The Data Encryption Standard (DES) is the best known and most widely used cryptosystem for civilian applications. It was developed at IBM and adopted by the National Bureau of Standards in the mid 1970s, and has successfully withstood all the attacks published so far in the open literature. In this paper we develop a new type of cryptanalytic attack which can break the reduced variant of DES with eight rounds in a few minutes on a personal computer and can break any reduced variant of DES (with up to 15 rounds) using less than 256 operations and chosen plaintexts. The new attack can be applied to a variety of DES-like substitution/permutation cryptosystems, and demonstrates the crucial role of the (unpublished) design rules.

/pdf/differential-cryptanalysis-of-des-like-cryptosystems-32wfmjcs4n.pdf

Differential cryptanalysis of DES-like cryptosystems

In September 1996 Boneh, Demillo, and Lipton from Bellcore announced a new type of cryptanalytic attack which exploits computational errors to find cryptographic keys. Their attack is based on algebraic properties of modular arithmetic, and thus it is applicable only to public key cryptosystems such as RSA, and not to secret key algorithms such as the Data Encryption Standard (DES).

/pdf/differential-fault-analysis-of-secret-key-cryptosystems-vzy31pvoov.pdf

Differential Fault Analysis of Secret Key Cryptosystems

In this paper we study the influence of key-scheduling algorithms on the strength of blockciphers. We show that the key-scheduling algorithms of many blockciphers inherit obvious relationships between keys, and use these key relations to attack the blockciphers. Two new types of attacks are described: New chosen plaintext reductions of the complexity of exhaustive search attacks (and the faster variants based on complementation properties), and new low-complexity chosen key attacks. These attacks are independent of the number of rounds of the cryptosystems and of the details of the F-function and may have very small complexities. These attacks show that the key-scheduling algorithm should be carefully designed and that its structure should not be too simple. These attacks are applicable to both variants of LOKI and to Lucifer. DES is not vulnerable to the related keys attacks since the shift pattern in the key-scheduling algorithm is not the same in all the rounds.

/pdf/new-types-of-cryptanalytic-attacks-using-related-keys-5d3f9hr0g6.pdf

New types of cryptanalytic attacks using related keys

In this paper we present a new cryptanalytic technique, based on impossible differentials, and use it to show that Skipjack reduced from 32 to 31 rounds can be broken by an attack which is faster than exhaustive search.

/pdf/cryptanalysis-of-skipjack-reduced-to-31-rounds-using-3218wexyln.pdf

Cryptanalysis of Skipjack reduced to 31 rounds using impossible differentials

Twofish is a 128-bit block cipher that accepts a variable-length key up to 256 bits. The cipher is a 16-round Feistel network with a bijective F function made up of four key-dependent 8-by-8-bit S-boxes, a fixed 4-by-4 maximum distance separable matrix over GF(2), a pseudo-Hadamard transform, bitwise rotations, and a carefully designed key schedule. A fully optimized implementation of Twofish encrypts on a Pentium Pro at 17.8 clock cycles per byte, and an 8-bit smart card implementation encrypts at 1660 clock cycles per byte. Twofish can be implemented in hardware in 14000 gates. The design of both the round function and the key schedule permits a wide variety of tradeoffs between speed, software size, key setup time, gate count, and memory. We have extensively cryptanalyzed Twofish; our best attack breaks 5 rounds with 2 chosen plaintexts and 2 effort.

/pdf/twofish-a-128-bit-block-cipher-3nyqmnjk4s.pdf

Twofish : A 128-bit block cipher

In data communications and information processing systems, cryptography is the most effective way to secure communications and store data. The most commonly used cryptogryphic algorithm is DES (1). However, it is generally implemented with hardware, and the cost is prohibitive for small scale systems such as personal computer communications. Accordingly, an encipherment algorithm that has safety equal to DES and is suitable for software as well as hardware implementation is needed. The FEAL (Fast data Encipherment ALgorihtm) fills this need.

/pdf/fast-data-encipherment-algorithm-feal-47depy2xp0.pdf

Fast data encipherment algorithm FEAL

Input data (R) is split by a splitting part (21) into a plurality of block data having an equal data length to be processed through respective channels (25 to 28). Each channel data is subjected in a function operation part (22) to a function operation in direct or indirect relation to all the other channel data to produce new channel data. Each channel data is subjected in a transform operation part (23) to a transform operation to produce new channel data. All final channel data obtained after function and transform operations are combined by a combining part (24) to obtain randomized data.

Data randomization equipment

PROBLEM TO BE SOLVED: To easily input a long URL(uniform source locator) by making each URL correspond to a digit symbol column within the specific number of digits, and inputting the symbol column. SOLUTION: Each URL 1 is made correspond to a digit symbol column within 10 digits, and the symbol column is inputted. The URL 1 indicates notation indicating the position of a certain resource on a network, and an ENC 2 encodes the URL 1 into a numeric symbol from 1 to 10 digits according to a definite rule. In this device, an HCD being the URL inputted by a remote controller RMC 6 and encoded by the ENC 2 is connected through a set top box STB 7 and a communication line with a data base HCDB 4. The HCDB 4 extracts the URL crrepsonding to the inputted HCD, and tranismits it to the STB 7. The STB 7 executes a conenctign operation with the returned URL, and the result is displayed on a monitor ITV 8. COPYRIGHT: (C)1998,JPO

Method for selecting internet information and device therefor

A user sets n=0, his mail account A and password S, then computes V0=E(A,S), W0=E(A,V0), V1=E(A,A~1), W1=E(A,V1) and M0=E(W1,V0), and initially registers W0, W1, M0 and A by e-mail in a mail server At a visiting site the user sends a service request and A to the mail server from an arbitrary terminal connected to the Internet, and the mail server reads out the authentication session number n corresponding to the identifier A and sends it back to the user The user computes V n-1=E (A,S+~(n-1)), V n+1=E(A,S~(n+1)), W n+1=E(A,V n+1)-V n=E(A,S~n) and M n=E(W n+1,V n) and sends V n-1, W n+1 and M n to the mail server The mail server computes E(A,V n-1) and E(W n,V n-1) and if they agree with preregistered W n-1 and M n-1, respectively, the mail server accepts the user as valid and sends a mail message of the user

Contents transmission control method with user authentication functions and recording medium with the method recorded thereon

A user sets n=0, his mail account A and password S, then computes V0=E(A,S), W0=E(A,V0), V1=E(A,A⊕1), W1=E(A,V1) and M0=E(W1,V0), and initially registers W0, W1, M0 and A by e-mail in a mail server. At a visiting site the user sends a service request and A to the mail server form an arbitrary terminal connected to the Internet, and the mail server reads out the authentication session number n corresponding to the identifier A and sends it back to the user. The user computes Vn-1=E(A,S⊕(n-1)), Vn+1=E(A,S⊕(n+1)), Wn+1=E(A,Vn+1). Vn=E(A,s⊕n) and Mn=E(Wn+1,Vn) and sends Vn-1, Wn+1 and Mn to the mail server. The mail server computes E(A,Vn-1) and E(Wn,Vn-1) and if they agree with preregistered Wn-1 and Mn-1, respectively, the mail server accepts the user as valid and sends a mail message of the user.

Akihiro Shimizu

Papers

Fast data encipherment algorithm FEAL

Data randomization equipment

Method for selecting internet information and device therefor

Contents transmission control method with user authentication functions and recording medium with the method recorded thereon

Contents transmission control method with user authentication functions