Block Cipher Design Principles

1. From Attacks Back to Design Rules

Topics 2–6 teach what breaks ciphers; this topic states the positive design rules that make differential, linear and brute-force attacks fail. Stallings lists: number of rounds, $F$ design (S-box nonlinearity), key schedule complexity — plus the Shannon confusion/diffusion foundation underneath.

2. Number of Rounds: Margin Above the Break

More rounds → characteristic probability / bias decays exponentially → data beyond reach:

Rounds (DES-like)	Differential data	Linear data	Status
8	$2^{21}$ — PC doable	$2^{21}$ — doable	Broken (lab exercise)
12	$2^{35}$ — heavy	$2^{33}$	Marginal
16 (DES)	$2^{47+}$ — infeasible	$2^{43}$ — 50-day experiment, 1 TB data	Resists in practice
16 + margin (AES 10–14 for its structure)	$\le 2^{-150}$ bound	$\le 2^{-150}$	Provable margin

Rule: choose rounds so best known attack needs MORE than brute force ( $2^k$ ), then add margin (extra rounds) for future analysis. DES 16 was exactly this; AES-128 uses 10 with a proof that 4 suffice differentially.

3. Design of F: S-Box Criteria (Memorize Five)

DES S-box rules (Coppersmith, declassified): (a) no output bit close to a linear function of inputs (linear resistance); (b) each row contains all 16 4-bit values exactly once (balanced); (c) Avalanche: 1 input bit changes $\ge 2$ outputs; (d) $S(X)$ vs $S(X \oplus 001100)$ differ in $\ge 2$ bits (differential hardening); (e) $S(X)
e S(X \oplus 11ef00) $for any nonzero mask (no complement weakness). AES S-box:$ GF(2^8) $inversion ($ x \to x^{-1} $, highly nonlinear: max differential$ 2^{-6} $-ish, max bias$ 2^{-4}$) + affine transform (kills algebraic simplicity) — no secret criteria, public rationale.

4. Key Schedule Principles

Large key: $k \ge 128$ today ( $2^{127}$ average brute force); 56 dead, 112 (3DES) legacy, 128/192/256 current.
No weak structure: no weak/semi-weak keys (DES's 4+6), no related-key patterns (AES-192/256 related-key analyses warn against over-simple schedules), no complement property.
Avalanche in schedule: 1 key bit flips many subkey bits (else related-key differentials); subkeys pseudorandom and independent-looking.
One-way derivation: master → subkeys easy, subkey → master hard (limits damage from round-key leakage); round constants break symmetry/slide attacks.

Exam Points

Rounds table (8 broken → 16 resists → AES margin) — 5-mark theory core.
Five S-box criteria list (linear-distance, Avalanche, differential rows) — 2–3 mark recall.
AES inversion + affine rationale vs DES secret criteria — favourite contrast.
Key-schedule checklist (size, no weak keys, Avalanche, one-way).

Block Cipher Design Principles