?? 09-07.html
字號:
<html><head><TITLE>APPLIED CRYPTOGRAPHY, SECOND EDITION: Protocols, Algorithms, and Source Code in C:Algorithm Types and Modes</TITLE>
<!-- BEGIN HEADER --><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><SCRIPT><!--function displayWindow(url, width, height) { var Win = window.open(url,"displayWindow",'width=' + width +',height=' + height + ',resizable=1,scrollbars=yes');}//--></SCRIPT></HEAD><body bgcolor="ffffff" link="#006666" alink="#006666" vlink="#006666"><P>
<CENTER><B>Applied Cryptography, Second Edition: Protocols, Algorthms, and Source Code in C (cloth)</B>
<FONT SIZE="-2">
<BR>
<I>(Publisher: John Wiley & Sons, Inc.)</I>
<BR>
Author(s): Bruce Schneier
<BR>
ISBN: 0471128457
<BR>
Publication Date: 01/01/96
</FONT></CENTER>
<P>
<!-- Empty Reference Subhead -->
<!--ISBN=0471128457//-->
<!--TITLE=APPLIED CRYPTOGRAPHY, SECOND EDITION: Protocols, Algorithms, and Source Code in C//-->
<!--AUTHOR=Bruce Schneier//-->
<!--PUBLISHER=Wiley Computer Publishing//-->
<!--CHAPTER=09//-->
<!--PAGES=205-208//-->
<!--UNASSIGNED1//-->
<!--UNASSIGNED2//-->
<CENTER>
<TABLE BORDER>
<TR>
<TD><A HREF="09-06.html">Previous</A></TD>
<TD><A HREF="../ewtoc.html">Table of Contents</A></TD>
<TD><A HREF="09-08.html">Next</A></TD>
</TR>
</TABLE>
</CENTER>
<P><BR></P>
<H3><A NAME="Heading10"></A><FONT COLOR="#000077">9.9 Counter Mode</FONT></H3>
<P>Block ciphers in <B>counter mode</B> use sequence numbers as the input to the algorithm [824,498,715]. Instead of using the output of the encryption algorithm to fill the register, the input to the register is a counter. After each block encryption, the counter increments by some constant, typically one. The synchronization and error propagation characteristics of this mode are identical to those of OFB. Counter mode solves the OFB mode problem of <I>n</I>-bit output where <I>n</I> is less than the block length.</P>
<I><P><A NAME="Fig13"></A><A HREF="javascript:displayWindow('images/09-13.jpg',209,131 )"><IMG SRC="images/09-13t.jpg"></A>
<BR><A HREF="javascript:displayWindow('images/09-13.jpg',209,131)"><FONT COLOR="#000077"><B>Figure 9.13</B></FONT></A> A keystream generator in output-feedback mode.</I>
</P>
<P>Nothing is sacred about the counter; it does not have to count through all the possible inputs in order. You can use any of the random-sequence generators in Chapters 16 and 17, whether cryptographically secure or not, as input to the block algorithm.
</P>
<P><FONT SIZE="+1"><B><I>Stream Ciphers in Counter Mode</I></B></FONT></P>
<P>Stream ciphers in counter mode have simple next-state functions and complicated output functions dependent on the key. This technique, illustrated in Figure 9.14, was suggested in [498,715]. The next-state function can be something as simple as a counter, adding one to the previous state.
</P>
<P>With a counter mode stream cipher, it is possible to generate the <I>i</I>th key bit, <I>k</I><SUB>i</SUB>, without first generating all the previous key bits. Simply set the counter manually to the <I>i</I>th internal state and generate the bit. This is useful to secure random-access data files; you can decrypt a specific block of data without decrypting the entire file.</P>
<H3><A NAME="Heading11"></A><FONT COLOR="#000077">9.10 Other Block-Cipher Modes</FONT></H3>
<P><FONT SIZE="+1"><B><I>Block Chaining Mode</I></B></FONT></P>
<P>To use a block algorithm in <B>block chaining (BC)</B> mode, simply XOR the input to the block cipher with the XOR of all the previous ciphertext blocks. As with CBC, an IV starts the process.</P>
<P>Mathematically, this looks like:</P>
<DL>
<DD><I>C</I><SUB>i</SUB> = <I>E</I><SUB>K</SUB>(<I>P</I><SUB>i</SUB> ⊕ <I>F</I><SUB>i</SUB>); <I>F</I><SUB>i+1</SUB> = <I>F</I><SUB>i</SUB> ⊕ <I>C</I><SUB>i</SUB>
<DD><I>P</I><SUB>i</SUB> = <I>F</I><SUB>i</SUB> ⊕ <I>D</I><SUB>K</SUB>(<I>C</I><SUB>i</SUB>); <I>F</I><SUB>i+1 </SUB>= <I>F</I><SUB>i</SUB> ⊕ <I>C</I><SUB>i</SUB>
</DL>
<P>Like CBC, BC’s feedback process extends errors in the plaintext. The primary problem with BC is that because the decryption of a ciphertext block depends on all the previous ciphertext blocks, a single error in the ciphertext will result in the incorrect decryption of all subsequent ciphertext blocks.
</P>
<I><P><A NAME="Fig14"></A><A HREF="javascript:displayWindow('images/09-14.jpg',200,132 )"><IMG SRC="images/09-14t.jpg"></A>
<BR><A HREF="javascript:displayWindow('images/09-14.jpg',200,132)"><FONT COLOR="#000077"><B>Figure 9.14</B></FONT></A> A keystream generator in counter mode.</I>
</P>
<P><FONT SIZE="+1"><B><I>Propagating Cipher Block Chaining Mode</I></B></FONT></P>
<P><B>Propagating cipher block chaining (PCBC)</B> [1080] mode is similar to CBC mode, except that both the previous plaintext block and the previous ciphertext block are XORed with the current plaintext block before encryption (or after decryption) (see Figure 9.15).</P>
<DL>
<DD><I>C</I><SUB>i</SUB> = <I>E</I><SUB>K</SUB>(<I>P</I><SUB>i</SUB> ⊕ <I>C</I><SUB>i-1</SUB> ⊕ <I>P</I><SUB>i-1</SUB>)
<DD><I>P</I><SUB>i</SUB> = <I>C</I><SUB>i-1</SUB> ⊕ <I>P</I><SUB>i-1</SUB> ⊕ <I>D</I><SUB>K</SUB>(<I>C</I><SUB>i</SUB>)
</DL>
<P>PCBC was used in Kerberos version 4 (see Section 24.5) to perform both encryption and integrity checking in one pass. In PCBC mode, an error in the ciphertext will result in incorrect decryption of all blocks that follow. This means that checking a standard block at the end of a message will ensure the integrity of the entire message.
</P>
<P>Unfortunately, there is a problem with this mode [875]. Swapping two ciphertext blocks results in the incorrect decryption of the two corresponding plaintext blocks, but due to the nature of the XOR with the plaintext and the ciphertext, the errors cancel. So if the integrity checker looks only at the last few blocks of the decrypted plaintext, it could be fooled into accepting a partially garbled message. Although no one has figured out how to exploit this weakness, Kerberos version 5 switched to CBC mode after the flaw was discovered.</P>
<P><FONT SIZE="+1"><B><I>Cipher Block Chaining with Checksum</I></B></FONT></P>
<P><B>Cipher block chaining with checksum (CBCC)</B> is a CBC variant [1618]. Keep a running XOR of all the plaintext blocks, and XOR that with the last plaintext block before encryption. CBCC ensures that any change made to any ciphertext block changes the decrypted output of the last block. If the last block contains any sort of integrity check or a constant, then the integrity of the decrypted plaintext can be checked with very little additional overhead.</P>
<I><P><A NAME="Fig15"></A><A HREF="javascript:displayWindow('images/09-15.jpg',140,146 )"><IMG SRC="images/09-15t.jpg"></A>
<BR><A HREF="javascript:displayWindow('images/09-15.jpg',140,146)"><FONT COLOR="#000077"><B>Figure 9.15</B></FONT></A> Propagating cipher block chaining mode.</I>
</P>
<P><FONT SIZE="+1"><B><I>Output Feedback with a Nonlinear Function</I></B></FONT></P>
<P><B>Output feedback with a nonlinear function (OFBNLF)</B> [777] is a variant of both OFB and ECB where the key changes with every block:</P>
<DL>
<DD><I>C<SUB>i</SUB></I> = <I>E</I><SUB>K<SUB>i</SUB></SUB>(<I>P</I><SUB>i</SUB>); <I>K</I><SUB>i</SUB> = <I>E</I><SUB>K</SUB>(<I>K</I><SUB>i-1</SUB>)
<DD><I>P</I><SUB>i</SUB> = <I>D</I><SUB>K<SUB>i</SUB></SUB>(<I>C</I><SUB>i</SUB>); <I>K</I><SUB>i</SUB> = <I>E</I><SUB>K</SUB>(<I>K</I><SUB>i-1</SUB>)
</DL>
<P>A single bit error in the ciphertext propagates to only one plaintext block. However, if a single bit is lost or added, then there is infinite error extension. With a block algorithm that has a complicated key scheduling algorithm, like DES, this mode is slow. I know of no cryptanalysis of this mode.
</P>
<P><FONT SIZE="+1"><B><I>More Modes</I></B></FONT></P>
<P>Other modes are possible, although they are not extensively used. <B>Plaintext block chaining (PBC)</B> is like CBC except the previous plaintext block is XORed with the plaintext block instead of with the ciphertext block. <B>Plaintext feedback (PFB)</B> is like CFB, except the plaintext, not the ciphertext, is used for feedback. These two modes allow chosen-plaintext attacks in order to resist known-plaintext attacks. There is also <B>cipher block chaining of plaintext difference (CBCPD)</B>. I’m sure it gets even weirder.</P>
<P>If a cryptanalyst has a brute-force keysearch machine, then he can recover the key if he can guess one of the plaintext blocks. Some of these stranger modes amount to light encryption before applying the encryption algorithm: for example, XORing the text with a fixed secret string or permuting the text. Almost anything nonstandard will frustrate this sort of cryptanalysis.</P><P><BR></P>
<CENTER>
<TABLE BORDER>
<TR>
<TD><A HREF="09-06.html">Previous</A></TD>
<TD><A HREF="../ewtoc.html">Table of Contents</A></TD>
<TD><A HREF="09-08.html">Next</A></TD>
</TR>
</TABLE>
</CENTER>
[an error occurred while processing this directive]
</body></html>?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -