Content area
Full Text
ABSTRACT: In this paper, we describe a simplified version of the Advanced Encryption Standard algorithm. This version can be used in the classroom for explaining the Advanced Encryption Standard. After presentation of the simplified version, it is easier for students to understand the real version. This simplified version has the advantage that examples can be worked by hand. We also describe attacks on this version using both linear and differential cryptanalysis. These too can be used in the classroom as a way of explaining those kinds of attacks.
KEYWORDS: Rijndael, Advanced Encryption Standard, linear cryptanalysis, differential cryptanalysis.
1 INTRODUCTION
A popular symmetric-key block cipher in the United States from the mid 1970's until the present has been the Data Encryption Standard (DES). As it became apparent that computer speed improvements were making the chosen key length insecure, people started using Triple-DES instead. Triple-DES usually involves sequentially using DES with a first key in encryption mode, followed by DES with a second key in decryption mode, followed by DES with the first key again or a third key in encryption mode. But DES was not designed with this in mind. So there ought to be more efficient algorithms with the same or higher level of security as Triple-DES. In 1997, the National Institute of Standards and Technology (NIST) solicited proposals for replacements of DES. In 2001, NIST chose 128-bit block Rijndael to become the Advanced Encryption Standard (AES). Rijndael is a symmetric-key block cipher designed by Joan Daemen and Vincent Rijmen (see [2]). From here on, we will refer to the 128-bit block Rijndael algorithm as the AES algorithm.
Though AES is not inordinately complicated, it would be best understood if one could work through an example by hand. However, this is not feasible. So we have designed a simplified version of AES for which it is possible to work through an example by hand. In addition, we believe that we have shrunk the parameters as much as possible without losing the essence of the algorithm. The parameters were also chosen so that the linear and differential cryptanalyses are not trivial.
Though not entirely necessary, an instructor should probably present this algorithm after a discussion of finite fields of the form GF(2^sup r^). This entire...