Copyright 1975, by the author(s). All rights reserved.

Transcription

1 Cpyright 1975, by the authr(s). All rights reserved. Permissin t make digital r hard cpies f all r part f this wrk fr persnal r classrm use is granted withut fee prvided that cpies are nt made r distributed fr prfit r cmmercial advantage and that cpies bear this ntice and the full citatin n the first page. T cpy therwise, t republish, t pst n servers r t redistribute t lists, requires prir specific permissin.

2 \) COSTS OF DATA ENCIPHERMENT ON COMPUTERS OF VARYING POWER by James Jatczynski Memrandum N. ERL-M493 January 1975 ELECTRONICS RESEARCH LABORATORY Cllege f Engineering University f Califrnia, Berkeley 94720

3 Abstract Encipherment appears t be an attractive means f prtecting sensitive data in cmputer systems, but the csts f encipherment are nt yet well knwn, A series f timing experiments was cnducted which measured perfrmance f enciphering tasks given each f tw applicatin mdels, fur additive encryptin methds, and three different cmputers. The applicatins simulated were file encryptin and cmmunicatin traffic encryptini the encryptin schemes were a baseline null transfrmatin and a shrt key, lng key, and pseud-randm key methds the cmputers used were the CDC 6^00, PDP-ll/45, and PDP-l/50. Encipherment rates attained by the assembly language prgrams Stnsf?/ftni 22»700 by/s f,r rardm key cmmunicatin encipherment n the PDP-11/^5 t 1,380,370 by/s fr null file encipherment n the CDC 6*f00. Estimated mnetary csts ranged frm,6720 t t encipher 1000 card images and frm t 3^.910 t supprt a 300 baud terminal fr ne hur* V

4 Csts f Data Encipherment+ 1 Summary The purpses f this study are t 1) explicitly define tw distinct date prcessing applicatins in which encipherment is likely t be used, 2) determine attainable enciphering rates in each applicatin using varius additive encipherment methds. 3) determine the relative perfrmance f varius cmputers in executin f enciphering tasks, and *) btain an estimate f the mnetary cst f encipherment. First, mdels f the tw applicatins are' defined. Then encipherment rates are determined by actually running enciphering prgram segments n the cmputers under cnsideratin and are verified by using instructin timing data frm manufacturers* manuals. Cst estimates are based n cmputer center accunting rates. Measured enciphering rates ranged frm 22,700 by/s1 t 1, by/s (a factr f 60) depending n the applicatin mdel, enciphering methd, and cmputer cnsidered. Fr asingle mdel and cmputer, rates between the simplest and mst cmplex enciphering methds differed by up t afactr f nine. Expected csts f encryptin were surprisingly lw. H» significant range f perfrmance between varius enciphering algrithms and varius prcessrs indicated aneed fr careful cnsideratin f equi^ent selectin fr enciphering applicatins. Aparticularly interesting pint brught ut by the use f tw applicatin mdels was the desirability f chsing aprcessr t fit the size f its intended task in rder that efficiency be maximized. ^Partially supprted by Natinal Science Fundatin Grant GJ 36475, by/s -byte/secnd where abyte cntains 8bits.

5 2. Intrductin 2.1 Backgrund With the increased interest in security and privacy aspects, f cmputer systems has cme the recgnitin f enciphering methds as an effective means f prtecting data. It has been recgnized that cryptgraphic methds are applicable t bth file strage and intercmputer transmissin f data (Pet, Skap Bar, Fei, Hf, Pri). Encipherment may be effected, by either hardware r sftware; hwever, nly sftware encipherment will be cnsidered here. The gal f any enciphering methd (r privacy transfrmatin) is t disguise data in such a way that they cannt be understd by unauthrized persns. The datura under cnsideratin at any time is called a message. Its undisguised frm is called cleartext and its disguised frm is called ciphertext. The transfrmatin frm cleartext t ciphertext must be perfrmed in such a way that the reverse transfrmatin can be perfrmed at a later time, and furthermre that it can be perfrmed nly by authrized persns (Kah, Hf). Thus an enciphering scheme nrmally cnsists f 1) an algrithm which gives the general methd t be used t transfrm the cleartext int ciphertext and 2) a kejr which is a parameter f the algrithm and is smehw cmbined with the cleartext by the algrithm t generate the ciphertext; in essence, the key selects a particular instance f the general algrithm. The algrithm is designed t be invertible s that anyne wh knws the inverse algrithm and the key used in a particular instance can recver the cleartext message frm the ciphertext. Therefre, secrecy f the key is a necessary but nt sufficient cnditin fr data security; Baran has suggested that secrecy regarding the algrithm is neither necessary nr desirable (Bar). Thus the encipherment prcess can be symblized as fllws (where T is the enciphering algrithm r transfrmatin, M is the cleartext message, K is the key,.and C

6 is the ciphertext) (Kf): T(M,K) -* C (1) # Deciphering can be viewed as T-1(<2) -Trl(T(H,K)) -* M (2). key, The classical methds f encipherment include additin f cleartext and substitutin f ne alphabet fr anther, and transpsitin f characters f cleartext (Hf, Fri, Kah). Enciphering methds with nn-linear prperties have als been cnsidered (Fei). Because additive ciphers use the exclusive r peratin t effect additin they are extremely well suited fr sftware implementatin, particularly frm the standpints f ease f prgramming and speed f executin. Therefre nly additive ciphers will be cnsidered here. An additive enciphering methd wrks schematically as fllwst CLEARTEXT + KEY -*. CIPHERTEXT (3) where + symblizes the exclusive r peratin. Because f the additivity, deciphering is algrlthmically equivalent t enciphering, namelyt CIPHERTEXT + KEY ~& CLEARTEXT (4) The text may be any length and it may naturally be divided int segments r blcks such as characters r wrds. The key may be as lng as the message r shrter in which case it is used repeatedly in a cyclic manner until the entire text is encrypted/decrypted. The natural prtin f the text which becmes available at a given time r which is mst cnvenient t cnsider will be called a segment. Variatin amng additive methds arises frm schemes f key generatin. A cnstant key which has length ne segment is mst cnvenient, but ffers little data prtectin. Lnger cnstant keys (10, 100, 1000 r mre segments) ffer mre prtectin at sme added expense in algrithm cmplexity and key strage. Infinite key methds using pseud randm number generatrs t prduce

7 an ever changing key prvide ptentially excellent security but have the expense f generating the "randm" numbers (Bar, Car, Kah). The relative efficiency and abslute cst f varius methds f encipherment are f practical interest. Sme f the data available t date are the fllwing: 1) Carrl and McClelland (Car) reprt an encipherment rate f 37,000 by/s fr a pseud randm key methd running n a PDP-l/50. 2) Friedman and Hffman (Fri) investigated several techniques n the CDC They were able t mve data (null "encipherment") at 1,575,600 by/s, effect cnstant ne-segment-key encryptin nearly as fast, lng key encryptin (125-segment key) at 909,075 by/s, and infinite pseud randm key encryptin at 374,100 by/s. The 60-bit wrd was their segment. 3) Tests reprted in (Hf) fr the 360/67 shwed adata transfer rate (as in 2) f 700,560 by/s, ne-segment-key rate f 514,800 by/s, lng key rate f by/s, and infinite randm key rate f 243,000 by/s. Additinal figures are given in (Fri). 2.2 Scpe and Limitatins Ihree additive enciphering methds (cnstant-key, flng key, and infinite randm key) were studied here. and PDP-10) were used. cnsidered. Three different cmputers (CDC 6400, PDP-11, Tw different data prcessing applicatins were Certain encipherment methds were nt studied because they clsely resemble ther methds (e.g. lng key vs. duble key, see.(fri)) r because they were deemed unsuitable fr sftware implementatin (e.g. Lucifer which handled by/s in ahardware implementatin but nly 2910* by/s n the Hneywell'6180-(Ben)). (Hwever, see Appendix I) Thus we cnsider nly avery small subset f the three-dimensinal space f applicatin vs. enciphering methd vs. prcessr. In additin, ur cst 4

8 figures are very crude and shuld be judged as pssibly in errr by a factr f 2 f 3. 3«Discussin 3.1 Applicatin Mdels Tw mdels f applicatin areas in which encipherment is likely t be used are cnsidered here. Applicatin Mdel I cncerns encryptin f files within a cmputer system (batch, timesharing, management infrmatin); Mdel II cncerns encryptin f cmmunicatin traffic between a cmputer system and a characterriented terminal typically used in timesharing applicatins. These applicatins represent tw extremes f data availabilityi In applicatin I a large mass f data is immediately available fr prcessing; in applicatin II data are available nly n a character by character basis, and furthermre, character arrivals are separated by relatively lng perids f time. These mdels imply simple but significant differences in the prgrams necessary t handle encryptin. Applicatin Mdel I. Encryptin f a file within a system might be accmplished by a cmmand such as ENCRYPT input-file utput-file key where the parameters are self-explanatry. The input file is immediately available in ttal, and buffering techniques fr input/utput allw the encryptin rutine t use the full pwer f the machine t read, encrypt, and write data very rapidly. Mre specifically, nce the machinate fast registers have been laded with parameters required by the encryptin rutine, it prceeds t cmpletin with essentially n additinal verhead. The prcessing sequence is illustrated in Figure 1, In this mdel, the segment size is ne machine wrd. Applicatin Mdel II. In this situatin single character encryptin ccurs at intervals as characters are received at and transmitted by the system. We

9 C START *) INlM'JP ARRAY IN RETRIEVE ENCRYPTION PARAMETERS TO FAST REGISTERS MEMORY >- GET A WORD FROM INPUT ARRAY ENCRYPT IT STORE IT INTO OUTPUT ARRAY j^t Aan\ y «/wi \ YES \WORD J^ C_ STOP } UPDATE [n PARAMETERS IN REGISTERS OUTPUT ARRAY IN MEMORY Figure 1. Applicatin Mdel I Prcessing Sequence C START Q 9 } WAIT FOR CHARACTER GET A CHARACTER GET PARAMETERS FROM MEMORY TO FAST REGISTERS ENCRYPT CHARACTER STORE IT STORE PARAMETERS BACK IN MEMORY Figure 2. Applicatin Mdel II Prcessing Sequence

10 assume highly interactive applicatins where any character may be significant, and thus each character must be deciphered (remember the algrithmic equivalence f enciphering and deciphering) as it is transmitted r received. (Nte that enciphering f entire messages fr transmissin culd ccur as in Mdel I.) Here, in additin t enciphering time, significant verhead is incurred because 1) enciphering rutine parameters must be retrieved frm memry fr each character (since characters are widely separated in time) and 2) a (say) 60-blt machine perating n an 8-bit character is using nly a fractin f its prcessing pwer. The prcessing sequence is illustrated in Figure 2 (nte that in the figure "encrypt" is synnymus with "decrypt"). In this mdel, the segment size is ne byte«3.2 Encipherment Methds A "null encipherment" and three additive enciphering methds were cnsidered in this study. The null encipherment cnsisted f simply mving data frm ne place t anther in memry. The additive methds were thse using a shrt nesegment key, a lng 128-segment key, and an "infinite" pseud-randm key. Let M.0 E, and K. be the 1-th segment f the message, the enciphered message, and the key respectively Then the enciphering methds can be symblized as fllwsi Methd? 1. Null Ei-Mi 2. Shrt Ei - "i + K 3 Lng Ei " Mi + Ki md 128 (5) (6) (7) ^ Randm E = H + K In (6), K is a cnstant ne segment lng. In (7)# K is a table f 128 key segments. In (8), successive wrds f K are prduced by a linear cngruential (8). pseud-randm number generatr. As befre, "+" symblizes the exclusive r peratin, 3 <>3 Cmputers Three cmputers were used in these experiments, namely the (Cntrl Data 6

11 Crpratin) CDC 6400 running under the scpe perating system (CDC), the (Digital Equipment Crpratin) DEC PDP-ll/45 running under UNIX (Unx)t and the DSC PDP-10 (KA10 prcessr) running under the Timesharing Mnitr (PIO). The main machine characteristics are: wrd size memry cycle clck CDC by.5/(s high frequency PDP-li/ by.85/is line PDP W 1.65/is high frequency The memry "cycle" fr the CDC 6400 is quted as.5/*s because extensive memry interleaving makes the.5«s access time rather than the l.q^s cycle time significant fr the cnsideratins here. Clck refers t the clck surce used t btain timing infrmatin. The high frequency clcks prvide timing accuracy f better than 1 ms and the line clck prvides accuracy f 16.6 ras. Thus much lnger cmputer runs had t be made n the PDP-11 t btain reasnable timing accuracy. Nte that each f these machines can execute a full wrd exclusive r via ne instructin. These machines were chsen because ne represents the class f high-pwer prcessrs (CDC 6400), ne the class f medium-scale prcessrs (PDP-10), and ne the class f minicmputers (PDP-11) Experiments Twenty-fur separate timing experiments were perfrmed. Fr each f the tw applicatin mdels, fur enciphering methd 1prgrams were timed, and each f these eight cmbinatins was run n all three cmputers. Cmputer Prgrams. Fr each cmputer eight prgrams were written. TW prgrams perfrmed the null transfrmatin, tw the shrt key encipherment, tw the lng key encipherment, and tw the infinite randm key encipherment. In each case, ne prgram simulated applicatin Mdel I and the ther simulated

12 applicatin Mdel II. between applicatin mdels very clsely. Figures 1 and 2 mirrr the differences in prgramming In Mdel I prgrams, whle wrds were enciphered at a time and enciphering parameters were kept in registers. Hwever in Mdel II prgrams, nly character-at-a-time encipherment was perfrmed, and furthermre parameters were mved back and frth between memry and registers fr each character in rder t reflect the fact that ther prcesses wuld run and thus usurp the registers between character times. a lp cntrl test had t be added t Mdel II's prgrams. In additin, f curse, All prgrams were written in assembly language fr the particular machine. In additin t the enciphering task each prgram cntained cde needed t btain CPU time infrmatin frm the particular perating system. Cmputer Runs. Each prgram was run 50 times n each cmputer in rder t btain an average. Hwever, there was very little deviatin frm run t run. Fr the CDC 6400 and PDP-10 the prgrams were allwed t lp 20,000 times n each run (i.e. t encrypt 20,000 segments be they wrds in Mdel Ir bytes in Mdel II). (See Fri fr astatistical analysis f CDC 6400 results). Fr the PDP-11 with its less accurate timer, the prgrams were allwed t lp 524,288 times. Initially, variatin f the number f lps shwed that the additinal time intrduced by the timing cde was insignificant. Fr each run, the enciphering rate in by/s and the enciphering time per byte in s/by was cmputed. Results f all runs were cmbined t give an aggregate enciphering rate and time fr each mdel/methd/cmputer cmbinatin. Only the aggregate rates are presented here. 3.5 Timing Cmputatins In additin t measured times, theretical executin times based n manufacturers' timing infrmatin were cmputed in rder t increase cnfidence in the measured times. All cmputed times were within 5# f the measured times. 8

13 An example fllws. The segment f cde which realizes the inner lp f Mdel II, enciphering methd 2 n the CDC 6400 cnsists f 7 instructins which fit int 3 wrds. Accrding t manufacturers' figures, the sequence shuld take 7.0/43. That is, ne character can be encrypted in 7.0;us. The measured figure was 7.26/g fr an errr f 3.7#. In mst cases, errrs culd be accunted fr by memry interference nt cnsidered in the calculatins. 3.6 Cst Cmputatins A cst figure was cmputed fr each mdel/methd/cmputer cmbinatin. Fr Mdel I, the cst f encrypting 1000 cards (» 80,000 characters) was cmputed. Fr Mdel II, the cst f supprting ne 300-baud terminal transmitting at full speed fr ne hur (» 108,000 bytes) was cmputed. Csts were based entirely n CPU time charges estimated as fllws (Cs)i CDC 6400 PDP-11/45 PDP-10 $7.00 per CPU minute $4.00 per CPU minute $5.50 per CPU minute. This is smewhat unjustified because memry usage may be significant in sme f the applicatins (especially fr file buffers in Mdel I). Hwever, these figures shuld give reasnable estimates f marginal csts f adding encryptin prcedures t existing system rutines. 4. Results The bjectives f this study were t determine time and mney csts f each enciphering mdel/methd/cpu cmbinatin. 4.1 Timing Results Table 1 gives the enciphering rate in bytes per secnd and the CPU time per byte In/cs. Fr example, the CDC 6400 perating under Mdel I cnstraints is

14 Methd JNull Shrt Lng Randm Table 1. CDC 6400 Mdel I PDP 11 1»330, , U332, , , , , , PDP , ,860 ^ , , CDC , , , , Mdel II PDP , , , , PDP 10 87, , , , Measured Raw Enciphering Rates (by/s) and Enciphering Time per Byte (jis) T*ble 2. Enciphering Time Cefficients fr Prcessr/Mdel Cmbinatins

15 1,500,000n 3 C5 vo Q O Figure 3. PH I 2 3 CPU and Methd Mdel I Raw Enciphering Rates , fa 1,000, , ,000- s a Pw Oh Q Ph Figure CPU and Methd Mdel II Raw Enciphering Rates

16 Methd *CDC 6400 Mdel I PDP 11 PDP 10 CDC 6400 Mdel II PDP 11 PDP 10 Null 92, ,000 95,240 90,040 92, ,750 Shrt 88,840 91,400 79,882 68,870 5^, Lng 59,860 40,700 59,620 40, Randm i0c665 20,500 51,572 19, Memry T77 Wrd Size (by) Table 3. Nrmalized Enciphering Rates (by/s).5.85 IT Methd Mdel I K-cst t encrypt 1000 cards (cents) Mdel II Cst t encrypt 108,000 ^fsinte) Table 4. Csts f Encrypt! n

17 12,00 i CO C (0 - c P<<Z> >» c p 03 O a P«a Pm P«12 3 CPU and Methd Figure 5. Mdel I Encryptin Csts 40,00 w <D O CO c CO c 20,00. Pi" >> c -p ^5 r* O Q O P-, Q P-. P< Q P-4 Figure CPU and Methd Mdel II Encryptin Csts

18 capable f enciphering 897,850 by/s using a lng key methd; this is equivalent t an enciphering time f l.lljus per byte. Figures 3 and 4 shw this infrmatin graphically. Table 2 gives the enciphering time cefficients (Fri) fr each mdel/cpu cmbinatin taken acrss all methds. The enciphering time cefficient is the rati f the time taken t encipher a segment t the time needed t perfrm the null transfrmatin n that segment. Thus, fr the example f the last paragraph, the enciphering time cefficient is 1.11/.72 «1.54. That is, it takes 1.54 times as much CPU time t encipher a segment using the lng key methd as it takes t simply mve that segment. Table 4 gives the estimated csts f encryptin based ri the time figures in Table 1 and the accunting figures mentined previusly. Figures 5 and 6 depict these figures graphically. Nte that the amunts f data cnsidered under Mdels I and II differ. This was dne in rder t anchr the cst results in the real wrld -related t each applicatin mdel. 4.2 Grss Analysis Since the null encryptin methd effects n transfrmatin f the input it was fastest in all cases. The shrt key methd requires the additin f an exclusive r peratin between input segment and key and thus takes smewhat lnger. The lng key methd requires a table lkup, exclusive r, and maintenance f a pinter int the key table, and thus takes even lnger. Finally the randm key methd requires calling a randm number generatr/r cmputatin f the next pseud randm number by a linear cngruential methd and thus requires a multiplicatin and an additin t generate the key, and then an exclusive r. In Tables 1 t 4 the trend in executin time with increasing cmplexity is apparent. Since in Mdel I a wrd is enciphered at a time and in Mdel II nly a byte 10

19 is enciphered at a time, ne wuld expect arati f abut the CPU's wrd length in bytes between cmparable bxes in Iand II f Table 1. Fr example, fr the CDC 6400 the rati f the Mdel It Mdel II null transfrmatin is / »7.67 and the wrd length is 7.5 by. This, hwever is nly arugh rule since ther factrs influence this rati, mst ntably the differences in prgram structure fr Mdel I vs. Mdel II, Obviusly, csts increase with the cmplexity f the enciphering algrithm. One wuld expect, hwever, that fr agiven mdel and enciphering methd, the cst f encipherment wuld be rughly cmparable ver CPU's (given well knwn ecnmic laws). Fr Mdel Iwe have cst differences up t afactr f 5J. and fr Mdel II the differences g.up t afactr f 2. These differences are due t at least tw factrs: 1) Charges fr CPU time may be based n factrs ther than the pwer f the CPU and 2) Inaccuracies in CPU time charge estimates. Nthing mre will be said abut csts since nly preliminary estimates were intended, 4.3 Detailed Analysis It is the intent f this sectin t accunt fr the differences in enciphering times between prcessrs based n CPU characteristics. The cntributins f bth hardware and instructin set characteristics will be cnsidered. One cnment shuld be made befre beginning, hwever. The randm key methd fr Mdel In the CDC 6400 requires tw calls f the randm number generatr. This is because the generatr prduces nly a48-bit randm number, and the wrd is 60 bits lng. This anmaly des nt arise n the ther tw machines. Hardware Cntribjjtins. Iw main hardware factrs effect enciphering rates. 11

20 V namely wrd size and memry cycle time. With a larger wrd size, mre data can be manipulated at nce (this, f curse, is applicable in Mdel I but nt Mdel II). Similarly with a faster memry cycle, data can be manipulated mre rapidly and instructins can be fetched mre rapidly. Let R be the enciphering rate determined in a bx f Table 1, C the memry cycle time in /<s, and W the wrd size in bytes. Then we define N the nrmalized enciphering rate by N ~R(c/rf) (9). Table 3 presents the nrmalized enciphering rates. Whereas in Table 1 we have rate differences acrss prcessrs f up t 9j, in Table 3, these differences are reduced t at mst a factr f 3 (except fr the pathlgical case mentined in the secnd paragraph f this sectin) j the factr here is typically 1.5 t 2.0. We believe that this nrmalizatin accunts handily fr the primary hardware factrs. Instructin Set Cntributins. Extremely detailed analysis is pssible here n several frnts. T shrten the presentatin, ne micrscpic example will be cnsidered fllwed by bradbrush treatment f additinal factrs. Table 2 will be the primary vehicle. Cnsider the enciphering time cefficients fr Mdel I, shrt key enciphering. The CDC 6400 exhibits a near unity cefficient while thse fr the PDP-11 and PDP-10 are cnsiderably larger. This stems frm the peculiar CDC 6400 architecture which allws lading int registers 1 t 5 nly and string frm 6 and 7 nly. Fr the null transfrmatin we lad say register 1, mve its cntents t register 6, and stre frm register 6. Fr the shrt key methd, we replace the mve with an exclusive r with a previusly laded key. A prgramming peculiarity which required the inclusin f a NO OP instructin intrduced the small additinal time. On the PDP-11 the null mve is accmplished 12

21 by a single memry t memry mve instructin. Hwever, three instructins are needed' t effect the shrt key methd, namely mve t register, exclusive r, stre. Thus the rather large time increase is seen. In the PDP-10 nly a single instructin is added t a 4 instructin lp, namely/ exclusive r t register^ thus the increase in time is smaller. With reference t the enciphering time cefficients in Table 2, tw general pints f cmparisn between prcessrs efficiencies can be made: 1) PDP-11 cefficients in general grw the mst rapidly. This ccurs because the instructin set architecture is such that as additinal algrithmic cmplexity is added, additinal r multi-wrd instructins must be used, whereas with the ther prcessrs simple mdificatins within instructins ften suffice. 2) PDP-10 cefficients seem t grw the mst slwly, perhaps due t the fact that the PDP-10 has a relatively small spread in instructin executin times (abut 4 t 1) when cmpared t, say, the CDC 6400x (11 t 1) n the instructins added t the enciphering prgrams as their cmplexity increased. Only these tw pints will be mentined here, but any aspect f interprcessr cmparisn will yield t detailed analysis f instructin set architecture and timing. 4,4 Accuracy The accuracy f timing f CPU peratins is f cncern in estimating the validity f these results. It is believed that the figures here represent gd wrking estimates s nly brief cnsideratin f their accuracy will be made. This belief is based n l) clse agreement between theretical and actual timing results and 2) use f varius methds t eliminate timing errrs. Friedman and Hffman (Fri) perfrmed a careful statistical analysis f their results n the CDC 6400 and qute a 95* cnfidence level fr their timing figures. It is believed that their analysis f timing accuracy is 13

22 applicable here since tests were perfrmed at the same installatin. In any case, bserved accuracy in the present study was typically better than 1 part in 10,000. The PDP-10 clck is inherently mre accurate than the CDC 6400 system clck because its handling rutine is interrupt driven. Variance ver test runs was practically nnexistent. Accuracy here was typically 1 part in 25,000, The PDP-11 line frequency clck was quite imprecise in that ver any interval it is guaranteed t be accurate nly within 16.7ms. Timing accuracy here ranged frm 1 part in 200 t 1 part in Thus, nly three significant figures are quted in PDP-11 results (in many cases, this shuld be reduced t tw), 5 Cnclusins The time taken t encipher streams f data with tw applicatin mdels and three additive encryptin methds was measured n three distinct cmputers. Fr cmparisn purpses, the time taken t effect a null transfrmatin was als measured. Enciphering-rates varied by a factr f 60 ver all applicatins, methds, and cmputers. Rates decreased with increasing cmplexity f the enciphering methd. Mnetary csts were als estimated, and these varied by as much as a factr f 16 (6) ver all methds and CPU's in Mdel I (Mdel Il)j verall, these csts were quite lw. It. was fund that much f the difference in rates between CPU's culd be accunted fr by wrd size and memry cycle time. Further differences are accunted fr by appeal t differences in detail f instructin set architecture and instructin timing. Results indicate that a CPU shuld be chsen carefully t fit the particular enciphering applicatin cnsidered while prviding maximal efficiency. 14

23 6. Recmmendatins Several specific recmmendatins are implied by this study» 1) Since nly a small sampling f enciphering methds was cnsidered, an expanded study shuld be made which wuld include ther methds such as Lucifer. 2) Mre realistic figures culd be btained by e.g. adding encryptin cde directly t a COPY utility r the cmmunicatin interface prcedure f a given system, 3) The chice f a prcessr t perfrm encryptin shuld be based n the particular applicatin at hand; as seen in Mdel II figures, raw cmputing pwer des nt imply significant cst effectiveness. Benchmark data stream, simulatins shuld be set up and tested n several cmputers. 4) Standards fr cding encipherment simulatin and benchmark prgrams are needed in rder t insure cmparability between implementatins. It is suggested that applicatin mdels be frmalized and prgram schema be agreed upn. 15

24 Appendix I Preliminary Investigatin f Lucifer Lucifer was deemed inapprpriate fr inclusin in this study fr the fllwing reasns: 1) Its applicability t Mdel II is questinable because it deals with blcks f 16 bytes instead f single bytes. 2) Its cmplexity is an rder f magnitude abve that f the methds cnsidered here and furthermre the algrithm is nt In the spirit f the ther algrithms cnsidered (i.e. successively mre cmplex methds f key generatin). Thus, in a sense, they are incmparablej Lucifer wuld have been a smewhat ad hc additin t the experimental design. 3) The cst effectiveness f sftware implementatin f Lucifer is questinable. Hwever I have perfrmed a preliminary analysis f Lucifer's perfrmance and cst, and the results are given here. First, existing results are cnsidered. 3enedict wrte an assembly language implementatin f Lucifer fr the Hneywell 6180 (Ben). He achieved an enciphering rate f nly 2910 by/s fr a byte enciphering time f 344/ts. Since the Multics (blck) cmmunicatin interface prgram required nly 100/& t prcess a character, he cncluded that serius degradatin in perfrmance wuld ccur if Lucifer were used n mst terminal cmmunicatin. Generalizing this result adds weight t the inapplicability f a sftware Lucifer system t general terminal cmmunicatin. Estimating the CPU time charge fr the 6180 at $5.00/CPU minute, encryptin f 1000 cards wuld cst abut $2.30 and supprt f a 300 baud line fr 1 hur wuld cst $3.10. These figures are significantly higher than thse fr the methds cnsidered in the text. Hwever, tradeffs f degree f prtectin vs. cst must be cnsidered. A preliminary prgram has been written fr the CDC 6400 and manufacturer's 16

25 timing figures indicate an attainable enciphering rate f 8000 by/s r 125/us/by. This gives csts at least 20 times greater than thse fr the randm key methd used here. Encryptin f 1000 cards wuld cst $1.16 and supprt f the terminal as abve wuld cst $1.60. These figures are given credence by the estimate that the CDC 6400 is abut tw t three times as fast as the Hneywell The abve figures shuld be cmpared with thse determined fr a hardware Lucifer system. A rate f 96,970 by/s r 10.3ty*s/by was achieved. N estimates f cst effectiveness were available. 17

26 Appendix II Cmparisn f Results with thse f Friedman &Hffman The fllwing table cmpares the results given in (Fri) with results determined here fr the CDC 6400 Mdel I prgrams. (***) Present study Nul1 <K76 5M Shrt 4#78 ^ Lng Randm Time t Encrypt 7.5 byte wrd (us) Differences in the first three algrithms can be accunted fr by single instructin differences in the lp which prcesses a wrd. The large differences in the randm key algrithm is due t the calling rather than in-line invcatin f the randm number generatr. Only descriptins (n listings) f randm number generatrs culd be btained fr the PDP-10 and PDP-11. It had been decided that existing generatrs shuld be used because their crrectness culd be reasnably assumed. The cmmn... denminatr implied by these tw cnstraints Was that the system rutines be called rather than mdified and placed ift-line. Functinal similarity f rutines was assured by clse examinatin f their specificatins. It remains t accunt fr the timing differences explicitly. subrutine call and return fr the CDC 6400 is as fllws: call subrutine jump t return instructin jump back t calling rutine TOTAL 2.1/<s U3/IS 1.3iis kt?jus Timing fr The randm number rutine must check its argument t determine which f several functins it is t perfrm. This requires: 18

27 lad parameter t X register 1.2^s jump if nn-zer (fails),5#s nn-verlapped instructin fetch.2^s penalty fr jump in slt tw ' f instructin wrd TOTAL GRAND TOTAL.^as 2.0/ts 6.7/tS All the abve must be dne twice fr a ttal f 13«^ms. Hwever, we still have t accunt fr 13.43/^s/wrd r 6.72/(s per call f the generatr. time cmes frm the required lading and string f registers t avid This cnflicts with the generatr. Hwever a few micrsecnds are left unaccunted fr, It is suggested that the standard prgram schema mentined in the recmmendatins (p. 15) use in-line invcatin f the generatr. 19

28 7 References (Hf) Hffmanr L. J. Class Ntes fr Cmputer Science 244. University f Califrnia, Berkeley. Fall These ntes were used in a graduate level curse in cmputer security engineering. They include cnsideratin f hardware and sftware safeguards, perating systems, physical and administrative security, and mdels f secure systems. They include brad cverage f encryptin. (Fri) Friedman, T. D. and Hffman, L. J. Executin Time Requirements fr Encipherment Prgrams. Cmmunicatins f the ACM. Vl. 17, N. 8 (August 1974) pp This paper reprts a study similar t the wrk dne here. A null enciphering methd and three additive methds were timed n the CDC 6400, The enciphering time cefficient was intrduced. (Pet) Petersn, H. E, and Turn, R. System Implicatins f Infrmatin Privacy. Prc. AFIPS I967 3JCC. Vl. 30, AFIPS Press, Mntvale, N. J., pp The paper lists many threats t infrmatin privacy and categrizes cunter-measures int the areas f access management, prcessing restrictins, threat mnitring, and privacy transfrmatins. It prvides a gd crss tabulatin f threats and cuntermeasures, (Ska) Skatrud, R, 0. A Cnsideratin f the Applicatin f Cryptgraphic Techniques t Data Prcessing. Prc. AFIPS I969 FJCC, Vl. 35, AFIPS Press, Mntvale, N. J., pp In this paper, tw cryptgraphic techniques are described. The first is a substitutin system using an additive methd with tw key memries and the secnd is a rute transpsitin system. Cnsideratin is given t the security f the methds. (3ar) 3aran, P, On Distributed Cmmunicatins: IX. Security, Secrecy, and Tamper-Free Cnsideratins. RM-3765-PR, August The Rand Crpratin, Memrandum This paper states Baran*s principle regarding secrecy abut secrecy. It presents sme basics f cryptgraphy, describes a real wrld applicatin t a distributed message cmmunicatin system, and prvides a critical examinatin f this system. 20

29 (Fei) Feistel, H. Cryptgraphy and Cmputer Privacy. Scientific American. Vl. 228, N. 5 (May 1973). pp The paper- describes recent wrk dne at IBM n nnlinear blck ciphers (the Lucifer system). It prvides a lucid descriptin f the prblems invlved in prducing a ciphering methd which is highly resistant t cryptanalysis. (Kah) Kahn, D. The Cdebreakers. (Macmillan, I967) This bk prvides an extensive and fascinating accunt f the techniques and histry f cryptgraphy frm ancient times t the end f Wrld War II. (Car) Carrl, J. M. and McLelland, P. M. Fast "Infinite-Key" privacy Transfrmatins fr Resurce-Sharing Systems. AFIPS 1970 FJCC, Vl. 37, AFIPS Press, Mntvale, N. J. pp This paper describes privacy threats and cuntermeasures. It discusses a tw-stage randm number generatr and an implementatin f the assciated privacy transfrmatin. It als gives an analysis f the gdness f the generatr and gives timing figures fr an encryptin using the generatr n a PDP-10/50. (Ben) Benedict, G. G. An Enciphering Mdule fr Multics. MAC Technical Memrandum 50. Massachusetts Institute f Technlgy, Cmputer Systems Research Divisin, Prject MAC. This mem describes bth a PL/l and an assembly language implementatin f the Lucifer system n the Multics System. Cmplete prgram listings are prvided and results f timing experiments are summarized. (CDC) Cntrl Data 6400/6500/6600 Cmputer Systems Reference Manual. Pub, N Cntrl Data Crpratin.(I969). (P10) PDP10 Reference Handbk. Digital Equipment Crpratin (1970). (Pll) PDP-11/45 Prcessr Handbk. Digital Equipment Crpratin (1973). These three manuals cntain all the infrmatin needed t prgram the particular cmputer in machine language. In additin, each gives cmplete Instructin timing infrmatin. (Unx) UNIX Handbk. University f Califrnia, Berkeley. Department f Electrical Engineering and Cmputer Sciences. This manaul cntains reprints f several manuals written at Bell Labratries which describe the peratin f the UNIX timesharing system fr the PDP-ll/45. 21

30 (Cs) Cst estimates fr CPU time. These are my wn estimates f CPU time charges. The CDC 6480 figure is that actually charged fr a particular grade f service at the University f Califrnia, Berkeley Cmputer Center. The PDP-10 figure was btained in a private cmmunicatin at the Lawrence Livermre Labratry. The PDP-11 figure has been widely circulated in the literature f small timesharing cmpanies. 22