Block ciphers with Feistel (or NLFSR) structure. We have learned that DES is an NLFSR, but...

 

Transcribed Image Text:

Block ciphers with Feistel (or NLFSR) structure. We have learned that DES is an NLFSR, but the nonlinear feedback function is given by 32 4-bit permutations. In 2013, NSA presented two new cipher families, called Simon and Speck. In the Simon design, there are two registers where each holds n bits. Assume that an initial state of the NLFSR is given by P = (ao, a₁), a message with 2n bits, a 2n-bit key is denoted as K has 2n bits, and the feedback function is given by f(x0, x₁, ko) = L(x1) · L³(x₁) + L² (x₁) + xo + ko where L is the cyclic shift operator, L' means shift by i times, i = 2,8. Now for a toy example, we assume that n = 4, the cipher text is given by C = Enck (P) = (a4, a5) where we assume for every other round, the key is repeated. (a) Given K = (0001, 0101) = (ko, k₁) and P = (0011, 0110) = (ao, a1) the most left bit is LSB. Find the ciphertext of P. (b) If attacker knows a pair of ciphertext and plaintext, P = (0000, 0101) = (ao, a1) C = (1000, 1100) = (a4, a5) find the key using i) exhaustive search, ii) the time-memory trade-off attack method. Block ciphers with Feistel (or NLFSR) structure. We have learned that DES is an NLFSR, but the nonlinear feedback function is given by 32 4-bit permutations. In 2013, NSA presented two new cipher families, called Simon and Speck. In the Simon design, there are two registers where each holds n bits. Assume that an initial state of the NLFSR is given by P = (ao, a₁), a message with 2n bits, a 2n-bit key is denoted as K has 2n bits, and the feedback function is given by f(x0, x₁, ko) = L(x1) · L³(x₁) + L² (x₁) + xo + ko where L is the cyclic shift operator, L' means shift by i times, i = 2,8. Now for a toy example, we assume that n = 4, the cipher text is given by C = Enck (P) = (a4, a5) where we assume for every other round, the key is repeated. (a) Given K = (0001, 0101) = (ko, k₁) and P = (0011, 0110) = (ao, a1) the most left bit is LSB. Find the ciphertext of P. (b) If attacker knows a pair of ciphertext and plaintext, P = (0000, 0101) = (ao, a1) C = (1000, 1100) = (a4, a5) find the key using i) exhaustive search, ii) the time-memory trade-off attack method.

Answer rating: 100% (QA)

a The ciphertext is CEnck P a4 a5 01101001 b i The key is K 0001 0101 ... View the full answer