Cryptography Reference
In-Depth Information
Listing 6-3
Python code for performing linear cryptanalysis on the EASY1 cipher.
# Best deviation so far
maxdev = -1
# Best deviation's index
maxk = -1
# Which S-box we are working with
koffset = 6
# Initialize all of the counts to zero
count = [0
for
i
in
range(ssize)]
# Brute force the subkeys
for
k1
in
range(ssize):
# Calculate target partial subkey
k = k1 << koffset
# For each plaintext-ciphertext pair
for
j
in
range(0,len(plaintext)):
# Get the pair
pt = plaintext[j]
ct = ciphertext[j]
# Undo the last mixing layer with
# target partial subkey
v = apbox(ct)
v = demux(v)
v = mix(v, k)
# Go backwards through last S-box
u = mux([asbox(v[0]),asbox(v[1]),\
asbox(v[2]),asbox(v[3]),asbox(v[4]),\
asbox(v[5])])
# If the linear expression holds, increment
# the appropriate count
if
grab(pt, 6) ^ grab(pt, 7) ^ grab(pt, 8) ^ \
grab(pt, 9) ^ grab(pt, 10) ^ grab(u, 8) ^ \
grab(u, 9) == 0:
count[k1] = count[k1] + 1
# If this was the best so far, then mark it
if abs(count[k1] - len(plaintext)/2) >= maxdev:
maxdev = abs(count[k1] - len(plaintext)/2)
maxk = k
# Uncomment the following lines if you want to see your progress
# print k1,
# print count[k1]
To calculate the linear expression, we first have to process the ciphertext. First, we undo the last permutation.
Then, we XOR in the current subkey guess. Finally, we run the process backwards through the last layer of
S-boxes. We now have all of the bits necessary to calculate the linear cryptanalysis expression. Throughout the
process, we keep track of the best key (with the highest or lowest count).
Just so that we have a nice, easy-to-read display of what happened in the linear cryptanalysis, we can print
out the following summary, showing us the relevant candidate keys, as well as the proper keys. Simply add the
Search WWH ::
Custom Search