Editing Block cipher (section)

==Definition==
[[File:Block Cipher-en.svg|thumb|Block diagram of cipher block showing its inputs, outputs and components.]]
A block cipher consists of two paired [[algorithm]]s, one for encryption, {{var serif|E}}, and the other for decryption, {{var serif|D}}.<ref>{{cite book|last1=Cusick |first1=Thomas W. |last2=Stanica |first2=Pantelimon|title=Cryptographic Boolean functions and applications|publisher=Academic Press|year=2009|isbn=9780123748904|pages=158–159|url=https://books.google.com/books?id=OAkhkLSxxxMC&pg=PA158}}</ref> Both algorithms accept two inputs: an input block of size {{var serif|n}} bits and a [[key (cryptography)|key]] of size {{var serif|k}} bits; and both yield an {{var serif|n}}-bit output block. The decryption algorithm {{var serif|D}} is defined to be the [[inverse function]] of encryption, i.e., {{math|1={{var serif|D}} = {{var serif|E}}<sup>−1</sup>}}. More formally,<ref name="HAC">{{cite book|first1=Alfred J.|last1=Menezes|first2=Paul C.|last2=van Oorschot|first3=Scott A.|last3=Vanstone|title=Handbook of Applied Cryptography|publisher=CRC Press|year=1996|chapter=Chapter 7: Block Ciphers|isbn=0-8493-8523-7|url=http://cacr.uwaterloo.ca/hac/|access-date=2012-07-15|archive-date=2021-02-03|archive-url=https://web.archive.org/web/20210203194011/https://cacr.uwaterloo.ca/hac/|url-status=dead}}</ref><ref name="modern-crypto">{{citation|first1=Mihir|last1=Bellare|first2=Phillip|last2=Rogaway|title=Introduction to Modern Cryptography|format = Lecture notes|date=11 May 2005|url=http://www.cs.ucdavis.edu/~rogaway/classes/227/spring05/book/main.pdf |archive-url=https://ghostarchive.org/archive/20221009/http://www.cs.ucdavis.edu/~rogaway/classes/227/spring05/book/main.pdf |archive-date=2022-10-09 |url-status=live}}, chapter&nbsp;3.</ref> a block cipher is specified by an encryption function
:<math>E_K(P) := E(K,P): \{0,1\}^k \times \{0,1\}^n \rightarrow \{0,1\}^n,</math>
which takes as input a key {{var serif|K}}, of bit length {{var serif|k}} (called the ''key size''), and a bit string {{var serif|P}}, of length {{var serif|n}} (called the ''block size''), and returns a string {{var serif|C}} of {{var serif|n}} bits. {{var serif|P}} is called the [[plaintext]], and {{var serif|C}} is termed the [[ciphertext]]. For each {{var serif|K}}, the function {{var serif|E}}<sub>{{var serif|K}}</sub>({{var serif|P}}) is required to be an invertible mapping on {{math|{0,1}<sup>{{var serif|n}}</sup>}}. The inverse for {{var serif|E}} is defined as a function
:<math>E_K^{-1}(C) := D_K(C) = D(K,C): \{0,1\}^k \times \{0,1\}^n \rightarrow \{0,1\}^n,</math>
taking a key {{var serif|K}} and a ciphertext {{var serif|C}} to return a plaintext value {{var serif|P}}, such that
:<math>\forall P: D_K(E_K(P)) = P.</math>

For example, a block cipher encryption algorithm might take a 128-bit block of plaintext as input, and output a corresponding 128-bit block of ciphertext. The exact transformation is controlled using a second input –&nbsp;the secret key. Decryption is similar: the decryption algorithm takes, in this example, a 128-bit block of ciphertext together with the secret key, and yields the original 128-bit block of plain text.<ref>{{cite book|last1=Chakraborty |first1=D. |last2=Rodriguez-Henriquez |first2=F.|chapter=Block Cipher Modes of Operation from a Hardware Implementation Perspective|editor-last=Koç |editor-first=Çetin K.|title=Cryptographic Engineering |publisher=Springer |year=2008 |isbn=9780387718163 |page=321 |chapter-url=https://books.google.com/books?id=nErZY4vYHIoC&pg=PA321}}</ref>

For each key ''K'', ''E<sub>K</sub>'' is a [[permutation]] (a [[bijective]] mapping) over the set of input blocks. Each key selects one permutation from the set of <math>(2^n)!</math> possible permutations.{{sfn|Menezes|van Oorschot|Vanstone|1996|loc=section 7.2}}