In this lab we'll do some exercises with DES and some of its variants, as we discussed in the last lecture: http://cs.curs.pub.ro/2014/pluginfile.php/13095/mod_resource/content/2/sasc_curs4_5.pdf

Remember DESX defined as the operation DESX( (k1,k2,k3), m) = k1 ⊕ DES(k2, m ⊕ k3), where k1, k3 have 64 bits (same as input/output of DES) and k2 has 56 bits (DES key size). Show a brute force (exhaustive key search) attack on DESX that runs in time $O(2^{120})$.

Show why the following schemes do not bring any real advantage compared to DES:

• a) c = k1 ⊕ DES(k2, m)
• b) c = DES(k2, m ⊕ k1)

The goal of this exercise is to implement the meet-in-the-middle attack on double DES. For this, you are given a starter code (see below), implemented using the Pycrypto library: https://pypi.python.org/pypi/pycrypto

Perform the following tasks:

• a) Install the pycrypto library
• b) Starting from the starter code (see below), write methods to encrypt and decrypt using double-DES (2DES), defined as follows:

<quote> 2DES( (k1,k2), m) = DES(k1, DES(k2, m))</quote>

• c) You are given the ciphertexts

c1 = 'cda98e4b247612e5b088a803b4277710f106beccf3d020ffcc577ddd889e2f32'

c2 = '54826ea0937a2c34d47f4595f3844445520c0995331e5d492f55abcf9d8dfadf'

as hex strings (i.e. you need to decode them to get the actual byte strings to use with DES, e.g. c1.decode('hex'))

Decrypt them using the following keys:

k1 = 'Smerenie'

k2 = 'Dragoste'

The plaintext corresponding to c1 is m1='Fericiti cei saraci cu duhul, ca'. Find the plaintext m2 corresponding to c2.

• d) Decrypt the entire ciphertext (c1 || c2) with k1 and k2 using 2DES and check it matches the messages m1||m2 above.
• e) You are given the following ciphertext/plaintext pairs:

m1 = 'Pocainta' (in byte string, i.e. can be used directly with Pycrypto DES)

c1 = '9f98dbd6fe5f785d' (in hex string, you need to hex-decode)

m2 = 'Iertarea'

c2 = '6e266642ef3069c2'

Due to a problem with the PRG, you also know the last 6-bytes of each key (note we now have a different key than for the previous exercises): k1 (last 6 bytes) = 'oIkvH5' k2 (last 6 bytes) = 'GK4EoU'

To build a table, I recommend using a list of tuples, where you add new (key,enc) pairs as follows:

tb = []
tb.append(('keyval', 'encva'))

To sort the table, you can do this:

tbs = sorted(tb, key=itemgetter(1))

To search with binary search, first select just the second column (to search the encryptions):

tenc = [value for _,value in tbs]

then use the bisect library (e.g. bisect.bisect_left) https://docs.python.org/2/library/bisect.html

The starter code is this:

import sys
import random
import string
from operator import itemgetter
import time
import bisect
from Crypto.Cipher import DES

def strxor(a, b): # xor two strings (trims the longer input)
  return "".join([chr(ord(x) ^ ord(y)) for (x, y) in zip(a, b)])

def hexxor(a, b): # xor two hex strings (trims the longer input)
  ha = a.decode('hex')
  hb = b.decode('hex')
  return "".join([chr(ord(x) ^ ord(y)).encode('hex') for (x, y) in zip(ha, hb)])

def bitxor(a, b): # xor two bit strings (trims the longer input)
  return "".join([str(int(x)^int(y)) for (x, y) in zip(a, b)])

def str2bin(ss):
  """
    Transform a string (e.g. 'Hello') into a string of bits
  """
  bs = ''
  for c in ss:
    bs = bs + bin(ord(c))[2:].zfill(8)
  return bs

def str2int(ss):
  """
    Transform a string (e.g. 'Hello') into a (long) integer by converting
    first to a bistream
  """
  bs = str2bin(ss)
  li = int(bs, 2)
  return li

def hex2bin(hs):
  """
    Transform a hex string (e.g. 'a2') into a string of bits (e.g.10100010)
  """
  bs = ''
  for c in hs:
    bs = bs + bin(int(c,16))[2:].zfill(4)
  return bs

def bin2hex(bs):
  """
    Transform a bit string into a hex string
  """
  bv = int(bs,2)
  return int2hexstring(bv)

def byte2bin(bval):
  """
    Transform a byte (8-bit) value into a bitstring
  """
  return bin(bval)[2:].zfill(8)

def int2hexstring(bval):
  """
    Transform an int value into a hexstring (even number of characters)
  """
  hs = hex(bval)[2:]
  lh = len(hs)
  return hs.zfill(lh + lh%2)

def get_index(a, x):
  'Locate the leftmost value exactly equal to x in list a'
  i = bisect.bisect_left(a, x)
  if i != len(a) and a[i] == x:
    return i
  else:
    return -1

def des_enc(k, m):
  """
  Encrypt a message m with a key k using DES as follows:
  c = DES(k, m)

  Args:
    m should be a bytestring (i.e. a sequence of characters such as 'Hello' or '\x02\x04')
    k should be a bytestring of length exactly 8 bytes.

  Note that for DES the key is given as 8 bytes, where the last bit of
  each byte is just a parity bit, giving the actual key of 56 bits, as expected for DES.
  The parity bits are ignored.

  Return:
    The bytestring ciphertext c
  """
  d = DES.new(k)
  c = d.encrypt(m)

  return c

def des_dec(k, c):
  """
  Decrypt a message c with a key k using DES as follows:
  m = DES(k, c)

  Args:
    c should be a bytestring (i.e. a sequence of characters such as 'Hello' or '\x02\x04')
    k should be a bytestring of length exactly 8 bytes.

  Note that for DES the key is given as 8 bytes, where the last bit of
  each byte is just a parity bit, giving the actual key of 56 bits, as expected for DES.
  The parity bits are ignored.

  Return:
    The bytestring plaintext m
  """
  d = DES.new(k)
  m = d.decrypt(c)

  return m
  
def main():

  # Exercitiu pentru test des2_enc
  key1 = 'Smerenie'
  key2 = 'Dragoste'
  m1_given = 'Fericiti cei saraci cu duhul, ca'
  c1 = 'cda98e4b247612e5b088a803b4277710f106beccf3d020ffcc577ddd889e2f32'
  # TODO: implement des2_enc and des2_dec
  m1 = des2_dec(key1, key2, c1.decode('hex'))

  print 'ciphertext: ' + c1
  print 'plaintext: ' + m1
  print 'plaintext in hexa: ' + m1.encode('hex')

  # TODO: run meet-in-the-middle attack for the following plaintext/ciphertext
  m1 = 'Pocainta'
  c1 = '9f98dbd6fe5f785d' # in hex string
  m2 = 'Iertarea'
  c2 = '6e266642ef3069c2'
  
  # Note: you only need to search for the first 2 bytes of the each key:
  k1 = '??oIkvH5'
  k2 = '??GK4EoU'



if __name__ == "__main__":
  main()