ftp.cse.unsw.edu.au/2014.06.ftp.cse.unsw.edu.au.tar/ftp.cse.unsw.edu.au/pub/doc/algorithms/DES_Encryption

Internet Message Format | 1992-10-18 | 5.6 KB

From [e-mail] Thu Jul 14 17:26:09 1988
Relay-Version: version B UNSW 1.1 19 Sep 1984; site elecvax.eecs.unsw.oz
Path: elecvax!usage!ccadfa!csadfa!lpb
From: [e-mail] (Lawrie Brown)
Newsgroups: sci.crypt
Subject: Modes of DES (was Re: Feedback Chain Encipherment?)
Message-ID: <[e-mail]>
Date: 12 Jul 88 00:28:43 GMT
Date-Received: Wed, 13 Jul 88 07:29:33 AEST
References: <21400002@silver>
Organization: Dept. of Computer Science, University College, UNSW, ADFA, Canberra, Australia
Lines: 114

From article <21400002@silver>, by [e-mail]:
>
>    I am sort of studying cryptology on my own, and today I ran across the
> term 'feedback chain encipherment' while reading about the DES encryption
> algorithm. Unfortunately the book did not explain the term. Can anyone out
> there explain it to me, or if it is rather involved, recommend a book that
> would explain it? (I have a fairly solid math background).
>
    The DES "core" if you like, is a function which takes a 64-bit
plaintext block, a 56-bit key, and produces a 64-bit ciphertext output.
ie:
    C = DES(P, K)

There are a number of ways of using this core in an enciphering scheme. There
are 4 techniques defined by ANSI for use:

The first two modes are for "block" ciphers:

i) Electronic Codebook Mode (ECB) - this is the simplest. You break your
    message into 64-bit blocks, encrypt and send each separately. There
    is no linkage between blocks, hence errors in one will not propogate
    to others. This is probably the least secure form, since the error
    propogation is needed to detect message repeats etc. It also is very
    bad at enciphering regular patterns of data (eg images). Mainly used
    when single blocks (often authenticators) need to be exchanged.
    ie:     C(i) = DES(P(i), K),    i>0

ii) CipherBlock Chaining (CBC) - in this mode the message is also divided
    into 64-bit blocks. However, before each block is enciphered, it is
    XOR'd with the previous ciphertext block, and is then enciphered and
    transmitted. The first block is XOR'd with an Initialization Vector
    (IV) which is specified as part of the scheme.
    ie:    C(i) = DES((P(i) XOR C(i-1)), K), C(0) = IV, i>0
    To decrypt, first decipher C(1) then XOR with IV to recover original
    message, etc. This scheme ensures that each block is a function of all
    previous blocks, and prevents replays of the data. This is the mode
    specified for use in EFT applications etc., where data is organized
    in regular blocks.

The remaining two modes are used in stream ciphers, typically on 1-byte (8-bits)
    of data at a time.

iii) Ciphertext Feedback Mode (CFB) - the ciphertext output is formed by the
    XOR of n-bits of input message (typically 1 or 8) and n-bits of DES
    output. The input of the DES module at each step is the (64-n) bits
    of the previous input shifted left by n bits, and OR'd with the n-bits
    of the previous ciphertext. Again an Initialization Vector is used in
    the first step.
    ie:    C(i) = P(i) XOR (n-bits of DES(((I(i-1) << n) | C(i-1)), K)),
            I(0) = IV, i>0
    Again every ciphertext block is a function of all previous blocks.
    This scheme is used when the message is a bit or byte stream rather than
    a series of blocks. It is obviously less efficient than CBC by a factor
    of 64/n since only n-bits are used from the DES stage at each step.

iv) Output Feedback Mode (OFB) - is very similar, save in the feedback loop.
    The ciphertext output is formed by the XOR of n-bits of input message
    (typically 1 or 8) and n-bits of DES output. The input of the DES
    module at each step is the (64-n) bits of the previous input shifted
    left by n bits, and OR'd with the n-bits of the previous DES output
    (this is the difference from CFB mode). Again an Initialization Vector
    is used in the first step.
    ie:    D(i) = n-bits of DES(((I(i-1) << n) | D(i-1)), K)
        C(i) = P(i) XOR D(i), I(0) = IV, i>0
    Again every ciphertext block is a function of all previous blocks.
    This scheme is used when the message is a bit or byte stream rather than
    a series of blocks. It differs from CFB in that the "keystream" D(i),
    can be computed independently of the message stream, which is useful in
    some applications.

As for references - well as you have noted discussion of all the DES modes
is rather sparse on the ground. The best reference is the ANSI standards
themselves:

    ANSI X3.92-1981 - The Data Encryption Algorithm
    ANSI X3.106-1983 - Data Encryption Algorithm, Modes of Operation

I also suggest the following articles:

C. R. Abbruscato, "Data Encryption Equipment", IEEE Communications Magazine
    Vol. 22, No. 9, Sept. 1984, pp15-21.

M. Davio, Y. Desmedt, et al. "Analytic Characteristics of the DES",
    in Advances in Cryptology - Proc. of Crypto 83, pp 171-202,
    Plenum Press, New York.

F Hoornaert, J. Goubert, Y. Desmedt, "Efficient Hardware Inplementation of DES",
    in Advances in Cryptology - Proc. of Crypto 84, pp 147-173,
    Springer-Verlag, Berlin.

and finally some of the good books on cryptography are:

J. Seberry, J. Pieprzyk, "Cryptography: An Introduction to Computer Security",
    Addison-Wesley, 1988. (to appear in the very near future).

D. E. Denning, "Cryptography and Data Security", Addison-Wesley, 1982.

C. H. Meyer, S. M. Matyas, "Cryptography: A New Dimension in Computer Security",
    John Wiley & Sons. 1982.

    Hope this is of interest.

    Regards
    Lawrie Brown.


----
Mr. Lawrie Brown,        Phone ISD:   [phone]   Fax: [phone]
Dept. Computer Science,        Telex:         ADFADM AA62030
University College, UNSW,    ACSNET/CSNET:    [e-mail]
Aust. Defence Force Academy,    UUCP:        ...!uunet!munnari!cs.adfa.oz!lpb
Canberra. ACT 2600.        ARPA:        [e-mail]
AUSTRALIA            JANET:        [e-mail]
                Other Gateways:    see CACM 29(10) Oct. 1986