full-disclosure - [FD] GOST 28147-89 gets 512 bit and 1 kbit keys

Open Source and information security mailing list archives

Message-ID: <20140331203549.GA30901@gremlin.ru>
Date: Tue, 1 Apr 2014 00:35:49 +0400
From: gremlin@...mlin.ru
To: undisclosed-recipients: ;
Subject: [FD] GOST 28147-89 gets 512 bit and 1 kbit keys

Hello list!

The GOST 28147-89 block cipher celebrates its' 25-years jubilee this
year. First published in 1989, it's one of the oldest (if not the most)
of all symmetric block ciphers which are currently in use.

Original publishing describes possible key sizes of 32, 64, 128 and 256
bits. However, the internal representation of key data consists of 32
subkeys of 32 bits each - for example, when the 256 bits key is split
into 8 subkeys k0...k7 of 32 bits each, the internal keys are:

int: 00 01 02 03 04 05 06 07  08 09 10 11 12 13 14 15
sub: k0 k1 k2 k3 k4 k5 k6 k7  k0 k1 k2 k3 k4 k5 k6 k7

int: 16 17 18 19 20 21 22 23  24 25 26 27 28 29 30 31
sub: k0 k1 k2 k3 k4 k5 k6 k7  k7 k6 k5 k4 k3 k2 k1 k0

(see http://en.wikipedia.org/wiki/GOST_28147-89)

But now, the 512 bits and 1 kbit keys come to scene... For 512 bits key
split into 16 subkeys k0...kF, the internal keys are:

int: 00 01 02 03 04 05 06 07  08 09 10 11 12 13 14 15
sub: k0 k1 k2 k3 k4 k5 k6 k7  k8 k9 kA kB kC kD kE kF

int: 16 17 18 19 20 21 22 23  24 25 26 27 28 29 30 31
sub: k7 k6 k5 k4 k3 k2 k1 k0  kF kE kD kC kB kA k9 k8

and for 1 kbit key the internal keys are, obviously, just k00...k1F.

Also, the number of rounds for 512 bits and 1 kbit keys encryption
will be increased up to 48 and 64 respectively.

This makes GOST 28147-89 the second (after Threefish) block cipher
capable of using 512 bit and 1 kbit keys. Together with its' resistance
against superpipelined bruteforcing (rumoured to be effectively used
somewhere in South-Eastern Asia to break Rijndael), that means the "old
horse" is still running.

The updated standard will get the new GOST registry number from the
GOST-R 34.xxx series and is expected to be published till the end of
2014.

So... Let's wait for its' appearance in OpenSSL :-)

-- 
Alexey V. Vissarionov aka Gremlin from Kremlin <gremlin ПРИ gremlin ТЧК ru>
GPG: 8832FE9FA791F7968AC96E4E909DAC45EF3B1FA8 @ hkp://keys.gnupg.net

Content of type "application/pgp-signature" skipped

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives