Re: [Cfrg] Encrypt in place guidance

[Dan Brown <[e-mail]>]

> -----Original Message-----
> From: Cfrg <[e-mail]> On Behalf Of Leo Perrin
> 
> > So I am looking for both a 64 bit and 96 bit block cipher.  I figured
> > out that if there is no 96 bit, I can do this by first encrypting the
> > 1st 64 bits and then the last 64 bits.  The middle 32bits are double
> > encrypted, but I not seeing that as a problem. But then I am not a
> > cryptographer, only a crypto-plumber.
> 
> I would advise you *not* to do this: this effectively creates a 96-bit block
> cipher with at least one significant flaw.
> 
> Suppose that your plaintext is (A,B,C), where each word is 32-bit long, and that
> you use a block cipher E_k operating on 64 bits. Then you would first obtain
> (W,X) = E_k(A,B), and then (Y,Z) = E_k(X,C), so that the encryption of (A,B,C) is
> (W,Y,Z). The problem with this approach is that W does not depend on C. A
> similar behaviour exists for decryption (C does not depend on W). As a
> consequence, this 96-bit block cipher does not provide full diffusion!
> 
This is a good catch!  

Another way to say this is that information leaks.  If A,B ever repeats, then W repeats, so information about A,B leaks.

(Hmm, also in a previous message Robert said that K is re-used, so if (A,B,C) repeats, then (W,Y,Z) repeats.  What is the threat model here?)

Also, Leo's observation implies a weakening of implicit message authentication.  An adversary who sees (W,Y,Z) replaces it by (W',Y,Z), which decrypts to (A',B',C) where A' and B' are junk, but C is real.  If the decrypted messages are explicit authenticated based on message redundancy, and most of the redundancy is C, then a kind of forgery is obtained. 

> 
> If you really need to turn a 64-bit block cipher into a 96-bit one, then you
> would need to do at least 3 iterations of the 64-bit cipher instead of 2 as you
> suggested:
> 
> (A, B, C) ---(E_k, Id)---> (W, X, C)
> (W, X, C) ---(Id, E_k)---> (W, Y, Z)
> (W, Y, Z) ---(E_k, Id)---> (T, U, Z)
> 
> Still: from a security stand-point, I would much prefer a dedicated 96-bit
> cipher if I were in your position.

Surely somebody has studied such constructions?  I remember hearing about how many rounds of Feistel ladder were necessary, etc.

Intuitively, there ought to some kind of limitation to the security of such constructions, or else one could build up a large block size from a very small size, which sounds implausible.  That said, I never studied block cipher design ...
 


----------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.