Understanding Cryptography Solutions Handbook

26 Pages·0.267 MB·English

by  Christof Paar , Jan Pelzl

Solutions to Homework Problems (Odd Numbered
Problems)
Understanding Cryptography
A Textbook for Students and Practitioners
byChristofPaarandJanPelzl
1
2 SolutionstoHomeworkProblems(OddNumberedProblems)
Problems ofChapter 1
1.1
1. Letterfrequencyanalysisoftheciphertext:
letter count freq[%] letter count freq[%]
A 5 0.77 N 17 2.63
B 68 10.53 O 7 1.08
C 5 0.77 P 30 4.64
D 23 3.56 Q 7 1.08
E 5 0.77 R 84 13.00
F 1 0.15 S 17 2.63
G 1 0.15 T 13 2.01
H 23 3.56 U 24 3.72
I 41 6.35 V 22 3.41
J 48 7.43 W 47 7.28
K 49 7.59 X 20 3.10
L 8 1.24 Y 19 2.94
M 62 9.60 Z 0 0.00
2. Because the practice of the basic movements of kata is the focus and
mastery of self is the essence of Matsubayashi Ryu karate do, I shall
try to elucidate the movements of the kata according to my interpretation
based on forty years of study.
It is not an easy task to explain each movement and its significance,
and some must remain unexplained. To give a complete explanation, one
would have to be qualified and inspired to such an extent that he could
reach the state of enlightened mind capable of recognizing soundless
sound and shapeless shape. I do not deem myself the final authority,
but my experience with kata has left no doubt that the following is
the proper application and interpretation. I offer my theories in the
hope that the essence of Okinawan karate will remain intact.
3. Shoshin Nagamine, further reading: The Essence of Okinawan Karate-Do by Shoshin Nagamine,
TuttlePublishing,1998.
1.3
Onesearchenginecosts$100includingoverhead.Thus,1milliondollarsbuyus10,000engines.
1. keytestspersecond:5 108 104=5 1012keys/sec
· · ·
Onaverage,wehavetocheck(2127keys:
(2127keys)/(5 1012keys/sec)=3.40 1025sec=1.08 1018years
· · ·
Thatisabout108=100,000,000timeslongerthantheageoftheuniverse.Goodluck.
2. LetibethenumberofMooreiterationsneededtobringthesearchtimedownto24h:
1.08 1018years 365/2i=1day
· ·
2i=1,08 1018 365days/1day
· ·
i=68.42
Weroundthisnumberupto69assumingthenumberofMooreiterationsisdiscreet.Thus,wehave
towaitfor:
1.5 69=103.5years
·
NotethatitisextremelyunlikelythatMoore’sLawwillbevalidforsuchatimeperiod!Thus,a128
bitkeyseemsimpossibletobrute-force,evenintheforeseeablefuture.
1.5
1. 15 29mod13 2 3mod13 6mod13
· ≡ · ≡
2. 2 29mod13 2 3mod13 6mod13
· ≡ · ≡
3. 2 3mod13 2 3mod13 6mod13
· ≡ · ≡
4. 2 3mod13 2 3mod13 6mod13
· ≡ · ≡
SolutionstoHomeworkProblems(OddNumberedProblems) 3
15,2and-11(and29and3respectively)arerepresentationsofthesameequivalenceclassmodulo13
andcanbeused“synonymously”.
1.7
1.
MultiplicationtableforZ
4
0123
×
0 0000
1 0123
2 0202
3 0321
2.
AdditiontableforZ MultiplicationtableforZ
5 5
+ 0 1234 0 1234
×
0 0 1234 0 0 0000
1 1 2340 1 0 1234
2 2 3401 2 0 2413
3 3 4012 3 0 3142
4 4 0123 4 0 4321
3.
AdditiontableforZ MultiplicationtableforZ
6 6
+ 0 12345 0 12345
×
0 0 12345 0 0 00000
1 1 23450 1 0 12345
2 2 34501 2 0 24024
3 3 45012 3 0 30303
4 4 50123 4 0 42042
5 5 01234 5 0 54321
4. ElementswithoutamultiplicativeinverseinZ are2and0
4
ElementswithoutamultiplicativeinverseinZ are2,3,4and0
6
ForallnonzeroelementsofZ existsbecause5isaprime.Hence,allnonzeroelementssmallerthan
5
5arerelativelyprimeto5.
1.9
1. x=9mod13
2. x=72=49 10mod13
3. x=310=95≡ 812 9 32 9 81 3mod13
≡ · ≡ · ≡ ≡
4. x=7100=4950 1050 ( 3)50=(310)5 35 32=9mod13
5. bytrial:75 11≡mod13≡ − ≡ ≡
≡
1.11
1. FIRST THE SENTENCE AND THEN THE EVIDENCE SAID THE QUEEN
2. CharlesLutwidgeDodgson,betterknownbyhispennameLewisCarroll
1.13
a (x1 x2)−1(y1 y2)modm
≡ − −
b y ax modm
1 1
≡ −
Theinverseof(x x )mustexistmodulom,i.e.,gcd((x x ),m)=1.
1 2 1 2
− −
4 SolutionstoHomeworkProblems(OddNumberedProblems)
Problems ofChapter 2
2.1
1. y =x +K mod26
i i i
x =y K mod26
i i i
−
ThekeystreamisasequenceofrandomintegersfromZ .
26
2. x =y K =”B” ”R”=1 17= 16 10mod26=”K”etc
1 1 1
− − − − ≡ ···
DecryptedText:”KASPARHAUSER”
3. Hewasknifed.
2.3
Weneed128pairsofplaintextandciphertextbits(i.e.,16byte)inordertodeterminethekey.s isbeing
i
computedby
s =x y; i=1,2, ,128.
i i i
L ···
2.5
Z(cid:13)
i(cid:13)
1(cid:13) 0(cid:13) 0(cid:13) = Z(cid:13)
0(cid:13)
1(cid:13) 1(cid:13) 0(cid:13) = Z(cid:13)
1(cid:13)
1(cid:13) 1(cid:13) 1(cid:13) = Z(cid:13)
2(cid:13)
0(cid:13) 1(cid:13) 1(cid:13) = Z(cid:13)
3(cid:13)
1(cid:13) 0(cid:13) 1(cid:13) = Z(cid:13)
4(cid:13)
0(cid:13) 1(cid:13) 0(cid:13) = Z(cid:13)
5(cid:13)
0(cid:13) 0(cid:13) 1(cid:13) = Z(cid:13)
6(cid:13)
1(cid:13) 0(cid:13) 0(cid:13) = Z(cid:13) = Z(cid:13)
7(cid:13) 0(cid:13)
1. Sequence 1: z(cid:13) = 0 0 1 1 1 0 1 0 0 1 1 1 0 1 ...(cid:13)
0(cid:13)
0(cid:13) 1(cid:13) 1(cid:13) = Z(cid:13)
0(cid:13)
1(cid:13) 0(cid:13) 1(cid:13) = Z(cid:13)
1(cid:13)
0(cid:13) 1(cid:13) 0(cid:13) = Z(cid:13)
2(cid:13)
0(cid:13) 0(cid:13) 1(cid:13) = Z(cid:13)
3(cid:13)
1(cid:13) 0(cid:13) 0(cid:13) = Z(cid:13)
4(cid:13)
1(cid:13) 1(cid:13) 0(cid:13) = Z(cid:13)
5(cid:13)
1(cid:13) 1(cid:13) 1(cid:13) = Z(cid:13)
6(cid:13)
0(cid:13) 1(cid:13) 1(cid:13) = Z(cid:13) = Z(cid:13)
7(cid:13) 0(cid:13)
2. Sequence 2: z(cid:13) = 1 1 0 1 0 0 1 1 1 0 1 0 0 1 ...(cid:13)
0(cid:13)
SolutionstoHomeworkProblems(OddNumberedProblems) 5
3. Thetwosequencesareshiftedversionsofoneanother.
2.7
Thefeedbackpolynomialfrom2.3isx8+x4+x3+x+1.
s s s s s s s s
7 6 5 4 3 2 1 0
CLK
1 1 1 1 1 1 1 1 = Z
0
0 1 1 1 1 1 1 1 = Z
1
0 0 1 1 1 1 1 1 = Z
2
0 0 0 1 1 1 1 1
0 0 0 0 1 1 1 1
1 0 0 0 0 1 1 1
0 1 0 0 0 0 1 1
0 0 1 0 0 0 0 1
1 0 0 1 0 0 0 0
1 1 0 0 1 0 0 0
1 1 1 0 0 1 0 0
0 1 1 1 0 0 1 0
0 0 1 1 1 0 0 1
1 0 0 1 1 1 0 0
0 1 0 0 1 1 1 0 = Z
14
0 0 1 0 0 1 1 1 = Z
15
So,theresultingfirsttwooutputbytesare(1001000011111111) =(90FF) .
2 16
2.9
1. Theattackerneeds512consecutiveplaintext/ciphertextbitpairsx,y tolaunchasuccessfulattack.
i i
2. a. First,theattackerhastomonitorthepreviouslymentioned512bitpairs.
b. Theattackercalculatess =x +y mod2,i=0,1,...,2m 1
i i i
−
c. Inordertocalculatethe(secret)feedbackcoefficientsp,Oscargenerates256linearlydependent
i
equationsusingtherelationshipbetweentheunknownkeybitsp andthekeystreamoutputdefined
i
bytheequation
m 1
(cid:229) −
s p s mod2;s,p 0,1 ;i=0,1,2,...,255
i+m j i+j i j
≡ · ∈{ }
j=0
withm=256.
d. After generating this linear equation system, it can be solved e.g. using Gaussian Elimination,
revealingthe256feedbackcoefficients.
3. Thekeyofthissystemisrepresentedbythe256feedbackcoefficients.Sincetheinitialcontentsof
the LFSR are unalteredly shifted out of the LFSR and XORed with the first 256 plaintext bits, it
wouldbeeasytocalculatethem.
2.11
x y =x (x z)=z
i i i i i i
L L L
W 22=10110 J 9=01001
2 2
⇐⇒ ⇔
P 15=01111 5 31=11111
2 2
⇐⇒ ⇐⇒
6 SolutionstoHomeworkProblems(OddNumberedProblems)
I 8=01000 A 0=00000
2 2
⇔ ⇔
x =101100111101000
i
y =010011111100000
i
z =111111000001000
i
1. InitializationVector:(Z =1,1,1,1,1,1)
0
2.
1
C0 1 11 111 − 0
     
C 1 11 110 0
1
C2 =1 11 100 0
C3 1 11 000 ·0
     
C4 1 10 000 0
     
C5 1 00 000 1
1
 
1
0
= 
0
 
0
 
0
J 5 A 0 E D J 2 B
3. y =01001 11111 00000 11010 00100 00011 01001 11100 00001
i z }| { z }| { z }| { z }| { z }| { z }| { z }| { z }| { z }| {
z =11111 10000 01000 01100 01010 01111 01000 11100 10010
i
x =10110 01111 01000 10110 01110 01100 00001 00000 10011
i
W P I W O M B A T
| {z } | {z } | {z } | {z } | {z } | {z } | {z } | {z } | {z }
4. WombatsliveinTasmania.
5. Known-plaintextAttack.
Problems ofChapter 3
3.1
1. s(x ) s(x )=1110
1 2
L
s(x x )=s(x )=0000=1110
1 2 2
L 6
2. s(x ) s(x )=1001
1 2
L
s(x x )=s(x )=1000=1001
1 2 2
L 6
3. s(x ) s(x )=1010
1 2
L
s(x x )=s(x )=1101=1010
1 2 2
L 6
3.3
S (0)=14=1110
1
S (0)=15=1111
2
S (0)=10=1010
3
S (0)= 7 =0111
4
S (0)= 2 =0010
5
S (0)=12=1100
6
S (0)= 4 =0100
7
S (0)=13=1101
8
SolutionstoHomeworkProblems(OddNumberedProblems) 7
P(S)=D8D8 DBBC
(L ,R )=0000 0000 D8D8 DBBC(1)
1 1
3.5
IP(x)mapsbit57toposition33,whichisposition1inR .
0
•
E-Expansionboxmapsbitposition1topositions2and48.
•
InputtoS-Boxes:
•
S :010000
1
S =S = =S :000000
2 3 7
···
S :000001
8
TwoS-Boxesgetadifferentinput.
⇒
P(S)=D058 5B9E
(L ,R )=8000 0000 D058 5B9E
1 1
1. 2S-Boxes,S andS
1 8
2. Accordingtodesigncriteria,aminimumof2bits/bit.
2 2=4bits
⇒ ·
3. See(1).
4. 6bitshavechanged:
3fromS
1
2fromS
8
1inthelefthalf
3.7
1. K =K fori=0,1,...7.
1+i 16 i
2. Following(−a),twoequationsareestablished:
C =C
1+i 16 i
−
D = D fri=0,1,...,7.
1+i 16 i
−
Theseequationsyield
C =0undD =0or
0,j 0,j
C =0undD =1or
0,j 0,j
C =1undD =0oder
0,j 0,j
C =1undD =1 fr j=1,2,...,28.
0,j 0,j
HencethefourweakkeysafterPC-1aregivenby:
Kˆ = [0...0 0...0]
w1
Kˆ = [0...0 1...1]
w2
Kˆ = [1...1 0...0]
w3
Kˆ = [1...1 1...1]
w4
3. P(randomlychoseaweakkey)= 22 =2 54.
256 −
3.9
Worst-Case:256keys.
Average:256/2=255keys.
3.11
1. AsingleDESenginecancompute100 106DESencryptionspersecond.ACOPACOBANAmachine
can, thus, compute 4 6 20 100 106·=4.8 1010 DES encryptionsper second. For an average of
· · · · ·
8 SolutionstoHomeworkProblems(OddNumberedProblems)
255 encryptionsforasuccessfullbrute-forceattackonDES,255/(4.8 1010) 750600secondsare
· ≈
required(whichapproximatelyis8.7days).
2. Forasuccessfullaverageattackinonehour,8.72˙4 18machinesarerequired.
≈
3. The machine performsa brute–forceattack. However,there might be more powerfulanalyticalat-
tackswhichexploreweaknessesofthecipher.Hence,thekey–searchmachineprovidesonlyalower
securitythreshold.
3.13
1. ThestateofPRESENTaftertheexecutionofoneroundisF000 0000 0000 000F.Belowyou
canfindallintermediatevalues.
Plaintext 0000 0000 0000 0000
Roundkey BBBB 5555 5555 EEEE
StateafterKeyAdd BBBB 5555 5555 EEEE
StateafterS-Layer 8888 0000 0000 1111
StateafterP-Layer F000 0000 0000 000F
2. Theroundkeyforthesecondroundis7FFF F777 6AAA AAAA.Belowyoucanfindallinterme-
diatevalues.
Key BBBB 5555 5555 EEEE FFFF
Keystateafterrotation DFFF F777 6AAA AAAA BDDD
KeystateafterS-box 7FFF F777 6AAA AAAA BDDD
KeystateafterCounterAdd 7FFF F777 6AAA AAAA 3DDD
RoundkeyforRound2 7FFF F777 6AAA AAAA
Problems ofChapter 4
4.1
1. ThesuccessoroftheDES,theAES,waschosenbytheNISTbyapublicproceeding.Thepurpose
ofthispubliccontestwastoallowbroadlyevaluationofthecandidatesbyasmanyresearchorgani-
sationsandinstitutesaspossible.
ThisstronglycontraststothedevelopmentofDES,whichwasonlyperformedbyIBMandtheNSA
firstlykeepingdetails(e.g.theS-boxes)insecret.DESwaspublishedandstandardizedin1975.
2. 1/2/97: Call for algorithms, which could potentially lead to the AES. The selection process was
governedbytheNIST.8/20/98:15algorithmswerenominatedascandidatesfortheselectionprocess.
9.8.1999:5algorithmsreachthe”finals”(Mars,RC6,Rijndael,Serpent,Twofish)
2.10.2000:NISTelectsRijndaeltoAES.
3. Rijndael
4. Dr.VincentRijmenandDr.JoamDaemenfromBelgium
5. Rijndaelsupportsblocksizesof128,192and256bit,aswellaskeylengthsof128,192and256bit.
Infact,onlytheversionwith128bitblocksize(andallthreekeylengths)iscalledAES.
4.3
MultiplicationtableforGF(23),P(x)=x3+x+1
0 1 x x+1 x2 x2+1 x2+x x2+x+1
×
0 0 0 0 0 0 0 0 0
1 0 1 x x+1 x2 x2+1 x2+x x2+x+1
x 0 x x2 x2+x x+1 1 x2+x+1 x2+1
x+1 0 x+1 x2+x x2+1 x2+x+1 x2 1 x
x2 0 x2 x+1 x2+x+1 x2+x x x2+1 1
x2+1 0 x2+1 1 x2 x x2+x+1 x+1 x2+x
x2+x 0 x2+x x2+x+1 1 x2+1 x+1 x x2
x2+x+1 0x2+x+1 x2+1 x 1 x2+x x2 x+1
4.5 MultiplicationinGF(24):
SolutionstoHomeworkProblems(OddNumberedProblems) 9
1. A(x) B(x)=(x2+1)(x3+x2+1)=x5+x4+x2+x3+x2+1
∗
A(x) B(x)=x5+x4+x3+1
∗
x +1
x4+x+1x5 +x4 +x3 +1
x5 +x2 +x
x4 +x3 +x2 +x+1
x4 +x+1
x3 +x2
C=x3+x2 A(x) B(x)modP(x).
≡ ∗
2. A(x) B(x)=(x2+1)(x+1)=x3+x+x2+1
C=x∗3+x2+x+1 A(x) B(x)modP(x)
≡ ∗
ThereductionpolynomialisusedtoreduceC(x)inordertoreducetheresulttoGF(24).Otherwise,a
’simple’multiplicationwithoutreductionwouldyieldaresultofa higherdegree(e.g.,withx5) which
wouldnotbelongtoGF(24)anymore.
4.7
1. BytheExtendedEuclideanalgorithm:
x4+x+1=[x3](x)+[x+1]t (x)=t q t = q = x3=x3
2 0 11 1
− − −
x =[1](x+1)+1 t (x)=t q t =1 1 x3=1 x3=x3+1
3 1 22
− − ∗ −
x+1 =[x+1](1)+0
So,A 1=x3+1.
−
Check:x (x3+1)=x4+x (x+1)+xmodP(x)=1modP(x).
∗ ≡
2. BytheExtendedEuclideanalgorithm:
x4+x+1=[x2+x+1](x2+x)+[1]t =t q t = q =x2+x+1
2 0 11 1
− −
x2+x =[x2+x]1+[0]
So,A 1=x2+x+1.
−
Check:(x2+x)(x2+x+1)=x4+2x3+2x2+x=x4+x (x+1)+xmodP(x)=1modP(x).
≡
4.9
(cid:4)
16161616
 
16161616
B=ByteSub(A)=
16161616
 
16161616
(cid:4) TheShiftRowsoperationdoesnotchangeanythingsinceallbytesofBequaleachother.
(cid:4) TheMixComumnoperationisequalforeveryresultigbyteCiandisdescribedby
(01+01+02+03) (16) .Wehavetoremind,thatallcalculationshavetobedoneinGF(28),
hex hex
·
sothat(01+01+02+03) =(01) andhence,allresultingbytesofCremain(16)
hex hex hex
⇒
16161616
 
16161616
C=MixColumn(B)=
16161616
 
16161616
(cid:4) ThefirstroundkeyequalstheunmodifiedAESkey.So,theoutputofthefirstis
16161616 FF FF FF FF E9E9E9E9
     
16161616 FF FF FF FF E9E9E9E9
C K= =
⊕ 16161616⊕FF FF FF FF E9E9E9E9
     
16161616 FF FF FF FF E9E9E9E9
4.11