ICT Standards and Guidelines
Segment 204
Information Integrity / Security
Encryption Standards and
Algorithms
(Version 2.0)
Table of Contents – Encryption Standards and Algorithms
1.0
2.0
Encryption Standards ............................................................................... 1
1.1
Prelude – Private Key Management ..................................................... 1
1.2
Encryption Implementation Standards ................................................. 1
1.3
Encryption Algorithm ......................................................................... 1
Encryption Algorithms .............................................................................. 2
2.1
RSA ................................................................................................. 2
2.2
DES ................................................................................................. 3
2.2.1 A Note on the DES .................................................................. 4
2.3
Triple DES (FIPS 46-3)....................................................................... 4
2.4
SHA-1 .............................................................................................. 4
2.5
AES ................................................................................................. 4
2.6
Blowfish ........................................................................................... 6
2.6.1 Subkeys ................................................................................. 6
2.6.2 Encryption .............................................................................. 7
2.6.3 Generating the Subkeys: .......................................................... 7
2.7
CAST ............................................................................................... 8
1.0
Encryption Standards
This appendix provides the standards for encryption technology to be deployed. This
includes digital signature standards and encryption standards for data. The objective of
a standard encryption implementation is to ensure the expected degree of safety is in
place.
1.1
Prelude – Private Key Management
The effectiveness of any encryption method is dependent on the ability to keep the
decryption key (private key) from falling into the hands of an unauthorized person.
Once the private key is compromised, the data encrypted with the corresponding public
key is no longer protected. Therefore, private key management is very important. Only
a few persons (preferably no more than two person – the primary and backup) should be
given access to the private key.
1.2
Encryption Implementation Standards
There are two types of encryption implementations: Symmetric and Asymmetric
encryption. Symmetric encryption uses the same key word for encrypting data and
decrypting the encrypted data or cipherdata. It provides faster execution. Asymmetric
encryption uses different keys for encrypting data and decrypting cipherdata.
Asymmetric encryption implementation is more secured than symmetric since the party
encrypting the data need not know the private key of the recipient. The sender simply
use the recipient’s public key (which can be made public without compromising the
security) to encrypt the data and send the cipherdata to the recipient. Decryption of the
data uses the recipient’s private key not the public key.
1.3
Encryption Algorithm
Since the protocols of current Local Area Networks (such as IEEE 802.3 standard with
10BaseT/100Base-T/1000Base-X/1000Base-T, IEEE 802.5, 802.11b, or ISO 9314 FDDI,
etc.) do not encrypt any data within their payload, data to be transmitted over any
network must be encrypted prior to being passed to the next layer.
The strength of the encryption depends on the algorithm used. Several encryption
algorithms are well suited for standard encryption needs, such as encryption for static
document or data. In addition to strong encryption, the algorithm must be fast so that
the performance of application will not be unduly impacted.
The algorithm to be used for encryption must be suitable for both static document and
data, yet has performance acceptable for application data exchange. The algorithm that
has strong encryption and acceptable performance is AES Rijndael with block size of 128
bits and key size of no less than 256 bites. This block-key size requirements provides a
lifetime of
Encryption Standards and Algorithms
Page 1
2.0
Encryption Algorithms
This section provides additional discussions about some popular encryption algorithms.
This section provides technical details of how the various algorithms work. Although
understanding of these technical details is not necessary to implement them, it is
beneficial for technical manager to have a basic idea of how encryption algorithms work.
At the end of each algorithm, there is a short discussion about the pros and cons of that
algorithm. This section will provide the technical manager insight and basis to evaluate
products that implement different algorithms.
2.1
RSA
RSA is a public-key cryptosystem developed by MIT professors Ronald L. Rivest, Adi
Shamir, and Leonard M. Adleman in 1977, in an effort to help ensure Internet security.
RSA uses modular arithmetic and elementary number theory as the basis for encryption
computation.
The "key" of an RSA cipher is three numbers: The first is “Xpub”, the public exponent,
the second is “Xpriv”, the private exponent, and the third is Mod, the modulus. The
“Xpub” and “Xpriv” are also known as primes. The RSA algorithm uses two large primes
and messages of unconditional length.
The message “M” (which must be shorter than Mod) is interpreted as a number. It is
broken into chunks, as necessary, to meet the length requirement. This number is raised
to the power of “Xpub”, modulo Mod, to give “C”, the ciphertext. “C” may in turn be
raised to the power of “Xpriv”, modulo Mod, to give “M”. The public key is the pair
(Xpub, Mod). The private key is the pair (Xpriv, Mod). The private key is generated
using the following formula:
where
“p” and “q” are large (  500 bits) random integrates
“e” is a random number relatively prime to (p-1)(q-1)
The public key is generated as follows:
The public key pair (Xpub, Mod) is therefore (e, n). The Mod, “n”, is also used in
conjunction with “Xpriv”. If we call the “Xpriv” “d”, then the private key pair (Xpriv,
Mod) is (d, n).
The message to be encrypted is divided into blocks of fixed length (cipher block), but no
longer than the number of digits in “Xpub”, and encrypted as follows:
where
“C” is the encrypted text (ciphertext)
Encryption Standards and Algorithms
Page 2
“M” is the plaintext
“j” is the j-th block
The encrypted text can be decrypted using
The RSA is a commonly used encryption algorithm throughout the world, and is generally
supported by most encryption software. However, its safety relies on the user selecting
the key with a sufficiently large size and a non-common key word. The human is
generally considered the weakest link in cryptography. Considering that the public and
private keys are generated through modulus mathematic, it is possible to break the key
through factoring. However, the upper limit is:
where “n” is the length of the number in bits.
From the above equation, the degree of difficulty in factoring the prime increases ten
folds for every 10 bits added. It is recommended that the key length be no less than
500 bit.
Although the RSA is a solid algorithm and produces strong ciphertext, it has been
broken, using brute force and other crypto-analysis techniques. However, by carefully
selection of the key and ensuring that the size of the key is at least 500 bits, the
algorithm is extremely difficult to break. The algorithm is also supported by most Java
packages.
2.2
DES
DES, the Data Encryption Standard, describes the Data Encryption Algorithm (DEA),
defined in the ANSI standard X9.32. The DES is the United States Federal Information
Processing Standard (FIPS 46-3) for encryption of non-classified document and data
(Confidential and Protected Data). The DES is a 16-round fixed sized cipher block with
eight (8) party bits for error checking. The DES uses the DEA algorithm and executes
very quickly. It was the first official U.S. government cipher intended for commercial
use and was the most widely used cryptosystem in the world. The DES can also be used
for single-user encryption, such as to store files on a hard disk in an encrypted form. In
a multi-user environment, secure key distribution may be difficult; public-key
cryptography provides an ideal solution to this problem.
The United States National Institute of Standards and Technology (NIST) FIPS 46-3
reaffirms Triple DES usage as of October 1999, but single DES is permitted only for
legacy systems. FIPS 46-3 includes a definition of triple-DES (TDEA, corresponding to
X9.52). In November of 2001, FIPS 46-3 was replaced by the Advanced Encryption
Standard (AES - FIPS 197). Please see paragraph 11.5 for further discussions about the
AES encryption.
Encryption Standards and Algorithms
Page 3
2.2.1 A Note on the DES
The DES standard specifies a 64-bit block size, but uses only 56-bit key during
execution. Eight (8) bits are stripped off the full 64-bit key for parity. DES, a symmetric
cryptosystem, is a 16-round Feistel that was originally designed for hardware
implementation. When used for communication, both the sender and the receiver must
know the same secret key, which can be used to encrypt and decrypt the message, or to
generate and verify a message authentication code (MAC). It has been found that the
number of rounds is exponentially proportional to the amount of time required to find a
key using a brute-force attack. Therefore, as the number of rounds increases, the
security of the algorithm increases exponentially.
2.3
Triple DES (FIPS 46-3)
Triple DES was the answer to many of the shortcomings of the DES. Since the Triple
DES algorithm is based on the DES, modification of the existing software is very easy. It
also has the advantage of proven reliability and a longer key length that eliminates many
of the shortcut attacks that can be used to reduce the amount of time it takes to break
the DES. However, even this more powerful version of DES may not be strong enough
to protect data for very much longer.
2.4
SHA-1
The Secure Hash Algorithm (SHA) is specified in the Secure Hash Standard (SHS, FIPS
180). The SHA-1, a revision to the SHA that was published in 1994, corrected an
unpublished flaw in the SHA. Its design is very similar to the MD4 family of hash
functions developed by Rivest. The SHA-1 is also described in the ANSI X9.30 (part 2)
standard.
The algorithm takes a message of less than 264 bits in length and produces a 160-bit
message digest. The algorithm is slightly slower than MD5, but the larger message
digest makes it more secure against brute-force collision and inversion attacks. It
should be noted that SHA is a hash algorithm and not an encryption algorithm.
2.5
AES
The AES is the Advanced Encryption Standard (FIPS 197). In November of 2001, AES
designated Rijndael algorithm as the standard algorithm. Therefore, the terms AES
algorithm and Rijndael algorithm are used interchangeably. There are several
algorithms proposed for AES, including RC6, Blowfish, and skipjack. However, Rijndael
is selected because of its flexibility and simplicity.
Rijndael is a symmetric block cipher with a block size of 128 bits. The AES specifies the
algorithm to support variable key sizes: 128, 192, and 256 bits. The algorithm operates
on an internal two-dimensional array called the State. The State consists of four rows of
bytes, each containing Nb bytes, where Nb is the block length divided by 32. In the
State array denoted by the symbol s, each individual byte has two indices, with its row
number r in the range 0 r < 4 and its column number c in the range 0 c < Nb. This
allows an individual byte of the State to be referred to as s[r,c].
Encryption Standards and Algorithms
Page 4
Since AES specifies Nb = 4, the range for c, the column number of the State, is 0 c <
4.
For the AES algorithm, the length of the input block, the output block, and the State is
128 bits. This is represented by Nb = 4, which reflects the number of 32-bit words
(number of columns) in the State.
For the AES algorithm, the length of the Cipher Key, k, is 128, 192, or 256 bits. The key
length is represented by Nk = 4, 6, or 8, which reflects the number of 32-bit words
(number of columns) in the Cipher Key.
Therefore
Nk = k / 32
For the AES algorithm, the number of rounds to be performed during the execution of
the algorithm is dependent on the key size. The number of rounds is represented by Nr,
where Nr = 10 when Nk = 4, Nr = 12 when Nk = 6, and Nr = 14 when Nk = 8.
The only Key-Block-Round combinations that conform to this standard are given in the
Table 1.
Table 1
Key-Block-Round Combination
AES-128
AES-192
AES-256
Key Length
(Nk words)
4
6
8
Block Size
(Nb words)
4
4
4
Number of Rounds
(Nr)
10
12
14
Rijndael consistently outperforms other proposed AES algorithms in both hardware and
software across a wide range of computing environments, regardless of its use in
feedback or non-feedback modes. Its key setup time is excellent, and its key agility is
good. Rijndael's very low memory requirements make it well suited for restricted-space
environments, in which it also demonstrates excellent performance. Rijndael's
operations are among the easiest to defend against power and timing attacks.
Encryption Standards and Algorithms
Page 5
Additionally, it appears that some defense can be provided against such attacks without
significantly impacting Rijndael's performance. Rijndael is designed with some flexibility
in terms of block and key sizes, and the algorithm can accommodate alterations in the
number of rounds, although these features require further study, and are not being
depolyed at this time. Finally, Rijndael's internal round structure appears to have good
potential to benefit from instruction-level parallelism (multiple instructions can be
executed in parallel). The following is the high-level schematic of Rijndael algorithm.
2.6
Blowfish
Blowfish is a variable-length key, 64-bit block cipher. The algorithm consists of two
parts: a key-expansion part and a data- encryption part. Key expansion converts a key
of at most 448 bits into several subkey arrays totaling 4168 bytes.
Data encryption occurs through a 16-round Feistel network. Each round consists of a
key-dependent permutation and a key- and data-dependent substitution. All operations
are XORs and additions on 32-bit words. The only additional operations are four indexed
array data lookups per round.
2.6.1 Subkeys
Blowfish uses a large number of subkeys. These keys must be pre-computed before any
data encryption or decryption.
1. The P-array consists of 18 32-bit subkeys:
P1, P2,..., P18.
2. There are four 32-bit S-boxes with 256 entries each:
Encryption Standards and Algorithms
Page 6
S1,0,
S2,0,
S3,0,
S4,0,
S1,1,...,
S2,1,..,,
S3,1,...,
S4,1,..,,
S1,255;
S2,255;
S3,255;
S4,255.
2.6.2 Encryption
Blowfish is a Feistel network consisting of 16 rounds (see Figure 1). The input is a 64-bit
data element, x.
Divide x into two 32-bit halves: xL, xR
For i = 1 to 16{
xL = xL XOR Pi
xR = F(xL) XOR xR
Swap xL and xR
Swap xL and xR (Undo the last swap.)
xR = xR XOR P17
xL = xL XOR P18
}
Recombine xL and xR
Function F{
Divide xL into four eight-bit quarters: a, b, c, and d
F(xL) = ((S1,a + S2,b mod 232) XOR S3,c) + S4,d mod 232
}
Decryption is exactly the same as encryption, except that P1, P2,..., P18 are used in the
reverse order.
Implementations of Blowfish that require the fastest speeds should unroll the loop and
ensure that all subkeys are stored in cache.
2.6.3 Generating the Subkeys:
The subkeys are calculated using the Blowfish algorithm. The method of generating the
subkeys is as follows:
1. First, initialize the P-array and then the four S-boxes, in order, with a fixed string.
This string consists of the hexadecimal digits of pi (less the initial 3). For example:
P1
P2
P3
P4
=
=
=
=
0x243f6a88
0x85a308d3
0x13198a2e
0x03707344
2. XOR P1 with the first 32 bits of the key, XOR P2 with the second 32-bits of the key,
and so on for all the bits of the key. Repeatedly cycle through the key bits until the
entire P-array has been XORed with key bits. For every short key, there is at least one
equivalent longer key; for example, if A is a 64-bit key, then AA, AAA, etc., are
equivalent keys.
3. Encrypt the all-zero string with the Blowfish algorithm, using the subkeys described in
steps (1) and (2).
Encryption Standards and Algorithms
Page 7
4. Replace P1 and P2 with the output of step (3).
5. Encrypt the output of step (3) using the Blowfish algorithm with the modified subkeys.
6. Replace P3 and P4 with the output of step (5).
7. Continue the process, replacing all entries of the P- array, and then all four S-boxes in
order, with the output of the continuously-changing Blowfish algorithm. In total, 521
iterations are required to generate all required subkeys. For faster execution,
applications can store the subkeys (in protected session name space) rather than
execute this derivation process multiple times.
2.7
CAST
CAST-128 (CAST5) is another popular 64-bit Feistel cipher allowing key sizes up to 128
bits. The name CAST stands for Carlisle Adams and Stafford Tavares, the original
inventors of CAST. CAST-128 consists of 16 non-identical rounds, where each round is
built up by simple operations such as integer and bitwise addition and rotation. CAST256 (CAST6) is a freely available extension of CAST-128 accepting up to 256 bits of key
size and with a 128-bit block size. CAST-256 was one of the original candidates for the
AES. Although no security weaknesses were found, the algorithm did not qualify for the
second round. CAST-256 has the property of strongly favoring security over speed.
Feistel ciphers are a special class of iterated block ciphers where the ciphertext is
calculated from the plaintext by repeated application of the same transformation or
round function. Feistel ciphers are sometimes called DES-like ciphers. The following
figure illustrates the concept of Feistel ciphers.
Feistel Cipher
CAST-128 has been endorsed by the Canadian government as one of the replacement
algorithms for DES. CAST-256 was a candidate for AES in the first round of evaluation.
Encryption Standards and Algorithms
Page 8