Re: Wide-block Encryption Alternative
You certainly are not out of order.
We have already discussed, what I hope you don't mind me calling MEM
for large blocks.
At first blush, the current state of the art, this type of construction
has never been formally presented as secure. Look at the references in
both Shai and Clements proposals. I am not suggesting that your
proposal is insecure, I am suggesting that if your proposal is secure,
it is a significant step forward in the cryptographic community in
general. For instance, read the attack on Shai and Rogaway first
proposal. Very subtle and devastating.
Minor edit, on the diagram on page 5, K3, P3 and K3 and P3 are combined
to create H3. I believe that this is incorrect.
The "cascade" of this mode does not seem complete. Clement's proposal
(R=1) is similar MEM for a single block. in general you PP_x =
f(K,P_{n-1},P_n). And on the reverse, C_x = f(K,CC_{x-1},CC_x). This in
itself is a very limited diffusion. While you will (I am sure) argue
that since PP_1 is unknown to the attacker, this is not of use. Well
this is only partially true....
The major method I would choose to attack this is as a chosen plaintext
attack. That is, can the attacker manipulate the plaintext and be able
to manipulate the ciphertext in such a way that he can gain an
understanding of K_x. If he can, then the mixing function fails.
The way I would attacking this is by manipulating P_1 and P_32 in such
a way that I can determin relationships between K_1 and K_32 and then
unraveling the rest. Since you are proposing this, I would think that
you may have thought about this and already have an answer?
I am interested in your answer.
As a matter of process, this is an OK first step, but the procedure I
would suggest (but the committee could override me) is that we would
like to only standardize things that have been peer reviewed first, to
get around WiFi problem where, after the fact they showed it to
cryptographers that said "I would not have done it that way, but I
don't see any problems" but there were problems later.
To get this peer reviewed in the Crypto community you need to write a
serious paper and there are several members on the committee that can
help you write this, and if it still survives, get it submitted to
conferences.
Hope this helps.
I am attaching your .ppt ziped so that it gets into the archive.
Thanks
jim
On Feb 27, 2004, at 5:19 PM, Williams, Jim wrote:
>
> Being new to this effort, I am not sure what has already been
> discussed and
> or decided.
> So I hope this discussion is not out of order.
>
> I have attached a brief description of an alternative wide block
> encryption algorithm. I am certainly far from recommending or
> proposing
> this, but would be quite interested in any discussion of pros and cons.
>
> Best case, this alternative is less costly to implement at a given
> performance
> level, and easier to prove secure. Worst case, it is totally broken.
> And
> there
> is much room in between.
>
> - Jim
>
>
> <<blockEncryption.ppt>>
>
>
blockEncryption.ppt.zip