Internet.Security

Figure 3.20 Pseudocode for the inverse cipher (FIPS Publication, 2001).

Inverse of AddRoundKey() Transformation

AddRoundKey() is its own inverse because it only involves application of the XOR operation.

For decrypting ciphertext, the Inverse Cipher is described in the pseudocode shown in Figure 3.20.

Example 3.26 The input to the Inverse Cipher is the cipher encryption values obtained from Example 3.25.

Ciphertext = a6 24 62 48 34 dd a8 b9 1a f1 73 5d 00 0e cf 61

Cipherkey = 36 8a c0 f4 ed cf 76 a6 08 a3 b6 78 31 31 27 6e

The round key values are the same as those used in Example 3.25. The following table shows the values in the state array as the Inverse Cipher progresses.

Inverse Cipher (Decrypt)

122 INTERNET SECURITY

with CDMA cellular mobile communications system. DMDC divides messages into blocks of 64 bits. The DMDC hash function generates message digests with variable sizes – 18, 32, 64 or 128 bits. This scheme is appropriate for the use of digital signatures and hence it can be employed to increase Internet security.

The message to be signed is first divided into a sequence of 64-bit blocks:

M1, M2, . . . , Mt

Appropriate padding rules need to be devised for messages that do not divide conveniently. The adjacent message blocks are hashed together with a self-generated key. A better approach is to use one block (64 bits) of the correct message length as the key.

Figure 4.1 shows a typical scheme for hash code computation for M = 192 bits using DMDC.

4.1.1Key Schedule

One authentication problem in the CDMA mobile system is how to confirm the identity of the mobile station by exchanging information between a mobile station and base station. When the authentication field of the access parameters message is set to ‘01’, the mobile station attempts to register by sending a registration request message on the access channel; and the authentication procedure will be performed. Computing the authentication data of mobile station registrations, it is necessary to have a 152-bit message value which complies with RAND (32 bits), ESN (32 bits), MIN (24 bits) and SSD-A (64bits):

RAND: Authentication random challenge value ESN: Electronic serial number

MIN: Mobile station identification number

SSD-A: Shared secret data to support the authentication procedure.

The 192-bit value is composed of 152-bit message length and 40-bit padding. Suppose

Example 4.1 Assume that division of the 192-bit padded message into 64 bits consists of:

M1 = 7a138b2524af17c3

M2 = 17b439a12f51c5a8

M3 = 51cb360000000000

Note that no one-bit flag and no message length in hex are inserted in this example. The 48-bit key generation using row/column permutations is given below. Assume that the first data block M1 is used as the key input. Using Table 3.1 (PC-1), M1 splits into two blocks:

C0 = a481394, D0 = e778253

As shown in Table 3.2, C1 and D1 are obtained from C0 and D0 by shifting one bit to the left, respectively.

Using Table 3.3 (PC-2), the 48-bit compressed key is computed as:

K0 = 058c4517a7a2.

Finally, using Table 4.1, the 48-bit key with the row/column permutations is computed as:

K = 5458c42bcc07

This is the key block to be provided for M2 and M3, as shown in Example 4.2.

Example 4.2 Referring to Figure 4.1, M2 = 17b439a12f51c5a8 and M3 = 51cb360000000000 are processed as follows:

Using Table 3.4, M2 and M3 are divided into

Expansion of these four data blocks using Table 3.5 yields

The 48-bit key, K = 5458c42bcc07, obtained through row/column permutations, should be shifted 0, 2, 1 and 3 bits to the left such that

K1 = 5458c42bcc07 (zero shift)

K2 = a8b18857970e (two shifts)

K3 = 516310af301d (one shift)

K4 = a2c6215e603a (three shifts)

These four keys are used for XORing with expanded blocks such that

1 = E(L1) K1 = e459ca81a7fd

2 = E(R1) K2 = b437ede5b0be

3 = E(L2) K3 = 28d982d71808

4 = E(R2) K4 = a286295e2036

These four i , 1 ≤ i ≤ 4, are inputs to the (S-box)i , respectively.

Using Table 3.6, the outputs i of S-boxes are computed as:

1 = a4064766

2 = 1d1dabb8

3 = f89d0b16

4 = dabaae4d

: Bit-by-bit XORing of 16-bit subblocks

: Concatenation

Since we have already calculated P( i ) in Example 4.2, the message digest of 32 bits is ready to be computed from Figure 4.2:

Y1 = c6cc

Y2 = e99a

Y3 = fd20

Y4 = 4839

H1 = 3bec

H2 = a1a3

Concatenation of H1 with H2 results in the 32-bit hash code h such that

h = (H1||H2) = 3beca1a3

64-bit hash code computation:

Referring to Figure 4.3, the 64-bit message digest is computed as follows:

Y1 = 97a0e99a

Y2 = 371d4fc8

H1 = f41d3352

H2 = 753f20dc

The 64-bit hash code is thus computed as:

h = (H1||H2) = f41d3352753f20dc

Note that:

: Multiplication of 32-bit blocks modulo 232 + 1 = 4294967297

+: Addition of 32-bit blocks modulo 232 = 4294967296

<<<m : Shifting m bits to the left

18-bit hash code computation:

Utilising the 64-bit message digest h obtained above, the 18-bit hash code can be computed from the decimation process as shown in Figure 4.4.

h = f41d3352753f20dc (64 bits)