NetNews Usenet Archive 1992 #30/NN_1992_30.iso/spool/sci/crypt/5747

Text File | 1992-12-16 | 3.0 KB | 59 lines

Newsgroups: sci.crypt
Path: sparky!uunet!spool.mu.edu!uwm.edu!linac!att!att!dptg!ulysses!ulysses!smb
From: [e-mail] (Steven Bellovin)
Subject: Re: Enlarging key size of the DES algorithm
Message-ID: <[e-mail]>
Date: Wed, 16 Dec 1992 16:47:04 GMT
References:  <[e-mail]>
Organization: AT&T Bell Laboratories
Keywords: DES, key size
Lines: 47

In article <[e-mail]>, [e-mail] (Bartjan Wattel) writes:
> Hi,
>
> I'm currently working on a project which involves the design of a DES cryto-
> chip. When reading some papers on this subject, it appeared to me that there
> is a great need for enlarging the number of bits used in the cipher key. I read
> about an implementation of the DES with a cipher key of 768 bits in the paper
> of T.Kropf, J.Fr"ossl, W.Beller and T.Giesler: A hardware implementation of a
> modified DES-algorithm, in North-Holland Micorprocessing and Microprogramming
> 30, 1990.
>
> Questions:
>
>   1)  Does anybody know the reason(s) for the number of circular left shifts
>       which are performed on the cipher key each iteration in the original
>       DES algorithm ?
>   2)  Does anybody know of other modifications concerning the key size ?
>   3)  Do modifications exist which have been published or proposed by the
>       NBS, or do other (de facto) standard modifications exist ?

First of all, when adopting any sort of cryptosystem, you have to decide
who the enemy is.  Increasing the key size is useful in defending against
brute-force attacks.  The Biham/Shamir paper showed that picking all 768
bits independently did not make a significant difference in how long it took
to use differential cryptanalysis.  To me, that says that the strength
of DES, under that attack at least, is something on the close order of 56
bits.  I would not be at all surprised to learn of other attacks that
showed the same property.

There are weaknesses that come about from picking the bits independently.
Specifically, DES now has the property that changing 1 key bit will change,
on the average, 50% of the bits in the output for constant inputs.  That
wouldn't be the case with the proposed change.  Key bits near the end
of the 768 bits should be much easier to recover.

And that, in turn, brings up the reason for shifting the key bits around
to produce the 16 subkeys.  The intent is to have each key bit operate
on each plaintext bit as soon as possible.  The E-box is tied in to this,
too, and as I recall Shamir's talk it in turn interacts with the S-boxes.

I'm certainly not saying that you can't design a better cipher than DES.
But I doubt that the sort of localized tampering you're suggesting is
likely to result in a cipher that's stronger overall.  What you may
accomplish is to confound some canned techniques -- possibly even including
NSA's -- simply because the attacker has bothered to invest the upfront capital
to attack DES.  Your system may be more effective in practice, though not
stronger in theory, simply because it may not be worth attacking.