In this paper, we will propose a new type of cipher named DICING_csb, which
is derived from our previous stream cipher DICING. It has applied a stream of
subkey and an encryption form of block ciphers, so it may be viewed as a
combinative of stream cipher and block cipher. Hence, the new type of cipher
has fast rate like a stream cipher and need no MAC.Comment: There is a new variant added in the section 

Li, An-Ping

English

arXiv

Abstract: In this paper, we will propose a new type of cipher named DICING_CSB, which come from our previous a synchronous stream cipher DICING. It applies a stream of subkeys and a encryption form of block ciphers, so, it can be viewed a combinative of stream cipher and block cipher. Hence, the new type of cipher has fast speed like a stream cipher and no need MAC

Li An-ping

CiteSeerX

A NEW TYPE OF CIPHER: DICING_CSB

In this paper, we will propose a new type of cipher named DICING_CSB, which come from our previous a synchronous stream cipher DICING. It applies a stream of subkeys and a encryption form of block ciphers, so, it can be viewed a combinative of stream cipher and block cipher. Hence, the new type of cipher has fast speed like a stream cipher and no need MAC

Li An-Ping

Cryptology ePrint Archive

A NEW TYPE OF CIPHER:  DICING_CSB  Li An-Ping  Beijing 100085, P.R.China apli0001@sina.com   Abstract: In this paper, we will propose a new type of cipher named DICING_CSB, which come from our previous a synchronous stream cipher DICING. It applies a stream of subkeys and a encryption form of block ciphers, so, it can be viewed a combinative of stream cipher and block cipher. Hence, the new type of cipher has fast speed like a stream cipher and no need MAC.   .   Keywords:  stream cipher, block cipher, LFSR, projector, finite field.                           1. Introduction   In a synchronous stream cipher, the ciphertext is generally made by bitwise adding (XOR) the plaintext with a binary sequence called keystream. Clearly, in this encryption form the plaintext is  easy to be falsified by other people. As a result, a synchronous stream cipher usually is equiped a MAC ( message authentication code ) to protect the message from to be tampered. In our algorithm DICING [1], one of candidates of eSTREAM ( The ECRYPT STREAM Ciphers Project ), the combining function had mainly applied keyed-Sboxes, which are often used in the block ciphers, we realize that it is possible to make a combinative of stream cipher and block cipher (CSB mode), so will be able to omit MAC in this way. In the proposal cipher, the component tu of DICING will be applied as a role of a stream of subkeys, and the encryption means are mainly keyed-Sboxes, like one ordinary block cipher. The components are almost same to the ones in DICING, for the completeness, which are repeated in this paper.   In the proposal cipher, we will apply the LFSR-like components called projector (Pr.). A projector consists of an element tσ  called state from some finite field )2(mGF and an updating rule. The rule of updating states is that multiplying tσ  withkx , k is an integer, namely,   tkt x σσ ⋅=+1 .                          (1.1) The finite fields used in here are )2( mGF , 126,127,128 orm = . In other word, the operation shift in LFSR now is replaced by multiplying kx  in the field )2( mGF .  As same as DICING, the key sizes in DICING_CSB can be 128 bits or 256 bits, and the size of initial value may be taken as large as 256 bits, and the size of output is 128 bits.   In this paper the finite field )2(GF  is simply denoted as F , and [ ]xF is the polynomial ring of unknown x over the field F. The symbols ⊕ , ⊗ will represent the bitwise addition XOR, bitwise and, that is the operation &  in C , and symbols >>, <<, |  and ~ stand for the operations right-shift, left-shift , concatenate and complement respectively. Suppose that ζ is a binary string, denoted by biti][ζ and bitji ],[ζ  the i-th bit and the segment from i-th bit to j-th bit respectively, and there are the similar expressions bytebyte jii ],[,][ ζζ  and wordword jii ],[,][ ζζ  measured in bytes and 32-bits words respectively, and if the meaning is explicit from the context, the low-index bit, byte and word will be omitted.   2. Construction     We will use two projectors 1Γ  and 2Γ , the first one acts a controller to control the updating of the second one, which will be used to form a stream of subkeys, or runkeys.  Denoted by tα and tω  the states of 1Γ  and 2Γ  in time t  respectively, which are based on the finite fields 1E and 2E , [ ] / ( ), 1, 2,i ix p x i= =E F  )(1 xp and 2 ( )p x  are two primitive polynomials with degree 127 and 128 respectively, which expressions are given in the List 1. The state tα  satisfy the simple recurrence equation 81 , 0,1, 2, .. .i ix iα α+ = ⋅ = .                     (2.1) The integer of the last eight bits of tα  is called the dice tD , denoted by ( 4) 1,td D= >> +    the states tω  will be updated as    1 , 0.dt tx for tω ω+ = ⋅ ≥                     (2.2) Besides, we use a memorizes tu to assemble tω ,  1 , 0t t tu u for tω−= ⊕ > ,                   (2.3) The initial values 0 0, ,α ω and 0u will be specified in the later. Suppose that K  is a finite field )2( 8GF , [ ] / ( )x p x=K F , )(xp  is an irreducible polynomial of degree eight, which expression is given in the List 1. We define S-box 0 ( )S x as 1270 ( ) 5 ( 3) ,S x x x= ⋅ ⊕ ∈K .                  (2.4) We also adopt the representation )(0 ζS  for a bytes string ζ to represent that S-box 0S  substitute each byte of the string ζ . The startup includes two subprocesses keysetup and ivsetup, where the basic materials as the secret key and key-size will be input and the internal states will be initialized. Besides, in the keysetup we will make a key-defined two S-boxes 1( )S x and 2 ( )S x from 0 ( )S x and a diffusion transformation L . The process is as following.  For a string ρ of 8 bytes, we define a 8 8× matrix M ρ :              u lM T J Tρ = ⋅ ⋅ .                              (2.5) where 88, )( ×= jiu aT  and , 8 8( )l i jT b ×= are the upper-triangular matrix and the lower-triangular matrix respectively,  , ,[8 ] , [8 ] ,1 , 1 ,0 , 0 ,bit biti j i ji j if i j i j if i ja if i j b if i jif i j if i jρ ρ+ < + >⎧ ⎧⎪ ⎪= = = =⎨ ⎨⎪ ⎪> <⎩ ⎩      (2.6) and J is a key-defined permutation matrix, for the simplicity, here take 1.J =   Suppose that K  is the secret key, let [0,23] [8,31]c byte byteK K K= ⊕  if | | 256K = , else [0,15] | ( [0,7] [8,15]),cK K K K= ⊕ [( 1) 8, 8 1] , 1, 2, 3,i c byteK i i iλ = − × − = and define three affine ransformations on K ,           1 2 3( ) ( ), ( ) ( ), ( ) ( ),A x M x B x M x C x M x xλ λ λ= = = ∈K ,          (2.7) and a transformation L on 4K , A B A A BB A A B ALA A B A BA B A B A⊕⎛ ⎞⎜ ⎟⊕⎜ ⎟=⎜ ⎟⊕⎜ ⎟⊕⎝ ⎠.                  (2.8) Denoted by 0 8[ ] , 1, 2,3,i i bytekv k iλ≤ <= =⊕ and define two new S-boxes   1 0 1 2 2 0 2 3( ) ( ) , ( ) ( ( ) ), .S x S x v v S x C S x v v x= ⊕ ⊕ = ⊕ ⊕ ∈K         (2.9) Suppose that ζ is a string of n bytes, if 4n k=  we also view it as a string of k words, and write ( )L ζ to represent that L takes on the each word of ζ . Simply, we denote  1( ) ( )Q L Sζ ζ= ⋅ .                           (2.10) In the ivsetup , the second step of the startup, the internal states will be initialized with the secret key and the initial value.  For a 32-bytes string ζ we define a bytes permutation φ : ( )φζ φ ζ= , [ ] [4 mod31]i iφζ ζ= , for 0 31i≤ < , and [31] [31]φζ ζ= . Let K K= if 256K =  else | ( )K K K= ∼ , denoted by 0 ,K K= [8 ,31] | [0,8 1] , 1, 2,3,i byte byteK K i K i i= − =  define the functions recurrently 0 0 1( ) ( ( )), ( ) ( ) , ( ) ( ( )) , 1, 2,3.i i iF Q F F K F F F K iζ φ ζ ζ ζ ζ ζ−= = ⊕ = ⊕ =    (2.11)   Suppose that IV is the initial value of 32-bytes, e is the base of natural logarithm and c the integral part of 57!e ⋅ , and , 0 3i iξ ≤ ≤ , are four 32-bytes strings defined as  0 3 3 1( ), ( ), 1, 2.i iF IV c F c iξ ξ ξ −= ⊕ = ⊕ =             (2.12) In the encryption we will employ an array of 16 bytes η . The internal states are initialized respectively as following 0 0 0 1 0 1 0 2[0,15] [16,31], [0,15], [128,254] , [0,15].bituη ξ ξ ξ α ξ ω ξ= ⊕ = = =    (2.13) If 2[0,15] 0,ξ = the states 0ω will be re-set as  0 0 2( , ) [16,31]ω τ ξ= .                          (2.14) .Note   For a secret key, there is at most one IV such that 2 0.ξ =  In the proposal cipher DICING_CSB, the sequence { }tu will play a flow of subkeys. After initialization, the process enters the recurrence part of encryption/decryption, in which including the sub-process of updating states, namely, making the stream of subkeys{ }tu . Denoted by 0{ }t tx >  and 0{ }t ty > the sequences of plaintext and ciphertext respectively, the encryption function is defined as  2( ) ( ( ) ( ))t t t t ty Encrypt x S Q x u Q uη= = ⊕ ⊕ ⊕ .          (2.15)                      We have summarized the whole process in a sketch as Fig. 1.   List of the Primitive Polynomials used                             Polynomials               Expression )(xp  1568 ++++ xxxx  )(1 xp  127 96 64 5( 1)( 1)x x x x+ + + +  2 ( )p x  128 96 67 32 3( 1)( 1)x x x x x+ + + + +    List 1     The Sketch of Encryption Process                                                                                  Initializing                                                                                           Updating states                                                  Plaintext tx     Encrypting    Ciphertext ty                                                              Fig.1   3. Security analysis  The analysis for DICING_CSB as a stream cipher will be similar to the one for DICING, refer to see paper [1]. Besides, as a block cipher, the encryption mode of DICING_CSB is not as usual iterative one, so the traditional analyses for the block ciphers of iterative mode will not be feasible. Although the proposal cipher is stronger than additive stream ciphers in plaintext-recovery attacks, it would be insecure if a IV’s value would be allowed to use repeatedly more than 162 times for a secrete key K , as DICING_CSB only has the diffusion range of 32 bits. So, it is suggested that the usage of a IV is best one time one value. If intend to apply a IV many times, then in encryption function should be added a more round in order to enlarge the range of diffusion, as a cost, the encrypting rate will be raised about 2 cycles/byte.  It maybe should be mentioned that we have reduced two Pr.’s from DICING for we think that in this encryption form the requirement for the period of the sequence { }tu may be relaxed, in this place, the period of the sequence{ }tu is no less than 126 128(17 2 1)(2 1).⋅ − −    4. Implementation  In the platform of 32-bit Windows OS and Intel ® Celeron 2.66G, 64-bit processor, Borland C++ 5.0, the performance of DICING_CSB is as following     This is the recurrence part Report of Performance   Encryption Decryption Sub-processes             Time   Sub-processes            Time  Keysetup              9890 cycles  Keysetup           16400 cycles IVsetup   2870 cycles   IVsetup 2920 cycles Encrypting rate   10.3 cycles/byte  Decrypting rate 10.3 cycles/byte   List 2  Remark: There is an alternate updating rule for the states tα and tω as following:  161 , 0.t tx for tα α+ = ⋅ >                     (2.1’) Denoted by 11 ( [ ] &15), 0 16,i t byted i iα += + ≤ <  the states tω  are updated as 16 1 16 , 0 16, 0.idt i t ix i for tω ω+ + += ⋅ ≤ < ≥            (2.2’)  With the updating rules above, the encrypting/decrypting rate will be as fast as 8.8 /cycles byte  in the case of larger size of message. We call the rule (2.1’) and (2.2’) as loting.  Besides, with the processors as Pentium-m, Pentium 4 or AMD-64, the implementation will be faster about 20~30%.   5. Conclusion  The proposal cipher can be viewed as a combinative of a stream cipher and a block cipher. It assimilates the good qualities of stream ciphers in the speed and block ciphers in the secure. It is able to serve as a synchronous stream cipher or a block cipher, and there will not be need to equip a MAC when it is applied as a synchronous stream cipher. While it is applied as block cipher, it will still require a IV to initilize the internal states, however, this requirement is easy to be simply satisfied, for example, the name or the date of files may be taken as the IV’values.          References  [1] A.P. Li, A New Stream Cipher: DICING, now available at     eSTREAM - The ECRYPT Stream Cipher Project - Phase 2 

A New Type of Cipher: DICING_csb

Abstract

Similar works

Full text

Available Versions

CiteSeerX

Cryptology ePrint Archive