Block Ciphers, Feistel Networks, and Confusion/Diffusion

TAKEAWAYS:

• Block ciphers encrypt fixed-length blocks (e.g., 64/128 bits) using rounds of substitution (confusion) and permutation (diffusion).
• The Feistel structure splits each round into two halves: a function F (keyed transformation) and a swap, ensuring reversible encryption without transposition.
• Confusion hides statistical patterns (e.g., via S-boxes), while diffusion spreads plaintext bits across ciphertext (e.g., via P-boxes).
• DES (56-bit key) and AES (128/192/256-bit keys) are classic examples; AES uses a substitution-permutation network with key expansion.
• Weaknesses include chosen-plaintext attacks (if diffusion is poor) and related-key attacks (if confusion is predictable).
• Real-world use: eSewa (AES-256 for transaction data), Khalti (DES for legacy PIN encryption), and WhatsApp (Signal Protocol’s AES-256 for end-to-end chats).

1. Block Ciphers: Core Concepts

Block ciphers encrypt data in fixed-size chunks (e.g., 64 bits for DES, 128 bits for AES). Unlike stream ciphers (which encrypt bit-by-bit), they apply the same algorithm to each block, using a key to produce a unique ciphertext.

Key Properties

• Deterministic: Same plaintext + key → same ciphertext.
• Reversible: Decryption uses the same algorithm with the inverse key.
• Block size: Typically 64–256 bits (e.g., AES-128 uses 128-bit blocks).

How They Work

1. Plaintext is split into blocks of size n bits.
2. Each block undergoes multiple rounds of transformations (substitution + permutation).
3. Key schedule derives round keys from the input key.
4. Ciphertext is produced after the final round.

2. The Feistel Structure

Invented for DES, the Feistel network splits each round into two halves:

• Function F: A keyed transformation (e.g., substitution + permutation).
• Swap: The right half becomes the new left half, and the left half is XORed with F(right, key).

Why It Matters

• No transposition needed: The swap ensures reversibility (decryption uses the same F but reversed keys).
• Confusion + Diffusion: F introduces confusion (via S-boxes), while the swap diffuses bits across halves.

Example: DES Round

For a 64-bit block split into L₀/R₀:

1. Compute F(R₀, K₁) → 32 bits.
2. New L₁ = R₀, R₁ = L₀ ⊕ F(R₀, K₁).
3. Repeat for 16 rounds.

flowchart LR
    A["L₀
(32 bits)"] -->|XOR| B["F("R₀, K₁")
32 bits"]
    C["R₀
(32 bits)"] --> D["L₁ = R₀"]
    C --> E["R₁ = L₀ ⊕ F(R₀, K₁)"]
    D -->|"swap"| F["L₁/R₁"]
    E --> F

3. Confusion vs. Diffusion

Real-World Tie-In: eSewa’s AES-256

• Confusion: AES’s S-boxes ensure no byte in ciphertext reveals plaintext bytes.
• Diffusion: MixColumns guarantees a single plaintext bit affects 32 ciphertext bits.
• Attack Mitigation: Even if an attacker knows 128 bits of plaintext, they get no info about other blocks (thanks to CBC mode).

4. Classic Block Ciphers: DES vs. AES

Worked Example: DES Encryption Trace

Plaintext: 00000001 00100000 00000011 00000100 (16 hex bytes) Key: 0F1571C947D9E85B (56 bits, after parity bits removed) Round 1:

1. Split into L₀/R₀.
2. Compute F(R₀, K₁):
   • Expand R₀ to 48 bits.
   • XOR with K₁.
   • Pass through S-boxes → 32 bits.
   • Permute via P-box.
3. New L₁ = R₀, R₁ = L₀ ⊕ F(R₀, K₁).

flowchart TD
    A["L₀: 00000001 00100000"] --> B["R₀: 00000011 00000100"]
    B --> C["Expand to 48 bits
(6 bits per byte)"]
    C --> D["XOR with K₁
(0F1571C9)"]
    D --> E["S-box lookup
(e.g., S₁[0x0F] = 0x0A)"]
    E --> F["P-box permutation"]
    F --> G["F(R₀, K₁) = 10101010 00000000"]
    A --> H["L₁ = R₀"]
    G --> I["R₁ = L₀ ⊕ F(R₀, K₁)"]
    I --> J["= 10101011 00100000"]

5. Security Considerations

Attack Vectors

Real-World Example: Ncell’s SIM Encryption

• Problem: Early Ncell SIMs used DES for authentication.
• Risk: Weak keys or poor randomness → differential attacks could reveal user IDs.
• Fix: Migrated to AES-128 for 4G/LTE.

6. Modes of Operation

Block ciphers alone are insecure (e.g., ECB mode reveals patterns). Modes add randomness or chaining:

Example: CBC Mode in Khalti

1. IV: Random 128-bit value (sent with ciphertext).
2. Encryption:
   • C₁ = E(K, P₁ ⊕ IV)
   • C₂ = E(K, P₂ ⊕ C₁)
3. Decryption:
   • P₁ = D(K, C₁) ⊕ IV
   • P₂ = D(K, C₂) ⊕ C₁

• Why? Prevents replay attacks (IV ensures uniqueness).

7. Advanced: AES Internals

AES uses a substitution-permutation network (no Feistel structure):

1. SubBytes: Non-linear substitution via S-box (derived from GF(2⁸)).
2. ShiftRows: Left rotation of rows (diffusion).
3. MixColumns: Matrix multiplication (further diffusion).
4. AddRoundKey: XOR with round key.

Key Schedule:

• Expands 128-bit key to 1408 bits (11 round keys for AES-128).
• Uses Rcon (round constants) and S-box for non-linearity.

In the Real World

1. eSewa’s Transaction Security

   • Idea Used: AES-256 in CBC mode with a 128-bit IV.
   • How: Each transaction block is encrypted with a unique IV, preventing pattern leaks. The IV is sent in plaintext but never reused.
   • Why It Matters: Even if two users send the same amount, their ciphertexts differ (thanks to IV + CBC).

2. Khalti’s Legacy PIN Encryption

   • Idea Used: DES in ECB mode (for backward compatibility).
   • How: PINs are hashed with DES, but modern Khalti apps now use SHA-256 + AES-128.
   • Risk: If an attacker captures ciphertexts, ECB mode could reveal repeated PINs (e.g., "1234").

3. WhatsApp’s End-to-End Encryption

   • Idea Used: AES-256 in counter (CTR) mode for message encryption.
   • How:
     • A synchronization vector (IV) is shared via the Signal Protocol.
     • Each message block is encrypted with AES-CTR (stream cipher mode).
   • Why It Works: CTR mode turns AES into a stream cipher, enabling forward secrecy (past messages stay secure even if the key is compromised later).

4. NTC’s Fiber-Optic Network Security

   • Idea Used: AES-128 in GCM mode for tunnel encryption.
   • How: NTC’s backbone uses AES-GCM to encrypt IP packets, providing both confidentiality and integrity (detects tampering).
   • Real Hardware:

Exam Tip

1. Diagrams Are Mandatory

   • For Feistel structure: Draw 1 round with L/R splits, F, and swap.
   • For AES: Show 1 round with SubBytes → ShiftRows → MixColumns → AddRoundKey.
   • Label everything: Keys, S-boxes, P-boxes, IVs.

2. Define Key Terms Precisely

   • Confusion: "Hides relationships between key and ciphertext."
   • Diffusion: "Ensures one plaintext bit affects many ciphertext bits."
   • Feistel Structure: "A reversible round function where the right half is XORed with F(left, key)."

3. Worked Examples

   • DES Trace: Show 1 round with hex values (use the example above).
   • AES Key Schedule: Explain how the first round key is derived from the input key.
   • Mode Comparison: Contrast ECB (insecure) vs. CBC (secure) with diagrams.

4. Common Pitfalls

   • ECB Mode: Always mention its pattern leakage risk.
   • DES Weaknesses: Note its 56-bit key and S-box vulnerabilities.
   • AES Strengths: Emphasize its 128-bit block size and resistance to linear/differential attacks.

5. Real-World Links

   • eSewa/Khalti: Use AES-256/CBC for transactions.
   • WhatsApp: Uses AES-CTR for messages.
   • NTC: Uses AES-GCM for fiber networks.
   • Banks: Use 3DES (legacy) or AES-256 for PIN encryption.

Final Note: Block ciphers are the backbone of modern security. Master the Feistel structure, confusion/diffusion, and AES rounds—these are the most exam-weighted topics. Always draw diagrams!