3

What is the more desirable for a block cipher's sub-keys ?

Given two blocks ciphers, letting all other properties be equal (they have the same strength), the only difference between them is that:

  • one generates a unique set of sub-keys for each key,
  • while the other generates a set of of pseudo random subkeys.

In other words for each different possible key, the fist cipher always generates a unique subkey set that only that key can, while the second has the possibility (however small) that it could generate a subkey set that another key might also generate.

Focus on this property itself: assume everything else about the cipher and key derivation process are of sufficiently high quality.

Biv
  • 9,979
  • 2
  • 39
  • 67
Mandalf The Beige
  • 31
  • 1
  • Think of what happens when two keys happen to generate the same set of subkeys, as possible in the second cipher, and that's identified by an adversary. In particular, consider that cipher used in the Davies-Meyer construction to build a one-way function. Or perhaps, assume that for every key, there is another that generates the same set of subkeys, and think of how an attacker can use that in a known-plaintext attack. – fgrieu Oct 23 '16 at 15:24

1 Answers1

1

What you call Block Sub-Keys, is called key schedule.

The first thing you need to know, is that this sub-key generation needs to be deterministic (else how would you be able to decrypt the cipher text).

Thus you are considering two cases:

  1. a simple key schedule to generate the sub-keys.
  2. a Pseudo Random Generator (or more usually a Hash function) to generate the sub-keys.

In the first case you have: $$F(K) = K_1,\\ F(K_1) = K_2,\\ F(K_2) = K_3,\\ ...$$

In the second case you have: $$H(K) = K1 || K_2 || K_3 || ... $$ where $H$ is a eXtendable-Output Functions (XOF) such as SHAKE and $||$ is the string concatenation.

In the first case you have a sort of key dependence (from $K_1$ you can deduce $K_2$, but luckily not the other way around) while on the second case each sub keys are independent (you can't deduce $K_2$ from $K_1$).

From this point of view, surely the second approach looks the safest however, one must also consider speed and memory consumption. Generating a long stream of bits in order to have the sub-keys takes time. If you were to compare the time spend on encrypting the data provided a set of sub-key and the time to generate the set of sub-keys, with this solution the slowest one would probably be the sub-key generation. And this is not something desirable if you want to have a usable cipher. Also the second methods requires to generate all the sub-keys at the initialization of the algorithm. This requires some memory...

To sum up, I'll point you to this two answers:

Biv
  • 9,979
  • 2
  • 39
  • 67