Subject: RE: [Cfrg] Who agree with building block cipher, hash, MAC with same round function and key schedulel

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 3 Aug 2006 11:20:25 -0400

1. The idea of "chosen key attack" sounds rather ridiculous to me,
especially in a normal society. Consider "ability to decrypt enemy
ciphertexts using chosen key attack" and improving that to "known key
attack". I can imagine societies when such techniques could be useful -
but hope that Third Reich is gone for good (probably I'm overly
optimistic, but anyway this would turn a discussion away from Crypto
Research topic).

2. An excellent point regarding non-permutation S-boxes. In fact,
"substitution block space" is NON-linear. There ARE bad S-boxes. The
rumor is that KGB (who was in charge of providing S-boxes) would decide
how good an S-box set to give you!

3. There was a suggestion in Academia to use 8x8 S-boxes instead of 4x4.
The only problem with it is - where to get good S-boxes. :-)

-----Original Message-----
From: Jack Lloyd [mailto:[email-masked]] 
Sent: Thursday, August 03, 2006 12:11 AM
To: [email-masked]
Subject: Re: [Cfrg] Who agree with building block cipher, hash,MAC with
same round function and key schedulel

On Wed, Aug 02, 2006 at 06:46:02PM -0400, Blumenthal, Uri wrote:

> B) In practice, trying to attack REMOTE communications - when you
can't
> open your own cell phone and pry information from its SIM card (or
when
> the specs are not public and you weren't selected to be an
implementor)
> - you will have sweet time figuring the unknown S-boxes out. Not that
it
> is impossible - but it's yet another tall fence to climb over. And
after
> you get those S-boxes, you're still stuck with breaking 256-bit key.

2^32 encryptions under a single chosen key - I wouldn't really
consider that a much of a 'tall fence', especially in comparison to a
256-bit keysearch. See "A chosen key attack against the secret S-boxes
of GOST", Markku-Juhani Saarinen.

I would personally be skeptical of using GOST Sboxes that were not
permutations, which would mean there is significantly less than 2^512
possible (good) choices. But that is just a quibble, I suppose, as the
naive search space would still be quite large with those possibilities
removed from consideration.

Jack

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "duo lei" <[email-masked]>
Date: Fri, 4 Aug 2006 22:41:43 +0800

> optimistic, but anyway this would turn a discussion away from Crypto

In my understanding, when we use the block cipher algorithm to build a hash,
the chosen key attack become useful.  Since the key is replaced by chaining
value or message. It is possible for the attacker to select some 'key' for
attack. If the cipher is not immune aganist selected key attack, it is hard
to give proof of the hash is security. To get over this problem, I try many
ways to use the known proofs, but failed.

> how good an S-box set to give you!

I am not very understanding this part, but when I compute the conditional
probability of known hash structure, I found that, if the compression
function is not a permutation, the probability distribution of output may
not be a uniformly distribution, so I think, the permutation may be the
better selection. Of cause that was dependent on the condition.