Chapter 2

Conventional
Encryption
Message
ConfidentialityHenric Johnson
Blekinge Institute of Technology, Sweden
[Link]
[Link]@[Link]
Henric Johnson 1
 Outline
• Conventional Encryption Principles
• Conventional Encryption
Algorithms
• Cipher Block Modes of Operation
• Location of Encryption Devices
• Key Distribution

Henric Johnson 2
 Conventional
Encryption Principles
• An encryption scheme has five
ingredients:
– Plaintext
– Encryption algorithm
– Secret Key
– Ciphertext
– Decryption algorithm
• Security depends on the secrecy of the
key, not the secrecy of the algorithm
Henric Johnson 3
 Conventional
Encryption Principles

Henric Johnson 4
 Cryptography
• Classified along three independent
dimensions:
– The type of operations used for
transforming plaintext to ciphertext
– The number of keys used
• symmetric (single key)
• asymmetric (two-keys, or public-key encryption)
– The way in which the plaintext is processed

Henric Johnson 5
 Average time required
for exhaustive key
search
Key Number of Time required
Size Alternative at 106
(bits) Keys Decryption/µs
32 232 = 4.3 x 109 2.15 milliseconds
56 256 = 7.2 x 1016 10 hours
128 2128 = 3.4 x 1038 5.4 x 1018 years
168 2168 = 3.7 x 1050 5.9 x 1030 years
Henric Johnson 6
Feistel Cipher Structure
• Virtually all conventional block
encryption algorithms, including
DES have a structure first described
by Horst Feistel of IBM in 1973
• The realization of a Fesitel Network
depends on the choice of the
following parameters and design
features (see next slide):
Henric Johnson 7
Feistel Cipher Structure
• Block size: larger block sizes mean greater
security
• Key Size: larger key size means greater
security
• Number of rounds: multiple rounds offer
increasing security
• Subkey generation algorithm: greater
complexity will lead to greater difficulty of
cryptanalysis.
• Fast software encryption/decryption: the
speed of execution of the algorithm becomes a
concern

Henric Johnson 8
Henric Johnson 9
 Conventional
Encryption Algorithms
• Data Encryption Standard (DES)
– The most widely used encryption
scheme
– The algorithm is reffered to the Data
Encryption Algorithm (DEA)
– DES is a block cipher
– The plaintext is processed in 64-bit
blocks
– The key is 56-bits in length
Henric Johnson 10
Henric Johnson 11
Henric Johnson 12
 DES
• The overall processing at each
iteration:
– Li = Ri-1
– Ri = Li-1 F(Ri-1, Ki)
• Concerns about:
– The algorithm and the key length
(56-bits)
Henric Johnson 13
Time to break a code
(106 decryptions/µs)

Henric Johnson 14
 Triple DEA
• Use three keys and three
executions of the DES algorithm
(encrypt-decrypt-encrypt)
C = EK3[DK2[EK1[P]]]
• C = ciphertext
• P = Plaintext
• EK[X] = encryption of X using key K
• DK[Y] = decryption of Y using key K

• Effective key length of 168 bits

Henric Johnson 16
Other Symmetric Block
Ciphers
• International Data Encryption
Algorithm (IDEA)
– 128-bit key
– Used in PGP
• Blowfish
– Easy to implement
– High execution speed
– Run in less than 5K of memory

Henric Johnson 17
 Other Symmetric Block
Ciphers
• RC5
– Suitable for hardware and software
– Fast, simple
– Adaptable to processors of different word lengths
– Variable number of rounds
– Variable-length key
– Low memory requirement
– High security
– Data-dependent rotations
• Cast-128
– Key size from 40 to 128 bits
– The round function differs from round to round

Henric Johnson 18
 Cipher Block Modes of
Operation
• Cipher Block Chaining Mode (CBC)
– The input to the encryption algorithm is the
XOR of the current plaintext block and the
preceding ciphertext block.
– Repeating pattern of 64-bits are not exposed

Ci E k [Ci  1  Pi ]

D K [Ci ] D K [E K (Ci  1  Pi )]
D K [Ci ] (Ci  1  Pi )
Ci  1  D K [Ci ] CHenric
i 1  Ci  1  Pi Pi
Johnson 19
Henric Johnson 20
 Location of Encryption
Device
• Link encryption:
– A lot of encryption devices
– High level of security
– Decrypt each packet at every switch
• End-to-end encryption
– The source encrypt and the receiver decrypts
– Payload encrypted
– Header in the clear
• High Security: Both link and end-to-end
encryption are needed (see Figure 2.9)
Henric Johnson 21
Henric Johnson 22
 Key Distribution
1. A key could be selected by A and
physically delivered to B.
2. A third party could select the key and
physically deliver it to A and B.
3. If A and B have previously used a key, one
party could transmit the new key to the
other, encrypted using the old key.
4. If A and B each have an encrypted
connection to a third party C, C could
deliver a key on the encrypted links to A
and B.
Henric Johnson 23
 Key Distribution (See
Figure 2.10)
• Session key:
– Data encrypted with a one-time
session [Link] the conclusion of the
session the key is destroyed
• Permanent key:
– Used between entities for the purpose
of distributing session keys

Henric Johnson 24
Henric Johnson 25
Recommended Reading
• Stallings, W. Cryptography and
Network Security: Principles and
Practice, 2nd edition. Prentice Hall,
1999
• Scneier, B. Applied Cryptography,
New York: Wiley, 1996
• Mel, H.X. Baker, D. Cryptography
Decrypted. Addison Wesley, 2001

Henric Johnson 26