Twofish is a 128-bit block cipher that accepts a variable-length key up to 256 bits. The cipher is a 16-round Feistel network with a bijective F function made up of four key-dependent 8-by-8-bit S-boxes, a fixed 4-by-4 maximum distance separable matrix over GF(2 8 ), a pseudo-Hadamard transform, bitwise rotations, and a carefully designed key schedule. A fully optimized implementation of Twofish encrypts on a Pentium Pro at 17.8 clock cycles per byte, and an 8-bit smart card implementation encrypts at 1660 clock cycles per byte. Twofish can be implemented in hardware in 14000 gates. The design of both the round function and the key schedule permits a wide variety of tradeoffs between speed, software size, key setup time, gate count, and memory. We have extensively cryptanalyzed Twofish; our best attack breaks 5 rounds with 2 22.5 chosen plaintexts and 2 51 effort.

This document describes how to use CBC-mode cipher algorithms with the IPSec ESP (Encapsulating Security Payload) Protocol. It not only clearly states how to use certain cipher algorithms, but also how to use all CBC-mode cipher algorithms. Table of Contents 1. Introduction...................................................2 1.1 Specification of Requirements...............................2 1.2 Intellectual Property Rights Statement......................2 2. Cipher Algorithms..............................................2 2.1 Mode........................................................3 2.2 Key Size....................................................3 2.3 Weak Keys...................................................4 2.4 Block Size and Padding......................................5 2.5 Rounds......................................................6 2.6 Backgrounds.................................................6 2.7 Performance.................................................8 3. ESP Payl...

We present the new block cipher SHARK. This cipher combines highly non-linear substitution boxes and maximum distance separable error correcting codes (MDS-codes) to guarantee a good diffusion. The cipher is resistant against differential and linear cryptanalysis after a small number of rounds. The structure of SHARK is such that a fast software implementation is possible, both for the encryption and the decryption. Our C-implementation of SHARK runs more than four times faster than SAFER and IDEA on a 64-bit architecture.

MMX is a new technology to accelerate multimedia applications on Pentium processors. We report an implementation of IDEA on a Pentium MMX that is $1.65$ times faster than any previously known implementation on the Pentium. By parallelizing four IDEA's we reach an unprecedented $78$ Mbits/s throughput per output block on a 166MHz MMX. In the light of rapidly increasing popularity of multimedia applications, causing more dedicated hardware to be built, and observing that most of the current block ciphers do not benefit from MMX, we raise the problem of designing block ciphers (and encryption modes) fully utilizing the basic operations of multimedia.

In commonplace text-based password schemes, users typically choose passwords that are easy to recall, exhibit patterns, and are thus vulnerable to brute-force dictionary attacks. This leads us to ask whether other types of passwords (e.g., graphical) are also vulnerable to dictionary attack because of users tending to choose memorable passwords. We suggest a method to predict and model a number of such classes for systems where passwords are created solely from a user’s memory. We hypothesize that these classes define weak password subspaces suitable for an attack dictionary. For user-drawn graphical passwords, we apply this method with cognitive studies on visual recall. These cognitive studies motivate us to define a set of password complexity factors (e.g., reflective symmetry and stroke count), which define a set of classes. To better understand the size of these classes and, thus, how weak the password subspaces they define might be, we use the “Draw-A-Secret ” (DAS) graphical password scheme of Jermyn et al. [1999] as an example. We analyze the size of these classes for DAS under convenient parameter choices and show that they can be combined to define apparently popular subspaces that have bit sizes ranging from 31 to 41—a surprisingly small proportion of the full password space (58 bits). Our results quantitatively support suggestions that user-drawn graphical password systems employ measures, such as graphical password rules or guidelines and proactive password checking.

pmhQmaths.uq.edu.au Abstract. Large weak key classes of IDEA are found for which mem-bership is tested with a differential-linear test while encrypting with a single key. In particular, one in every 2' ' keys for 8.5-round IDEA is weak. A related-key differential-linear attack on 4-round IDEA is pre-sented which is successful for all keys. Large weak key classes are found for 4.5- to 6.5-round and 8-round IDEA for which membership of these classes is tested using similar related-key differential-linear tests.

In this paper we describe an attack on 3 rounds of IDEA, making use of linear as well as differential cryptanalytic techniques. The attack is independent of the key schedule. The main attack requires at most 2 29 chosen plaintext pairs and a workload of about 2 49 additions modulo 2 16 + 1 to find two subkeys or their additive inverses modulo 2 16 + 1. Further we describe a method, which then can find two more subkeys or their additive inverses modulo 2 16 + 1, which needs less than 10 of the already encrypted pairs and a total workload of at most 2 33 multiplications modulo 2 16 +1. This attack is more powerful than all previously published general attacks on the IDEA structure. 1 Introduction In 1990 J. Massey and X. Lai introduced the iterated block cipher PES (Proposed Encryption Standard), [1]. In 1991 the same authors, joined by S. Murphy, suggested a modification of PES, called IPES (Improved PES), [2]. In [2] it was shown that this modification improves the secur...

In this paper, we present techniques to protect bitslice block ciphers against power analysis attacks. We analyze and extend a technique proposed in [14]. We apply the technique to BaseKing, a variant of 3-Way[10] that was published in [8]. We introduce an alternative method to protect against power analysis speci c for BaseKing. Finally, we discuss the applicability of the methods to the other known bitslice ciphers 3-Way and Serpent [2].

Abstract not found

Twofish is a new block cipher with a 128 bit block, and a key length of 128, 192, or 256 bits, which has been submitted as an AES candidate. In this paper, we briefly review the structure of Twofish, and then discuss the key schedule of Twofish, and its resistance to attack. We close with some open questions on the security of Twofish's key schedule.