Design and Implementation of Algorithm for DES Cryptanalysis

Harshali D. Zodpe Prakash W.Wani

Department of Electronics and Telecommunication Department of Electronics and Telecommunication
Engineering, Engineering,
Maharashtra Institute of Technology, College of Engineering,
Pune, India Pune, India
e-mail: [email protected] e-mail: [email protected]

Rakesh R. Mehta
Mechatronics Test Equipments (I) Pvt Ltd,
Pune, India
e-mail: [email protected]

Abstract— With the advent of low cost Field Programmable building special purpose hardware for cryptanalysis out of
Gate Arrays (FPGA’s), building special purpose hardware for the reach for commercial or research institutions.
computationally intensive applications has now become However, Reconfigurable Computing offers advantages
possible. Cryptanalysis of block ciphers involves massive over traditional software and hardware implementations of
computations which are independent of each other and can be
computationally intensive algorithms. Reconfigurable
instantiated simultaneously so that the solution space is
explored at a faster rate. This paper presents the design for computing is based on using low cost FPGA’s which can be
Hardware implementation of Data Encryption Standard (DES) configured after fabrication to take advantage of a hardware
cryptanalysis on FPGA using exhaustive key search. Two design but still maintain the flexibility of software. Thus
architectures viz. Iterative and Loop unrolled DES Cryptanalytic hardware has now become a possibility
architecture are implemented. The aim of this work is to make outside government agencies.
cryptanalysis faster and better. Depending on what information the adversary can
obtain the different attack scenarios can be distinguished as
Keywords-Cryptanalysis, DES, Hardware implementation, Ciphertext-Only attack, Known-Plaintext attack, Chosen-
Iterative architecture, Loop unrolled architecture
Plaintext attack, Chosen-ciphertext attack, Adaptive
Chosen-Plaintext/Ciphertext attack as published in [1].
I. INTRODUCTION This paper presents a FPGA based hardware design for
The widespread use of computers and electronic data cryptanalysis of DES based on known-plaintext attack using
storage and transmission with the exponential growth of brute force technique. The DES algorithm is chosen for
internet has generated strong demand for a robust security implementation as it is basic cryptographic algorithm and is
mechanism, and they in turn depend critically on used by academicians as a test unit for experimentation. The
cryptographic protection. The computer power is also idea is to create multiple instances of the key search engine
increasing rapidly and it is important to assess the strength in an FPGA chip to make the cryptanalysis process faster
of deployed cryptographic algorithm. and provide a better cost performance ratio.
Cryptanalysis is the science of revealing the hidden data Cryptanalysis has a historical background.
of a cryptographic algorithm or system, either to get at the Cryptanalysis is practiced by a broad range of organizations
data for the own sake or to test the strength of the to test the strength of the cryptosystem being used. The first
cryptographic algorithm being used. Cryptanalysis of exhaustive DES key search machine estimation was
ciphers (encrypted information) usually involves massive proposed by Diffie and Hellman in 1977 [2]. It contained
and parallel computations. The security parameter (in 106 chips, with an estimated cost of US$ 20 million and a 12
particular the key length) of almost all practical crypto hour expected search time. After few years, a first detailed
algorithms is chosen such that attacks with conventional hardware design description for a brute force attack was
computers are computationally infeasible. Such parallel presented by Michael Wiener at CRYPTO’93 [3]. It was
functionality can be realized by special purpose hardware estimated that the machine could be built for less than a
blocks that can be operated simultaneously, improving the million US dollars. The proposed machine consisted of
time complexity of the overall computations. But the high 57, 000 DES chips that could recover a key every three and
non-recurring engineering cost for Application Specific half hours. In 1997, a detailed cost estimate for three
Integrated Circuits (ASIC’s) had put most projects for different approaches for DES key search, distributed
computing, FPGAs and custom ASIC designs, was

978-1-4673-5116-4/12/$31.00 2012
c IEEE 278

Authorized licensed use limited to: NYSS'S Yeshwantrao Chavan College of Engineering. Downloaded on November 23,2022 at 16:41:35 UTC from IEEE Xplore. Restrictions apply.
 presented by M. Blaze [4]. In 1998, the Electronic Frontier As seen in Figure1, the first block is initial permutation.
Foundation (EFF) finally built a DES hardware cracker It changes the order of the input bits according to a fixed
called Deep Crack which could perform an exhaustive key permutation. The result is then divided into two equal halves
search within 56 hours [5]. Their DES cracker consisted of of 32-bit each i.e. Li and Ri where ‘i’ denotes the round
1, 536 custom designed ASIC chips at the material cost of number. In each round, the previous word Ri is fed to a
around US$ 250,000 and could search 88 billion keys per round function ‘f’ and the result is then XORed to the
second. In 2006, the Cost Optimal Parallel Code Breaker previous word Li. Both the words are then swapped and the
(COPACOBANA) for DES brute-force attack was built for algorithm proceeds to the next iteration.
less than US$ 10,000 [6]. COPACOBANA hosts 120 low- The round function ‘f’ is key dependent and involves the
cost FPGAs and is the latest developed cryptanalysis following steps. The first step is expansion. Here the 32-bit
hardware capable of breaking DES in less than one week on input word is expanded to 48-bits by duplicating and
average. With the emergence of newer and powerful reordering the right half of the bits. This input is then
devices, continuous efforts are being made to make XORed with the required key depending on the round
cryptanalysis faster and better. number in the second step. In the third step, the 48-bits
output from previous step is split into eight 6-bits words
II. DESCRIPTION OF DES ALGORITHM which are substituted in eight parallel 6x4 bit S-boxes. This
The Data Encryption Standard (DES) is one of the first substitution increases the strength of the cryptosystem. The
commercially developed ciphers. DES was published as a last step is permutation. In this step the 32-bit output from
U.S. Federal Information Processing Standard, FIPS-46 [7]. previous step is reordered according to a fixed permutation.
DES is a block cipher operating on 64-bit data blocks. The
encryption transformation depends on a 56-bit secret key and
consists of sixteen rounds surrounded by two permutation
layers. The decryption process is the same as encryption,
except the order of the round keys is reversed as compared to
the encryption process as shown in Figure 1.

Figure 2 – Key Schedule Algorithm

The subkeys (keys generated from the given input key)

required for the 16-rounds are calculated by the key
schedule algorithm. Figure 2 shows the key schedule
algorithm. The block PC1 of the key schedule algorithm
discards the 8 parity bits from the input 64-bit key and
Figure 1- DES Decryption Process divides the resultant 56-bits into two halves of 28-bit each

2012 12th International Conference on Hybrid Intelligent Systems (HIS) 279

Authorized licensed use limited to: NYSS'S Yeshwantrao Chavan College of Engineering. Downloaded on November 23,2022 at 16:41:35 UTC from IEEE Xplore. Restrictions apply.
 i.e., Ci and Di. These are cyclically rotated over one As seen from Figure 3, the incoming data is passed
position to the left after rounds 1, 2, 9, 16 and over two through the initial permutation. The output from IP block is
positions after all other rounds. The round keys are then then passed 16-times through the round along with the 16
constructed by repeatedly extracting 48-bits from Ci and Di sub-keys generated by the ‘subkey gen’ block. In order to
at 48 fixed positions determined by block PC2. Thus the loop the output back to the input multiplexer is used. The
keys generated are Key1 to Key16 for the 16-rounds. multiplexer switches the input’s of the data from the
For decryption process the subkeys have to be applied in previous round and the new input data.
reverse order. Hence SRL16 block is used to reverse the
order of subkeys.
III. ARCHITECTURAL CONSIDERATION FOR
IMPLEMENTATION
The design is implemented considering various
architecture options for speed area optimization. For
cryptanalysis the ciphertext is deciphered under each key
and the result is compared with the known plaintext. If they
are equal, then it is possible that the key tried is the correct
key. Thus for cryptanalysis first decryption has to be
performed with each key. The decryption takes 16-rounds to
decipher the ciphertext. DES algorithm contains an iterative
structure. Data is passed through the same set of steps called
‘round’ 16 times, each time with a different sub-key from
the key transformation. The first architecture is
implemented using iterative technique where only one round
is design and using a multiplexer, the same round is used 16
times with different sub-key for each round as shown in
Figure 3. This architecture is area efficient but with lesser
throughput.
Figure 4 - DES Decryption using Loop unrolled
architecture with pipelining

The second architecture that is implemented is the loop

unrolled architecture as shown in Figure 4. Unrolling an
iterative loop increases throughput. Here 16 instances are
created for 16-rounds. In this design better throughput can
be achieved at the cost of increased area utilization. The
throughput can be further improved by using pipelining. For
pipelining registers are inserted between each step. In a
pipelined design the new data can begin processing before
the prior data has finished processing. However, there exists
a degree of pipelining that maximizes the throughput per
unit area.
IV. CRYPTANALYSIS OF DES
This paper presents a FPGA based hardware design for
cryptanalysis of DES based on known-plaintext attack using
brute force technique. A known-plaintext attack requires the
adversary to have access to (part of) the plaintext
corresponding to the captured ciphertext blocks. In the
proposed design using brute force technique, the captured
ciphertext block is decrypted with all possible keys and the
resultant plaintext is compared with the know-plaintext. As
shown in Figure 5, the DES Decryption block decrypts the
Figure 3 - DES Decryption using Iterative architecture ciphertext and the resultant plaintext is compared with the
known-plaintext. The key for which the resultant plaintext

280 2012 12th International Conference on Hybrid Intelligent Systems (HIS)

Authorized licensed use limited to: NYSS'S Yeshwantrao Chavan College of Engineering. Downloaded on November 23,2022 at 16:41:35 UTC from IEEE Xplore. Restrictions apply.
 matches with the known plaintext is considered to be the We have implemented the design in Virtex-4 FPGA chip
correct key. (xc4vlx100-12ff1148) using Xilinx 13.1 development
platform. The design is implemented using both Iterative
and Loop unrolled architecture. After synthesis of the design
incorporating 4 key search engines in a single FPGA along
with the additional logic required for finding the correct key
the device utilization and throughput for both the
architectures are as shown below.
A. Using Iterative architecture
The usage of 1,662 slices, 892 slice flip-flops (FF) and
3,187 Look up Tables (LUTs) is reported by the tool. (3%
slices, 0% slice FF and 3% LUT utilization of the
xc4vlx100-12ff1148 device respectively). The throughput
achieved for the design is 0.817GBPS with maximum
frequency of 230.063MHz.
B. Using loop unrolled architecture
The usage of 9,019 slices, 7,614 slice flip-flops and
16,954 LUTs is reported by the tool. (18% slices, 7% slice
FF and 17% LUT utilization of the xc4vlx100-12ff1148
Figure 5 – Block Diagram for Cryptanalysis of DES device respectively). The throughput achieved for the design
is 0.874GBPS with maximum frequency of 245.874MHz.
Each DES Decryption block decrypts the ciphertext with From the above experimental results, the device
different key. Thus with ‘n’ nos. of DES Decryption blocks utilization for design using Iterative architecture is
‘n’ different keys can be searched in one clock cycle thereby considerably less as compared to design using Loop
reducing the time required for key search by a factor of ‘n’. unrolled architecture at the cost of reduced throughput.
The no. of DES Decryption blocks ‘n’ depends on the Considering the device utilization of the Iterative
available logic resources in an FPGA and the logic architecture, 128 key search instances can be fit in a single
utilization of one DES Decryption block. FPGA and considering the clock frequency as
V. ABOUT VIRTEX 4 230.063MHZ, the entire key space can be searched in
approximately 11.5 days theoretically. Similarly
Virtex 4 FPGA is selected as the target device for current considering the device utilization of the Loop unrolled
implementation. Xilinx Virtex series devices are lowest architecture, 16 key search instances can be fit in a single
power high performance reprogrammable FPGA’s with FPGA and considering the clock frequency as 245.874
Advanced Silicon Modular Block (ASMBL) architecture. MHZ, the entire key space can be searched in approximately
They are user programmable gate arrays with various 97 days theoretically. Thus the Iterative architecture is a
configurable elements and embedded cores optimized for better choice for faster key search process.
high-density and high performance system. They provide up
to 40% speed improvement over previous generation VII. SIMULATION RESULTS
devices. The General Routing Matrix (GRM) provides an
array of routing switches between each component. Each A. Using Iterative architecture
programmable element is tied to a switch matrix, allowing
multiple connections to the general routing matrix. The I/P- plaintext<=x"12cf4d587bf4eb08";
overall programmable interconnection is hierarchical and I/P- ciphertext<=x"b6060c26730925bc";
designed to support high-speed designs. O/P- Key<= x"00000000000001";

VI. IMPLEMENTATION OF DES CRYPTANALYSIS

The aim of the hardware is the probable key search to be
accomplished by partitioning the solution space on the
FPGA chip and instantiating multiple instances of the
design in parallel. As the solution space is independent and
inter-process communication is hardly required, the key
search time can be reduced by ‘n’ fold for ‘n’ instances of
the design in single a FPGA chip. Figure 6 - Simulation result for key= x"00000000000001"

2012 12th International Conference on Hybrid Intelligent Systems (HIS) 281

Authorized licensed use limited to: NYSS'S Yeshwantrao Chavan College of Engineering. Downloaded on November 23,2022 at 16:41:35 UTC from IEEE Xplore. Restrictions apply.
 I/P- plaintext<=x"12cf4d587bf4eb08"; Referring to Figures 8-9, using the loop unrolled
I/P- ciphertext<=x"637bece15b6e2b25"; architecture with the given plaintext-cipher text pair, the
O/P- Key<= x"40000000000010"; correct key x"00000000000001" and x"40000000000010" is
obtained at 4,300 ns and 7,300 ns respectively. As compare
to Iterative architecture the time required for searching the
desired key has effectively reduced.

CONCLUSION
This work presents the design for cryptanalysis of DES
algorithm based on Iterative and Loop unrolled architecture
using FPGA’s. Based on the experimental results for four
instances of key search in a single FPGA it is found that the
Figure 7 - Simulation result for key= x"40000000000010" Iterative architecture requires less area and can search the
entire solution space in less time as compared to the Loop
Referring to Figures 6-7, using the iterative architecture unrolled architecture. Expanding the design to fit maximum
with the given plaintext-cipher text pair, the correct key instances of the key search engine in a single FPGA and
x"00000000000001" and x"40000000000010" is obtained at implementing the design in FPGA is the future work of this
6,900 ns and 54,900 ns respectively. Using single instance paper.
of the key search engine would take months to search the
correct key x"40000000000010". By running four instances ACKNOWLEDGEMENT
in parallel the search time has considerably reduced. We would like to thank the entire team from
Mechatronics Test Equipments (I) Pvt Ltd, Pune for their
B. Using Loop unrolled architecture valuable guidance and support.

REFERENCES:
I/P- plaintext<=x"12cf4d587bf4eb08";
I/P- ciphertext<=x"b6060c26730925bc"; [1] Christophe De Canniere, Alex Biryukov and Bart Preneel, “An
O/P- Key<= x"00000000000001"; introduction to block cipher cyrptanalysis,” Proceedings of The IEEE,
Vol. 94, No. 2, pp. 346-356,February 2006.
[2] W. Diffe and M. Hellman, “Exhaustive cryptanalysis of the NBS
Data Encryption Standard,” COMPUTER, Vol. 10, No. 6, pp.74-84,
June 1977.
[3] M. J. Wiener, “Efficient DES Key Search,” Crypto ’93, Santa
Barbara, California, USA, August 1993. Reprinted in Practical
Cryptography for Data Internetworks, W. Stallings editor, IEEE
Computer Society Press, 1996, pp. 31-79.
[4] M. Blaze, W. Diffie, R. L. Rivest, B. Schneier, T. Shimomura, E.
Thompson, and M. Wiener, “Minimal Key Lengths for Symmetric
Figure 8 - Simulation result for key= x"00000000000001" Ciphers to Provide Adequate Commercial Security,” Technical
report, Security Protocols Workshop, Cambridge, UK, January 1996.
Available at http://www.counterpane.com/keylength.html.
I/P- plaintext<=x"12cf4d587bf4eb08";
[5] Electronic Frontier Foundation, Cracking DES: Secrets of Encryption
I/P- ciphertext<=x"637bece15b6e2b25"; Research, Wiretap Politics & Chip Design. O’Reilly & Associates
O/P- Key<= x"40000000000010"; Inc., July 1998.
[6] S. Kumar, C. Paar, J. Pelzl, G. Pfeiffer, and M. Schimmler, “Breaking
Ciphers with COPACOBANA - A Cost-Optimized Parallel Code
Breaker”. In L. Goubin and M. Matsui, editors, Proceedings of the
Workshop on Cryptograpic Hardware and Embedded Systems (CHES
2006), volume 4249 of LNCS, pages 101–118. Springer-Verlag,
2006. Available at
http://www.copacobana.org/paper/copacobana\_CHES2006.pdf.
[7] National Bureau of Standards, FIPS PUB 46, The Data Encryption
Standard, Federal Information Processing Standard, NIST, U.S. Dept.
of Commerce, Jan. 1977.
Figure 9 - Simulation result for key= x"40000000000010" [8] B.Schneier, Applied Cryptography, second ed. John Wiley and Sons,
1996.

282 2012 12th International Conference on Hybrid Intelligent Systems (HIS)

Authorized licensed use limited to: NYSS'S Yeshwantrao Chavan College of Engineering. Downloaded on November 23,2022 at 16:41:35 UTC from IEEE Xplore. Restrictions apply.