[互联网]DES算法.ppt

Linear cryptanalysis is newer than differential cryptanalysis. DES is more vulnerable to linear cryptanalysis than to differential cryptanalysis. S-boxes are not very resistant to linear cryptanalysis. It has been shown that DES can be broken using 243 pairs of known plaintexts. However, from the practical point of view, finding so many pairs is very unlikely. 6.5.3 Linear Cryptanalysis We show an example of DES linear cryptanalysis in Appendix N. Note 6.2.3 Continued Figure 6.10Key generation 6.2.3 Continued Table 6.12 Parity-bit drop table Table 6.13 Number of bits shifts 6.2.3 Continued Table 6.14 Key-compression table 6.2.3 Continued Algorithm 6.2 Algorithm for round-key generation 6.2.3 Continued Algorithm 6.2 Algorithm for round-key generation (Continue) Example 6.5 6.2.4 Examples We choose a random plaintext block and a random key, and determine what the ciphertext block would be (all in hexadecimal): Table 6.15 Trace of data for Example 6.5 Example 6.5 Table 6.15 Trace of data for Example 6.5 (Conintued 6.2.4 Continued Continued Example 6.6 6.2.4 Continued Let us see how Bob, at the destination, can decipher the ciphertext received from Alice using the same key. Table 6.16 shows some interesting points. 6-3 DES ANALYSIS Critics have used a strong magnifier to analyze DES. Tests have been done to measure the strength of some desired properties in a block cipher. 6.3.1 Properties6.3.2 Design Criteria 6.3.3 DES Weaknesses Topics discussed in this section: Two desired properties of a block cipher are the avalanche effect and the completeness. 6.3.1 Properties Example 6.7 To check the avalanche effect in DES, let us encrypt two plaintext blocks (with the same key) that differ only in one bit and observe the differences in the number of bits in each round. Example 6.7 6.3.1 Continued Although the two plaintext blocks differ only in the rightmost bit, the ciphertext blocks differ in 29 bits. This means that changing approximat