# Where is the proof of security of Diffie's cipher?

There is an apparently provably secure cipher that was proposed by Diffie, but enhanced by R.A. Rueppel. The scheme, which was mentioned in Applied Cryptography, works like this:

1. Measure the length of the plain-text, $n$.
2. Multiply it by $128$.
3. Generate this much ($128·n$ bytes of) real random data and split it out into 128 byte-arrays of length each equal to the plain-text. This can be thought as a two dimensional array:
1. One of the indices gives the sequence number ($0\dots 127$).
2. One of the indices gives the position in the sequence, $0 \dots n-1$.
4. Use a 128-bit key to choose which of these streams to XOR together. Each bit of the key corresponds to "yes/no" on whether to use particular sequence. All the selected sequences are XORed together to make a single keystream, $K$.
5. Compute $P \oplus K$ to give the cipher-text $C$.
6. Serialize the two dimensional array and append it to the cipher text.
7. Send the whole package to Bob, who can then decrypt by de-serializing the matrix and selecting the same rows.

Apparently, this scheme is completely secure. The attacker has to examine every possible combination of sequences ($2^{127}$ on average) in order to break the encryption scheme.

What is the proof of this? I can't find the paper that discusses this anywhere.

-

## 2 Answers

This looks totally weak. If you know 128 bits of known plaintext, you can infer the corresponding 128 bits of keystream. The keystream being the multiplication of the random matrix by the key (in the vector space $\mathbb{F}_2^{128}$), the key is then revealed through a basic matrix inversion.

-

Interesting, this may be completely wrong then.   The algorithm is mentioned in Applied Cryptography.   The original Diffie algorithm used 2^k strings, and the key just selected what string to use.   The modification was to use a linear combination of just k strings - but the paper discussing the modification was unreferenced in the text. It said that the paper used a linear combination of the k strings and it was equally secure.  I used XOR as the linear combination in my example. Perhaps this  is the source of my mistake. – Simon Johnson Nov 28 '11 at 17:36
Can something be perfectly secure and still vulnerable to a known-plaintext key recovery? – Ethan Heilman Nov 28 '11 at 20:03

I have done quite a bit of Google searching and apparently the description of the algorithm along with its proof of security is detailed in Contemporary cryptology: the science of information integrity.

At this stage I have no idea whether the algorithm matches what is listed above. Probably not as the construction is insecure. I'll keep digging and fix this comment when I have some more information.

-
{"extraction_info": {"found_math": true, "script_math_tex": 0, "script_math_asciimath": 0, "math_annotations": 0, "math_alttext": 0, "mathml": 0, "mathjax_tag": 0, "mathjax_inline_tex": 10, "mathjax_display_tex": 0, "mathjax_asciimath": 0, "img_math": 0, "codecogs_latex": 0, "wp_latex": 0, "mimetex.cgi": 0, "/images/math/codecogs": 0, "mathtex.cgi": 0}, "config": {"markdown_headings": true, "markdown_code": true, "boilerplate_config": {"ratio_threshold": 0.18, "absolute_threshold": 20, "end_threshold": 15, "enable": true}, "remove_buttons": true, "remove_image_figures": true, "remove_link_clusters": true, "table_config": {"min_rows": 2, "min_cols": 3, "format": "github"}, "remove_chinese": true, "remove_edit_buttons": true, "extract_latex": true}, "english_confidence": 0.9274699687957764, "perplexity_flag": "middle"}