3

What is the more desirable for a block cipher's sub-keys ?

Given two blocks ciphers, letting all other properties be equal (they have the same strength), the only difference between them is that:

  • one generates a unique set of sub-keys for each key,
  • while the other generates a set of of pseudo random subkeys.

In other words for each different possible key, the fist cipher always generates a unique subkey set that only that key can, while the second has the possibility (however small) that it could generate a subkey set that another key might also generate.

Focus on this property itself: assume everything else about the cipher and key derivation process are of sufficiently high quality.

Biv
  • 10,088
  • 2
  • 42
  • 68
Mandalf The Beige
  • 31
  • 1

1 Answers1

1

What you call Block Sub-Keys, is called key schedule.

The first thing you need to know, is that this sub-key generation needs to be deterministic (else how would you be able to decrypt the cipher text).

Thus you are considering two cases:

  1. a simple key schedule to generate the sub-keys.
  2. a Pseudo Random Generator (or more usually a Hash function) to generate the sub-keys.

In the first case you have: $$F(K) = K_1,\\ F(K_1) = K_2,\\ F(K_2) = K_3,\\ ...$$

In the second case you have: $$H(K) = K1 || K_2 || K_3 || ... $$ where $H$ is a eXtendable-Output Functions (XOF) such as SHAKE and $||$ is the string concatenation.

In the first case you have a sort of key dependence (from $K_1$ you can deduce $K_2$, but luckily not the other way around) while on the second case each sub keys are independent (you can't deduce $K_2$ from $K_1$).

From this point of view, surely the second approach looks the safest however, one must also consider speed and memory consumption. Generating a long stream of bits in order to have the sub-keys takes time. If you were to compare the time spend on encrypting the data provided a set of sub-key and the time to generate the set of sub-keys, with this solution the slowest one would probably be the sub-key generation. And this is not something desirable if you want to have a usable cipher. Also the second methods requires to generate all the sub-keys at the initialization of the algorithm. This requires some memory...

To sum up, I'll point you to this two answers:

Biv
  • 10,088
  • 2
  • 42
  • 68