Sp eci cation of C amel l ia | a 128-bit Blo ck Cipher y z y Kazumaro AOKI , Tetsuya ICHIKAWA , Masayuki KANDA , z y z z Mitsuru MATSUI , Shiho MORIAI , Junko NAKAJIMA , Toshio TOKITA y z Nipp on Telegraph and Telephone Corp oration, Mitsubishi Electric Corp oration Version 1.0: July 12, 2000 Version 2.0: September 26, 2001 Contents 1 Intro duction 3 2 Notations and Conventions 3 2.1 Radix . 3 2.2 Notations . 3 2.3 List of Symbols . 3 2.4 Bit/Byte Ordering . 3 3 Structure of C amel l ia 5 3.1 List of Functions and Variables . 5 3.2 Encryption Pro cedure . 5 3.2.1 128-bit key . 5 3.2.2 192-bit and 256-bit key . 6 3.3 Decryption Pro cedure . 6 3.3.1 128-bit key . 6 3.3.2 192-bit and 256-bit key . 7 3.4 Key Schedule . 8 4 Comp onents of C amel l ia 10 4.1 F -function . 10 4.2 FL-function . 10 1 4.3 FL -function . 10 4.4 S -function . 10 4.5 s-b oxes . 11 4.6 P -function . 15 A Figures of the Camellia Algorithm 16 B Test Data 22 1 Copyright NTT and Mitsubishi Electric Corp oration 2000-2001 2 C Software Implementation Techniques 22 C.1 Setup . 22 C.1.1 Store All Subkeys . 22 C.1.2 Subkey Generation Order . 23 C.1.3 XOR Cancellation Prop erty in Key Schedule . 23 C.1.4 Rotation Bits for K , K , K ,andK . 23 L R A B C.1.5 kl and kl Generation from k and k . 23 5 6 11 12 C.1.6 On-the- y Subkey Generation . 23 C.1.7 128-bit key and 192/256-bit key . 23 C.1.8 How to Rotate an ElementinQ . 23 C.1.9 F -function . 24 C.1.10 Keyed Functions . 24 C.2 Data Randomization . 24 C.2.1 Endian Conversion . 24 C.2.2 1-bit Rotation in Little Endian Interpretation . 25 C.2.3 Whitening . 25 C.2.4 Key XOR . 25 C.2.5 S -function . 26 C.2.6 P -function . 26 C.2.7 Substitution and Permutation . 27 C.2.8 Making Indices for s-b ox . 29 C.3 General Guidelines . 30 D Design Policy 30 E Design Rationale 31 E.1 F -function . 31 E.2 P -function . 31 E.3 s-b oxes . 32 F Version Information 32 G Ob ject Identi er 33 H Applications and Pro ducts 33 Copyright NTT and Mitsubishi Electric Corp oration 2000-2001 3 1 Intro duction This do cument shows a complete description of the encryption algorithm Camel lia, which is a secret key cipher with 128-bit data blo ck and 128/192/256-bit secret key. 2 Notations and Conventions 2.1 Radix We use the pre x 0x to indicate hexadecimal numb ers. 2.2 Notations Throughout this do cument, the following notations are used. 8 B denotes a vector space of 8-bit (byte) elements; that is, B := GF (2) . 4 W denotes a vector space of 32-bit (word) elements; that is, W := B . 8 L denotes a vector space of 64-bit (double word) elements; that is, L := B . 16 Q denotes a vector space of 128-bit (quad word) elements; that is, Q := B . An element with the sux (e.g. x )shows that the elementisn-bit long. (n) (n) An element with the sux (e.g. x ) denotes left-half part of x. L L An element with the sux (e.g. x ) denotes right-half part of x. R R The sux will b e omitted if no ambiguity is exp ected. See section 2.4 for numerical examples (n) of \left" and \right". 2.3 List of Symbols The bitwise exclusive-OR op eration. jj The concatenation of the two op erands. <<< The left circular rotation of the op erand by n bits. n \ The bitwise AND op eration. [ The bitwise OR op eration. x The bitwise complementof x. 2.4 Bit/Byte Ordering We adopt big endian ordering. The following example shows how to comp ose a 128-bit value Q (128) of two 64-bit values L (i = 1; 2), four 32-bit values W (i = 1; 2; 3; 4), sixteen 8-bit values i(64) i(32) B (i =1; 2;::: ;16), or 128 1-bit values E (i =1; 2;::: ;128), resp ectively. i(8) i(1) Copyright NTT and Mitsubishi Electric Corp oration 2000-2001 4 Q = L jjL (128) 1(64) 2(64) = W jjW jjW jjW 1(32) 2(32) 3(32) 4(32) = B jjB jjB jjB jj ::::::jjB jjB jjB jjB 1(8) 2(8) 3(8) 4(8) 13(8) 14(8) 15(8) 16(8) = E jjE jjE jjE jj ::::::::::::::::::jjE jjE jjE jjE 1(1) 2(1) 3(1) 4(1) 125(1) 126(1) 127(1) 128(1) Numerical examples: Q = 0x0123456789ABCDEF0011223344556677 (128) (128) L = Q = 0x0123456789ABCDEF 1(64) L(64) (64) L = Q = 0x0011223344556677 2(64) R(64) (64) W = L = 0x01234567 1(32) 1L(32) (32) W = L = 0x89ABCDEF 2(32) 1R(32) (32) W = L = 0x00112233 3(32) 2L(32) (32) W = L = 0x44556677 4(32) 2R(32) (32) B = 0x01 ; B = 0x23 ; B = 0x45 ; B = 0x67 ; 1(8) (8) 2(8) (8) 3(8) (8) 4(8) (8) B = 0x89 ; B = 0xAB ; B = 0xCD ; B = 0xEF ; 5(8) (8) 6(8) (8) 7(8) (8) 8(8) (8) B = 0x00 ; B = 0x11 ; B = 0x22 ; B = 0x33 ; 9(8) (8) 10(8) (8) 11(8) (8) 12(8) (8) B = 0x44 ; B = 0x55 ; B = 0x66 ; B = 0x77 ; 13(8) (8) 14(8) (8) 15(8) (8) 16(8) (8) E = 0 ; E = 0 ; E = 0 ; E = 0 ; 1(1) (1) 2(1) (1) 3(1) (1) 4(1) (1) E = 0 ; E = 0 ; E = 0 ; E = 1 ; 5(1) (1) 6(1) (1) 7(1) (1) 8(1) (1) . E = 0 ; E = 1 ; E = 1 ; E = 1 ; 121(1) (1) 122(1) (1) 123(1) (1) 124(1) (1) E = 0 ; E = 1 ; E = 1 ; E = 1 : 125(1) (1) 126(1) (1) 127(1) (1) 128(1) (1) Q <<< = E jjE jjE jjE jj ::::::::::::::::::jjE jjE jjE jjE jjE 1 (128) 2(1) 3(1) 4(1) 5(1) 125(1) 126(1) 127(1) 128(1) 1(1) = 0x02468ACF13579BDE0022446688AACCEE (128) Copyright NTT and Mitsubishi Electric Corp oration 2000-2001 5 3 Structure of Camellia 3.1 List of Functions and Variables M The plaintext blo ck. (128) C The ciphertext blo ck. (128) K The secret key, whose length is 128, 192, or 256 bits. kw ;k ;kl The subkeys. t(64) u(64) v (64) (t =1; 2; 3; 4) (u =1; 2;::: ;18) (v =1; 2; 3; 4) for 128-bit secret key. (t =1; 2; 3; 4) (u =1; 2;::: ;24) (v =1; 2;::: ;6) for 192-bit and 256-bit secret key. Y = F (X , k ) The F -function that transforms a 64-bit input X to a (64) (64) (64) (64) 64-bit output Y using a 64-bit subkey k . (64) (64) Y = FL(X ;k ) The FL-function that transforms a 64-bit input X to a (64) (64) (64) (64) 64-bit output Y using a 64-bit subkey k . (64) (64) 1 1 Y = FL (X ;k ) The FL -function that transforms a 64-bit input X to (64) (64) (64) (64) a 64-bit output Y using a 64-bit subkey k . (64) (64) Y = S (X ) The S -function that transforms a 64-bit input X to a (64) (64) (64) 64-bit output Y . (64) Y = P (X ) The P -function that transforms a 64-bit input X to a (64) (64) (64) 64-bit output Y . (64) y = s (x ) The s-b oxes that transform an 8-bit input to an 8-bit output i (8) (8) (i =1; 2; 3; 4). 3.2 Encryption Pro cedure 3.2.1 128-bit key Figure 1 shows the encryption pro cedure for a 128-bit key. The data randomizing part has an 1 18-round Feistel structure with two F L=F L -function layers after the 6-th and 12-th rounds, and 128-bit XOR op erations b efore the rst round and after the last round. The key schedule part generates subkeys kw (t =1; 2; 3; 4), k (u =1; 2;::: ;18) and kl (v =1; 2; 3; 4) from the t(64) u(64) v (64) secret key K ; see section 3.4 for details of the key schedule part. In the data randomizing part, rst the plaintext M is XORed with kw jjkw and (128) 1(64) 2(64) separated into L and R of equal length, i.e., M (kw jjkw ) = L jjR . 0(64) 0(64) (128) 1(64) 2(64) 0(64) 0(64) Then, the following op erations are p erfomed from r = 1 to 18, except for r = 6 and 12; L = R F (L ;k ); r r 1 r 1 r R = L : r r 1 Copyright NTT and Mitsubishi Electric Corp oration 2000-2001 6 For r = 6 and 12, the following is carried out; 0 L = R F (L ;k ); r 1 r 1 r r 0 R = L ; r 1 r 0 L = FL(L ;kl ); r 2r=61 r 1 0 R = FL (R ;kl ): r 2r=6 r Lastly, R and L are concatenated and XORed with kw jjkw .