Chapter 5

Introduction to
Modern Symmetric-key
Ciphers

Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.
5.1
 Chapter 5
Objectives

❏ To distinguish between traditional and modern

symmetric-key ciphers.
❏ To introduce modern block ciphers and discuss
their characteristics.
❏ To explain why modern block ciphers need to be
designed as substitution ciphers.
❏ To introduce components of block ciphers such as
P-boxes and S-boxes.

5.2
 Chapter 5
Objectives (Contnuied)

❏ To discuss product ciphers and distinguish

between two classes of product ciphers: Feistel
and non-Feistel ciphers.

5.3
 5-1 MODERN BLOCK CIPHERS

A symmetric-key modern block cipher encrypts an

n-bit block of plaintext or decrypts an n-bit block of
ciphertext. The encryption or decryption algorithm
uses a k-bit key.

Topics discussed in this section:

5.1.1 Substitution or Transposition
5.1.2 Block Ciphers as Permutation Groups
5.1.3 Components of a Modern Block Cipher
5.1.4 Product Ciphers
5.1.5 Two Classes of Product Ciphers

5.4
5.1 Continued

Figure 5.1 A modern block cipher

5.5
5.1 Continued
Example 5.1
How many padding bits must be added to a message of 100
characters if 8-bit ASCII is used for encoding and the block
cipher accepts blocks of 64 bits?

Solution
Encoding 100 characters using 8-bit ASCII results in an 800-
bit message. The plaintext must be divisible by 64. If | M | and
|Pad| are the length of the message and the length of the
padding,

5.6
 5.1.1 Substitution or Transposition

A modern block cipher can be designed to act as a

substitution cipher or a transposition cipher.

Note

To be resistant to exhaustive-search attack,

a modern block cipher needs to be
designed as a substitution cipher.

5.7
 5.1.1 Continued
Example 5.2
Suppose that we have a block cipher where n = 64. If there
are 10 1’s in the ciphertext, how many trial-and-error tests
does Eve need to do to recover the plaintext from the
intercepted ciphertext in each of the following cases?
a. The cipher is designed as a substitution cipher.
b. The cipher is designed as a transposition cipher.

Solution
a. In the first case, Eve has no idea how many 1’s are in the
plaintext. Eve needs to try all possible 264 64-bit blocks to
find one that makes sense.
b. In the second case, Eve knows that there are exactly 10 1’s
in the plaintext. Eve can launch an exhaustive-search
attack using only those 64-bit blocks that have exactly 10
5.8
1’s.
 5.1.3 Continued
P-Boxes: Invertibility

Note
A straight P-box is invertible, but compression and
expansion P-boxes are not.

5.9
 5.1.3 Continued

Example 5.7
Figure 5.6 shows how to invert a permutation table
represented as a one-dimensional table.
Figure 5.6 Inverting a permutation table

5.10
 5.1.3 Continued

Figure 5.7 Compression and expansion P-boxes are non-invertible

5.11
 5.1.3 Continued
S-Box
An S-box (substitution box) can be thought of as a
miniature substitution cipher. The input to an S-box
could be an n-bit word, but the output can be an m-bit
word, where m and n are not necessarily the same.

An S-box is an m × n substitution unit, where m and

n are not necessarily the same.

5.12
 5.1.3 Continued
Example 5.8
In an S-box with three inputs and two outputs, we have

The S-box is linear because a1,1 = a1,2 = a1,3 = a2,1 = 1 and

a2,2 = a2,3 = 0. The relationship can be represented by
matrices, as shown below:

5.13
 5.1.3 Continued
Example 5.9
In an S-box with three inputs and two outputs, we have

where multiplication and addition is in GF(2). The S-box is

nonlinear because there is no linear relationship between the
inputs and the outputs.

5.14
 5.1.3 Continued
Example 5.10
The following table defines the input/output relationship for
an S-box of size 3 × 2. The leftmost bit of the input defines the
row; the two rightmost bits of the input define the column.
The two output bits are values on the cross section of the
selected row and column.

Based on the table, an input of 010 yields the output 01. An

input of 101 yields the output of 00.
5.15
 5.1.3 Continued
S-Boxes: Invertibility

An S-box may or may not be invertible. In an invertible

S-box, the number of input bits should be the same as the
number of output bits.

5.16
 5.1.3 Continued

Example 5.11
Figure 5.8 shows an example of an invertible S-box. For
example, if the input to the left box is 001, the output is 101.
The input 101 in the right table creates the output 001, which
shows that the two tables are inverses of each other.

Figure 5.8 S-box tables for Example 5.11

5.17
 5.1.3 Continued

Exclusive-Or
An important component in most block ciphers is the
exclusive-or operation.

Figure 5.9 Invertibility of the exclusive-or operation

5.18
 5.1.3 Continued
Exclusive-Or (Continued)

The inverse of a component in a cipher makes sense if the

component represents a unary operation (one input and
one output). For example, a keyless P-box or a keyless S-
box can be made invertible because they have one input
and one output. An exclusive operation is a binary
operation. The inverse of an exclusive-or operation can
make sense only if one of the inputs is fixed (is the same
in encryption and decryption). For example, if one of the
inputs is the key, which normally is the same in
encryption and decryption, then an exclusive-or operation
is self-invertible, as shown in Figure 5.9.

5.19
 5.1.1 Continued
Figure 5.9 Invertibility of the exclusive-or operation

5.20
 5.1.3 Continued

Circular Shift
Another component found in some modern block ciphers
is the circular shift operation.

Figure 5.10 Circular shifting an 8-bit word to the left or right

5.21
 5.1.3 Continued

Swap
The swap operation is a special case of the circular shift
operation where k = n/2.

Figure 5.11 Swap operation on an 8-bit word

5.22
 5.1.3 Continued
Split and Combine

Two other operations found in some block ciphers are

split and combine.

Figure 5.12 Split and combine operations on an 8-bit word

5.23
 5.1.3 Continued
Figure 5.12 Split and combine operations on an 8-bit word

5.24
 5.1.4 Product Ciphers

Shannon introduced the concept of a product cipher. A

product cipher is a complex cipher combining
substitution, permutation, and other components
discussed in previous sections.

5.25
 5.1.4 Continued

Diffusion
The idea of diffusion is to hide the relationship between
the ciphertext and the plaintext.

Note
Diffusion hides the relationship between the
ciphertext and the plaintext.

5.26
 5.1.4 Continued

Confusion
The idea of confusion is to hide the relationship between
the ciphertext and the key.

Note
Confusion hides the relationship between the
ciphertext and the key.

5.27
 5.1.4 Continued

Rounds
Diffusion and confusion can be achieved using iterated
product ciphers where each iteration is a combination of
S-boxes, P-boxes, and other components. Each iteration
is referred to as a round. The block cipher uses a key
schedule or key generator that creates different keys for
each round from the cipher key.

5.28
 5.1.5 Two Classes of Product Ciphers

Modern block ciphers are all product ciphers, but they

are divided into two classes.

1. Feistel ciphers

2. Non-Feistel ciphers

5.29
 5.1.5 Continued

Feistel Ciphers
Feistel designed a very intelligent and interesting cipher
that has been used for decades. A Feistel cipher can have
three types of components: self-invertible, invertible, and
noninvertible.

Example: DES

5.30
 5.1.5 Continued

Figure 5.15 The first thought in Feistel cipher design

Note
Diffusion hides the relationship between the
ciphertext and the plaintext.
5.31
 5.1.3 Continued
Example 5.12
This is a trivial example. The plaintext and ciphertext are
each 4 bits long and the key is 3 bits long. Assume that the
function takes the first and third bits of the key, interprets
these two bits as a decimal number, squares the number, and
interprets the result as a 4-bit binary pattern. Show the
results of encryption and decryption if the original plaintext
is 0111 and the key is 101.
Solution
The function extracts the first and second bits to get 11 in
binary or 3 in decimal. The result of squaring is 9, which is
1001 in binary.

5.32
 5.1.5 Continued
Figure 5.16 Improvement of the previous Feistel design

5.33
 5.1.5 Continued
Figure 5.17 Final design of a Feistel cipher with two rounds

5.34
 5.1.5 Continued

Non-Feistel Ciphers
A non-Feistel cipher uses only invertible components. A
component in the encryption cipher has the
corresponding component in the decryption cipher.

Example: AES

5.35