Unit-II
Data Encryption Techniques And Standards
Model of Network Security
Fig.12 Model of Network Security
Basic Tasks
This general model shows that there are four basic tasks in designing a particular security service:
1. Design an algorithm for performing the security-related transformation. The algorithm should
be such that an opponent cannot defeat its purpose.
2. Generate the secret information to be used with the algorithm.
3. Develop methods for the distribution and sharing of the secret information.
4. Specify a protocol to be used by the two principals that makes use of the security algorithm
and the secret information to achieve a particular security service
1
Network Access Security Model
Fig. Network Access Security Model
1. Symmetric Encryption
A symmetric encryption scheme has five ingredients
• Plaintext: This is the original message or data that is fed into the algorithm as input.
• Encryption algorithm: The encryption algorithm performs various substitutions and
transformations on the plaintext.
• Secret key: The secret key is also input to the algorithm. The exact substitutions and transformations
performed by the algorithm depend on the key.
• Ciphertext: This is the scrambled message produced as output. It depends on the plaintext and the
secret key. For a given message, two different keys will produce two different ciphertexts.
• Decryption algorithm: This is essentially the encryption algorithm run in reverse. It takes the
ciphertext and the same secret key and produces the original plaintext.
Fig.14 Simplified Model of Symmetric Encryption
2
Encryption, is the process of changing information in such a way as to make it unreadable by anyone
except those possessing special knowledge (usually referred to as a "key") that allows them to change
the information back to its original, readable form.
(a) Basic Terms
▪ Plaintext - original message
▪ Ciphertext - coded message
▪ Cipher - algorithm for transforming plaintext to cipher text
▪ Key - info used in cipher known only to sender/receiver info used in cipher known only to
sender/receiver
3
▪ Encipher (encrypt) Encipher (encrypt) - converting plaintext to ciphertext
▪ Decipher (decrypt) - recovering ciphertext from plaintext
▪ Cryptography - study of encryption principles/methods study of encryption
principles/methods
▪ Cryptanalysis (code breaking) - study of principles/ methods of deciphering ciphertext
without knowing key
▪ Cryptology - field of both cryptography and cryptanalysis
(b) Cryptography – Classification
1. By type of encryption operations used:
➢ Substitution
➢ Transposition
➢ Product
2. By number of keys used By number of keys used:
➢ Single-key or private key
➢ Two-key or public
3. By the way in which plaintext is processed:
➢ Block
➢ Stream
Substitution
❑ A substitution technique is one in which the letters of plaintext are replaced by other letters
or by numbers or symbols.
❑ If the plaintext is viewed as a sequence of bits, then substitution involves replacing
plaintext bit patterns with cipher text bit patterns.
❑ Caesar Cipher.
❑ Playfair Cipher.
❑ One-Time Pad.
❑ Hill Cipher
❑ Monoalphabetic Ciphers
4
❑ Polyalphabetic Ciphers
1.12.1 Caesar Cipher:
The earliest known use of a substitution cipher and the simplest was by Julius Caesar.
If n=3
Plain Text: meet me after the toga party
Considering n=3
Cipher Text: PHHW PH DIWHU WKH WRJD SDUWB
Weakness: Total 26 keys
Brute Force Cryptanalysis
• If it is known that a given ciphertext is a Caesar cipher, then a brute-force cryptanalysis is
easily performed: simply try all the 25 possible keys.
• Three important characteristics of this problem enabled us to use a bruteforce cryptanalysis:
1. The encryption and decryption algorithms are known.
2. There are only 25 keys to try.
3. The language of the plaintext is known and easily recognizable.
5
Fig.15 Brute Force Cryptanalysis
Block Cipher Vs Stream Cipher
• A stream cipher is one that encrypts a digital data stream one bit or one byte at a time.
Examples of classical stream ciphers are the autokeyed Vigenère cipher and the Vernam
cipher.
• A block cipher is one in which a block of plaintext is treated as a whole and used to
produce a ciphertext block of equal length. Typically, a block size of 64 or 128 bits is used.
Block Cipher
• A block cipher is an encryption/decryption scheme in which a block of plaintext is treated
as a whole and used to produce a ciphertext block of equal length.
• Many block ciphers have a Feistel structure.
• Such a structure consists of a number of identical rounds of processing.
• In each round, a substitution is performed on one half of the data being processed, followed
by a permutation that interchanges the two halves.
• The original key is expanded so that a different key is used for each round.
6
Fig. 16 Stream Cipher
Fig. 17 Block Cipher
1.14 Feistel Cipher Structure
• A block cipher operates on a plaintext block of n bits to produce a ciphertext block of n bits.
There are 2n possible different plaintext blocks and, for the encryption to be reversible (i.e.,
for decryption to be possible), each must produce a unique ciphertext block. Such a
transformation is called reversible, or nonsingular.
• The following examples illustrate nonsingular and singular transformations for n=2.
Fig. 18 Reversible vs Irreversible Mapping
7
• Feistel proposed the use of a cipher that alternates substitutions and permutations, where
these terms are defined as follows:
• Substitution: Each plaintext element or group of elements is uniquely replaced by a
corresponding ciphertext element or group of elements.
• Permutation: A sequence of plaintext elements is replaced by a permutation of that
sequence. That is, no elements are added or deleted or replaced in the sequence,
rather the order in which the elements appear in the sequence is changed
• In fact, Feistel’s is a practical application of a proposal by Claude Shannon to develop a
product cipher that alternates confusion and diffusion functions
• The terms diffusion and confusion were introduced by Claude Shannon to capture the two
basic building blocks for any cryptographic system.
• In diffusion, the statistical structure of the plaintext is dissipated into long-range statistics of
the ciphertext. This is achieved by having each plaintext digit affect the value of many
ciphertext digits; generally, this is equivalent to having each ciphertext digit be affected by
many plaintext digits.
• confusion seeks to make the relationship between the statistics of the ciphertext and the
value of the encryption key as complex as possible, again to thwart attempts to discover the
key.
• The inputs to the encryption algorithm are a plaintext block of length 2W bits and a key.
• The plaintext block is divided into two halves, L0 and R0
• The two halves of the data pass through rounds of processing and then combine to produce
the ciphertext block
• Each round has as inputs Li-1 and Ri-1 derived from the previous round, as well as a
subkey Ki derived from the overall K.
• 16 rounds are used, although any number of rounds could be implemented.
• A substitution is performed on the left half of the data. This is done by applying a round
function F to the right half of the data and then taking the exclusive-OR of the output of that
function and the left half of the data.
8
• Permutation is performed that consists of the interchange of the two halves of the data
• This structure is a particular form of the substitution-permutation network (SPN) proposed
by Shannon
Fig.18 Fiestel Cipher Structure
Design Features
• The exact realization of a Feistel network depends on the choice of the following parameters
and design features:
• Block size: Larger block sizes mean greater security (all other things being equal) but reduced
encryption/decryption speed for a given algorithm
• Key size: Larger key size means greater security but may decrease encryption/ decryption
speed.
9
• Number of rounds: The essence of the Feistel cipher is that a single round offers inadequate
security but that multiple rounds offer increasing security. A typical size is 16 rounds.
• Subkey generation algorithm: Greater complexity in this algorithm should lead to greater
difficulty of cryptanalysis.
• Round function F: Again, greater complexity generally means greater resistance to
cryptanalysis.
Feistel Decryption Algorithm
• The process of decryption with a Feistel cipher is essentially the same as the encryption
process.
• The rule is as follows:
• Use the ciphertext as input to the algorithm, but use the subkeys Ki in reverse order.
1.15 Data Encryption Standard (DES)
• The Data Encryption Standard (DES) has been the most widely used symmetric encryption
algorithm until recently. It exhibits the classic Feistel structure.
• DES uses a 64-bit block and a 56-bit key.
• Two important methods of cryptanalysis are differential cryptanalysis and linear
cryptanalysis.
• DES has been shown to be highly resistant to these two types of attack.
DES Encryption
• As with any encryption scheme, there are two inputs to the encryption function: the plaintext
to be encrypted and the key. In this case, the plaintext must be 64 bits in length and the key is
56 bits in length.
• With the exception of the initial and final permutations, DES has the exact structure of a
Feistel cipher,
10
Fig. Data Encryption Standard
Single Round of DES Algorithm
Fig. 20 Single Round of DES Algorithm
11
12
Fig. 21 Calculation of F(R,K)
13
Fig. 22 Definition of S-Boxes
14
Fig. DES Example
The Avalanche Effect
15
• A desirable property of any encryption algorithm is that a small change in either the plaintext
or the key should produce a significant change in the ciphertext.
• In particular, a change in one bit of the plaintext or one bit of the key should produce a change
in many bits of the ciphertext.
• This is referred to as the avalanche effect.
• If the change were small, this might provide a way to reduce the size of the plaintext or key
space to be searched.
Fig. 24 Avalanche Effect in DES (Change in Plaintext)
Fig. 25 Avalanche Effect in DES (Change in Key)
16
Strength of DES
• The Use of 56-Bit Keys
• With a key length of 56 bits, there are 256 possible keys, which is approximately 7.2
X 1016 keys
• Thus, on the face of it, a brute-force attack appears impractical
• Assuming that, on average, half the key space has to be searched, a single machine
performing one DES encryption per microsecond would take more than a thousand
years to break the cipher.
• The Nature of the DES Algorithm
• Another concern is the possibility that cryptanalysis is possible by exploiting the
characteristics of the DES algorithm. The focus of concern has been on the eight
substitution tables, or S-boxes, that are used in each iteration. Because the design
criteria for these boxes, and indeed for the entire algorithm, were not made public,
there is a suspicion that the boxes were constructed in such a way that cryptanalysis
• For most of its life, the prime concern with DES has been its vulnerability to brute-
force attack because of its relatively short (56 bits) key length. However, there has
also been interest in finding cryptanalytic attacks on DES. With the increasing
popularity of block ciphers with longer key lengths, including triple DES, brute- force
attacks have become increasingly impractical.
Confidentiality using Symmetric Encryption
• Placement of Encryption Function
• What to encrypt and where to place the encrypted function
• Encryption placement – end to end encryption and link encryption
• There are number of locations where attacks can occur.
• And, it is not under the physical control of the end user.
17
Fig. 26 Packet Switching Network
Table 3 : Difference Between Link Encryption and End-to-End Encryption
Traffic Confidentiality
• The following types of information can be derived from a traffic analysis attack.
• Identities of partners
• How frequently the partners are communicating
• Message pattern, message length, quantity of messages that suggest important
information being exchanged.
• The events that correlate with special conversations between particular partners.
18
Covert Channel
• A covert channel is any communication channel that can be exploited by a process to transfer
information in a manner that violates the systems security policy.
• In short, covert channels transfer information using non-standard methods against the system
design.
• The main purpose of covert channels is to protect privacy or to increase security of critical
communication.
19
20