Symmetric Cipher Model

1. The Five Ingredients

Stallings reduces all symmetric (secret-key) encryption to five elements:

         K (secret key, shared)
        /                      \
Plaintext P ──[Encrypt E_K]──> Ciphertext C ──[Decrypt D_K]──> P
                                     |
                              Opponent (knows E, D, C)

Ingredient	Role	Examples
Plaintext $P$	Original message	"HELLO", file bytes
Encryption algorithm $E$	Transform $C = E(K, P)$	AES, DES, Caesar
Secret key $K$	Shared secret, the ONLY secret	128-bit AES key
Ciphertext $C$	Scrambled output on the channel	"KHOOR"
Decryption algorithm $D$	Inverse, $P = D(K, C)$	AES-decrypt

Requirements: (a) $D(K, E(K, P)) = P$ for all $P$ ; (b) opponent knowing $E, D, C$ but not $K$ cannot recover $P$ .

2. Kerckhoffs's Principle

"Security must depend only on the secrecy of the key, never on the secrecy of the algorithm." (Kerckhoffs 1883; Shannon's maxim "the enemy knows the system"). Reasons:

Algorithms ship in software/devices — reverse-engineerable; keys are short and replaceable.
Public algorithms get thousands of cryptanalysts testing them (AES competition); secret ones hide flaws (GSM A5/1, MIFARE broke once exposed).
Key compromise affects one session; algorithm compromise affects everyone forever.

Exam trap: "keeping the algorithm secret adds security" — FALSE as a design basis (obscurity may slow amateurs but never counts as security).

3. Cryptanalysis vs Brute Force

Two attack families on this model:

Attack	What attacker does	Example cost
Cryptanalysis	Exploit algorithm structure (statistics, differentials)	Break Caesar with frequency analysis in seconds
Brute force	Try every key: cost $\approx 2^{k-1}$ average for $k$ -bit key	DES $2^{55}$ (broken 1998, EFF machine); AES-128 $2^{127}$ (infeasible)

Cryptanalytic attack types (known hierarchy): ciphertext-only (hardest — only $C$ ) < known-plaintext ( $P, C$ pairs) < chosen-plaintext (attacker picks $P$ , gets $C$ — e.g. lunch-break access to encryptor) < chosen-ciphertext (picks $C$ , gets $P$ — CCA, breaks naive RSA). A cipher is "broken" if ANY attack beats brute force, even theoretically ( $2^{120}$ on AES-128 would count).

Worked brute-force estimate: $10^9$ keys/sec: DES $2^{55} \approx 3.6 \times 10^{16}$ → $\approx 417$ days single machine (parallel rigs did it in 56 hours, 1998); AES-128 $2^{127} \approx 1.7 \times 10^{38}$ → $\approx 5 \times 10^{21}$ years.

4. Unconditional vs Computational Security

Unconditional (information-theoretic): ciphertext gives ZERO information about $P$ , even with infinite compute — only the One-Time Pad (key $\ge$ message, never reused). Shannon proved it; impractical for bulk data (key distribution = message size).
Computational: breaking costs more than any feasible adversary (time/memory) — AES, DES (in its day). All practical ciphers live here; security = "no attack cheaper than brute force is known".

Exam Points

Draw 5-ingredient diagram + state $D(K,E(K,P)) = P$ — 2-mark opener.
Kerckhoffs statement + three justifications + "obscurity ≠ security" — 5-mark theory core.
Brute-force $2^{k-1}$ + DES vs AES numbers — favourite numerical.
Attack hierarchy (CO < KP < CP < CC) + unconditional (OTP) vs computational.

Symmetric Cipher Model