Symmetric Key Cryptography · Computer Networking Interactive

Symmetric key cryptography is two thousand years of substituting one thing for another. The climb runs from a cipher a child could break to the one that protects your bank.

Words you will meet

Plaintext — the original readable message.
Ciphertext — the scrambled version, written K(m).
Symmetric key — both sides hold the same secret key.
Block cipher — encrypts fixed-size chunks rather than one letter at a time.
Cipher block chaining — mixing each block with the one before it.
Initialization vector — the one random block CBC sends in the clear to start the chain.

Why this matters

Every classical cipher in this section is broken, and the book still spends four pages on them. The reason is that each one is broken by a specific attack, and the fix for that attack is what the next cipher does.

Read it as a ladder rather than a history. By the end, the last rung is what actually secures your web browsing, your e-mail and every virtual private network in the chapter that follows.

The final step, chaining, is the only one that is not about the cipher at all. It is about how you use a cipher — and it is where a strong cipher used the obvious way leaks anyway.

The setting, and one piece of notation

Alice has a message. She runs it through an encryption algorithm with a key K_A and gets ciphertext. Bob runs the ciphertext through a decryption algorithm with his key K_B and gets the message back.

The notation for this is short and used everywhere from here on: K_A(m) means the message m encrypted with the key K_A. Bob recovers the message by computing K_B(K_A(m)) = m.

In a symmetric key system, Alice’s and Bob’s keys are identical, and secret. That is this page. In a public key system they are not, and that is the next.

In plain words

The algorithm is not the secret. In almost every modern system it is published, standardised, and available to everyone — including Trudy.

The key is the secret. That is a deliberate choice, and a strange-looking one until you notice the alternative. A secret algorithm is a secret that thousands of people must keep, forever, and that cannot be replaced when it leaks. A key can be changed on Tuesday.

Rung one: substitute one letter for another

The Caesar cipher replaces each letter with the one k places later in the alphabet, wrapping z round to a. With k = 3, “bob, i love you. alice” becomes “ere, l oryh brx. dolfh”.

It looks like nonsense, and it is broken in seconds, because there are only 25 possible keys and you can try all of them.

The monoalphabetic cipher fixes that. Any letter may stand for any other, as long as the pairing is one-to-one, so there are 26! — roughly 4 × 10²⁶ — possible keys. A brute-force search is now hopeless.

The three schemes, on your own input

PlaintextCaesar key k = 3 — every letter moves 3 places later, wrapping z to a

Caesar, key 3: ere, l oryh brx. dolfh
Monoalphabetic (Figure 8.3) — any letter may stand for any other: nkn, s gktc wky. mgsbc

Caesar has 25 possible keys. The monoalphabetic cipher has 26! ≈ 4 × 10²⁶, and is still broken by counting how often each letter appears — e and t alone account for about 22 per cent of English text.

Switch to the middle tab and leave the plaintext at 010010010. Three identical blocks in, three identical blocks out — that repeat is the whole reason the third tab exists. Then switch to chaining and watch it disappear.

And yet it falls too, without any brute force at all. English letters are not equally common. e and t alone account for about 22 per cent of the text, and groups such as “in”, “it”, “the”, “ion” and “ing” appear constantly. Count the letters in the ciphertext, match the counts to English, and the key falls out.

The polyalphabetic cipher was invented five hundred years ago. It uses several Caesar ciphers in a repeating pattern. Say two of them, with k = 5 and k = 19, applied in the order C₁, C₂, C₂, C₁, C₂. Now the same plaintext letter encrypts differently depending on where it sits, which blunts the frequency count. The key is the two shifts plus the pattern.

What “broken” depends on

Whether a cipher survives is not a property of the cipher alone. It depends on what Trudy is assumed to know, and the book names three levels.

Three attack models — what Trudy is assumed to know

	Ciphertext-onlyshe has the encrypted text	Known-plaintextshe also knows some pairs	Chosen-plaintextshe picks what gets encrypted
What Trudy holds
How she might obtain it
Does a monoalphabetic cipher survive?
Does a modern block cipher survive?

Cells marked ⓘ have a reason behind them — click to read it.

The scheme has not changed between these columns. Only Trudy's knowledge has, and that alone decides whether a cipher survives. Click any cell.

The bottom-right cell is the one to keep. A modern cipher is expected to survive an attacker who can choose the plaintext and see what comes out. Every classical cipher on this page collapses under that assumption in a single message.

Rung two: stop thinking in letters

A block cipher processes the message in blocks of k bits, and maps each k-bit block to a k-bit block using a one-to-one mapping. Press “Show Table 8.1” in the widget above to see the book’s example with k = 3.

Eight inputs can be permuted in 8! = 40,320 ways, so there are 40,320 possible mappings, and the mapping is the key. That is small enough to break on a desktop computer, which is why real block ciphers use k = 64 or more: a general k-bit block cipher has 2ᵏ! possible mappings, a number that is astronomical even at k = 64.

But now there is a practical problem, and it is fatal. Alice and Bob cannot store that table. For k = 64 it has 2⁶⁴ entries, and changing keys would mean regenerating the whole thing. A full-table block cipher is, in the book’s words, simply out of the question.

Figure 8.5 — how a real block cipher fakes a 2⁶⁴-entry table

The problem: the table cannot existstep 1 of 4

A full 64-bit table would need 2⁶⁴ entries, and Alice and Bob would have to regenerate the whole thing every time they changed keys. It is simply out of the question.

Eight small tables, then a scramble, then round it again. Step through and watch how far one input bit spreads.

Read all steps as text

The problem: the table cannot exist — A full 64-bit table would need 2⁶⁴ entries, and Alice and Bob would have to regenerate the whole thing every time they changed keys. It is simply out of the question.
Break the block into eight chunks — The 64-bit block is split into 8 chunks of 8 bits. An 8-bit to 8-bit table has only 256 entries, which is a perfectly manageable size.
Scramble the 64 bits, then loop — The eight outputs are reassembled and their bit positions permuted. That output is fed back to the input, and another round begins.
Why more than one round — With a single round, one input bit could affect only 8 of the 64 output bits — it never leaves its own chunk. The rounds exist so that each input bit affects most, if not all, of the final output bits.

The answer is to use a function that behaves like a randomly permuted table without ever storing one. Break the 64-bit block into eight 8-bit chunks, push each through its own small table, reassemble, scramble the bit positions, and feed the result back in for another round.

The rounds are the point. After one round an input bit has only reached the 8 output bits of its own chunk. After n rounds it reaches nearly all 64.

The block ciphers in use today

	Block size	Key length	Note

Cells marked ⓘ have an explanation — click to read it. Sortable columns have a ↕ in the heading.

All three use functions rather than stored tables. The key selects the mini-table mappings and permutations inside.

Rung three: a strong cipher, used the obvious way, still leaks

Here is the failure that matters most on this page, because it has nothing to do with the strength of the cipher.

Take a long message, chop it into k-bit blocks, and encrypt each block independently. Some of those blocks will be identical — the book’s example is two blocks that both contain HTTP/1.1. Identical plaintext blocks produce identical ciphertext blocks, every time, because the mapping is a function.

Trudy cannot read those blocks. But she can see that they are the same. Given some knowledge of the protocol structure underneath, that may be enough to guess the cleartext, and possibly to unpick the entire message.

Worked: the leak, in nine bits

Take the plaintext 010 010 010 — three identical blocks — and Table 8.1.

Each block maps to 101, so the ciphertext is 101 101 101. Trudy sniffs it and can immediately conclude, correctly, that all three plaintext blocks were the same. She has learned something real without breaking anything.

Set the middle tab of the widget above to this input and the three repeats are marked in red.

The obvious fix, and what it costs

Mix in randomness. For block i, the sender picks a fresh random k-bit number r(i) and sends c(i) = K_S(m(i) ⊕ r(i)) together with r(i) itself.

The receiver knows both c(i) and r(i), so it recovers m(i). Trudy also sees r(i) — it travels in the clear — but without the key K_S that does her no good. And identical plaintext blocks now give different ciphertext, because the random numbers differ.

With r(1) = 001, r(2) = 111, r(3) = 100, that same plaintext encrypts to 100, 010, 000. Three different blocks.

The cost is exact and severe: for every bit of ciphertext, a bit of randomness must also be sent. The bandwidth doubles.

Cipher block chaining

Cipher Block Chaining gets the same result for one extra block in total, however long the message. The idea is to send one random value at the start and then use the previous ciphertext block in place of each subsequent random number.

The sender generates a random k-bit Initialization Vector, called c(0), and sends it in the clear.
The first block is c(1) = K_S(m(1) ⊕ c(0)).
Every block after it is c(i) = K_S(m(i) ⊕ c(i−1)).

Worked: the same nine bits, chained

Plaintext 010 010 010, Table 8.1, and IV c(0) = 001.

c(1) = K_S(010 ⊕ 001) = K_S(011) = 100
c(2) = K_S(010 ⊕ 100) = K_S(110) = 000
c(3) = K_S(010 ⊕ 000) = K_S(010) = 101

Ciphertext 100 000 101. Three identical plaintext blocks, three different ciphertext blocks, and only one extra block sent for the whole message.

Bob undoes it because he knows c(i−1): he decrypts c(i) to get m(i) ⊕ c(i−1), then exclusive-ors with c(i−1) to recover m(i).

Sending the IV in the clear is safe for the same reason sending r(i) was safe. Trudy learns c(0), but she does not know the secret key, so she still cannot invert the mapping.

And this has a consequence for protocol design

Because the receiver must have the IV before it can decrypt anything, every secure protocol in this chapter has to include a way to distribute it.

Watch for that when TLS (Transport Layer Security) and IPsec (IP Security) arrive. It is a requirement that comes from a choice made here, several layers away, about how to use a cipher.

The mental model

Substitution is the whole idea, at every rung. What changes is what gets substituted and how much an attacker must be assumed to know.

Letters, substituted one at a time by a fixed rule, fall to counting. Bits, substituted a block at a time by a key-selected function, do not — but a function applied blindly repeats itself, and repetition is information.

Chaining is the answer, and it is the first idea on this page that is not about the cipher at all. It is about using it so that the same input never produces the same output twice.

Check yourself

0 of 7 answered

1.The monoalphabetic cipher has about 4 × 10²⁶ possible keys, far too many to try. Why is it still easy to break?
2.Which attack model does a modern block cipher have to survive, that every classical cipher on this page fails?
3.predictUsing Table 8.1, you encrypt the plaintext 010010010 with each block on its own. What does Trudy learn from the ciphertext, without breaking anything?
4.Sending a fresh random block r(i) alongside every ciphertext block solves the repeat problem. What does it cost?
5.Why is it safe to send the Initialization Vector in the clear?
6.Why does a real block cipher run several rounds rather than one?
7.What consequence does CBC have for the design of every secure protocol later in this chapter?

What to remember

The algorithm is public; only the key is secret. That is deliberate — a secret algorithm is a secret thousands must keep forever and cannot replace when it leaks, while a key can simply be changed.
A strong cipher used the obvious way still leaks. Encrypting each block on its own means identical plaintext blocks give identical ciphertext blocks, and Trudy learns that they matched without decrypting anything.
Chaining fixes it for one extra block, not for double the bandwidth. Each block is exclusive-ored with the previous ciphertext, so only the Initialization Vector is overhead — and every protocol later in this chapter must therefore carry a way to distribute it.