Homework 7.ppt

JLM 2006021914:16 Homework 7 Homework 7 – Problem 1 We saw that a typical round of AES consisted of the following operations: for each byte, b in state ByteSub(b) ShiftRow(state) if(iNr) MixCol(state) AddRoundKey(i, state) For the 128 bit key, 128 bit block size version of Rijndael, using lookup tables to reduce the computations required and assuming basic operations (32 bit lookup, 32 bit xor, etc) all take about .001 microseconds and your code/data budget is under 16 MB, design a implementation of the round operations that is faster than implementing each of the primitive operations (ByteSub, ShiftRow, MixCol). How long does each round take (about)? Counter mode use of AES is used by selecting a nonce (n) and constructing cipher blocks AESK(n||ctr), AESK(n||ctr+1), AESK(n||ctr+2),…. The resulting bits are xored into the plaintext (as with the stream cipher). What properties of AES make this safe? Can the keystream be generated in parallel and stored for later use? What performance properties does this mode have over ECB? Homework 7 – Answer 1 Let the input to round and the round key be and let S[a] be the table which contains the values of ByteSub then after the Shiftrow operation, the “state” is Homework 7 – Answer 1 MixCol transforms a column as specified: [t0, t1, t2, t3]T ? t0 [2,1,1,3]T ? t1 [3,2,1,1]T ? t2 [1,3,2,1]T ? t3 [1,1,3,2]T So after MixCol the column j of the state matrix (for 128 bit key, 128 bit block) is: S[a0,j] [2,1,1,3]T ? S[a0,j-1] [3,2,1,1]T ? S[a0,j-2] [1,3,2,1]T ? S[a0,j-3] [1,1,3,2]T Setting T0(a)= S[a] [2,1,1,3]T , T1(a)= S[a] [3,2,1,1]T, T2(a)= S[a] [1,3,2,1]T, T3(a)= S[a] [1,1,3,2]T The output state, expressed as four columns, bj, resulting from an input state , aij, and the key expressed as columns kj, is: bj= kj? T0(a0,j) ? T1(a1,j-1)? T2(a2,j-2)? T3(a3,j-3) ……… RoundTransform The Ti tables are 1KB each for a total of 4 KB. With these RoundTransform requires about 16 lookups on Ti plus about 15