Weak Keys Research Articles

Practical RSA trapdoor

The author shows an easy way to construct weak keys for RSA. Furthermore, it appears to be hard to tell that these keys are weak without knowledge of a secret. This emphasises the general proposition that key generation requires extremely careful attention when designing, certifying and purchasing cryptographic systems.

A note on redundancy in encrypted messages

In a cryptographic protocol, it is important for a recipient to determine that a message has not been modified during transmission. This is normally achieved by providing redundancy in the message. Typically, a message is described in the literature as containing enough redundancy, not enough redundancy, or no redundancy at all. This note shows that, because of the secrecy that comes with encryption, redundancy can be provided at two different levels. An example demonstrates that this distinction is useful in guarding against certain cryptographic attacks on weak keys.

Is the Data Encryption Standard a group? (Results of cycling experiments on DES)

The Data Encryption Standard (DES) defines an indexed set of permutations acting on the message space ℳ ={0,1}64. If this set of permutations were closed under functional composition, then the two most popular proposals for strengthening DES through multiple encryption would be equivalent to single encryption. Moreover, DES would be vulnerable to a known-plaintext attack that runs in 228 steps on the average. It is unknown in the open literature whether or not DES has this weakness.Two statistical tests are presented for determining if an indexed set of permutations acting on a finite message space forms a group under functional composition. The first test is a “meet-in-the-middle” algorithm which uses O(√K) time and space, where K is the size of the key space. The second test, a novel cycling algorithm, uses the same amount of time but only a small constant amount of space. Each test yields a known-plaintext attack against any finite, deterministic cryptosystem that generates a small group.The cycling closure test takes a pseudorandom walk in the message space until a cycle is detected. For each step of the pseudorandom walk, the previous ciphertext is encrypted under a key chosen by a pseudorandom function of the previous ciphertext. Results of the test are asymmetrical: long cycles are overwhelming evidence that the set of permutations is not a group; short cycles are strong evidence that the set of permutations has a structure different from that expected from a set of randomly chosen permutations.Using a combination of software and special-purpose hardware, the cycling closure test was applied to DES. Experiments show, with overwhelming confidence, that DES is not a group. Additional tests confirm that DES is free of certain other gross algebraic weaknesses. But one experiment discovered fixed points of the so-called “weak-key” transformations, thereby revealing a previously unpublished additional weakness of the weak keys.

Cycle Structure of the DES for Keys Having Palindromic (or Antipalindromic) Sequences of Round Keys

Certain DES keys have been called weak or semiweak based upon the number of distinct round keys which they produce. For the weak keys, all 16 round keys are identical and encryption is the same as decryption. For the semiweak keys, there are only two distinct round keys but no specific weakness of the DES with these keys has been demonstrated.