1 classical cryptography prof. heejin park. 2 overview classical cryptosystems the shift cipher the...

1

Classical Cryptography

Prof. Heejin Park

2

Overview

Classical cryptosystems The Shift Cipher The Affine Cipher The Substitution Cipher The Vigenère Cipher The Hill Cipher The Permutation Cipher Stream Ciphers

Cryptanalysis of some classical cryptosystems

3

The Shift Cipher

Encryption of plaintext wewillmeet with K = 11

1. Convert each character to an integer

2. Add 11 mod 26 to each value.

3. Convert the value to its corresponding character.

w e w i l l m e e t

22

4 22

8 11

11

12

4 4 19

22

4 22

8 11

11

12

4 4 19

7 15

7 19

22

22

23

15

15

4

7 15

7 19

22

22

23

15

15

4

h p h t w w x p p e

4

The Shift Cipher

Decryption of ciphertext hphtwwxppe Inverse of encryption

Cryptanalysis of shift cipher Exhaustive key search

The key space is too small: only 26 possible keys

JBCRCLQRWCRVNBJENBWRWN

0 Jbcrclqrwcrvnbjenbwrwn

1 Iabqbkpqvbqumaidmavqvm

… …

9 astitchintimesavesnine

5

The Affine Cipher

Encryption

Encryption of hot using Since h, o, t are the 7th, 14th, and 19th characters, (7x7+3) mod 26 = 52 mod 26 = 0. (7x14+3) mod 26 = 101 mod 26 = 23. (7x19+3) mod 26 = 136 mod 26 = 6.

if a =1, it becomes a Shift Cipher.

26mod)()( baxxe 26, Zba

26mod37)( xxe

6

The Affine Cipher

Encryption

Decryption

a should be an integer such that a-1 exists. a-1 exists if and only if a and 26 are relatively prime. 12 integers: 1,3,5,7,9,11,15,17,19,21,23, 25

26mod)()( baxxe 26, Zba

26mod)()( 1 byayd

7

The Affine Cipher

Cryptanalysis The exhaustive key search: Count the number of keys

Number of a’s? 12: 1,3,5,7,9,11,15,17,19,21,23, 25

Number of b’s? 26: because b can be any integer among 0,1,…, 25.

We have 12 X 26 = 312 number of keys.

26mod)()( 1 byayd

26mod)()( baxxe

8

The Affine Cipher

Cryptanalysis

If the modulus is large, the exhaustive key search is infeasible.

However, the Affine Cipher can be easily cryptanalyzed by other methods.

9

The Substitution Cipher

Encryption Substitute each symbol in a plaintext using a

permutation.

a b c d e f g h i j k l m

X N Y A H P O G Z Q W B T

n o p q r s t u v w x y z

S F L R C V M U E K J D I

10


Decryption Substitute each symbol in a ciphertext using the

inverse permutation.

Quiz MGZVYZLGHCMHJMYXSSFMNHAHYCDLMHA ?

The Shift Cipher is a special case of the Substitution Cipher.

Is the Affine Cipher a special case of the Substitution Cipher?

11


Cryptanalysis

An exhaustive key search is infeasible. The number of possible permutation is 26! (> 4 x 1026).

However, the Substitution Cipher can be cryptanalyzed by other methods.

12

The Vigenère Cipher

Monoalphabetic cryptosystems The Shift Cipher and the Substitution Cipher. Each character is mapped to one character.

Polyalphabetic cryptosystems The Vigenère Cipher A character can be mapped to one of characters.

13


Encryption m = 6, K = (2,8,15,7,4,7)

Decryption Inverse of encryption

19 7 8 18 2 17 24 15 19 14 18 24

2 8 15 7 4 17 2 8 15 7 4 17

21 15 23 25 6 8 0 23 8 21 22 15

plaintext

key

ciphertext

14


Formal Definition Let m be a positive integer. Define P = C = K = (Z26)m. For

a key K = (k0, k1, … , km-1), we define

eK(x0, x1, … , xm-1) = ( x0 + k0 , x1 + k1, … , xm-1 + km-1)

dK(y0, y1, … , ym-1) = ( y0 - k0 , y1 - k1, … , ym-1 – km-1)

Where all operations are performed in Z26

15


Cryptanalysis

The number of possible keys 26m

Exhaustive key search is infeasible if m is not too small.

However, the Vigenère cipher can be cryptanalyzed by other methods.

16

The Hill Cipher

Encryption key: m x m matrix

1,11,10,1

1,11.10,1

1,01,00,0

11,0110

...

.........

...

...

),...,(),...,,(

mmmm

m

m

mm

kkk

kkk

kkk

xxxyyy

1,11,10,1

1,11.10,1

1,01,00,0

...

.........

...

...

mmmm

m

m

kkk

kkk

kkk

17

The Hill Cipher

Encrypt the plaintext july with k =

We partition july into ju and ly. ju: (9, 20)

ly: (11, 24)

73

811

(3,4)(159,212)140)60,72(9973

811(9,20)

(11,22)(84,256)168)72,88(1273

811(11,24)

18

The Hill Cipher

Decryption Use the inverse of key matrix

),...,(

1

...

.........

...

...

),...,,( 11,0

1,11,10,1

1,11.10,1

1,01,00,0

110

m

mmmm

m

m

m xxx

kkk

kkk

kkk

yyy

19

The Permutation Cipher

Encryption key: a permutation of size m

a permutation where m = 6

shesellsseashellsbytheseashore

shesel lsseas hellsb ythese ashore

EESLSH SALSES LSHBLE HSYEET HRAEOS

2 4 0 5 3 1

012345

20

The Permutation Cipher

Decryption Use the inverse permutation of the key

The Permutation Cipher is a special case of the Hill Cipher.

2 4 0 5 3 1

001000

000010

010000

000001

100000

000100

),...,(),...,,( 51,0510 xxxyyy

20 xy 41 xy

21

Stream Ciphers

Block ciphers Each plaintext element is encrypted using the same key K.

Stream ciphers Plaintext elements are encrypted using key stream .

)()( 1010 xexeyyy KK

)()( 1010 21xexeyyy ZZ

10zz

22

Stream Ciphers

Key stream construction

Synchronous stream ciphers The key stream is constructed from the key.

Non-synchronous stream ciphers The key stream is constructed from the key, the plaintext, or the

ciphertext.

23

Synchronous Ciphers

The Vigenère Cipher is a kind of stream cipher. Encryption

The is a synchronous stream cipher whose keystream is z1z2… such that

mii kz mod

1110 mmm xxxxx

10110 kkkkk m

1110 mmm yyyyy

26 mod mod miii kxy

24

Synchronous Ciphers

A stream cipher is a periodic stream cipher with period d if for all i ≥ 0. The Vigenère Cipher is a periodic stream cipher with

period m.

Stream cipher are often described in terms of binary alphabets (P = C = K = Z2) The encryption/decryption operations are just exclusive-or.

idi zz

iii zxy 10xx10zz

10 yyiii zyx

25

Synchronous Ciphers

A method for generating binary key stream z0z1…

Initialize z0…zm-1 using a binary tuple (k0, …, km-1). z0 = k0 , z1 = k1,…, zm-1 = km-1

Generate zmzm+1… using a linear recurrence of degree m

for all i ≥ 0, where are specified constant

1

0

2modm

jjijmi zcz

210 ,..., Zcc m

26

Synchronous Ciphers

Example m = 4 and the keystream is generated using

If starting with (1, 0, 0, 0), the keystream is 10001001…

If starting with (0, 0, 0, 0), the keystream is 00000000… So, zero vector should be avoided for the key.

If is chosen carefully, the period of the key stream can be 2m-1.

2mod)( 14 iii zzz

10 ,..., mcc

27

Synchronous Ciphers

LFSR (Linear feedback shift register) Use a shift register with m stages The vector (k1, … , km) is used to initialize the shift

register At each time unit, the following operation is

performed. k1 becomes the next keystream bit k2, … , km are shifted to the left The “new” value of km becomes

1

01

m

jjjkc

K1 K2 K3 K4

2mod)( 14 iii zzz

28

Non-synchronous stream cipher

Autokey Cipher

z0 = K , z1 = x0, z2 = x1,… zi = xi-1… Encryption

Decryption

26mod)( iii zxy

26mod)( 1 iii xxy

26mod)( 1 iii xyx

29


K = 8 and the plaintext is rendexvous

Convert the plaintext to integers

Keystream

Add corresponding elements modulo 26

Ciphertext is VRQHDUJIM

17 4 13 3 4 25 21 14 20 18

8 17 4 13 3 4 25 21 14 20

25 21 7 16 7 3 20 9 8 12

30


Decryption

25 21 7 16 7 3 20 9 8 12

1726mod) 825(1 x

426mod)1721(2 x

31

Overview

Classical cryptosystems The Shift Cipher The Affine Cipher The Substitution Cipher The Vigenère Cipher The Hill Cipher The Permutation Cipher Stream Ciphers

Cryptanalysis of some classical cryptosystems The Affine Cipher The Substitution Cipher The Vigenère Cipher The Hill Cipher The LFSR Stream Ciphers

32

Cryptanalysis

In general, it is assumed that the opponent knows the cryptosystem being used.

Cryptanalysis Full cryptanalysis

Find the key, i.e., generate the ciphertext string for any plaintext string.

Partial cryptanalysis Generate the ciphertext strings for some plaintext

strings.

33

Attacks

Ciphertext only attack The opponent can see the ciphertext strings.

Known plaintext attack The opponent can see some plaintext strings and their

ciphertext strings.

Chosen plaintext attack The opponent can temporary access to the encryption

machinery. Hence he can choose some plaintext strings and construct their ciphertext strings.

Chosen ciphertext attack The opponent can temporary access to the decryption

machinery. Hence he can choose some ciphertext strings and construct their plaintext strings.

34

English Text

The frequency of each character

E: about 12%

T, A, O, I, N, S, H, R: 6-9%

D, L : about 4%

C, U, M, W, F, G, Y, P, B: 1.5%-2.8%

V, K, J, X, Q, Z:< 1%

letter probability letter probability

A .082 N .067

B .015 O .075

C .028 P .019

D .043 Q .001

E .127 R .060

F .022 S .063

G .020 T .091

H .061 U .028

I .070 V .010

J .002 W .023

K .008 X .001

L .040 Y .020

M .024 Z .001

35

English Text

It is also useful to consider sequences of two or three consecutive letters, called digrams and trigrams

The 30 most common digrams are

The twelve most common trigrams are

TH, HE, IN, ER, AN, RE, ED, ON, ES, ST, EN, AT, TO, NT, HA, ND, OU, EA, NG, AS, OR, TI, IS, ET, IT, OF

THE, ING, AND, HER, ERE, ENT, THA, NTH, WAS, ETH, FOR, DTH

36

The Affine Cipher

Ciphertext only attack Suppose opponent has intercepted the following

ciphertext

Frequency of occurrence of the 26 ciphertext letters

FMXVEDKAPHFERBNDKRXRSREFMORUDSDKDVSHVUFEDKAPRKDLYEVLRHHR

letterFrequenc

yLetter

Frequency

A 2 H 5

B 1 I 0

C 0 J 0

D 7 K 5

E 5 L 2

F 4 M 2

G 0

letterFrequenc

yLetter

Frequency

N 1 U 2

O 1 V 4

P 2 W 0

Q 0 X 2

R 8 Y 1

S 3 Z 0

T 0

37

The Affine Cipher

Suppose opponent has intercepted the following ciphertext

Frequency of occurrence of the 26 ciphertext letters

FMXVEDKAPHFERBNDKRXRSREFMORUDSDKDVSHVUFEDKAPRKDLYEVLRHHR

letterFrequenc

yLetter

Frequency

A 2 H 5

B 1 I 0

C 0 J 0

D 7 K 5

E 5 L 2

F 4 M 2

G 0

letterFrequenc

yLetter

Frequency

N 1 U 2

O 1 V 4

P 2 W 0

Q 0 X 2

R 8 Y 1

S 3 Z 0

T 0

38

The Affine Cipher

The most frequent ciphertext characters are R (8 occurrences) D (7 occurrences) E, H, K (5 occurrences each) F, S, V (4 occurrences each)

First guess: eK(e)=R, eK(t)=D. We have eK(4)=17 and eK(19)=3. Recall that eK(x)=ax+b , where a and b are unknowns

This system has the unique solution a = 6, b = 19 (in Z26), but this is an illegal key, since gcd (a, 26) = 2 > 1

319

174

ba

ba

39

The Affine Cipher

Guess: eK(e)=R and eK(t)=E. Obtain a = 13, which is again illegal.

Guess: eK(e)=R and eK(t)=H. This yields a = 8, again impossible.

Guess: eK(e)=R and eK(t)=K. This produces a = 3, b = 5, which is at least a legal key. K = (3, 5)

Perform decryption The given ciphertext decrypts to yield

algorithmsarequitegeneraldefinitionsofarithmeticprocesses

40


Ciphertext only attackCiphertext obtained from a substitution cipher

The frequency analysis of this ciphertext

YIFQFMZRWQFYVECFMDZPCVMRZWNMDZVEJBTXCDDUMJNDIFEFMDZCDMQZKCEYFCJMYRNCWJCSZREXCHZUNMXZNZUCDRJXYYSMRTMEYIFZWDYVZVYFZUMRZCRWNZDZJJXZWGCHSMRNMDHNCMFQCHZJMXJZWIEJYUCFWDJNZDIR

letterFrequenc

yLetter

Frequency

A 0 H 4

B 1 I 5

C 15 J 11

D 13 K 1

E 7 L 0

F 11 M 16

G 1

letterFrequenc

yLetter

Frequency

N 9 U 5

O 0 V 5

P 1 W 8

Q 4 X 6

R 10 Y 10

S 3 Z 20

T 2

41


Z occurs significantly more often than others. We might conjecture that eK(e)=Z.

C, D, F, J, M, R, Y Occur at least ten times. We might expect that these letters are

encryptions of t, a, o, i, n, s, h, r. But, not vary enough what the correspondence

might be.

42


We might look at digrams, especially those of the form –Z or Z– The most common digrams of this type

DZ and ZW (four times each) NZ and ZU (three times each) RZ, HZ, XZ, FZ, ZR, ZV, ZC, ZD and ZJ (twice each)

ZW occurs four times and WZ not at all W occurs less often than many other characters, The Common digrams e– : ER, ED, ES, EN, EA, ET

expect letter {t, a, o, i, n, s, h, r} we might guess that dk(W) = d

DZ occurs four times and ZD occurs twice The common digram –e : HE(EH not exist), RE, SE, TE },,{)( tsrDDK

43


If we proceed on the assumption that dk(Z) = e and dk(W) = d. ZRW(e-d) and RZW(-ed) both occurring near the beginning of

the ciphertext and RW(-d) occurs again later on.

Since R occurs frequently in the ciphertext and nd is a common digram, we might try dk(R) = n as the most likely possibility.

------end---------e----ned---e------------YIFQFMZRWQFYVECFMDZPCVMRZWNMDZVEJBTXCDDUMJ

--------e----e---------n—d---en----e----eNDIFEFMDZCDMQZKCEYFCJMYRNCWJCSZREXCHZUNMXZ

-e---n------n------ed---e---e--ne-nd-e-e--NZUCDRJXYYSMRTMEYIFZWDYVZVYFZUMRZCRWNZDZJJ

-ed----- n ------------e----ed-------d---e--nXZWGCHSMRNMDHNCMFQCHZJMXJZWIEJYUCFWDJNZDIR

44


Next step might be to try dK(N) = h NZ(he) is a common digram and ZN(eh) is not A common digram –e : HE(EH not exist), RE, SE, TE So, dK(N) = h If this is correct, then the segment of plaintext ne – ndhe suggests

that dK(C) = a ZC(e-) is a common digram and CZ(-e) is not

------end-----a---e-a--nedh--e------a-----YIFQFMZRWQFYVECFMDZPCVMRZWNMDZVEJBTXCDDUMJ

h-------ea---e-a---a---nhad-a-en--a-e-h--eNDIFEFMDZCDMQZKCEYFCJMYRNCWJCSZREXCHZUNMXZ

he-a-n------n------ed---e---e--neandhe-e--NZUCDRJXYYSMRTMEYIFZWDYVZVYFZUMRZCRWNZDZJJ

-ed-a--- nh---ha---a-e----ed-----a-d--he--nXZWGCHSMRNMDHNCMFQCHZJMXJZWIEJYUCFWDJNZDIR

45


We might consider M, the second most common ciphertext character The ciphertext segment RNM, which we believe decrypts to nh- Suggest that h- begins a word, so M probably represent a vowel We have already accounted for a and e

expect letter {t, a, o, i, n, s, h, r} So, we expect that dK(M) = i or o Since ai is a much more likely digram than ao, so dK(M) = i first

-----iend-----a-i-e-a-inedhi-e------a---i-YIFQFMZRWQFYVECFMDZPCVMRZWNMDZVEJBTXCDDUMJ

h-----i-ea-i-e-a---a-i-nhad-a-en--a-e-hi-eNDIFEFMDZCDMQZKCEYFCJMYRNCWJCSZREXCHZUNMXZ

he-a-n-----in-i----ed---e---e-ineandhe-e--NZUCDRJXYYSMRTMEYIFZWDYVZVYFZUMRZCRWNZDZJJ

-ed-a---inhi--hai--a-e-i--ed-----a-d--he--nXZWGCHSMRNMDHNCMFQCHZJMXJZWIEJYUCFWDJNZDIR

46


Next, We might try to determine which letter is encrypted to o Since o is a common letter, we guess one of D, F, J, Y

At least ten times characters : C, D, F, J, M, R, Y Y seem to be the possibility

We would get long strings of vowels, namely aoi form CFM or CJM Hence, let’s suppose dK(Y) = o

The three most frequent remaining ciphertext letters are D, F, J, which we conjecture could decrypt to r, s, t in some order Two occurrences of the trigram NMD(hi-) suggest that dK(D) = s, giving the

trigram his in the plaintext

The segment HNCMF could be an encryption of chair, which would give dK(F) = r (and dK(H) = c) So we would then have dK(J) = t

Process of elimination

47


Now, we have

The complete decryption is

o-r-riend-ro--arise-a-inedhise--t---ass-itYIFQFMZRWQFYVECFMDZPCVMRZWNMDZVEJBTXCDDUMJ

hs-r-riseasi-e-a-orationhadta-en--ace-hi-eNDIFEFMDZCDMQZKCEYFCJMYRNCWJCSZREXCHZUNMXZ

he-asnt-oo-in-i-o-redso-e-ore-ineandhesettNZUCDRJXYYSMRTMEYIFZWDYVZVYFZUMRZCRWNZDZJJ

-ed-ac--inhischair-aceti-ted--to-ardsthes-nXZWGCHSMRNMDHNCMFQCHZJMXJZWIEJYUCFWDJNZDIR

Our friend from Paris examined his empty glass with surprise, asif evaporation had taken place while he wasn’t looking. I poured somemore wine and he settled back in his chair, face tilted up towards the sun

48


Encryption m = 6, K = (2,8,15,7,4,7)

We first compute m and then compute K. Techniques used

Kasiski test The index of coincidence

19 7 8 18 2 17 24 15 19 14 18 24

2 8 15 7 4 17 2 8 15 7 4 17

21 15 23 25 6 8 0 23 8 21 22 15

plaintext

key

ciphertext

49


Observation: Two identical segments of plaintext will be encrypted to the same ciphertext whenever their occurrence in the plaintext is δ positions apart, where .

Kasiski test

Search the ciphertext for pair of identical segments of length at least three.

Record the distance between the starting positions of the two segments If we obtain several such distances, sayδ1,δ2, … ,

Then we would conjecture that m divides all of the δi’s Hence m divides the greatest common divisor of theδi’s

)(mod 0 m

50


The distances from the first occurrence to other four occurrences are 165, 235, 275, 285.

The greatest common divisor of these four integers is 5. (very likely keyword length)

CHREEVOAHMAERATBIAXXWTNXBEEOPHBSQMQEQERBWRVXUOAKXAOSXXWEAHBWGJMMQMNKGRFVGXWTRZXWIAKLXFPSKAUTEMNDCMGTSXMXBTUIADNGMGPSRELXNJELXVRVPRTULHDNQWTWDTYGBPHXTFALJHASVBFXNGLLCHRZBWELEKMSJIKNBHWRJGNMGJSGLXFEYPHAGNRBIEQJTAMRVLCRREMNDGLXRRIMGNSNRWCHRQHAEYEVTAQEBBIPEEWEVKAKOEWADREMXMTBHHCHRTKDNVRZCHRCLQOHPWQAIIWXNRMGWOIIFKEE

51


The index of coincidence

Observe that a completely random string will have

The two values 0.065 and 0.038 are quite apart.

letter probability letter probability

A .082 N .067

B .015 O .075

C .028 P .019

D .043 Q .001

E .127 R .060

F .022 S .063

G .020 T .091

H .061 U .028

I .070 V .010

J .002 W .023

K .008 X .001

L .040 Y .020

M .024 Z .001

065.0)(25

0

2 i

ic pI x

038.026

1)

26

1(26 2 cI

52


Using index of coincidenceDefine m substring of y, denoted y1, y2, … , ym,

y1 = y1ym+1y2m+1 … y2 = y2ym+2y2m+2 …

…ym= ymy2my3m …

If m is indeed the keyword length Each value Ic(yi) ≈ 0.065.

If m is not the keyword length The substrings yi will look much more random. Each value Ic(yi) ≈ 0.038.

53


Computation of indices of coincidence m = 1, index of coincidence is 0.045 m = 2, we get 0.046 and 0.041 m = 3, we get 0.043, 0.050, and 0.047 m = 4, we get 0.042. 0.039. 0.046, and 0.040 m = 5, we get 0.063, 0.068, 0.069, 0.061, and

0.072

54


How to determine the key K = (k1, k2, … , km).

Let p’0, … , p’25 denote the probabilities of A, B, …, Z in the string yi.

Since substring yi is obtained by shift encryption of a subset of the plaintext using a shift ki ,

p0 ≈ p’0+k , p1 ≈ p’1+k , …

55


Compute

for all 0 ≤ k ≤ 25.

If k = ki, I ≈ 0.065.

If k ≠ ki, I ≈ 0.038.

'25

0

I kii

i pp

56


Y1

.035 .031 .036 .037 .035 .039 .028 .028 .048

.061 .039 .035 .040 .038 .038 .044 .036 .030

.042 .043 .036 .033 .049 .043 .041 .036 .000

Y2

.069 .044 .032 .035 .044 .034 .036 .033 .030

.031 .042 .045 .040 .045 .046 .042 .037 .032

.034 .037 .032 .034 .043 .032 .026 .047 .000

Y3

.048 .029 .042 .043 .044 .034 .038 .035 .032

.049 .035 .031 .035 .065 .035 .038 .036 .045

.027 .035 .034 .034 .037 .035 .046 .040 .000

Y4

.045 .032 .033 .038 .060 .034 .034 .034 .050

.033 .033 .043 .040 .033 .028 .036 .040 .044

.037 .050 .034 .034 .039 .044 .038 .035 .000

Y5

.034 .031 .035 .044 .047 .037 .043 .038 .042

.037 .033 .032 .035 .037 .036 .045 .032 .029

.044 .072 .036 .027 .030 .048 .036 .037 .000

57


From the data in Table 1.4, the key is likely to be K = (9, 0, 13, 4, 19)

Decrytion of the ciphertext

The almond tree was in tentative blossom. The days were longer, often ending with magnificent evenings of corrugated pink skies. The hunting season was over, with hounds and guns put away for six months. The vineyards were busy again as the well-organized farm-ers treated their vines and the more lackadaisical neighbors hurried to do the pruning they should have done in November.

58

The Hill Cipher

Encryption key K: m x m matrix

The hill cipher can be difficult to break with a ciphertext-only attack, but it succumbs to a known plaintext attack. Assume that the opponent know the value of m.

Kxxx

kkk

kkk

kkk

xxxyyy m

mmmm

m

m

mm ),...,(

...

.........

...

...

),...,(),...,,( 11,0

1,11,10,1

1,11.10,1

1,01,00,0

11,0110

1,11,10,1

1,11.10,1

1,01,00,0

...

.........

...

...

mmmm

m

m

kkk

kkk

kkk

59

Suppose he has m distinct plaintext-ciphertext pairs

, for 0 ≤ j ≤ m-1.

The Hill Cipher

),...,,( ,1,1,0 jmjjj xxxx ),...,,( ,1,1,0 jmjjj yyyy

Kxxxyyy mm ),...,(),...,,( 0,10,1,0,00,10,10,0

Kxxxyyy mm ),...,(),...,,( 1,11,1,1,01,11,11,0

1,11,10,1

1,11.10,1

1,01,00,0

1,11,11,0

1,11,11,0

0,10,10,0

1,11,11,0

1,11,11,0

0,10,10,0

...

.........

...

...

...

.........

...

...

...

.........

...

...

mmmm

m

m

mmmm

m

m

mmmm

m

m

kkk

kkk

kkk

xxx

xxx

xxx

yyy

yyy

yyy

· ·

· ·

60

The Hill Cipher

1,11,10,1

1,11.10,1

1,01,00,0

1,11,10,1

1,11.10,1

1,01,00,0

1,11,10,1

1,11.10,1

1,01,00,0

...

.........

...

...

...

.........

...

...

...

.........

...

...

mmmm

m

m

mmmm

m

m

mmmm

m

m

kkk

kkk

kkk

xxx

xxx

xxx

yyy

yyy

yyy

1,11,10,1

1,11.10,1

1,01,00,0

1,11,10,1

1,11.10,1

1,01,00,0

1,11,10,1

1,11.10,1

1,01,00,0

...

.........

...

...

...

.........

...

...1

...

.........

...

...

mmmm

m

m

mmmm

m

m

mmmm

m

m

kkk

kkk

kkk

yyy

yyy

yyy

xxx

xxx

xxx

61

The Hill Cipher

Suppose the plaintext Friday is encrypted to the ciphertext PQCFKU using a Hill Cipher with m = 2. eK(5, 17) = (15, 16), eK(8, 3) = (2, 5), eK(0, 24) = (10,

20) We get the matrix equation

So

K

38

175

52

1615

152

19

38

173det)1(

38

1751,1

11

1

A

38

197

52

1615

152

19K

62

What would the opponent do if he does not know m?

Assuming that m is not too big, he could simply try m = 2, 3, …. , untill the key found.

The Hill Cipher

63

The LFSR Stream Cipher

Ciphertext is the exclusive-or of the plaintext and the keystream

The keystream is produced from an initial m-tuple, (z0, … , zm-1)=(k0, … , km-1), using the linear recurrence

for all i ≥ 0, where

iii zxy

1

0

2modm

jjijmi zcz

210 ,..., Zcc m

64


Known plaintext attack From the given paintext string x1x2…xn and

the corresponding ciphertext string y1y2…yn, the keystream bits z1z2…zn .

Suppose that opponent knows the value of m

He needs only to compute c0, …, cm-1 .

iii yxz

65


If n ≥ 2m, then there are m linear equations in m unknowns, which can subsequently be solved.

121

132

21

110221

...

.........

...

...

),...,,(),...,,(

mmm

m

m

mmmm

zzz

zzz

zzz

ccczzz

),...,,(

1

...

.........

...

...

),...,,( 110

121

132

21

221

m

mmm

m

m

mmm ccc

zzz

zzz

zzz

zzz

66


Example Suppose the ciphertext string is

10110 10111 10011 and the plaintext string is

01100 11111 11000 Then the keystream bits are

11010 01000 01010

67


If m = 5,

00100

01001

10010

00101

01011

),,,,()0,0,0,1,0( 43210 ccccc

11101

11010

10000

01001

10010

00100

01001

10010

00101

010111

)0,1,0,0,1(

11101

11010

10000

01001

10010

)0,0,0,1,0(),,,,( 43210

ccccc

Thus zi+5 = (zi+zi+3) mod 2

1 classical cryptography prof. heejin park. 2 overview classical cryptosystems the shift cipher the...

Documents

vigenre cipher encryption

periodic stream cipher

substitution cipher

kind of stream cipher

permutation cipher decryption

hill cipher encryption

vigenre cipher cryptanalysis

substitution cipher