Round (cryptography)

Edit links
Source: Wikipedia, the free encyclopedia.

In cryptography, a round or round function is a basic transformation that is repeated (iterated) multiple times inside the algorithm. Splitting a large algorithmic function into rounds simplifies both implementation and cryptanalysis.[1]

For example, encryption using an oversimplified three-round cipher can be written as , where C is the ciphertext and P is the plaintext. Typically, rounds are implemented using the same function, parameterized by the round constant and, for block ciphers, the round key from the key schedule. Parameterization is essential to reduce the self-similarity of the cipher, which could lead to slide attacks.[1]

Increasing the number of rounds "almost always"[2] protects against differential and linear cryptanalysis, as for these tools the effort grows exponentially with the number of rounds. However, increasing the number of rounds does not always make weak ciphers into strong ones, as some attacks do not depend on the number of rounds.[3]

The idea of an

cryptographic hashes).[5]

For some

DES).[6]

Round constants

Inserting round-dependent constants into the encryption process breaks the symmetry between rounds and thus thwarts the most obvious slide attacks.[3] The technique is a standard feature of most modern block ciphers. However, a poor choice of round constants or unintended interrelations between the constants and other cipher components could still allow slide attacks (e.g., attacking the initial version of the format-preserving encryption mode FF3).[7]

Many

encryption key. A poor choice of round constants in this case might make the cipher vulnerable to invariant attacks; ciphers broken this way include SCREAM and Midori64.[8]

Optimization

Daemen and Rijmen assert that one of the goals of optimizing the cipher is reducing the overall workload, the product of the round complexity and the number of rounds. There are two approaches to address this goal:[2]

  • local optimization improves the worst-case behavior of a single round (two rounds for Feistel ciphers);
  • global optimization optimizes the worst-case behavior of more than one round, allowing the use of less sophisticated components.

Reduced-round ciphers

Cryptanalysis techniques include the use of versions of ciphers with fewer rounds than specified by their designers. Since a single round is usually cryptographically weak, many attacks that fail to work against the full version of ciphers will work on such reduced-round variants. The result of such attack provides valuable information about the strength of the algorithm,[9] a typical break of the full cipher starts out as a success against a reduced-round one.[10]

References

  1. ^ a b Aumasson 2017, p. 56.
  2. ^ a b Daemen & Rijmen 2013, p. 74.
  3. ^ a b Biryukov & Wagner 1999.
  4. ^ Shannon, Claude (September 1, 1945). "A Mathematical Theory of Cryptography" (PDF). p. 97.
  5. ^ Biryukov 2005.
  6. ^ Kaliski & Yin 1995, p. 173.
  7. ^ Dunkelman et al. 2020, p. 252.
  8. ^ Beierle et al. 2017.
  9. ^ Robshaw 1995, p. 23.
  10. ^ Schneier 2000, p. 2.

Sources

Retrieved from "https://en.wikipedia.org/w/index.php?title=Round_(cryptography)&oldid=1163481924"