Imprimitive Permutation Groups and Trapdoors in Iterated Block Ciphers

Abstract

Abstract. An iterated block cipher can be regarded as a means of producing a set of permutations of a message space. Some properties of the group generated by the round functions of such a cipher are known to be of cryptanalytic interest. It is shown here that if this group acts imprimitively on the message space then there is an exploitable weakness in the cipher. It is demonstrated that a weakness of this type can be used to construct a trapdoor that may be difficult to detect. An example of a DES-like cipher, resistant to both linear and differential cryptanalysis that generates an imprimitive group and is easily broken, is given. Some implications for block cipher design are noted.

Security of Symmetric Encryption against Mass Surveillance

“…In the light of recent revelations, we contend that kleptography deserves to play a larger role in the future development of our field. Additional work on back-doored blockciphers can be found in [38,35,36]. This entire line of work has focused on building schemes with deliberately-inserted and hard-to-detect backdoors.…”

Mixing Properties of Operations Defined on the Set of N-Dimensional Vectors Over a Prime Finite Field

“…In other words, the results suggest bad mixing properties of the considered operations: first, there are many nontrivial subgroups that are subgroups with respect to both operations; second, the structure of the respective quotient group is completely retained for such subgroups. In terms of attacks based on homomorphisms [6], we may state that cosets of such subgroups create imprimitivity blocks, and the presence of such blocks potentially allows implementing these attacks on block ciphers constructed with the use of only the operations of bitwise and modular addition.…”

Group theoretic properties of Rijndael-like ciphers

“…A first motivation for the investigation of the group theoretic structure of a block cipher is to exclude undesirable properties, such as short cycles or non-trivial factor groups for the group generated by the round functions of the cipher. For example, it was shown in [27] that if the group generated by the round functions of a block cipher acts imprimitively on the state space, then there is an exploitable weakness in the cipher. Moreover, it is possible to give examples of DES-like block ciphers, which have a trapdoor with respect to this property, but nevertheless possess a certain resistance against classical linear and differential cryptanalysis (see [27]).…”

“…For example, it was shown in [27] that if the group generated by the round functions of a block cipher acts imprimitively on the state space, then there is an exploitable weakness in the cipher. Moreover, it is possible to give examples of DES-like block ciphers, which have a trapdoor with respect to this property, but nevertheless possess a certain resistance against classical linear and differential cryptanalysis (see [27]). A further motivation to study the group theoretic properties of a block cipher stems from a connection to the Markov cipher approach to classical differential cryptanalysis [16,25].…”