c

„he ƒ€iih gipher

‰uli—ng heng

ƒ™hool of gomputingD won—sh niversity

w™w—hons ‚o—dD pr—nkstonD wel˜ ourneD †sg QIWWD eustr—li—

im—ilX yzhengdf™itFmon—shFeduF—u

e˜str—™tF ƒ€iih is — priv—te key ˜lo ™k ™ipherF st supp orts three v—riE

—˜le p—r—metersX @IA d—t— length | the length of — pl—intextG™iphertext

of ƒ€iih ™—n ˜ e TRD IPV or PST ˜itsF @PA key length | the length of —n

en™ryptionGde™ryption key of ƒ€iih ™—n ˜ e —ny integer ˜ etween RV —nd

PST @in™lusiveA —nd divisi˜le ˜y ITF @QA rounds | the num˜er of rounds

involved in en™ryptionGde™ryption ™—n ˜ e —ny integer divisi˜le ˜y R ˜ut

not sm—ller th—n QPF

ƒ€iih is ™omp—™tD whi™h is indi™—ted ˜y the f—™t th—t the o˜ je™t ™o de

of — str—ightforw—rd implement—tion of ƒ€iih in the progr—mming l—nE

gu—ge g o ™™upies less th—n Q kiloE˜ytesF st m—kes full use of ™urrentD

—nd more imp ort—ntlyD emerging g€ —r™hite™tures whi™h host — l—rge

num˜er of highEsp eed h—rdw—re registers dire™tly —v—il—˜le to —ppli™—E

tion progr—msF enother imp ort—nt fe—ture of ƒ€iih is th—t it is ˜uilt

on re™ent rese—r™h results on highly nonline—r ™ryptogr—phi™ fun™tionsD

—s well —s other ™ounterEme—sures —g—inst dierenti—l —nd line—r ™ryptE

—n—lyti™ —tt—™ksF

st is hop ed th—t the ™omp—™tnessD high throughput —nd —djust—˜le p—E

r—meters oered ˜y ƒ€iihD together with the f—™t th—t the ™ipher is

in the pu˜li™ dom—inD would m—ke it —n —ttr—™tive —ltern—tive ™ipher for

se™urity —ppli™—tions in™luding ele™troni™ n—n™i—l tr—ns—™tionsF

I hesign €hilosophy

„he —im of this p—p er is to introdu™e — priv—te key ™ipher th—t is suit—˜le for softE

w—re implement—tion —nd t—kes the m—ximum —dv—nt—ge of emerging ™omputer

—r™hite™tures th—t host —n in™re—sing num˜er of f—st intern—l h—rdw—re registers

dire™tly —v—il—˜le to —ppli™—tion progr—msF „he ™ipher is ™—lled ƒ€iih whi™h

st—nds for — ƒe™ure €—™k—ge for in™rypting ile™troni™ h—t—F

gryptogr—phi™ strength of ƒ€iih is ˜uilt on re™ent rese—r™h results on ™onE

stru™ting highly nonline—r fo ole—n fun™tions ‘ISD IT“F yp er—tion e™ien™y is —n

imp ort—nt f—™tor th—t h—s ˜ een t—ken into —™™ount in the pro ™ess of designF enE

other design go—l is to provide the ™ipher with —ppli™—˜ility to f—st oneEw—y h—shE

ing —nd e™ient gener—tion of ™ryptogr—phi™—lly strong pseudoEr—ndom num˜ersF

in™ryption —nd pseudoEr—ndom num˜er gener—tion h—ve dire™t —ppli™—tions in

c

„he sour™e ™o de of ƒ€iih implemented in the progr—mming l—ngu—ge g is lo ™—ted

—t the following ‚vX httpXGGps™itEwwwFf™itFmon—shFeduF—uG~yuli—ngG

providing d—t— ™ondenti—lityD where—s oneEw—y h—shing is essenti—l for e™ient

—uthenti™—tion —nd digit—l sign—tureF

‡hile most sm—rt ™—rds use VE˜it g€ sD workst—tions —nd p erson—l ™omputE

ers —re m—inly ˜—sed on QPE˜it g€ s whi™h supp ort f—st pro ™essing of VD IT —nd

QPE˜it d—t—F ƒimil—rlyD emerging TRE˜it g€ s supp ort e™ient h—ndling of VD ITD

QP —nd TRE˜it d—t—F „his results in our de™ision for the ˜—si™ d—t— unit for the

en™ryptionGde™ryption op er—tion of ƒ€iih to ˜ e — VE˜itD ITE˜it or QPE˜it wordF

es — pl—intextG™iphertext of ƒ€iih ™onsists of V wordsD ™hoosing — VE˜it word —s

the ˜—si™ d—t— unit results in — ˜lo ™k ™ipher on TRE˜it d—t—D — ITE˜it word results

in — ˜lo ™k ™ipher on IPVE˜it d—t—D —nd — QPE˜it word results in — ˜lo ™k ™ipher on

PSTE˜it d—t—F „he pro ™ess of ƒ€iih is ™omp osed of R p—ssesD e—™h involving V

or more ™onse™utive roundsF „hus simil—rly to ‚gS ‘IR“D ƒ€iih supp orts three

v—ri—˜le p—r—metersD n—mely d—t— lengthD key length —nd the num˜er of roundsF

‚elev—nt ide—s on v—ri—˜le p—r—meters were previously used in — oneEw—y h—shing

—lgorithm ™—lled re†ev ‘IV“F

e ˜itEwise nonline—r fo ole—n op er—tion is employed in e—™h roundF „o strengthen

the ™ipher —g—inst the dierenti—l —tt—™k prop osed ˜y fih—m —nd ƒh—mir ‘I“D —

d—t—Edep endent ™y™li™ shift is —pplied on the output of the op er—tionF „his te™hE

nique w—s inspired ˜y ‚gSF „he use of — m—xim—lly nonline—r fo ole—n fun™tion

in — ˜itEwise fo ole—n op er—tion would help thw—rt the line—r —tt—™k dis™overed

˜y w—tsui ‘W“F

„he rem—inder of this p—p er is org—nized —s followsX ƒe™tion P det—ils the

sp e™i™—tion of ƒ€iihD ƒe™tion Q provides ˜—™kground inform—tion on the round

tr—nsform used in ƒ€iihD —nd ƒe™tion R dis™usses the ™onstru™tion —nd prop erE

ties of the ve nonline—r fo ole—n fun™tions used in ƒ€iihF e prelimin—ry —n—lE

ysis of the strength of the ™ipher —g—inst ™rypt—n—lysis is rep orted in ƒe™tion SD

while — ™omp—rison of ƒ€iih with other ™iphers in terms of its throughput @the

num˜er of ˜its en™ryptedGde™rypted p er unit of timeA is provided in ƒe™tion TF

pin—lly —ppli™—tions of ƒ€iih in oneEw—y h—shing —nd pseudoEr—ndom num˜er

gener—tion —re suggested in ƒe™tions U —nd VF

P hes™ription of ƒ€iih

pirst we introdu™e — few terms used in this p—p erF es — ™ommon pr—™ti™eD — ˜yte

is ™omp osed of V ˜itsF es we mentioned e—rlierD ˜y — word we me—n — string of VD

IT or QP ˜itsF ell ˜its in — ˜yte or — word —re indexedD st—rting with HD from right

to left h—nd sideF st is ™onvenient to ™—ll right h—nd side ˜its lower ˜its D while

left h—nd side ˜its upper ˜itsF „hree types of op er—tions —re —pplied to d—t—F „he

rst is ˜itEwise fo ole—n op er—tionsD the se™ond is ™y™li™ shifts @iFeFD rot—tionA to

the right or leftD —nd the third is mo dul—r —dditionsF

sn the following dis™ussions we use w to indi™—te the length of @iFeD the num˜er

of ˜its inA — pl—intextG™iphertextD – the length of — keyD —nd r the num˜er of

roundsF w ™—n ˜ e ™hosen to ˜ e TRD IPV or PSTD – —n integer ˜ etween RV —nd PST

@in™lusiveA —nd divisi˜le ˜y ITD —nd r —n integer l—rger th—n or equ—l to QP —nd

divisi˜le ˜y RF ƒ€iih with p—r—meters w D – —nd r m—y ˜ e denoted ˜y @w Y –Y r AE

ƒ€iihD or simply ˜y w E˜it ƒ€iih if the length of — key —nd the num˜er

of rounds —re not ™on™ernedF sn „—˜le ID v—rious p ossi˜le ™om˜in—tions of the

P

p—r—meters w D – —nd r th—t would provide —dequ—te se™urity —re suggested F st

is re™ommended th—t ƒ€iih with less th—n RH rounds ˜ e used only for oneEw—y

h—shingF

pl—inG™iphertext length w TR IPV PST

@in ˜itsA

key length – @in ˜itsA

@– a RVY TRY XXXY PSTD ! TR ! TR ! TR

divisi˜le ˜y ITA

num˜er of rounds r

@r a QPY QTY RHY XXXD ! TR ! RV ! RV

divisi˜le ˜y RA

„—˜le IF ƒ€iih €—r—meters for edequ—te ƒe™urity @ r ` RV m—y ˜ e ™hosen only when

ƒ€iih is used for oneEw—y h—shingA

PFI in™ryption

qiven — key u of – ˜itsD ƒ€iih s™r—m˜les — pl—intext w of w ˜its into —

™iphertext g of the s—me lengthF

plow of h—t— „he ow of d—t— in ƒ€iih is depi™ted in pigure IF e ™ryptoE

gr—phi™ key u D whi™h is — string of – ˜itsD is rst exp—nded ˜y the key s™heduling

fun™tion into four su˜Ekeys u D u D u —nd u F i—™h u D i a IY PY QY RD ™onsists

I P Q R i

r r

words or round keys where indi™—tes the num˜er of rounds in e—™h p—ssF of

R R

w

e pl—intext w is intern—lly represented —s V wordsD e—™h ˜itsF „hese V

V

words —re pro ™essed ˜y € D € D € —nd € ™onse™utivelyF i—™h € D i a IY PY QY RD

I P Q R i

is ™—lled — p—ss —nd involves — su˜Ekey u F „he output g of € represents the

i R

™iphertext of the origin—l pl—intext w F

pour sntern—l €—sses es ™—n ˜ e seen from pigure PD the four intern—l p—sses

€ D i a IY PY QY RD —ll op er—te in — simil—r f—shionD —lthough e—™h p—ss employs —

i

dierent su˜EkeyD —s well —s — dierent nonline—r fun™tion for ˜itEwise fo ole—n

op er—tionsF „he four nonline—r ˜itEwise op er—tions —re shown in „—˜le P in the

form of logi™ ’sum @ˆy‚A of pro du™t @exhA4F

P

ƒee —lso — re™ent rep ort ˜y fl—ze et —l ‘P“ whi™h suggests th—t the length of — key for

— priv—te key ™ipher should ˜ e —t le—st US to provide —dequ—te se™urity for ™riti™—l

™ommer™i—l —ppli™—tionsF M

K 1 P 1

K 2 P 2 M a plaintext (64, 128 or 256 bits) K S C a ciphertext (64, 128 or 256 bits) K an encryption key (48,64,..., or 256 bits) K 3 P 3 K i a sub-key (r/4 words, r=32,36,40,...)

Pi a pass (r/4 rounds) S key scheduling K 4 P 4

C

pigF IF in™ryption sing ƒ€iih

in € p @ˆ Y ˆ Y FFF Y ˆ A a ˆ ˆ  ˆ ˆ  ˆ ˆ  ˆ ˆ  ˆ

I I T S H T Q S I R P I H H

in € p @ˆ Y ˆ Y FFF Y ˆ A a ˆ ˆ ˆ  ˆ ˆ ˆ  ˆ ˆ  ˆ ˆ  ˆ ˆ  ˆ ˆ  ˆ

P P T S H T R H R Q H S P R Q R I Q H I

in € p @ˆ Y ˆ Y FFF Y ˆ A a ˆ ˆ ˆ  ˆ ˆ  ˆ ˆ  ˆ ˆ  ˆ ˆ  ˆ

Q Q T S H S R H T R S P Q H I H Q

in € p @ˆ Y ˆ Y FFF Y ˆ A a ˆ ˆ ˆ ˆ  ˆ ˆ  ˆ ˆ  ˆ ˆ  ˆ ˆ  ˆ

R R T S H T R P H T S R Q Q P I H P

where

w

E˜it word @w a TRY IPV or PSTAD e—™h ˆ is —

i

V

ˆ ˆ represents the ˜itEwise exhD —nd

i j

ˆ  ˆ represents the ˜itEwise ˆy‚ of the two words involvedF

i j

„—˜le PF fitE‡ise xonline—r fo ole—n yp er—tions sed in € D € D € —nd €

I P Q R

r

„he input d—t— @— string of V wordsA to € is pro ™essed in ™onse™utive

i

R

roundsD e—™h involving the ™orresp onding word in the su˜Ekey u D where i a

i

IY PY QY RF sn the rst round @round HAD the rst U words in the input —re ˜itEwise

pro ™essed —™™ording to p whi™h is shown in „—˜le PF „he result of this op er—tion

i

is then ™y™li™—lly shifted to rightF „he ex—™t num˜er of ˜its ˜y whi™h the result is

w

™y™li™—lly shifted is determined ˜y the upp er log ˜its of the @h—lfEwordA sum

P

V

w

˜its —re indexed of the left —nd right h—lves of the resultF „hese upp er log

P

V

˜y ID P —nd Q for w a TRD ˜y RD SD T —nd U for w a IPVD —nd ˜y IID IPD IQD IR

—nd IS for w a PSTF „he shifted version of the result of the nonline—r ˜itEwise

w

V

op er—tion is —dded @in the sense of mo dulo P A to the ™y™li™—lly shifted @to the

w

I ˜itsA version of the left most word in the inputD whose result is right ˜y IT m i,7 m i,6 m i,5 m i,4 m i,3 m i,2 m i,1 m i,0

F i d

v Round 0 Ki,0

Rounds 1 ~ r/4-2

F i d

v Round r/4-1 Ki,r/4-1

c i,7 c i,6 c i,5 c i,4 c i,3 c i,2 c i,1 c i,0

d Ki,j w/8 bits cyclic shift to the right by d bits, d=w/16-1=3,7 or 15

v m i,j w/8 bits cyclic shift to the right by a variable number of bits w/8 c i,j w/8 bits addition modulo 2 w=64, 128 or 256 Fi bit-wise nonlinear Boolean operation

r = 32,36,40,...

pigF PF e €—ss € in ƒ€iihD i a IY PY QY R i

then —dded to the rst word in the su˜Ekey u F

i

„he n—l sum is reg—rded —s —n up d—ted version of the left most word in the

input to this roundF xow the eight words —mong whi™h the left most one h—s

˜ een up d—ted —re rot—ted to the left ˜y — wordD —nd then used —s —n input to

the next roundF

r

„he —˜ ove pro ™ess is iter—ted timesD e—™h involving — dierent word in the

R

su˜Ekey u F ‡h—t follows is pseudoE™o de for — p—ss € F

i i

e €—ss € in ƒ€iihD i a IY PY QY R

i

tUD tTD F F FD tH hold — VEword d—t—D while u i‘H“D F F FD u i‘r aR I“ hold — r aREword

su˜Ekey used in € F „he ™ontents in tUD tTD F F FD tH —re up d—ted —™™ording to the

i

following stepsX

for j from H up to @rGR E IA do

tU a rot—te•right@tUD wGIT E IAY

tmp a pi@tTD tSD tRD tQD tPD tID tHAY

vv a @@@tmp bb wGITA C tmpA 8 revp•‡h•weƒuA bb ††•ƒrsp„Y

tmp a rot—te•right@tmpD vvAY

tmp a @tU C tmp C ui‘j“A 8 p vv•‡h•weƒuY

tU a tTY tT a tSY tS a tRY tR a tQY

tQ a tPY tP a tIY tI a tHY tH a tmpY

end of for loop

r ig ht@xY nA inE where 8 denotes ˜itEwise exhD bb denotes shiftEtoErightD r ot—te

‡h weƒu di™—tes ™y™li™—lly shifting — w aVE˜it word x to the right ˜y n ˜itsD p vv

w aV w aIT

a P ID revp ‡h weƒu a P ID —nd †† ƒrsp„ t—kes the v—lue of

II for w a PSTD R for w a IPV —nd I for w a TR resp e™tivelyF

PFP uey Īheduling

en en™ryptionGde™ryption key u for ƒ€iih is — ˜in—ry string of – ˜itsD where

– is —n integer ˜ etween RV —nd PST @in™lusiveA —nd divisi˜le ˜y ITF „he fun™tion

of the key s™heduling is to ’extend4 u into r words or round keys required ˜y

the r rounds of pro ™essingF „he following issues —re ™onsidered in designing the

key s™hedulingX

IF st is simpleF

PF st —llows f—st softw—re implement—tionF

QF st do es not h—ve trivi—l we—k keysF

RF st is oneEw—y —t le—st in — we—k senseF

„he ˜—si™ d—t— unit in the key s™heduling is — dou˜leE˜yte d—t—F „hus —n

– –

E˜yte key is rst tr—nsl—ted into intern—l dou˜leE˜yte d—t— units k ˜ D –E˜it or

H

V IT

–

k ˜ D F F FD k ˜ – denote the length of — key in F por ™onvenien™eD let – a

I d˜

I

IT

IT

dou˜leE˜ytesF „he key s™heduling —lgorithm extends k ˜ D k ˜ D F F FD k ˜ F into

H I – I

d˜

r

—n —rr—y of units k ˜ D k ˜ D F F FD k ˜ D k ˜ D F F FD k ˜ D where l —st is when

H I – I – l—stI

d˜ d˜

P

w a TRD r when w a IPVD —nd P  r when w a PST resp e™tivelyF pin—lly these

units —re tr—nsl—ted into round keys @wordsA required ˜y the r rounds in ƒ€iihF

uey ƒ™heduling of ƒ€iih

ƒtep IF vet k ˜‘H“D k ˜‘I“D F F FD k ˜‘l —st I“ ˜ e —n —rr—y of dou˜leE˜ytesD where l —st is

r

when w a TRD r when w a IPVD —nd P  r when w a PST resp e™tivelyF ‡e

P

store the origin—l –E˜it key in k ˜‘H“D F F FD k ˜‘– I“ —s – dou˜leE˜yte d—t—

d˜ d˜

itemsF xote th—t the order of the origin—l key ˜its is m—int—inedF

ƒtep PF „his step ™onstru™ts k ˜‘– “D F F FD k ˜‘l —st I“ from the user key d—t— k ˜‘H“D

d˜

F F FD k ˜‘– I“F st employs three dou˜leE˜yte ™onst—nts  D  —nd  F

d˜ –YH –YI –YP

IF vet ƒ a  D ƒ a  —nd ƒ a  F

H –YH I –YI P –YP

PF por i from – to l —st I do the followingX

d˜

@—A „ a q@ƒ Y ƒ Y ƒ AF

P I H

@˜A ‚ot—te „ to the right ˜y S ˜itsF

IT

@™A „ a „ C ƒ C k ˜‘j “ @mo d P AD where j a i @mo d – AF

P d˜

@dA k ˜‘i“ a „ F

@eA ƒ a ƒ D ƒ a ƒ D ƒ a „ F

P I I H H

sn the ™—l™ul—tionD q represents — ˜itEwise op er—tion dened ˜y

q@ƒ Y ƒ Y ƒ A a ƒ ƒ  ƒ ƒ  ƒ ƒ

P I H P I I H H P

where e—™h ƒ is — dou˜leE˜yte d—t—D ƒ ƒ represents the ˜itEwise exhD while

i i j

ƒ  ƒ the ˜itEwise ˆy‚ of the two d—t— involvedF

i j

ƒtep QF „his step tr—nsl—tes the l —st dou˜leE˜yte d—t— k ˜ D k ˜ D F F FD k ˜ into r

H I l—stI

w

rounds keysD e—™h ™omp osed of ˜itsF „he tr—nsl—tion m—int—ins the order

V

of the dou˜leE˜yte d—t—F

„he three dou˜leE˜yte ™onst—nts @ D  —nd  A used in the se™ond

–YH –YI –YP

step —re t—ken from the fr—™tion—l p—rt of the squ—re ro ot of ISF „he rst three

™onst—nts from the fr—™tion—l p—rt —re used for the ™—se of – a RVD the next three

—re for – a TRD —nd so onF „hus in tot—l RP ™onst—nts —re required for the IR

dierent key lengthsF „hese ™onst—nts —re shown ˜ elow in the hex—de™im—l formF

hpUf hTPW iWhf QTPp ShHH pPHp gQhI IphP SVWf RQIP WIif UIVi fpPe IiUh fPSU UUeT

ITSR TfPe HhWf eWhQ TTVp IWfi pVSS ThWV HPPh iRiP hHIU iePp USUP gQfS IHVT RVHg

QeeT WgeH WVpU hHiR PSQg gWHI SSpQ WfpR pTSW hUTg

„hese ™onst—nts —re o˜t—ined ˜y using the following w—ple progr—mX

re—dli˜@writeAY

open@sqrtISfr™AY

printlevel Xa EIY

higits Xa QHHY

result Xa ev—lf@sqrt@ISA E QAY

u Xa P ” ITY

for i from I ˜y I while i `a RP do

nextword Xa trun™@result B uAY

writeln@™onvert@nextwordDhexAAY

result Xa fr—™@result B uAY

odY

pigure Q illustr—tes the se™ond step involved in the key s™hedulingF es ™—n

˜ e seen from the gureD the key s™heduling —lgorithm h—s simil—rities with —n

iter—tive ™ipherD with — m— jor ex™eption ˜ eing th—t it is —n irreversi˜le pro ™essF

QQQl,2 l,1 l,0

kb 0 5 G

kb l/16

kbi mod (l/16) 5 G

kb i

i=l/16, ..., last-1

5 cyclic shift to the left by 5 bits

addition modulo 216 G (X2, X1, X0) = X2 X1 X1 X0 X0 X2 last = 2*r for w=256, r for w=128, and r/2 for w=64

QQQl,2 l,1 l,0 are constants l is the length of a key

Note: all data are of 16 bits

pigF QF ƒtep P in uey ƒ™heduling

PFQ he™ryption

es — priv—te key ™ipherD ƒ€iih uses the s—me key ˜ oth for en™ryption —nd

de™ryptionF „o de™rypt — ™iphertext g with — key u D the whole pro ™ess of the

—lgorithm is reversedD ex™ept the key s™heduling whi™h rem—ins undistur˜ edF

„o ˜ e more pre™iseD the intern—l op er—tions of e—™h € D i a IY PY QY RD will ˜ e

i

™ondu™ted in reverse orderD whi™hD —s depi™ted in pigure RD results in € or the

i

€ with su˜Ekey u D inverse of € F „he ™iphertext g will ˜ e pro ™essed rst ˜y

R R i

€ with u D € with u D —nd n—lly € with u F „he ow of d—t— followed ˜y

Q Q P P I I

in de™ryption is depi™ted in pigure SF

Q yn the ‚ound „r—nsform sed in ƒ€iih

„he widely used h—t— in™ryption ƒt—nd—rd or hiƒ ‘IH“ w—s ˜—sed on — funE

d—ment—l tr—nsform rst introdu™ed ˜y peistel ‘RD S“F sn its origin—l formD the

peistel tr—nsform ™—n ˜ e represented ˜y

s@vY ‚A a @‚Y v  f @‚AA

where v —nd ‚ —re ˜in—ry strings of equ—l lengthD  denotes ˜itEwise ˆy‚ —nd

f is — length preserving fun™tionF

sing — simil—r not—tionD — round in ƒ€iih ™—n ˜ e ™h—r—™terized ˜y

C

t@f Y FFF Y f Y f Y f A a @f Y FFF Y f Y f Y f h@f Y FFF Y f Y f AA

U P I H T I H U T I H

w

C

where e—™h f D i a HY IY FFF Y UD is — word of denotes —ddition mo dE ˜itsD

i

V

w

V

ulo P D —nd h is — fun™tion th—t shrinks U input words into oneF

„he round tr—nsform used in ƒ€iih ™—n ˜ e reg—rded —s — gener—liz—tion

of the peistel tr—nsformF sn p—rti™ul—rD the ide—s ˜ ehind the round tr—nsform

™—n ˜ e tr—™ed ˜—™k to theoreti™—l studies of the peistel tr—nsform ™—rried out

˜y the s—me —uthor in the l—te IWVH9s in ‘IU“D where three types of gener—lized

peistel tr—nsforms were suggestedD together with — thorough ex—min—tion of their

™ryptogr—phi™ prop ertiesF sn the terminology of ‘IU“D the round tr—nsform used

in ƒ€iih ™—n ˜ e reg—rded —s — ’lightEweight4 version of the inverse of the third

type of gener—lized peistel tr—nsformsF

„he round tr—nsform in ƒ€iih ™—n ˜ e further gener—lized to

t@f Y FFF Y f Y f Y f A a @f Y FFF Y f Y f Y f  h@f Y FFF Y f Y f AA

k I P I H k P I H k I k P I H

for —n integer k ! PF sing — te™hnique simil—r to th—t for proving „heorem gI

in ‘IU“D one ™—n show th—t the ™on™—ten—tion of r indep endent rounds of — tr—nsE

form dened ˜y the tr—nsform yields — soE™—lled sup erEpseudoEr—ndom p ermuE

t—tion ‘V“ if —nd only if r ! k C PF e pr—™ti™—l impli™—tion of this result is th—t

—t le—st IH rounds would ˜ e required ˜y ƒ€iihD should e—™h round employ —

fun™tion ™hosen indep endently —t r—ndomF

‡e note th—t more re™entlyD gener—lized peistel tr—nsforms h—ve found —ppliE

™—tions in — num˜er of oneEw—y h—shing —lgorithmsD in™luding whS ‘IQ“D ƒrƒ ‘II“D

re†ev ‘IV“ —nd other ™losely rel—ted —lgorithmsF c i,7 c i,6 c i,5 c i,4 c i,3 c i,2 c i,1 c i,0

Ki,r/4-1 F i

v Round 0 d

Rounds 1 ~ r/4-2

Ki,0 F i

v Round r/4-1 d

m i,7 m i,6 m i,5 m i,4 m i,3 m i,2 m i,1 m i,0

d Ki,j w/8 bits cyclic shift to the left by d bits, d=w/16-1=3, 7 or 15

v m i,j w/8 bits cyclic shift to the right by a variable number of bits w/8 c i,j w/8 bits addition modulo 2 w = 64, 128 or 256 taking the negative (=multiplying by -1) r = 32,36,40,...

F i bit-wise nonlinear Boolean operation

pigF RF € D the snverse of — €—ss €

i i C

K 4 P 4

K 3 P 3 C a ciphertext (64, 128 or 256 bits) K S M a plaintext (64, 128 or 256 bits) K a decryption key (48,64,.., or 256 bits) K 2 P 2 K i a sub-key (r/4 words, r=32,36,40,...)

Pi inverse of a pass Pi S key scheduling K 1 P 1

M

pigF SF he™ryption sing ƒ€iih

R xonline—r pun™tions sed in ƒ€iih

e fun™tion f on † D the ve™tor sp—™e of dimension nD is s—id to ˜ e nonline—r if it

n

is not —neF „he nonline—rity of f is dened —s the minimum dist—n™e from f

to —ll the —ne fun™tionsF st is known th—t the nonline—rity of — fun™tion on †

n

I

nI nI

P

F f is s—id to s—tisfy the prop—g—tion ™riterion is upp erE˜ ounded ˜y P P

with resp e™t to — ve™tor in † if ™omplementing —n input to f —™™ording to the

n

ve™tor results in the output of f to ˜ e ™omplemented SH7 of the timesF ytherwise

if it results in the output of f to ˜ e — ™onst—nt @H or IAD the ve™tor is s—id to

˜ e — line—r stru™ture of f F sn m—ny ™ryptogr—phi™ —ppli™—tionsD it is desir—˜le

for — fun™tion to ˜ e highly nonline—rD to s—tisfy the prop—g—tion ™riterion for

—s m—ny ve™tors —s p ossi˜leD —nd to h—ve —s few line—r stru™tures —s p ossi˜leF

es — det—iled dis™ussion on nonline—rity is out of the s™op e of this p—p erD the

re—der is referred to ‘ISD IT“ for relev—nt ™on™epts —s well —s v—rious metho ds for

™onstru™ting highly nonline—r fun™tionsF

pive nonline—r fun™tions —re used in ƒ€iih for ˜itEwise op er—tionsF „he rst

of these fun™tions is used in the key s™heduling pro ™essD while the other four in

the four intern—l pro ™esses € D € D € —nd € F

I P Q R

RFI sn the uey Īheduling

„he nonline—r fo ole—n fun™tion used in the key s™heduling ™—n ˜ e represented

˜y

g @x Y x Y x A a x x  x x  x x

P I H P I I H H P

g is — ˜—l—n™ed m— jority fun™tion with — nonline—rity of PD whi™h is the m—ximum

v—lue th—t ™—n ˜ e —™hieved ˜y — fun™tion on † F st s—tises the prop—g—tion ™riteE

Q

rion with resp e™t to —ll ˜ut oneD @IDIDIAD nonEzero ve™tors in † F „he s—me fun™tion

Q

w—s previously used in oneEw—y h—shing —lgorithms ƒrƒ ‘II“ —nd whR ‘IP“F

RFP sn € D € D € —nd €

I P Q R

„he four nonline—r fo ole—n fun™tions used in € D € D € —nd € —re represented

I P Q R

˜y

f @x Y x Y FFF Y x A a x x  x x  x x  x x  x

I T S H T Q S I R P I H H

f @x Y x Y FFF Y x A a x x x  x x x  x x  x x  x x  x x  x

P T S H T R H R Q H S P R Q R I Q H I

f @x Y x Y FFF Y x A a x x x  x x  x x  x x  x x  x

Q T S H S R H T R S P Q H I H Q

f @x Y x Y FFF Y x A a x x x x  x x  x x  x x  x x  x

R T S H T R P H T S R Q Q P I H P

xote th—t f D f —nd f D in their origin—l formsD were previously used in — oneE

I Q R

w—y h—shing —lgorithm ™—lled re†ev ‘IV“ @in its €—sses ID Q —nd S resp e™tivelyAF

f is ™onstru™ted using — te™hnique shown in ƒe™tion VFQ of ‘IT“F

P

„he four fun™tions f D f D f —nd f —ll h—ve very go o d prop—g—tion or

I P Q R

—v—l—n™he ™h—r—™teristi™sF sn p—rti™ul—rD

IF f s—tises the prop—g—tion ™riterion with resp e™t to —ll ˜ut one nonEzero

I

ve™tors in † F „he ve™tor where the prop—g—tion ™riterion is not s—tised is

U

the only nonEzero line—r stru™ture of the fun™tionF

„he s—me is true for fun™tions f —nd f F

Q R

PF f s—tises the prop—g—tion ™riterion with resp e™t to —ll ˜ut ve @SA nonEzero

P

ve™tors in † F sn ™ontr—st to f D f —nd f D none of the ve ve™tors where

U I Q R

the prop—g—tion ™riterion is not s—tised is — line—r stru™ture of f F ren™e f

P P

do es not h—ve — nonEzero line—r stru™tureF

sn —dditionD

IF „hey —™hieve the m—ximum nonline—rity ST on † F

U

PF „hey —re —ll ˜—l—n™edF

QF „hey —re inequiv—lent in the sense th—t they ™—nnot ˜ e ™onverted into one

—nother vi— — nonEsingul—r —ne tr—nsform on input ™o ordin—tesF @„he inE

equiv—len™e of f D f —nd f is due to the f—™t th—t e—™h h—s — dierent

I Q R

—lge˜r—i™ degreeF yn the other h—ndD —s f h—s dierent prop—g—tion ™h—r—™E

P

teristi™sD it is equiv—lent to none of the other three fun™tionsFA

RF ell nonEzero line—r ™om˜in—tions of them —re ˜—l—n™edF emong the fteen

dierent ™om˜in—tionsD nine —™hieve the highest nonline—rity STD three —™hieve

SPD —nd the other three —™hieve RVF

st should ˜ e —dded th—t the ™o ordin—tes of f D f D f —nd f h—ve ˜ een reE

I P Q R

ordered ˜ efore they t—ke the ™urrent formsF yrigin—lly the four fun™tions —re —s

followsX



f @x Y x Y FFF Y x A a x x  x x  x x  x x  x

T S H I R P S Q T H I H

I



f @x Y x Y FFF Y x A a x  x x  x x  x x  x x x  x x x  x x

T S H R R T Q T Q S P S T Q S T H I

P



f @x Y x Y FFF Y x A a x x x  x x  x x  x x  x x  x

T S H I P Q I R P S Q T H Q H

Q



f @x Y x Y FFF Y x A a x x  x x  x x  x x x x  x x  x

T S H I R P S Q T H I P Q H S H

R

„he ™o ordin—tes of the four origin—l fun™tions —re reEordered —™™ording to

„—˜le Q so th—t the resulting fun™tions fulll the requirement th—t —ll their nonE

zero line—r ™om˜in—tions —re ˜—l—n™edF „hese reEorderings h—ve ˜ een o˜t—ined

through r—ndom s—mplingF

pun™tion x x x x x x x

T S R Q P I H

5 5 5 5 5 5 5



f x x x x x x x

P Q S R T I H

I



f x x x x x x x

R H I Q T S P

P



f x x x x x x x

I P T H S R Q

Q



f x x x x x x x

I Q S H R T P

R

„—˜le QF ‚eEordering the go ordin—tes

S ƒe™urity of ƒ€iih

„here —re two ™iphers th—t —re stru™tur—lly rel—ted to ƒ€iihF „hese two —lE

gorithms —re ‚gS ‘IR“ —nd w—™qun ‘Q“F es w—™qun round tr—nsforms —re

˜—sed on — very simple reE—rr—ngement of the su˜stitution ˜ oxes @ƒE˜ oxesA used

in hiƒD ƒ€iih is ™loser to ‚gS th—n to w—™qunF

elthough ƒ€iih —nd ‚gS sh—re the s—me fe—ture th—t ˜ oth ™iphers supp ort

three v—ri—˜le p—r—metersD n—mely d—t— lengthD key length —nd the num˜er of

roundsD there —re two —sp e™ts th—t dierenti—te the former from the l—tterF pirstD

the key s™heduling pro ™edures of the two ™iphers ˜ e—r no resem˜l—n™eF ƒe™ondD

ƒ€iih employs — fo ole—n fun™tion with the m—ximum nonline—rity in e—™h

roundD —lone with — d—t—Edep endent ™y™li™ shiftF sn ™ontr—stD — d—t—Edep endent

™y™li™ shift is the only nonline—r op er—tion involved in — round in ‚gSF

sn ‘T“D u—liski —nd ‰in h—ve presented ™onvin™ing eviden™e whi™h suggests

th—t ‚gS ˜ e se™ure —g—inst ˜ oth line—r —nd dierenti—l —tt—™ks if the num˜er of

@dou˜leA rounds in ‚gS is IP or moreF @ƒee —lso — rened —n—lysis ˜y unudsen

—nd weier ‘U“FA

pigure T shows — @dou˜leA round in ‚gS whi™h involves two ™y™li™ shifts —nd

—™hieves — mixing ee™t in th—t ˜ oth output words —re — mixture of ˜ oth input

wordsF es ƒ€iih h—s eight words in its input —nd output d—t—D eight rounds —re

required to —™hieve — simil—r mixing ee™tD n—mely e—™h output word is — fun™E

tion of —ll eight input wordsF „hereforeD stru™tur—lly — r Eround version of ƒ€iih

r

roughly ™orresp onds to — E@dou˜leA round version of ‚gSF hue to the use of

V

m—xim—lly nonline—r fun™tions in ƒ€iihD we exp e™t th—t for r ! QPD ƒ€iih

r

E@dou˜leA round ‚gSF „he re—der is invited to ex—mE is —t le—st —s se™ure —s —

V

ine the se™urity of ƒ€iih —g—inst —ll —tt—™ksD in™luding line—r —nd dierenti—l ™rypt—n—lysisF

A B B

B

S[2*i]

AB B

B

S[2*i+1]

AB

B cyclic shift to the left by a variable number of bits (determined by the lower bits of B)

S is an array of 2*(r+1) round keys

pigF TF e @hou˜leA ‚ound in ‚gS

„—˜le I suggests v—rious p ossi˜le ™om˜in—tions of the p—r—meters w D – —nd r

th—t would provide —dequ—te se™urity for ™ommer™i—l —ppli™—tionsF

T „hroughput —nd gomp—™tness of ƒ€iih

st ™—n ˜ e seen from pigure P th—t e—™h round involves the following op er—tionsX

IF e nonline—r ˜itEwise op er—tion on U wordsF „he ex—™t time for exe™uting it is

determined ˜y the ™omplexity of the nonline—r fun™tionD —nd more ™riti™—llyD

˜y the num˜er of f—st h—rdw—re registers within — g€ whi™h —re dire™tly

—v—il—˜le to — ™ryptogr—phi™ —ppli™—tion th—t employs the ™ipherF „he more

h—rdw—re registers the g€ h—sD the f—ster the op er—tionF

PF „wo ™y™li™ shift op er—tionsF yn most m—™hinesD they —re exe™uted qui™klyD

indep endently of the num˜er of ˜its to ˜ e ™y™li™—lly shiftedF

w

V

F „he one whi™h is not shown in pigure P is used QF „wo —dditions mo dulo P

for nding out the num˜er of ˜its for the output of the ˜itEwise op er—tion

to ˜ e ™y™li™—lly shiftedF

„he key s™heduling involves —dditionsD ˜itEwise nonline—r fo ole—n op er—tions

–

—nd rot—tionsD e—™h @l —st A timesF

IT

e str—ightforw—rd implement—tion of ƒ€iih in the progr—mming l—ngu—ge

g h—s ˜ een ™—rried outF „—˜le R shows the throughput @the num˜er of ˜its enE

™ryptedGde™rypted p er unit of timeA of the implement—tion on — ƒun ltr—ƒp—r™ P

interprise @PHHwrzA —s well —s on — €entium €ro IVHF foth m—™hines run on the

ƒol—ris PFSFI op er—ting systemF yn the ltr—ƒp—r™ the gg ™omm—nd ™—lls ƒp—r™E

gompiler gCC RFID while on the €entium it ™—lls €rogompiler gCC QFHIF „he

throughput indi™—tors h—ve —ll ˜ een o˜t—ined for — situ—tion where the key s™hedE

ule is ™—lled only on™eF „he t—˜le ™le—rly shows th—t when the num˜er of rounds

—re the s—meD PSTE˜it ƒ€iih is twi™e —s f—st —s IPVE˜it ƒ€iihD —nd four times

—s f—st —s TRE˜it ƒ€iihF por ™omp—risonD the throughput of the shie ™ipher

h—s —lso ˜ een listed —t the ˜ ottom of the t—˜leF

es the nonline—r fo ole—n op er—tion in e—™h round of ƒ€iih involves seven

wordsD in™re—se in the throughput of ƒ€iih ™—n ˜ e dr—m—ti™ when it is m—de

p—r—llel ˜y h—rdw—reF sn —dditionD pip eEline pro ™essingD —nd more signi™—ntlyD

p—rti—l p—r—llel exe™ution of up to six ™onse™utive rounds ™—n ˜ e implemented

˜y h—rdw—reF „his ™—n ˜ e seen from the f—™t th—t p—rt of the nonline—r fo ole—n

op er—tion in the se™ond roundD whi™h is not determined ˜y the out™ome of the

rst roundD ™—n ˜ e ™—rried out while the rst round is ˜ eing exe™utedF nder

— ™onserv—tive —ssumption th—t h—rdw—re implement—tion ™—n ˜ e PH times —s

f—st —s its softw—re ™ounterp—rt on — ƒun ltr—ƒp—r™ @PHHwrzAD the throughput

of @PSTY –Y TRAEƒ€iihD would ˜ e ˜ o osted to WTT meg—˜itGse™ondF ƒu™h — high

throughput would ˜ e —dequ—te even for —ppli™—tions on future gig—˜it networksF

pin—llyD —s indi™—ted ˜y the str—ightforw—rd ™o ding of the ™ipher in the proE

gr—mming l—ngu—ge gD ƒ€iih is suit—˜le for ™omp—™t implement—tion either ˜y

softw—re or h—rdw—reF sn p—rti™ul—rD when ™ompiled using –g™™ EyP9 on the lE

tr—ƒp—r™ m—™hineD the o˜ je™t ™o de for the g implement—tion o ™™upies less th—n

Q kiloE˜ytesF sn™ident—llyD this ™oin™ides with the size of the o˜ je™t ™o de of —

str—ightforw—rd implement—tion of the shie ™ipher ˜y ‚F he wolinerD —lso in

the progr—mming l—ngu—ge gF

snst—n™es of throughput @meg—˜itsGse™ondA

ƒ€iih on ltr—ƒp—r™ PHH on €entium €ro IVH

g™™ gg g™™ gg

@PSTY –Y RVAEƒ€iih RRFWI RVFQH PUFPQ PUFVQ

@PSTY –Y TRAEƒ€iih QRFIQ QTFSU IVFWT PHFVI

@PSTY –Y VHAEƒ€iih PUFVQ PWFUU ISFQQ ITFSP

@PSTY –Y WTAEƒ€iih PQFHT PRFSV IPFVR IQFTW

@IPVY –Y RVAEƒ€iih PIFQQ PRFTP IPFRQ IHFRI

@IPVY –Y TRAEƒ€iih ITFPH IVFSS WFRV UFUI

@IPVY –Y VHAEƒ€iih IPFWQ IRFVV UFTP TFIS

@IPVY –Y WTAEƒ€iih IHFVS IPFSS TFQU SFIP

@TRY –Y TRAEƒ€iih VFHH WFPV RFUR SFQV

@TRY –Y VHAEƒ€iih TFRT UFRR QFVQ RFQP

@TRY –Y WTAEƒ€iih SFRP TFPU QFPP QFST

shie UFUS ITFQH IQFTR WFQV

@IA gompilers —nd optionsX

–g™™ EyP9 on ˜ oth m—™hinesD

–gg Ef—st ExyR Ext—rgetaultr—9 on ltr—ƒp—r™D —nd

–gg Ef—st ExyR Epentium9 on €entium

@PA shie is tested using — p—™k—ge written ˜y ‚F he wolinerF

„—˜le RF „hroughput of ƒ€iih @—nd shieA

U sing ƒ€iih in yneE‡—y r—shing

ƒ€iih is — promising ™—ndid—te for digit—lly ngerEprinting or oneEw—y h—shing

— mess—ge of —r˜itr—ry lengthF „he length of — ngerEprint ™—n ˜ e up to w a PST

˜itsF st is exp e™ted th—t it is pr—™ti™—lly infe—si˜le to nd two or more dierent

mess—ges th—t h—ve the s—me ngerEprintF

vet – a PST —nd w ˜ e —n integer l—rger th—n or equ—l to the required num˜er

of ˜its in — ngerEprintF por the s—ke of e™ien™yD r m—y ˜ e ™hosen from ˜ etween

QP —nd RVF por e—™h mess—ge w to ˜ e h—shedD we —tt—™h to the end of w three

eldsF „he rst eld st—rts with — ˜it I whi™h is followed ˜y zero or more ˜it

H9s so th—t the length @in ˜itsA of the nowEexp—nded mess—ge is IVR mo dulo PSTF

„he se™ond eld h—s TR ˜its indi™—ting the length of w D iFeFD the num˜er of ˜its

in w F end n—llyD the third eld ™onsists of V ˜its whi™h indi™—te the required

num˜er of ˜its in the n—l ngerEprintF sn wh—t follows it will ˜ e™ome ™le—r th—t

sin™e the three elds —re —tt—™hed to the end of w D the op er—tion do es not h—ve

to ˜ e ™—rried out until h—shing the l—st ˜lo ™k @of PST ˜its or lessA in w F „his is

useful in su™h — situ—tion —s when the length of w is not known ˜ eforeh—ndF

xow denote ˜y w Y w Y FFF Y w the p—dded mess—geD where e—™h w

nI nP H i

™onsists of PST ˜itsF „he ngerEprint of the mess—ge is o˜t—ined in the following

w—yX

h a HY

H

h a h C ƒ € i i h @h AY i a HY IY FFF Y n IX

iCI i w i

i

„he ngerEprint of the origin—l mess—ge w is represented ˜y the desired num˜er

of ˜its in the right h—nd side of h F

n

xote th—t in the ™—l™ul—tionD ƒ € i i h @h A should ˜ e interpreted —s s™r—mE

w i

i

˜ling h with w —s — keyD —nd the summ—tion is wordEwise —ddition mo dulo

i i

w

V

P F

V sing ƒ€iih in €seudoE‚—ndom xum˜er qener—tion

es — ˜lo ™k ™ipherD ƒ€iih ™—n serve —s — ™ryptogr—phi™—lly strong pseudoE

r—ndom num˜er gener—tor when used in the output feed˜—™k mo de @ypfAF

enother simple w—y to gener—te ™ryptogr—phi™—lly strong pseudoEr—ndom

num˜ers is ˜—sed on the o˜serv—tion th—t if ƒ€iih is — strong ™ipherD then

it —™ts —s — pseudoEr—ndom fun™tion whi™h pro du™es w a TRD IPV or PST pseudoE

r—ndom ˜its p er —ppli™—tion of the —lgorithmF vet ƒ ˜ e — r—ndom seed of PST

˜itsF essume th—t s g is — w E˜it initi—l ™onst—nt v—lueF „hen

ƒ € i i h @s g C iAY i a HY IY PY FFF Y

ƒ

denes — pseudoEr—ndom string th—t ™—n ˜ e used in ™ryptogr—phi™ —ppli™—tionsF

w

xote th—t s g C i should ˜ e interpreted —s s g C i mo dulo P F

e™knowledgments

st is the —uthor9s gre—test ple—sure to th—nk the following p eopleX ˆi—nEwo h—ng

for v—rious dis™ussions on nonline—r fo ole—n fun™tionsD „oshiy— stoh —nd —nonyE

mous referees for pin—n™i—l gryptogr—phy9WU for suggestions th—t h—ve help ed

improve the des™ription of the ™ipherD u—i y9‰—ng for —ssist—n™e with smo oth

l—nding on w—rs @ƒp—r™ IHAD tove @€entium €ro IVHA —nd ƒ—turn @ ltr—ƒp—r™D

PHHwrzA to test the throughput of ƒ€iihD —nd n—lly v—rs unudsen —nd r—ns

ho˜˜ ertin for helpful ™ommentsF

‚eferen™es

IF fih—mD iFD —nd ƒh—mirD eF hierenti—l grypt—n—lysis of the h—t— in™ryption

ƒt—nd—rdF ƒpringerE†erl—gD xew ‰orkD reidel˜ ergD „okyoD IWWQF

PF fl—zeD wFD hiffieD ‡FD ‚ivestD ‚FD ƒ™hneierD fFD ƒhimomur—D „FD „hompE

sonD iFD —nd ‡ienerD wF winim—l key length for symmetri™ ™iphers to provide

—dequ—te ™ommer™i—l se™urityD t—nu—ry IWWTF

QF fl—zeD wFD —nd ƒ™hneierD fF „he w—™qun ˜lo ™k ™ipher —lgorithmF sn p—st

ƒoftw—re in™ryption @ferlinD xew ‰orkD „okyoD IWWSAD volF IHHV of ve™ture xotes

in gomputer ƒ™ien™eD ƒpringerE†erl—gD ppF WU{IIHF

RF peistelD rF gryptogr—phy —nd ™omputer priv—™yF ƒ™ienti™ emeri™—n PPV @IWUQAD

IS{PQF

SF peistelD rFD xotzD ‡F eFD —nd ƒmithD tF vF ƒome ™ryptogr—phi™ te™hniques

for m—™hineEtoEm—™hine d—t— ™ommuni™—tionsF €ro™eedings of siii TQD II @IWUSAD

ISRS{ISSRF

TF u—liskiD fFD —nd ‰inD ‰F yn dierenti—l —nd line—r ™rypt—n—lysis of the ‚gS enE

™ryption —lgorithmF sn edv—n™es in gryptology E g‚‰€„y9WS @ferlinD xew ‰orkD

„okyoD IWWSAD volF WTQ of ve™ture xotes in gomputer ƒ™ien™eD ƒpringerE†erl—gD

ppF IUI{IVRF

UF unudsenD vFD —nd weierD ‡F smproved dierenti—l —tt—™ks on ‚gSF sn edv—n™es

in gryptology E g‚‰€„y9WT @ferlinD xew ‰orkD „okyoD IWWTAD volF IIHW of ve™ture

xotes in gomputer ƒ™ien™eD ƒpringerE†erl—gD ppF PIT{PPVF

VF vu˜yD wFD —nd ‚—™koffD gF row to ™onstru™t pseudor—ndom p ermut—tions from

pseudor—ndom fun™tionsF ƒsew tourn—l on gomputing IUD P @IWVVAD QUQ{QVTF e

prelimin—ry version in™luding other results —pp e—red in the €ro ™eedings of the IVth

egw ƒymp osium on „heory of gomputingD IWVTD ppFQSTEQTQF

WF w—tsuiD wF vine—r ™rypt—n—lysis metho d for hiƒ ™ipherF sn edv—n™es in grypE

tology E i ‚yg‚‰€„9WQ @IWWRAD volF UTSD ve™ture xotes in gomputer ƒ™ien™eD

ƒpringerE†erl—gD ferlinD reidel˜ ergD xew ‰orkD ppF QVT{QWUF

IHF x—tion—l fure—u of ƒt—nd—rdsF h—t— en™ryption st—nd—rdF peder—l snform—E

tion €ro ™essing ƒt—nd—rds €u˜li™—tion ps€ƒ € f RTD FƒF hep—rtment of gomE

mer™eD t—nu—ry IWUUF

IIF x—tion—l snstitute of ƒt—nd—rds —nd „e™hnologyF ƒe™ure h—sh st—nd—rdF

peder—l snform—tion €ro ™essing ƒt—nd—rds €u˜li™—tion ps€ƒ € f IVHEID FƒF heE

p—rtment of gommer™eD epril IWWSF

IPF ‚ivestD ‚F „he whR mess—ge digest —lgorithmD epril IWWPF ‚equest for gomE

ments @‚pgA IQPHF @elso presented —t grypto9WHD IWWHAF

IQF ‚ivestD ‚F „he whS mess—ge digest —lgorithmD epril IWWPF ‚equest for gomE

ments @‚pgA IQPIF

IRF ‚ivestD ‚F „he ‚gS en™ryption —lgorithmF sn p—st ƒoftw—re in™ryption @ferlinD

xew ‰orkD „okyoD IWWSAD volF IHHV of ve™ture xotes in gomputer ƒ™ien™eD ƒpringerE

†erl—gD ppF VT{WTF

ISF ƒe˜erryD tFD h—ngD ˆF wFD —nd hengD ‰F xonline—rity —nd prop—g—tion ™h—rE

—™teristi™s of ˜—l—n™ed ˜ o ole—n fun™tionsF snform—tion —nd gomput—tion IIWD I

@IWWSAD I{IQF

ITF h—ngD ˆF wFD —nd hengD ‰F gh—r—™terizing the stru™tures of ™ryptogr—phi™

fun™tions s—tisfying the prop—g—tion ™riterion for —lmost —ll ve™torsF hesignD godes

—nd gryptogr—phy U D IGP @IWWTAD III{IQRF sp e™i—l issue dedi™—ted to qus ƒimmonsF

IUF hengD ‰FD w—tsumotoD „FD —nd sm—iD rF yn the ™onstru™tion of ˜lo ™k ™iphers

prov—˜ly se™ure —nd not relying on —ny unproved hypothesesF sn edv—n™es in

gryptology E g‚‰€„y9VW @ferlinD xew ‰orkD „okyoD IWWHAD volF RQS of ve™ture

xotes in gomputer ƒ™ien™eD ƒpringerE†erl—gD ppF RTI{RVHF

IVF hengD ‰FD €ieprzykD tFD —nd ƒe˜erryD tF re†ev E — oneEw—y h—shing —lgoE

rithm with v—ri—l˜e length of outputF sn edv—n™es in gryptology E e ƒg‚‰€„9WP

@ferlinD xew ‰orkD „okyoD IWWQAD tF ƒe˜ erry —nd ‰F hengD idsFD volF UIV of ve™ture

xotes in gomputer ƒ™ien™eD ƒpringerE†erl—gD ppF VQ{IHRF

gerti™—tion h—t— for ƒ€iih

h—t— —re represented in the hex—de™im—l formF „he ˜yte order used in showing

the d—t— is —s followsX

the most signi™—nt ˜yte





the le—st signi™—nt ˜yte

ƒ€iih•he„e•vix a TRD ƒ€iih•ui‰•vix a TRD ƒ€iih•xy•yp•‚xh a TR

key a HH HH HH HH HH HH HH HH

pl—intext a HH HH HH HH HH HH HH HH

™iphertext a Pi HH VH IW fg PT VS Th

ƒ€iih•he„e•vix a IPVD ƒ€iih•ui‰•vix a IPVD ƒ€iih•xy•yp•‚xh a IPV

key a pp pp pp pp pp pp pp pp pp pp pp pp pp pp pp pp

pl—intext a pp pp pp pp pp pp pp pp pp pp pp pp pp pp pp pp

™iphertext a Tg IQ iR fW gQ IU IS UI ef SR hV IT WI Sf gR iV

ƒ€iih•he„e•vix a PSTD ƒ€iih•ui‰•vix a PSTD ƒ€iih•xy•yp•‚xh a PST

key a TH Sp Si Sh Sg Sf Se SW SV SU ST SS SR SQ SP SI

SH Rp Ri Rh Rg Rf Re RW RV RU RT RS RR RQ RP RI

pl—intext a Ip Ii Ih Ig If Ie IW IV IU IT IS IR IQ IP II IH

Hp Hi Hh Hg Hf He HW HV HU HT HS HR HQ HP HI HH

™iphertext a Qh iI Tg pe We TP TV RU RQ Ri IS UR TW Qp ig If

Qp ee SS Ve PW Tf TI hU HV fI QI gg fe QI IH TV

—

„his —rti™le w—s pro ™essed using the v „ ˆ m—™ro p—™k—ge with vvxgƒ style i