论文部分内容阅读
针对Biham和shamir提出的差分密码分析(或简译为差分分析一译者),本文研究了迭代分组密码的安全性。差分密码分析是对秘密钥分组密码的一种选择明文攻击,这种分组密码基于将一密码学弱函数迭代r次(例如,16轮DES)。文中指出,对一个r轮密码的成功攻击依赖于具有高概率的(r—1)轮差分的存在;这里的i轮差分定义为一个对(A,B),即在恰当定义“差量”这一概念的前提下,一对不同的、具有差量A的明文可以(经加密)得到具有差量B的第i轮输出对。这种差分的概率可用于确定差分密码分析复杂度的下限,同时显示一个r轮密码何时不易被差分密码分析攻击。基于其在差分密码分析中的重要性,“马尔可夫密码”这一概念被引入到迭代密码中。如果一个迭代密码是马尔可夫密码并且其各轮子密钥是独立的,则其每一轮输出的差量组成的序列构成了一条马尔可夫链。从 Biham和 Shamir 的研究结果,可以得出 DES 是一种马尔可夫密码。文中还指出,对于“差量”的恰当定义,Lai和Massey的推荐加密标准(PES),一种8轮迭代密码也是一种马尔可夫密码。通过估计PES的r轮差分的概率,文中指出,针对差分分析的攻击,2轮PES至少同10轮DES具有相当的安全性,同时,4轮PES是完全不易受到这种攻击的。
According to the differential cryptanalysis proposed by Biham and Shamir (or translated as a differential analysis), this paper studies the security of iterative block cipher. Differential cryptanalysis is an alternative plaintext attack on cryptographic key cryptography that is based on iterating r (eg, 16 rounds of DES) on a cryptographic weak function. It is pointed out in the paper that a successful attack on an r-round password relies on the presence of a (r-1) round difference with a high probability; here the i-th differential is defined as a pair (A, B) Under the premise of this concept, a different pair of plaintexts with difference A can be (encrypted) to get the i-th output pair with difference B. The probability of this difference can be used to determine the lower bound of the complexity of the differential cryptanalysis, while also showing when an r-th key is not easily attacked by differential cryptanalysis. Based on its importance in differential cryptanalysis, the concept of “Markov ciphers” is introduced into iterative cryptography. If an iterative password is a Markov-cipher and its individual wheel keys are independent, the sequence of the outputs of each round constitutes a Markov chain. From the results of Biham and Shamir, it can be concluded that DES is a Markov password. The article also pointed out that, for the proper definition of “difference”, Lai and Massey’s Recommended Encryption Standard (PES), an 8-iteration password is also a Markov-cipher. By estimating the probability of r-wheel differential in PES, it is pointed out in the paper that 2-round PES is at least as safe as 10-wheel DES against differential analysis attack, while 4-round PES is completely immune to this attack.