has access to one or more ciphertexts
would be unable to decipher the ciphertext or figure out the key. This requirement is
usually stated in a stronger form: The opponent should be unable to decrypt ciphertext
or discover the key even if he or she is in possession of a number of ciphertexts together
with the plaintext that produced each ciphertext.
2. Sender and receiver must have obtained copies of the secret key in a secure fashion and
must keep the key secure. If someone can discover the key and knows the algorithm, all
communication using this key is readable.

1|Page Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

We assume that it is impractical to decrypt a message on the basis of the ciphertext

plus knowledge of the encryption/decryption algorithm. In other words, we do not need
to keep the algorithm secret; we need to keep only the key secret. This feature of
symmetric encryption is what makes it feasible for widespread use.

Model of Symmetric Cryptosystem:

 A symmetric cipher model are broadly contains five parts.

 Plaintext: This is the original intelligible message.
 Encryption algorithm: The encryption algorithm performs various
substitutions and transformations on the plaintext. It takes in plaintext and
key and gives the cipher text.
 Secret key: The key is a value independent of the plaintext and of the algorithm.
Different keys will yield different outputs.
 Ciphertext: This is the scrambled message produced as output. It depends on the
plaintext and the secret key.
 Decryption algorithm: Runs on the cipher text and the key to produce the plaintext.
This is essentially the encryption algorithm run in reverse.

Let the plaintext be X = [X1, X2,…, XM],

key be K = [K1, K2,…, KJ]
and the cipher text produced be Y = [Y1,Y2,…, YN].
Then, we can write
𝑌 = 𝐸(𝐾, X)
 Here E represents the encryption algorithm and is a function of plaintext X and key K.

2|Page Dr. Manjula Emmi. Dept. ECE SGBIT

 Module-1 Data Security (BEC613B)

 The receiver at the other ends decrypts the cipher text using the key.
X = 𝐷(𝐾, 𝑌)
 Here D represents the decryption algorithm and it inverts the transformations of
encryption algorithm.
 An opponent not having access to X or K may attempt to recover K or X or both.
 It is assumed that the opponent knows the encryption (E) and decryption (D) algorithms.
 If the opponent is interested in only this particular message, then the focus
of the effort is to recover by generating a plaintext estimate ^X .
 If the opponent is interested in being able to read future messages as well
then he will attempt to recover the key by making an estimate ^𝐾 .

Encryption Animation [Link]

Cryptographic systems are characterized along three independent dimensions:

1. The type of operations used for transforming plaintext to ciphertext. All encryption
algorithms are based on two general principles: substitution, in which each element in
the plaintext (bit, letter, group of bits or letters) is mapped into another element, and
transposition, in which elements in the plaintext are rearranged. The fundamental
requirement is that no information be lost (i.e., that all operations are reversible). Most
systems, referred to as product systems, involve multiple stages of substitutions and
transpositions.
2. The number of keys used. If both sender and receiver use the same key, the system is
referred to as symmetric, single-key, secret-key, or conventional encryption. If the sender
and receiver use different keys, the system is referred to as asymmetric, two-key, or public-
key encryption.
3. The way in which the plaintext is processed. A block cipher processes the input one block of
elements at a time, producing an output block for each input block. A stream cipher processes
the input elements.

Cryptanalysis and Brute-Force Attack:

Typically, the objective of attacking an encryption system is to recover the key in use rather
than simply to recover the plaintext of a single ciphertext. There are two general approaches
to attacking a conventional encryption scheme:
■ Cryptanalysis: Cryptanalytic attacks rely on the nature of the algorithm plus perhaps some
knowledge of the general characteristics of the plaintext or even some sample plaintext–ciphertext
pairs. This type of attack exploits the characteristics of the algorithm to attempt to deduce a
specific plaintext or to deduce the key being used.
■ Brute-force attack: The attacker tries every possible key on a piece of cipher- text until an
intelligible translation into plaintext is obtained. On average, half of all possible keys must be
tried to achieve success.

3|Page Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

Type of Attack Known to Cryptanalyst

Ciphertext Only ■ Encryption algorithm
■ Ciphertext
Known Plaintext ■ Encryption algorithm
■ Ciphertext
■ One or more plaintext–ciphertext pairs formed with the secret key
Chosen Plaintext ■ Encryption algorithm
■ Ciphertext
■ Plaintext message chosen by cryptanalyst, together with its corresponding
ciphertext generated with the secret key

Chosen Ciphertext ■ Encryption algorithm

■ Ciphertext
■ Ciphertext chosen by cryptanalyst, together with its corresponding decrypted
plaintext generated with the secret key

Chosen Text ■ Encryption algorithm

■ Ciphertext
■ Plaintext message chosen by cryptanalyst, together with its corresponding
ciphertext generated with the secret key
■ Ciphertext chosen by cryptanalyst, together with its corresponding decrypted
plaintext generated with the secret key

Based on the amount of information known to the cryptanalyst cryptanalytic attacks can be
categorized as:
Cipher text Only Attack: The attacker knows only cipher text only. It is easiest to defend.

Known plaintext Attack: In this type of attack, the opponent has some plaintext-cipher
text pairs. Or the analyst may know that certain plaintext patterns will appear in a message.
For example, there may be a standardized header or banner to an electronic funds transfer
message and the attacker can use that for generating plaintext-cipher text pairs.
Chosen plaintext: If the analyst is able somehow to get the source system to insert into the
system a message chosen by the analyst, then a chosen-plaintext attack is possible. In such
a case, the analyst will pick patterns that can be expected to reveal the structure of the key.
Chosen Cipher text: In this attack, the analyst has cipher text and some plaintext-cipher
text pairs where cipher text has been chosen by the analyst.
Chosen Text: Here, the attacker has got cipher text, chosen plaintext-cipher text pairs and
chosen cipher text-plaintext pairs.
An encryption scheme is unconditionally secure if the ciphertext generated by the
scheme does not contain enough information to determine uniquely the corresponding
plaintext, no matter how much ciphertext is available. That is, no matter how much
time an opponent has, it is impossible for him or her to decrypt the ciphertext simply
because the required information is not there. With the exception of a scheme known
as the one-time pad (described later in this chapter), there is no encryption algorithm
that is unconditionally secure. Therefore, all that the users of an encryption algorithm
can strive for is an algorithm that meets one or both of the following criteria:
1. The cost of breaking the cipher exceeds the value of the encrypted information.
2. The time required to break the cipher exceeds the useful lifetime of the
information.
4|Page Dr. Manjula Emmi. Dept. ECE SGBIT
Module-1 Data Security (BEC613B)

An encryption scheme is said to be computationally secure if either of the foregoing

two criteria are met. Unfortunately, it is very difficult to estimate the amount of effort
required to cryptanalyze ciphertext successfully.
Substitution Techniques:

The two basic building blocks of all encryption techniques are substitution and transposition.
We examine these in the next two sections. Finally, we discuss a system that combines both
substitution and transposition.
A substitution technique is one in which the letters of plaintext are replaced by other letters or
by numbers or symbols.1 If the plaintext is viewed as a sequence of bits, then substitution
involves replacing plaintext bit patterns with ciphertext bit patterns.
Caesar cipher

The encryption rule is simple; replace each letter of the alphabet with the letter standing

a b c d e f g h i j k l m
0 1 2 3 4 5 6 7 8 9 10 11 12
n o p q r s t u v w x y z
13 14 15 16 17 18 19 20 21 22 23 24 25

3 places further down the alphabet.

The alphabet is wrapped around so that Z follows A.

Generally Plain text is in lower case and Cipher text is Upper Case.
Example 1:
Plaintext: meet me after the party
Ciphertext: PHHW PH DIWHU WKH SDUWB

Here, the key is 3. If different key is used, different substitution will be

obtained.
Mathematically, starting from a=0, b=1 and so on, Caesar cipher can be written as:
C = E(3, p) = (p + 3) mod 26
A shift may be of any amount, so that the general Caesar algorithm is
C = E(k, p) = (p + k) mod 26

where k takes on a value in the range 1 to 25. The decryption algorithm is simply
p = D(k, C) = (C - k) mod 26

5|Page Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

If it is known that a given ciphertext is a Caesar cipher, then a brute-force cryptanalysis is

easily performed: simply try all the 25 possible keys. Figure shows the results of applying
this strategy to the example ciphertext. In this case, the plaintext leaps out as occupying
the third line.

PHHW PH DIWHU WKH WRJD SDUWB

KEY
1 oggv og chvgt vjg vqic rctva
2 nffunfbgufsuifuphbqbsuz
3 meet me after the toga party
4 ldds ld zesdq sgd snfz ozqsx
5 kccr kc ydrcp rfc rmey nyprw
6 jbbq jb xcqbo qeb qldx mxoqv
7 iaap ia wbpan pda pkcw lwnpu
8 hzzo hz vaozm ocz ojbv kvmot
9 gyyn gy uznyl nby niau julns
10 fxxm fx tymxk max mhzt itkmr
11 ewwl ew sxlwj lzw lgys hsjlq
12 dvvk dv rwkvi kyv kfxr grikp
13 cuuj cu qvjuh jxu jewq fqhjo
14 btti bt puitg iwt idvp epgin
15 assh as othsf hvs hcuo dofhm
16 zrrg zr nsgre gur gbtn cnegl
17 yqqf yq mrfqd ftq fasm bmdfk
18 xppe xp lqepc esp ezrl alcej
19 wood wo kpdob dro dyqk zkbdi
20 vnnc vn jocna cqn cxpj yjach
21 ummb um inbmz bpm bwoi xizbg
22 tlla tl hmaly aol avnh whyaf
23 skkz sk glzkx znk zumg vgxze
24 rjjy rj fkyjw ymj ytlf ufwyd
25 qiix qi ejxiv xli xske tevxc

Example 2:
Plaintext: HELLO
Shift: 3
Encryption:
H -> K
E -> H
L -> O

6|Page Dr. Manjula Emmi. Dept. ECE SGBIT

 Module-1 Data Security (BEC613B)

L -> O
O -> R
Ciphertext: KHOOR

Decryption:
K -> H
H -> E
O -> L
O -> L
R -> O
Plaintext: HELLO
Three important characteristics of this problem enabled us to use a brute- force
cryptanalysis:
1. The encryption and decryption algorithms are known.
2. There are only 25 keys to try.
3. The language of the plaintext is known and easily recognizable.
Monoalphabetic Ciphers
A Monoalphabetic Cipher is a type of substitution cipher where each letter of the plaintext is
replaced by a different letter, but the same letter is always replaced by the same letter.
Each letter of the plaintext is replaced by a different letter, but the same letter is always
replaced by the same letter. For example, the letter "H" is always replaced by "K", and the letter
"E" is always replaced by "H".
 The relative frequency of the letters can be determined and compared
to a standard frequency distribution for English,
 In English ‘e’ is the most common letter followed by ‘t’, ‘r’, ‘n’, ’o’, ‘a’ etc.
Letters like ‘q’, ‘x’, ‘j’ are less frequently used.
 Moreover, digrams like ‘th’ and trigrams like ‘the’ are also more frequent.
 Tables of frequency of these letters exist. These can be used to guess the
plaintext if the plaintext is in uncompressed English language.
 The most common two letter combinations are called as digrams. e.g. th, in, er, re and
an.

7|Page Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

CIPHERTEXT:

UZQSOVUOHXMOPVGPOZPEVSGZWSZOPFPESXUDBMETSXAI
ZVUEPHZHMDZSHZOWSFPAPPDTSVPQUZWYMXUZUHSX
EPYEPOPDZSZUFPOMBZWPFUPZHMDJUDTMOHMQ

A powerful tool is to look at the frequency of two-letter combinations, known as digrams.

A tables showing the relative frequency of digrams. The most common such digram is th. In
our ciphertext, the most common digram is ZW, which appears three times. So we make the
correspondence of Z with t and W with h. Then, by our earlier hypothesis, we can equate P
with e. Now notice that the sequence ZWP appears in the ciphertext, and we can translate
that sequence as “the.” This is the most frequent trigram (three-letter combination) in
English, which seems to indicate that we are on the right track.
Next, notice the sequence ZWSZ in the first line. We do not know that these four letters
form a complete word, but if they do, it is of the form th_t. If so, S equates with a.
So far, then, we have

Only four letters have been identified, but already we have quite a bit of the message.
Continued analysis of frequencies plus trial and error should easily yield a solution from this point.
The complete plaintext, with spaces added between words, follows:

it was disclosed yesterday that several informal but direct contacts have been made with
political representatives of the viet cong in Moscow

Monoalphabetic ciphers are easy to break because they reflect the frequency data of the
original alphabet
8|Page Dr. Manjula Emmi. Dept. ECE SGBIT
 Module-1 Data Security (BEC613B)

Playfair Cipher
The best-known multiple-letter encryption cipher is the Playfair, which treats digrams in
the plaintext as single units and translates these units into ciphertext digrams.3
The Playfair algorithm is based on the use of a 5 × 5 matrix of letters constructed using
a keyword. Here is an example, solved by Lord Peter Wimsey in Dorothy Sayers’s Have
His Carcase:4

M O N A R
C H Y B D
E F G I/J K
L P Q S T
U V W X Z

In this case, the keyword is monarchy. The matrix is constructed by filling in the letters
of the keyword (minus duplicates) from left to right and from top to bottom, and then
filling in the remainder of the matrix with the remaining letters in alphabetic order. The
letters I and J count as one letter. Plaintext is encrypted two letters at a time, according to
the following rules:
1. Repeating plaintext letters that are in the same pair are separated with a filler letter, such as
x, so that balloon would be treated as ba lx lo on.
2. Two plaintext letters that fall in the same row of the matrix are each replaced by the letter to
the right, with the first element of the row circularly following the last. For example, ar is
encrypted as RM.
3. Two plaintext letters that fall in the same column are each replaced by the let- ter beneath,
with the top element of the column circularly following the last. For example, mu is
encrypted as CM.
4. Otherwise, each plaintext letter in a pair is replaced by the letter that lies in its own row
and the column occupied by the other plaintext letter. Thus, hs becomes BP and ea becomes
IM (or JM, as the encipherer wishes).
The Playfair cipher is a great advance over simple monoalphabetic ciphers. For one
thing, whereas there are only 26 letters, there are 26 × 26 = 676 digrams,
Example 2:
Plaintext = meet me at the school house
Splitting two letters as a unit => me et me at th es ch ox ol ho us ex
Corresponding cipher text => CL KL CL RS PD IL HY AV MP HF XL IU

9|Page Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

TRADITIONAL BLOCK CIPHER STRUCTURE:

BLOCK CIPHER PRINCIPLES

Stream Ciphers and Block Ciphers

A stream cipher is one that encrypts a digital data stream one bit or one byte
at a time. Examples of classical stream ciphers are the autokeyed Vigenère cipher
and the Vernam cipher. Accordingly, for practical reasons, the bit-stream generator
must be implemented as an algorithmic procedure, so that the cryptographic bit stream
can be produced by both users.

In this approach, the bit-stream generator is a key-controlled algorithm and

must produce a bit stream that is cryptographically strong. Now, the two users need
only share the generating key, and each can produce the keystream.

A block cipher is one in which a block of plaintext is treated as a whole and used
to produce a ciphertext block of equal length. Typically, a block size of 64 or 128 bits
is used. As with a stream cipher, the two users share a symmetric encryption key.

Ciphertext

Encryption Key ( Decryption

algorithm K) algorithm

Ciphertext

10 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

 Module-1 Data Security (BEC613B)

A block cipher can be used to achieve the same effect as a stream cipher. In general,
they seem applicable to a broader range of applications than stream ciphers. The vast
majority of network-based symmetric cryptographic applications make use of block
ciphers.

Motivation for the Feistel Cipher Structure

A block cipher operates on a plaintext block of n bits to produce a ciphertext
block of n bits. There are 2n possible different plaintext blocks and, for the
encryption to be reversible (i.e., for decryption to be possible), each must
produce a unique ciphertext block. Such a transformation is called reversible, or
nonsingular. The following examples illustrate nonsingular and singular
transformations for n = 2.

Reversible Mapping Irreversible Mapping

Plaintext Ciphertext Plaintext Ciphertext
00 11 00 11
01 10 01 10
10 00 10 01
11 01 11 01

In the latter case, a ciphertext of 01 could have been produced by one of two
plain- text blocks. So if we limit ourselves to reversible mappings, the
number of different transformations is 2n!.2

Below figure illustrates the logic of a general substitution cipher for n = 4.

A 4-bit input produces one of 16 possible input states, which is mapped by the substitution cipher
into a unique one of 16 possible output states, each of which is represented by 4 ciphertext bits. The
encryption and decryption mappings can be defined by a tabulation, as shown in Table 4.1. This
is the most general form of block cipher and can be used to define any reversible mapping
between plaintext and ciphertext. Feistel refers to this as the ideal block cipher, because it
allows for the maximum number of possible encryption mappings from the plaintext block

Encryption should be reversible. Figure shows the logic of a general substitution cipher for n=4
(block size).

11 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

In general the logic of a general substitution cipher for n=4 with 4-bit input produces one of
16 possible input states, which is mapped by the substitution cipher into a unique one of 16
possible output states, each of which is represented by 4 cipher text bits. The encryption and
decryption mappings can be defined by tabulation, as shown below.

This is the most general form of block cipher and can be used to define any
reversible mapping between plaintext and ciphertext. Feistel refers to this as the ideal block
cipher, because it allows for the maximum number of possible encryption mappings from
the plaintext block.
with a key length of k bits and a block length of n bits, allowing a total of 2 k possible
transformations, rather than the 2n ! transformations available with the ideal block cipher. In
particular, Feistel proposed the use of a cipher that alternates substitutions and permutations,
where these terms are defined as follows:

• Substitution: Each plaintext element or group of elements is uniquely replaced by

corresponding cipher text element or group of elements.

• Permutation: A sequence of plaintext elements is replaced by a permutation of that sequence.

That is, no elements are added or deleted or replaced in the sequence, rather the order in which the

12 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

elements appear in the sequence is changed.

In fact, Feistel’s is a practical application of a proposal by Claude Shannon to develop a

product cipher that alternates confusion and diffusion functions.

DIFFUSION AND CONFUSION

These are measures to thwart cryptanalysis based on statistical analysis. In diffusion, the statistical
structure of the plaintext is dissipated into long range statistics of the ciphertext. This is achieved
by having each plaintext letter affect the value of many ciphertext digits, which is equivalent to
saying that each ciphertext digit is affected by many plaintext digits. An example of diffusion is
to encrypt a message m=m1,m2,m3,.. Of characters with an averaging operation:

Adding k successive letters to get a ciphertext letter yn. The letter frequencies in the ciphertext will
be more nearly equal than in the plaintext (structure dissipated).

Confusion seeks to make the relationship between the statistics of the ciphertext and and the value
of the encryption key as complex as possible. This is achieved by the use of a complex substitution
algorithm. These operations became the cornerstone of modern block cipher design.

THE FEISTEL CIPHER

Feistel proposed [FEIS73] that we can approximate the ideal block cipher by utilizing the
concept of a product cipher, which is the execution of two or more simple ciphers in sequence in
such a way that the final result or product is cryptographically stronger than any of the
component ciphers. The essence of the approach is to develop a block cipher
.
FEISTEL CIPHER STRUCTURE
 The left-hand side of deFigure depicts the encryption structure proposed by Feistel.
 The inputs to the encryption algorithm are a plaintext block of length 2w bits and a
key K.
 The plaintext block is divided into two halves, LE0 and RE0. The two halves of the
data pass through n rounds of processing and then combine to produce the ciphertext
block. Each round i has as inputs LEi-1 and REi-1 derived from the previous round, as
well as a subkey Ki derived from the over- all K. In general, the subkeys Ki are
different from K and from each other. 
 In Figure 16 rounds are used, although any number of rounds could be implemented.
 All rounds have the same structure. A substitution is performed on the left half of
the data. This is done by applying a round function F to the right half of the data and
then taking the exclusive-OR of the output of that function and the left half of the
data.
 The round function has the same general structure for each round but is
parameterized by the round subkey Ki. Another way to express this is to say that F
is a function of right-half block of w bits and a subkey of y bits, which pro- duces an

13 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

output value of length w bits: F(REi, Ki+ 1).

 Following this substitution, a permutation is performed that consists of the
interchange of the two halves of the data.6 This structure is a particular form of the
substitution-permutation network (SPN) proposed by Shannon.

Feistel Decryption: First, consider the encryption process.

We see that

14 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

 Module-1 Data Security (BEC613B)

Thus, we have LD1 = RE15 and RD1 = LE15. Therefore, the output of the first round of
the decryption process is RE15 LE15, which is the 32-bit swap of the input to the sixteenth
round of the encryption. This correspondence holds all the way through the 16 iterations,
as is easily shown. We can cast this process in general terms. For the ith iteration of the
encryption algorithm
LEi = REi-1
REi = LEi-1 ⊕ F(REi-1, Ki)
Rearranging terms:
REi-1 = LEi

LEi-1 = REi ⊕ F(REi-1, Ki) = REi ⊕ F(LEi, Ki)

The exact realization of a Feistel network depends on the choice of the following parameters
and design features:
 Block size: Larger block sizes mean greater security (all other things being equal)
but reduced encryption/decryption speed for a given algorithm. The greater
security is achieved by greater diffusion. Traditionally, a block size of 64 bits has
been considered a reasonable trade off and was nearly universal in block cipher
design. However, the new AES uses a 128-bit block size
 Key size: Larger key size means greater security but may decrease encryption/ decryption
speed. The greater security is achieved by greater resistance to brute-force attacks
and greater confusion. Key sizes of 64 bits or less are now widely considered to be
inadequate, and 128 bits has become a common size.
 Number of rounds: The essence of the Feistel cipher is that a single round offers
inadequate security but that multiple rounds offer increasing security. A typical size
is 16 rounds.
 Subkey generation algorithm: Greater complexity in this algorithm should lead to
greater difficulty of cryptanalysis.
 Round function F: Again, greater complexity generally means greater resistance to
cryptanalysis.
There are two other considerations in the design of a Feistel cipher:
■ Fast software encryption/decryption: In many cases, encryption is embedded in applications
or utility functions in such a way as to preclude a hardware implementation. Accordingly,
the speed of execution of the algorithm becomes a concern.
■ Ease of analysis: Although we would like to make our algorithm as difficult as possible to

15 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

cryptanalyze, there is great benefit in making the algorithm easy to analyze. That is, if the
algorithm can be concisely and clearly explained, it is easier to analyze that algorithm for
cryptanalytic vulnerabilities and therefore develop a higher level of assurance as to its
strength. DES, for example, does not have an easily analyzed functionality.

THE AES CIPHER

Input Structure
1. Block size: 128-bit block

2. Matrix structure: 4 × 4 square matrix of bytes

3. State array: Input block is copied into the State array

4. Byte ordering: Bytes are ordered by column

5. Input processing: State array is modified at each stage of encryption/decryption

6. Output: Final State array is copied to an output matrix

Key Structure
1. Key size: 128-bit key

2. Matrix structure: Square matrix of bytes

3. Key expansion: Key is expanded into an array of key schedule words

4. Word size: Each word is four bytes

5. Key schedule size: 44 words for the 128-bit key

6. Byte ordering: Bytes are ordered by column

7. Word formation: First four bytes of expanded key form a word, occupying the first
column of the w matrix
Figure shows the overall structure of the AES encryption process. The cipher takes a plaintext
block size of 128 bits, or 16 bytes. The key length can be 16, 24, or 32 bytes (128, 192, or 256
bits). The algorithm is referred to as AES-128, AES-192, or AES-256, depending on the key
length.

The input to the encryption and decryption algorithms is a single 128-bit block. this block is
depicted as a 4 × 4 square matrix of bytes. This block is copied into the State array, which is
modified at each stage of encryption or decryption. After the final stage, State is copied to an

16 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

output matrix. These operations are depicted in Figure b. Similarly, the key is depicted as a
square matrix of bytes. This key is then expanded into an array of key schedule words.

Fig b shows the expansion for the 128-bit key. Each word is four bytes, and the total key
schedule is 44 words for the 128-bit key. Note that the ordering of bytes within a ma- trix is by
column. So, for example, the first four bytes of a 128-bit plaintext input to the encryption cipher
occupy the first column of the in matrix, the second four bytes occupy the second column, and so
on. Similarly, the first four bytes of the expanded key, which form a word, occupy the first
column of the w matrix.

17 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

The cipher consists of N rounds, where the number of rounds depends on the key length:
10 rounds for a 16-byte key
12 rounds for a 24-byte key, and
14 rounds for a 32-byte key .
The first N - 1 rounds consist of four distinct transformation functions:
SubBytes, ShiftRows, MixColumns, and AddRoundKey, which are described subsequently.
The final round contains only three transformations, and there is a initial single transformation
(AddRoundKey) before the firstround, which can be considered Round 0 .
4 × 4 matrices as input and produces a 4 × 4 matrix as output. Figure a. shows that the output
of each round is a 4 × 4 matrix, with the output of the final round being the ciphertext. Also,
the key expansion function generates N + 1 round keys, each of which is a distinct 4 × 4 matrix.
Each round key serves as one of the inputs to the AddRoundKey transformation in each round.

Here are the key points explaining the structure and operation of the cipher:

Cipher Structure
- The cipher consists of N rounds.
- The number of rounds depends on the key length:
- 10 rounds for a 16-byte key.
- 12 rounds for a 24-byte key.
- 14 rounds for a 32-byte key.

Round Operations
- The first N - 1 rounds consist of four transformations:
- SubBytes.
- ShiftRows.
- MixColumns.
- AddRoundKey.
- The final round contains only three transformations.

Input and Output

- The cipher takes a 4 × 4 matrix as input.

18 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

- Each round produces a 4 × 4 matrix as output.

- The output of the final round is the ciphertext.

Key Expansion
- The key expansion function generates N + 1 round keys.
- Each round key is a distinct 4 × 4 matrix.
- Each round key serves as input to the Add Round Key transformation in each round.

Detailed Structure of AES:

Figure C shows the AES cipher in more detail, indicating the sequence of transformations in each
round and showing the corresponding decryption function. AES instead processes the entire
data block as a single matrix during each round using substitutions and permutation.
1. The key that is provided as input is expanded into an array of forty-four 32-bit words,
w[i]. Four distinct words (128 bits) serve as a round key for each round.
2. Four different stages are used, one of permutation and three of substitution:
a. Substitute bytes: Uses an S-box to perform a byte-by-byte substitution of the
block.
b. ShiftRows: A simple permutation.
c. MixColumns: A substitution that makes use of arithmetic over GF(28).
d. AddRoundKey: A simple bitwise XOR of the current block with a portion of the
expanded key.
3. The structure is quite simple. For both encryption and decryption, the cipher begins
with an Add RoundKey stage, followed by nine rounds that each in- cludes all four
stages, followed by a tenth round of three stages. Figure c. depicts the structure of a full
encryption round.
4. Only the AddRoundKey stage makes use of the key. For this reason, the cipher begins and
ends with an AddRoundKey stage. Any other stage, applied at the beginning or end, is
reversible without knowledge of the key and so would add no security.
5. The AddRoundKey stage is, in effect, a form of Vernam cipher and by itself would not
be formidable. The other three stages together provide confusion, diffusion, and
nonlinearity, but by themselves would provide no security be- cause they do not use the
key. We can view the cipher as alternating operations of XOR encryption (AddRoundKey)
of a block, followed by scrambling of the block (the other three stages), followed by
XOR encryption, and so on. This scheme is both efficient and highly secure.
6. Each stage is easily reversible. For the Substitute Byte, ShiftRows, and MixColumns
stages, an inverse function is used in the decryption algorithm. For the AddRoundKey
stage, the inverse is achieved by XORing the same round key to the block, using the
result that A ⊕ B ⊕ B = A.(Refer fig D)
7. As with most block ciphers, the decryption algorithm makes use of the expanded key
in reverse order. However, the decryption algorithm is not
identical to the encryption algorithm. This is a consequence of the particular structure
of AES.
8. Once it is established that all four stages are reversible, it is easy to verify that
decryption does recover the plaintext. Figure lays out encryption and decryption going
in opposite vertical directions. At each horizontal point (e.g., the dashed line in the
figure), State is the same for both encryption and decryption.
9. The final round of both encryption and decryption consists of only three stages. Again, this is

19 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

a consequence of the particular structure of AES and is required to make the cipher
reversible.
10. The final round of both encryption and decryption consists of only three stages. Again, this is
a consequence of the particular structure of AES and is required to make the cipher
reversible

20 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

THE AES KEY EXPANSION:

Key Expansion Algorithm

The AES key expansion algorithm takes as input a four-word (16-byte) key and produces a
linear array of 44 words (176 bytes). This is sufficient to provide a four- word round key for the
initial AddRoundKey stage and each of the 10 rounds of the cipher. The pseudocode on the
next page describes the expansion.
The key is copied into the first four words of the expanded key. The remain- der of the
expanded key is filled in four words at a time. Each added word w[i] depends on the immediately
preceding word, w[i - 1], and the word four positions back, w[i - 4]. In three out of four cases, a
simple XOR is used. For a word whose position in the w array is a multiple of 4, a more complex
function is used. Fig E. illustrates the generation of the expanded key, using the symbol g to
represent that complex function.

21 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

 Module-1 Data Security (BEC613B)

The function g consists of the following subfunctions.

1. RotWord performs a one-byte circular left shift on a word. This means that an input word [B 0,
B1, B2, B3] is transformed into [B 1, B2, B3, B0].
2. SubWord performs a byte substitution on each byte of its input word, using the S-box (Table
6.2a).
3. The result of steps 1 and 2 is XORed with a round constant, Rcon[j].

The round constant is a word in which the three rightmost bytes are always 0. Thus, the
effect of an XOR of a word with Rcon is to only perform an XOR on the
leftmost byte of the word. The round constant is different for e ach round and is de-
fined as Rcon[j] = (RC[j], 0, 0, 0), with RC[1] = 1, RC[j] = 2 RC[j - .1] and with
multiplication defined over the field GF(28). The values of RC[j] in hexadecimal are

j 1 2 3 4 5 6 7 8 9 10
RC[j] 01 02 04 08 10 20 40 80 1B 36

Rationale
The Rijndael developers designed the expansion key algorithm to be resistant to known
cryptanalytic attacks. The inclusion of a round-dependent round constant eliminates the
symmetry, or similarity, between the ways in which round keys are generated in different

22 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

rounds. The specific criteria that were used are [DAEM99]

1. Knowledge of a part of the cipher key or round key does not enable calculation of many
other round-key bits.
2. An invertible transformation [i.e., knowledge of any Nk consecutive words of the
expanded key enables regeneration of the entire expanded key (Nk = key size in
words)].
3. Speed on a wide range of processors.
4. Usage of round constants to eliminate symmetries.
5. Diffusion of cipher key differences into the round keys; that is, each key bit affects
many round key bits.
6. Enough nonlinearity to prohibit the full determination of round key differ ences from
cipher key differences only.
7. Simplicity of description.

Block cipher Principles:

Block Cipher Modes of Operation:
A block cipher takes a fixed-length block of text of length b bits and a key as
input and produces a b-bit block of ciphertext. If the amount of plaintext to be
encrypted is greater than b bits, then the block cipher can still be used by
breaking the plain- text up into b-bit blocks. When multiple blocks of plaintext
are encrypted using the same key, a number of security issues arise.
There are Five modes of operation in block cipher:

Mode Description Typical Application

Electronic Codebook (ECB) Each block of plaintext bits is r Secure transmission of single values (e.g.,
encoded independently using the an encryption key)
same key.
Cipher Block Chaining (CBC) The input to the encryption algo- r General-purpose block- oriented
rithm is the XOR of the next block transmission
of plaintext and the preceding r Authentication
block of ciphertext.
Cipher Feedback (CFB) Input is processed s bits at a time. r General-purpose stream-oriented
Preceding ciphertext is used as transmission
input to the encryption algorithm r Authentication
to produce pseudorandom output,
which is XORed with plaintext to
produce next unit of ciphertext.
Output Feedback (OFB) Similar to CFB, except that the r Stream-oriented transmission over noisy
input to the encryption algorithm channel (e.g., satellite communication)
is the preceding encryption output,
and full blocks are used.
Counter (CTR) Each block of plaintext is XORed r General-purpose block- oriented
with an encrypted counter. The transmission
counter is incremented for each r Useful for high-speed requirements
subsequent block.

23 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

1. Electronic Code Book

 The simplest mode is the electronic codebook (ECB) mode, in which

plaintext is handled one block at a time and each block of plaintext is
encrypted using the same key.
 For a message longer than b bits, the procedure is simply to break the
message into b-bit blocks, padding the last block if necessary.
Decryption is performed one block at a time, always using the same
key. In Figure f, the plaintext (padded as necessary) consists of a
sequence of b-bit blocks, P1, P2, c , P N; the corresponding sequence
of ciphertext blocks is C1, C2, c , CN. 
 The most significant characteristic of ECB is that if the same b-bit
block of plaintext appears more than once in the message, it always
produces the same ciphertext.
 For lengthy messages, the ECB mode may not be secure. If the
message is highly structured, it may be possible for a cryptanalyst to
exploit these regularities.

24 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Data Security (BEC613B)

2. Cipher block chaining:

 The input to the encryption algorithm is the XOR of the current plaintext block
and the preceding ciphertext block; the same key is used for each block.
 The input to the encryption function for each plaintext block bears no fixed
relationship to the plaintext block refer figure.g
 Therefore, repeating patterns of b bits are not exposed. As with the ECB mode,
the CBC mode requires that the last block be padded to a full b bits if it is a
partial block.
 For decryption, each cipher block is passed through the decryption algorithm.
The result is XORed with the preceding ciphertext block to produce the
plaintext block.
 Produce the first block of ciphertext, an initialization vector (IV) is XORed
with the first block of plaintext. On decryption, the IV is XORed with the output
of the decryption algorithm to recover the first block of plaintext. The IV is a
data block that is the same size as the cipher block.
 The IV must be known to both the sender and receiver but be unpredictable by
a third party.
C1 = E(K, [IV ⊕ P1])
P1 = IV ⊕ D(K, C1 )

25 | P a g e Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Classical Encryption Techniques Data security (BEC613B)

3. Cipher feedback mode:

 CFB stream cipher eliminates the need to pad a message to be an integral number
of blocks. It also can operate in real time.
 CFB mode stands for Cipher Feedback Mode. In this mode, the data is encrypted in the
form of units where each unit is of S bits.
 Like cipher block chaining mode, IV is initialized. The IV is kept in the shift register. It is
encrypted using the key and form the ciphertext.
 Now the leftmost j bits of the encrypted IV is XOR with the plain text’s first j bits. This
process will form the first part of the ciphertext, and this ciphertext will be transmitted to
the receiver.
 Now the bits of IV is shifted left by j bit. Therefore the rightmost j position of the shift
register now has unpredictable data. These rightmost j positions are now filed with the
ciphertext. The process will be repeated for all plain text units.

4. Output feedback:
 The output feedback (OFB) mode is similar in structure to that of CFB. For OFB,
the output of the encryption function is fed back to become the input for encrypting
the next block of plaintext fig h. In CFB, the output of the XOR unit is fed back

Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Classical Encryption Techniques Data security (BEC613B)

to become input for encrypting the next block. The other difference is that the OFB
mode operates on full blocks of plaintext and ciphertext, whereas CFB operates
on an s-bit subset.
 As with CBC and CFB, the OFB mode requires an initialization vector. In the
case of OFB, the IV must be a nonce; that is, the IV must be unique to each
execution of the encryption operation
 The reason for this is that the sequence of encryption output blocks, Oi, depends
only on the key and the IV and does not de- pend on the plaintext. Therefore, for
a given key and IV, the stream of output bits used to XOR with the stream of
plaintext bits is fixed. If two different messages had an identical block of plaintext
in the identical position, then an attacker would be able to determine that portion
of the Oi stream.
 One advantage of the OFB method is that bit errors in transmission do not
propagate. For example, if a bit error occurs in C1, only the recovered value of P1
is affected; subsequent plaintext units are not corrupted.

Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Classical Encryption Techniques Data security (BEC613B)

5. Counter mode:
 Although interest in the counter (CTR) mode has increased recently with
appli- cations to ATM (asynchronous transfer mode) network security and
IPsec (IP security), this mode was proposed in 1979
 Fig i depicts the CTR mode. A counter equal to the plaintext block size is used.
The only requirement stated in SP 800-38A is that the counter value must be different
for each plaintext block that is encrypted. Typically, the counter is initialized to
some value and then incremented by 1 for each subsequent block
 For encryption, the counter is encrypted and then XORed with the plaintext block
to produce the ciphertext block; there is no chaining. For decryption, the same
sequence of counter values is used, with each encrypted counter XORed with a
ciphertext block to recover the corresponding plaintext block.
 Thus, the initial counter value must be made available for decryption.
 As with the OFB mode, the initial counter value must be a nonce; that is, T1
must be different for all of the messages encrypted using the same key. Further,
all Ti values across all messages must be unique. 

Dr. Manjula Emmi. Dept. ECE SGBIT

Module-1 Classical Encryption Techniques Data security (BEC613B)

Advantages:

1. Hardware efficiency
2. Software efficiency
3. Preprocessing
4. Random access
5. Provable security
6. Simplicity

Dr. Manjula Emmi. Dept. ECE SGBIT