CRYPTOGRAPHY AND

NETWORK SECURITY
 AES Requirements

■ private key symmetric block cipher

■ 128-bit data, 128/192/256-bit keys
■ stronger & faster than Triple-DES
■ active life of 20-30 years (+ archival use)
■ provide full specification & design details
■ both C & Java implementations
 AES Evaluation Criteria

■ initial criteria:
– security – effort to practically cryptanalyse
– cost – computational
– algorithm & implementation characteristics
■ final criteria
– general security
– software & hardware implementation ease
– implementation attacks
– flexibility (in en/decrypt, keying, other factors)
 The AES Cipher - Rijndael

■ designed by Rijmen-Daemen in Belgium

■ has 128/192/256 bit keys, 128 bit data
■ an iterative rather than feistel cipher
– treats data in 4 groups of 4 bytes
– operates an entire block in every round
■ designed to be:
– resistant against known attacks
– speed and code compactness on many CPUs
– design simplicity
Operation of AES
■AES is an iterative rather than Feistel cipher. It is based on
‘substitution–permutation network’. It comprises of a series of linked
operations, some of which involve replacing inputs by specific
outputs (substitutions) and others involve shuffling bits around
(permutations).
■Interestingly, AES performs all its computations on bytes rather
than bits. Hence, AES treats the 128 bits of a plaintext block as 16
bytes. These 16 bytes are arranged in four columns and four rows
for processing as a matrix −
■Unlike DES, the number of rounds in AES is variable and depends
on the length of the key. AES uses 10 rounds for 128-bit keys, 12
rounds for 192-bit keys and 14 rounds for 256-bit keys. Each of
these rounds uses a different 128-bit round key, which is calculated
from the original AES key.
 Rijndael

■ processes data as 4 groups of 4 bytes (state)

■ has 9/11/13 rounds in which state undergoes:
– byte substitution (1 S-box used on every byte)
– shift rows (permute bytes between groups/columns)
– mix columns (subs using matrix multipy of groups)
– add round key (XOR state with key material)
■ initial XOR key material & incomplete last round
■ all operations can be combined into XOR and table
lookups - hence very fast & efficient
Rijndael
 Byte Substitution
■ The 16 input bytes are substituted by looking up a
fixed table (S-box) given in design. The result is in a
matrix of four rows and four columns.
■ a simple substitution of each byte
■ uses one table of 16x16 bytes containing a
permutation of all 256 8-bit values
■ each byte of state is replaced by byte in row (left
4-bits) & column (right 4-bits)
– eg. byte {95} is replaced by row 9 col 5 byte
■ S-box is constructed using a defined
transformation of the values in GF(28)
■ designed to be resistant to all known attacks
 Shift Rows
■ a circular byte shift in each each
– 1st row is unchanged
– 2nd row does 1 byte circular shift to left
– 3rd row does 2 byte circular shift to left
– 4th row does 3 byte circular shift to left
■ decrypt does shifts to right
■ since state is processed by columns, this step permutes
bytes between the columns
 Mix Columns
■ Each column of four bytes is now transformed using a
special mathematical function. This function takes as input
the four bytes of one column and outputs four completely
new bytes, which replace the original column. The result is
another new matrix consisting of 16 new bytes. It should
be noted that this step is not performed in the last
round.each column is processed separately
■ each byte is replaced by a value dependent on all 4 bytes in the
column
■ effectively a matrix multiplication in GF(28) using prime poly
m(x) =x8+x4+x3+x+1
 Add Round Key
■ XOR state with 128-bits of the round key
■ again processed by column (though effectively a series of byte
operations)
■ inverse for decryption is identical since XOR is own inverse, just with
correct round key
■ designed to be as simple as possible
AES Round
 AES Key Expansion

■ takes 128-bit (16-byte) key and expands into array of 44/52/60

32-bit words
■ start by copying key into first 4 words
■ then loop creating words that depend on values in previous & 4
places back
– in 3 of 4 cases just XOR these together
– every 4th has S-box + rotate + XOR constant of previous
before XOR together
■ designed to resist known attacks
 AES Decryption

■The process of decryption of an AES ciphertext is similar to

the encryption process in the reverse order. Each round
consists of the four processes conducted in the reverse order
−
•Add round key
•Mix columns
•Shift rows
•Byte substitution
■Since sub-processes in each round are in reverse manner,
unlike for a Feistel Cipher, the encryption and decryption
algorithms needs to be separately implemented, although
they are very closely related.
 AES Decryption

■ AES decryption is not identical to encryption since steps done in

reverse
■ but can define an equivalent inverse cipher with steps as for
encryption
– but using inverses of each step
– with a different key schedule
■ works since result is unchanged when
– swap byte substitution & shift rows
– swap mix columns & add (tweaked) round key
Implementation Aspects

■ can efficiently implement on 8-bit CPU

– byte substitution works on bytes using a table of 256
entries
– shift rows is simple byte shifting
– add round key works on byte XORs
– mix columns requires matrix multiply in GF(28) which
works on byte values, can be simplified to use a table
lookup
Implementation Aspects

■ can efficiently implement on 32-bit CPU

– redefine steps to use 32-bit words
– can precompute 4 tables of 256-words
– then each column in each round can be computed using 4
table lookups + 4 XORs
– at a cost of 16Kb to store tables
■ designers believe this very efficient implementation was a key
factor in its selection as the AES cipher