Symmetric encryption algorithm and pattern of block cipher

This is a creation in Article, where the information may have evolved or changed.

• Symmetric encryption algorithms, that is, encryption and decryption using the same cryptographic key encryption and decryption algorithm.
• Block cipher is a class of encryption and decryption algorithms that can handle only a block of data of a specific length at a time.
• At present, the symmetric encryption Algorithm DES, 3DES, AES belong to the block cipher.

Des

• DES, the Universal Data Encryption Standard, is the last generation of symmetric cryptographic algorithms, and is now deprecated.
• key: Des is a symmetric cipher algorithm that encrypts 64bit plaintext into 64bit ciphertext, whose key length is 64bit (a bit is set for error checking every 7bit, so the actual key length 56bit is used).
• group : des is encrypted in plaintext as a unit of 64bit, and this 64bit unit is called grouping . Generally speaking, the cipher algorithm that is processed in group is called Block cipher (block cipher), des is one of the block cipher. Des encrypts only 64 bits of data at a time, and if the plaintext to be encrypted is longer, the DES encryption needs to be iterated.

DES encryption
Des decryption

3DES

• 3DES, that is Triple-des, is simply 3 times the combination of DES plus decryption . it is deprecated now.
• encryption : Cipthertext = e (K3, D (K2, E (K1, plaintext)))
• decryption : plaintext = d (K1, E (K2, D (K3, ciphertext)))
• features : If the three keys are the same, take just the same as DES.

Note: E indicates that encrypt,d represents decrypt.

3DES encryption
3DES decryption

Aes

• AES, advanced encryption standards, is the current symmetric encryption standard. currently (2017) if symmetric encryption is used, AES should be used. Of course, it can only be said that the current AES algorithm is secure, there is no guarantee that AES is always safe.
• group : 128bit.
• key: 128bit, 192bit, 256bit.

Mode of the block cipher

Introduction to Grouping passwords

• Block cipher, a class of cryptographic algorithms that can handle a piece of data at a specific length at a time, where a "piece" is called a block. The number of bits in a grouping is called the grouping length (block lengths).
• Stream cipher is a class of cryptographic algorithms that continuously process data streams.
• Most symmetric cipher algorithms, such as DES, 3DES, and AES, are grouped passwords.

ECB mode

• Full name electronic CodeBook mode, electronic password model.
• Grouping: The result of encrypting the plaintext group is called ciphertext grouping directly.
• Advantages:
  • A grouping corruption does not affect other groupings.
  • Can be decrypted in parallel.
• Disadvantages:
  • The same plaintext groupings are converted to the same ciphertext groupings.
  • It is possible to manipulate the plaintext without deciphering the password (each packet is independent and contextual irrelevant, adding or removing a grouping directly does not affect the correctness of other packet decryption processes).

ECB encryption
ECB decryption

CBC mode

• Full name cipher block Chaining mode, password grouping link modes.
• GROUP BY: The plaintext group is grouped with the previous cipher to perform an XOR operation before encrypting. The addition and decryption of each grouping depends on the previous grouping. The first grouping does not have the previous one, so an initialization vector (initialization vector) is required.
• Advantages:
  • The result of encryption is related to the previous article, which is helpful to improve the randomness of encryption result.
  • Can be decrypted in parallel.
• Disadvantages
  • cannot be encrypted in parallel.
  • A packet is corrupted, and if the cipher length is not changed, then two groups are affected.
  • A packet is corrupted, and if the cipher length is changed, all subsequent groupings are affected.

CBC Encryption
CBC Decryption

CFB Mode

• Full Name cipher FeedBack mode, ciphertext feedback model.
• Grouping method: The previous ciphertext packet is sent back to the input of the cryptographic algorithm (see details).
• In CBC and EBC mode, the plaintext groupings are encrypted through a cryptographic algorithm. In the CFB mode, the plaintext packet is not encrypted directly by the encryption algorithm, there is only one XOR between the plaintext group and the cipher group.
• The CFB mode is generated by using the XOR run of the "plaintext packet" and "output of the cipher algorithm" to generate the "ciphertext grouping". The bit sequence generated by the cryptographic algorithm in the CFB mode is called the key stream. The cipher algorithm is equivalent to the pseudo-random number generator of the key stream, and the initialization vector is equivalent to the seed of the pseudo-random number generator. (The CFB model is a bit like a one-time cipher .) ）
• Advantages:
  • Supports parallel decryption.
  • No padding (padding) is required.
• Disadvantages:
  • Cannot withstand replay attacks (replay attack).
  • Parallel encryption is not supported.

CFB Encryption
CFB Decryption

OFB mode

• Output FeedBack mode outputs feedback modes
• The output of the cryptographic algorithm is fed back into the input of the cipher algorithm (see details).
• In OFB mode, the bit sequence (key stream) required by XOR can be generated in advance by a cryptographic algorithm, regardless of the plaintext packet. You only need to prepare the required key stream in advance, and then perform the XOR operation.

OFB encryption
OFB decryption

Grouping Pattern Summary

It is recommended to use CBC mode.

Fill

• Why fill?
  The ECB and CBC modes require that the plaintext data be populated to an integer multiple of the length of the packet.

• Two problems with padding.

  • How many bytes are populated?
  • What does it fill?

• How many bytes are populated?
  The number of bytes that need to be populated is:paddingSize = blockSize - textLength % blockSize

• What does it fill? (The three ways listed here are essentially the same)

  • ANSI x.923: Fill the last byte of the sequence paddingSize , fill in the other 0.
  • ISO 10126: Fill the last byte of the sequence paddingSize and fill in the other random numbers.
  • PKCS7: Fills each byte of the fill sequence paddingSize .

Example

Write an example of AES encryption here with Golang.

Since the encrypted data is likely to have many invisible characters, the encrypted results will be base64encode once.

This uses the CBC mode +PKCS7 fill mode.

Package Mainimport ("bytes" "Crypto/cipher" "Crypto/aes" "Encoding/base64" "FMT") func pkcs7padding (Ciphert ext []byte, blockSize int] []byte {padding: = Blocksize-len (ciphertext)% blockSize padtext: = bytes. Repeat ([]byte{byte (padding)}, padding) return append (ciphertext, padtext ...)}  Func pkcs7unpadding (Origdata []byte) []byte {length: = Len (origdata) unpadding: = Int (origdata[length-1]) return Origdata[:(length-unpadding)]}func aesencrypt (Origdata, Key []byte) ([]byte, error) {block, err: = AES. Newcipher (key) if err! = Nil {return nil, err} blockSize: = block. BlockSize () Origdata = pkcs7padding (Origdata, BlockSize) Blockmode: = cipher. Newcbcencrypter (block, key[:blocksize]) crypted: = Make ([]byte, Len (origdata)) blockmode.cryptblocks (crypted, Origda TA) return crypted, Nil}func aesdecrypt (crypted, Key []byte] ([]byte, error) {block, err: = AES.   Newcipher (key) if err! = Nil {return nil, err} BlockSize: = block. BlockSize () Blockmode: = cipher. Newcbcdecrypter (block, key[:blocksize]) Origdata: = Make ([]byte, Len (crypted)) Blockmode.cryptblocks (Origdata, crypt ed) origdata = pkcs7unpadding (origdata) return Origdata, Nil}func main () {key: = []byte ("0123456789abcdef") r Esult, err: = Aesencrypt ([]byte ("Hello World"), key) if err! = Nil {panic (err)} FMT. Println (base64.    Stdencoding.encodetostring (Result)) Origdata, err: = Aesdecrypt (result, key) if err! = Nil {panic (err)} Fmt. Println (String (origdata))}

Reference documents

• "Graphic Cryptography"
• Wikipedia