Cryptography Reference
In-Depth Information
Fig. 3.2
DES
f
-function
Fig. 3.3
Splitting of the
f
-function
The DES
f
-function (see Fig.
3.2
) first applies an expansion layer
E
that expands
the 32 input bits into 48 output bits by duplicating 16 of them. The round key is
then introduced by bit-wise addition. Afterwards the block is split into eight six-bit
blocks, each entering into a different substitution box (S-box)
S
i
producing a four-
bit output. Finally, the 32 bits from the eight S-box outputs are permuted through a
bit-wise permutation
P
which yields the 32-bit output block.
Notation
: For the sake of simplicity and without loss of generality, we shall omit the
initial and the final permutations in the rest of the chapter. Namely, we will consider
C
16
r
=
1
F
K
r
(
P
)
. We shall also denote by
(
L
r
,
R
r
)
the value of the DES internal
=
state at the end of the
r
th round. Specifically, we have
(
L
r
,
R
r
)
=
F
K
r
(
L
r
−
1
,
R
r
−
1
),
with
.
We shall further denote by
E
i
,
P
−
i
and
K
r
,
i
,the
i
th six-bit coordinate of the
expansion function
E
,the
i
th four-bit coordinate of the inverse permutation
P
−
1
,
and
i
th six-bit coordinate of the round key
K
r
respectively. As illustrated on Fig.
3.3
,
these notations allow us to rewrite an equation
Y
(
L
0
,
R
0
)
=
P
and
C
=
(
L
16
,
R
16
)
=
f
K
r
(
X
)
with eight independent
equations:
