Independent Submission S. Kiyomoto
Request for Comments: 7008 W. Shin
Category: Informational KDDI R&D Laboratories, Inc.
ISSN: 2070-1721 August 2013 A Description of the KCipher-2 Encryption Algorithm
Abstract
This document describes the KCipher-2 encryption algorithm.
KCipher-2 is a stream cipher with a 128-bit key and a 128-bit
initialization vector. Since the algorithm for KCipher-2 was
published in 2007, security and efficiency have been rigorously
evaluated through academic and industrial studies. As of the
publication of this document, no security vulnerabilities have been
found. KCipher-2 offers fast encryption and decryption by means of
simple operations that enable efficient implementation. KCipher-2
has been used for industrial applications, especially for mobile
health monitoring and diagnostic services in Japan.
Status of This Memo
This document is not an Internet Standards Track specification; it is
published for informational purposes.
This is a contribution to the RFC Series, independently of any other
RFC stream. The RFC Editor has chosen to publish this document at
its discretion and makes no statement about its value for
implementation or deployment. Documents approved for publication by
the RFC Editor are not a candidate for any level of Internet
Standard; see Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc7008.
Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document.
C.2.13. S after init(13) . . . . . . . . . . . . . . . . . . . 33C.2.14. S after init(14) . . . . . . . . . . . . . . . . . . . 33C.2.15. S after init(15) . . . . . . . . . . . . . . . . . . . 33C.2.16. S after init(16) . . . . . . . . . . . . . . . . . . . 34C.2.17. S after init(17) . . . . . . . . . . . . . . . . . . . 34C.2.18. S after init(18) . . . . . . . . . . . . . . . . . . . 34C.2.19. S after init(19) . . . . . . . . . . . . . . . . . . . 34C.2.20. S after init(20) . . . . . . . . . . . . . . . . . . . 35C.2.21. S after init(21) . . . . . . . . . . . . . . . . . . . 35C.2.22. S after init(22) . . . . . . . . . . . . . . . . . . . 35C.2.23. S after init(23) . . . . . . . . . . . . . . . . . . . 35C.2.24. S(0) after init(24) . . . . . . . . . . . . . . . . . 36C.2.25. S(1) and the Key Stream at S(1) . . . . . . . . . . . 36C.2.26. S(2) and the Key Stream at S(2) . . . . . . . . . . . 371. Introduction
KCipher-2 is a stream cipher that uses a 128-bit secret key and a
128-bit initialization vector. Since the algorithm for KCipher-2 was
published in 2007 [SASC07], it has been evaluated in academic and
industrial studies. The security and performance of KCipher-2 have
been rigorously evaluated by its developers and other institutions
[SECRYPT07] [ICETE07] [CRYPTEC] [SIIS11]. As of the publication of
this document, no attack on KCipher-2 has been successful. KCipher-2
can be efficiently implemented in software to provide fast encryption
and decryption, owing to its uncomplicated design. Only four simple
operations are used: exclusive-OR, addition, shift, and table lookup.
When the algorithm is implemented in hardware, internal computations
can be parallel to yield greater efficiency. Moreover, since its
internal state representation only amounts to several hundred bits,
KCipher-2 is suitable for resource-limited environments. KCipher-2
has been actively used in several industrial applications in Japan,
has been published by an international standardization body (ISO/IEC
18033-4 [ISO18033]), and has been designated a Japanese e-Government
recommended cipher [CRYPTECLIST].
2. Algorithm Description
In this section, we describe the internal components of KCipher-2 and
define the operations for deriving key streams from an input key and
an initialization vector. We illustrate the detailed operations,
mostly in pseudocode format, but also provide code snippets written
in the C language syntax when necessary.
2.1. Notations
All values in this document are stored in big-endian order (aka
network byte order). We use the following notations in the
description of KCipher-2.
^ Bitwise exclusive-OR
n#m mth power of n
+n Integer addition modulo 2#n
<<_r n n-bit left circular shift in an r-bit register
0x Hexadecimal representation
E[i] The (i + 1)th element of E when E is composed of
consecutive multiple elements
GF Galois field. GF(n#m) means the finite field of exactly
n#m elements
** Multiplication of elements on the finite field GF(2#32)
NOTE: Many texts denote "the mth power of n" by "n^m", but we write
it using '#', instead of '^', to avoid reader confusion with the
power operator and the XOR operator of the C language syntax.
2.2. Internal State
The internal state of KCipher-2 can be denoted by S. The internal
state consists of six sub-components: two feedback shift registers,
FSR-A and FSR-B, and four internal registers, L1, R1, L2, and R2.
We, therefore, often write S = (A, B, L1, R1, L2, R2), where A and B
refer to FSR-A and FSR-B, respectively.
2.2.1. Feedback Shift Registers
The two feedback shift registers (FSRs) are separately called
Feedback Shift Register A (FSR-A) and Feedback Shift Register B
(FSR-B). FSR-A is composed of five 32-bit units that are
consecutively arranged. Each unit can be identified by A[0], A[1],
A[2], A[3], and A[4]. Likewise, FSR-B is composed of eleven
consecutive 32-bit units, B[0], ..., B[10]. All values stored in
each 32-bit unit of FSR is in GF(2#32).
2.2.2. Internal Registers
Besides FSR, KCipher-2 has four internal registers to store
intermediate computation results during operation. The four
registers are named L1, R1, L2, and R2.
2.3. Operations
Three major operations constitute the behavior of KCipher-2: init(),
next(), and stream(). The init() operation initializes the internal
values of the system. The next() operation derives new values of S'
from the values of S, where S' and S refer to the internal state.
The stream() operation derives a key stream from the current state S.
2.3.1. next()
The next() operation takes the current state S = (A, B, L1, R1, L2,
R2) as input. The size of the input amounts to twenty of the 32-bit
units in total (five units for A, eleven for B, and one for L1, R1,
L2, and R2). It produces the next state S' = (A', B', L1', R1', L2',
R2'). This operation is mainly used to generate secure key streams
by applying non-linear functions (NLFs) for every cycle of KCipher-2.
Additionally, it is used to initialize the system. The behaviors are
distinguished by the input parameter that indicates the operation
modes.
Inside the next() operation, the internal registers are updated by
the result of the substitution function described in Section 2.4.2.
The feedback shift registers are also updated by feedback functions.
The feedback functions include the multiplication of register units
and the fixed elements a0, a1, a2, and a3 in a finite field. The
fixed elements a0, ..., a3 are carefully chosen to provide the
maximum length of the feedback shift registers. The theory behind
the selection of fixed elements and the way to simplify the necessary
multiplications are briefly described in Section 2.4.4.
The operation takes the following inputs:
o S = (A, B, L1, R1, L2, R2)
o mode = {INIT, NORMAL}, where INIT means the operation is used for
initialization, and NORMAL means it is used for generating secure
key streams.
The operation outputs a new state,
o S' = (A', B', L1', R1', L2', R2')
by performing the following steps:
1. Set registers in the nonlinear functions
L1' = sub_K2(R2 +32 B[4]);
R1' = sub_K2(L2 +32 B[9]);
L2' = sub_K2(L1);
R2' = sub_K2(R1);
for m from 0 to 3
A'[m] = A[m + 1];
for m from 0 to 9
B'[m] = B[m + 1];
NOTE: sub_K2 is a substitution function described in
Section 2.4.2.
2. Depending on the value of the operation mode, do the following:
a. When the mode is NORMAL, A'[4] and B'[10] are computed as
follows:
A'[4] = (a0 ** A[0]) ^ A[3];
if A[2][30] is 1:
if A[2][31] is 1:
B'[10] = (a1 ** B[0]) ^ B[1] ^ B[6] ^ (a3 ** B[8]);
else if A[2][31] is 0:
B'[10] = (a1 ** B[0]) ^ B[1] ^ B[6] ^ B[8];
else if A[2][30] is 0:
if A[2][31] is 1:
B'[10] = (a2 ** B[0]) ^ B[1] ^ B[6] ^ (a3 ** B[8]);
else if A[2][31] is 0:
B'[10] = (a2 ** B[0]) ^ B[1] ^ B[6] ^ B[8];
b. When the mode is INIT, A'[4] and B'[10] are XOR-ed with the
non-linear function output described in Section 2.4.1.
A'[4] = (a0 ** A[0]) ^ A[3] ^ NLF(B[0], R2, R1, A[4]);
if A[2][30] is 1:
if A[2][31] is 1:
B'[10] = (a1 ** B[0]) ^ B[1] ^ B[6] ^ (a3 ** B[8]) ^
NLF(B[10], L2, L1, A[0]);
else if A[2][31] is 0:
B'[10] = (a1 ** B[0]) ^ B[1] ^ B[6] ^ B[8] ^
NLF(B[10], L2, L1, A[0]);
else if A[2][30] is 0:
if A[2][31] is 1:
B'[10] = (a2 ** B[0]) ^ B[1] ^ B[6] ^ (a3 ** B[8]) ^
NLF(B[10], L2, L1, A[0]);
else if A[2][31] is 0:
B'[10] = (a2 ** B[0]) ^ B[1] ^ B[6] ^ B[8] ^
NLF(B[10], L2, L1, A[0]);
3. Output S' = (A', B', L1', R1', L2', R2').
Note that A[2] is a 32-bit unit. Thus, A[2][j] is the value of the
jth least significant bit of A[2], where 0 <= j <= 31.
The corresponding code snippets written in the C language syntax can
be found in Section 2.4.4 and Appendix B.
2.3.2. init()
The init() operation takes a 128-bit key (K) and a 128-bit
initialization vector (IV) and prepares the values of the state
variables for generating key streams.
o K = (K[0], K[1], K[2], K[3]), where each K[i] is a 32-bit unit and
0 <= i <= 3
o IV =(IV[0], IV[1], IV[2], IV[3]), where each IV[i] is a 32-bit
unit and 0 <= i <= 3,
and the output is an initialized state S, which will be referenced as
S(0). The output is derived from the following steps:
1. Expand K to the 384-bit internal key IK = (IK[0], ..., IK[11]),
where IK[i] is a 32-bit unit and 0 <= i <= 11. The expansion
procedure is as follows:
for m from 0 to 11
if m is 0, 1, 2, or 3:
IK[m] = K[m];
else if m is 5, 6, 7, 9, 10, or 11:
IK[m] = IK[m - 4] ^ IK[m - 1];
else if m is 4:
IK[4] = IK[0] ^ sub_K2(IK[3] <<_32 8) ^
(0x01, 0x00, 0x00, 0x00);
else if m is 8:
IK[8] = IK[4] ^ sub_K2(IK[7] <<_32 8) ^
(0x02, 0x00, 0x00, 0x00);
NOTE: sub_K2 is the substitution function described in
Section 2.4.2.
2. Initialize the feedback shift registers and the internal
registers using the values of IK and IV as follows:
for m from 0 to 4
A[m] = IK[4 - m];
B[0] = IK[10]; B[1] = IK[11]; B[2] = IV[0]; B[3] = IV[1];
B[4] = IK[8]; B[5] = IK[9]; B[6] = IV[2]; B[7] = IV[3];
B[8] = IK[7]; B[9] = IK[5]; B[10] = IK[6];
L1 = R1 = L2 = R2 = 0x00000000;
Set S as (A, B, L1, R1, L2, R2).
3. Prepare the state values by applying the next() operation 24
times as follows:
for m from 1 to 24
Set S' as next(S, INIT);
Set S as S';
4. Output S.
2.3.3. stream()
The stream() function derives a 64-bit key stream, Z, from the state
values. Its input is an initialized state,
o S = (A, B, L1, R1, L2, R2)
and its output is Z = (ZH, ZL), where ZH and ZL are 32-bit units.
stream() performs the following:
1. Set register values
ZH = NLF(B[10], L2, L1, A[0]);
ZL = NLF(B[0], R2, R1, A[4]);
2. Output Z = (ZH, ZL).
NOTE: The function NLF is described in Section 2.4.1.
2.4. Subroutines
We explain the functions used above: sub_K2(), NLF(), and S_box().
2.4.1. NLF()
NLF() is a non-linear function that takes the four 32-bit values, A,
B, C, D, and outputs the 32-bit value, Q. The output Q is calculated
as follows.
Q = (A +32 B) ^ C ^ D;
2.4.2. sub_K2()
sub_K2() is a substitution function that is a permutation of
GF(2#32), based on components from the Advanced Encryption Standard
(AES) [FIPS-AES]. Its input is a 32-bit value divided into four
8-bit strings. Inside sub_K2(), an 8-to-8-bit substitution function,
S_box(), is applied to each 8-bit string separately, and then a 32-
to-32-bit linear permutation is applied to the whole 32-bit string.
Our S_box() function is identical to the S-Box operation of AES, and
our linear permutation is identical to the AES Mix Column operation.
Consider the input of sub_K2 as a 32-bit value W = (w[3], w[2], w[1],
w[0]), where each subelement of w is an 8-bit unit. Prepare two
32-bit temporary storages, T = (t[3], t[2], t[1], t[0]) and Q =
(q[3], q[2], q[1], q[0]), where t[i] and q[i] are 8-bit units and 0
<= i <= 3.
The 32-bit output Q is obtained from the following procedures:
1. Apply S_box() to each 8-bit input string. Note that S_box() is
defined in Section 2.4.3.
for m from 0 to 3
t[m] = S_box(w[m]);
2. Calculate q by the matrix multiplication, Q = M * T in GF(2#8) of
the irreducible polynomial f(x) = x#8 + x#4 + x#3 + x + 1, where
o Q is a 1x4 matrix, (q[0], q[1], q[2], q[3))
o M is a 4x4 matrix,
(02, 03, 01, 01,
01, 02, 03, 01,
01, 01, 02, 03,
03, 01, 01, 02)
o T is a 1x4 matrix, (t[0], t[1], t[2], t[3]).
Namely, the procedure that calculates (q[3], q[2], q[1], q[0])
can be written in the C language syntax as:
q[0] = GF_mult_by_2(t[0]) ^ GF_mult_by_3(t[1]) ^ t[2] ^ t[3];
q[1] = t[0] ^ GF_mult_by_2(t[1]) ^ GF_mult_by_3(t[2]) ^ t[3];
q[2] = t[0] ^ t[1] ^ GF_mult_by_2(t[2]) ^ GF_mult_by_3(t[3]);
q[3] = GF_mult_by_3(t[0]) ^ t[1] ^ t[2] ^ GF_mult_by_2(t[3]);
where GF_mult_by_2 and GF_mult_by_3 are multiplication functions
in GF(2#8), defined as follows:
o The function GF_mult_by_2(t) multiplies 2 by the given 8-bit
value t in GF(2#8) and returns an 8-bit value q as follows (lq
is a temporary 32-bit variable):
lq = t << 1;
if ((lq & 0x100) != 0) lq ^= 0x011B;
q = lq ^ 0xFF;
o The function GF_mult_by_3(t) multiplies 3 by the given 8-bit
value t in GF(2#8) and returns an 8-bit value q as follows (lq
is a temporary 32-bit variable):
lq = (t << 1) ^ t;
if ((lq & 0x100) != 0) lq ^= 0x011B;
q = lq ^ 0xFF;
3. Output Q = (q[3], q[2], q[1], q[0]).
2.4.3. S_box()
S_box() is a substitution that can be done by a simple table lookup
operation. Thus, S_box() can be defined by the following value
table:
S_box[256] = {
0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,
0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc,
0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a,
0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b,
0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85,
0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17,
0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88,
0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9,
0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6,
0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94,
0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68,
0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16 };
2.4.4. Multiplications in GF(2#32)
FSR-A and FSR-B are word-oriented linear feedback shift registers
(LFSRs). In the next() operation of Section 2.3.1, the feedback
functions to the two LFSRs are shown, which include multiplication of
fixed elements a0, a1, a2, or a3 in GF(2#32). The fixed elements are
carefully chosen to maximize the period of the key stream generated
by the two registers. Here, we briefly explain how we obtain the
fixed elements. Further details and theories can be found in
[SECRYPT07].
We obtain a0 as follows. First, to guarantee that the period is
maximized for an 8-bit unit, we consider p as the root of the
primitive polynomial:
x#8 + x#7 + x#6, + x + 1 in GF(2).
Therefore, an 8-bit string y = (y7, ..., y0), where y7 is the most
significant bit, can be written as:
y = y7(p#7) + y6(p#6) + ... + y1(p) + y0
Next, a0 is the root of irreducible polynomial of degree four:
x#4 + p#24(x#3) + p#3(x#2) + p#12(x) + p#71 in GF(2#8).
Then, hierarchically, a 32-bit unit Y = (Y3, Y2, Y1, Y0), where Y3 is
the most significant byte, can be written as:
Y3(a0#3) + Y2(a0#2) + Y1(a0) + Y0
The feedback polynomial to FSR-A,
f(x) = a0(x#5) + x#2 + 1
produces the maximum-length period of the key stream with a0.
Similarly, a1, a2, and a3 are the roots of irreducible polynomials of
degree four of
x#4 + q#230(x#3) + q#156(x#2) + q#93(x) + q#29 in GF(2#8)
x#4 + r#34(x#3) + r#16(x#2) + r#199(x) + r#248 in GF(2#8)
x#4 + s#157(x#3) + s#253(x#2) + s#56(x) + s#16 in GF(2#8)
respectively. The feedback polynomial to FSR-B that uses a1, a2, and
a3 can produce the maximum-length period. The feedback polynomials
to FSR-A and FSR-B are as written in Step 2 of the next() operation,
and the mathematical notations of these polynomials can also be found
in [SECRYPT07].
Calculation of the original feedback polynomials might be time-
consuming because it includes multiplications in finite fields.
However, these multiplications can be done faster if the multiples of
a0, ..., a3 were already calculated for all possible inputs. The
tables of amul0, ..., amul3 in Appendix A provide such pre-
calculation results. As shown in Step 2 of next(), we can utilize
these tables to finish the necessary calculations efficiently.
For example, consider the input as a 32-bit value w, which represents
an element of GF(2#32). The 32-bit output string w' = a0 ** w can be
obtained using the amul0 table in Appendix A.1 as follows:
w' = (w << 8) ^ amul0[w >> 24];
Likewise, multiplications of (a1 ** w), (a2 ** w), and (a3 ** w) can
be obtained in the same way, simply by using the amul1, amul2, and
amul3 tables that we provide in Appendixes A.2, A.3, and A.4.
Eventually, Step 2 of the next() operation, which updates A'[4] and
B'[10], can be written in the C language syntax as follows. Note
that nA[4] and nB[10] correspond to A'[4] and B'[10], respectively,
and temp1 and temp2 are 32-bit variables.
nA[4] = ((A[0] << 8) ^ amul0[(A[0] >> 24)]) ^ A[3];
if (mode == INIT)
nA[4] ^= NLF(B[0], R2, R1, A[4]);
if (A[2] & 0x40000000) {
temp1 = (B[0] << 8) ^ amul1[(B[0] >> 24)];
} else {
temp1 = (B[0] << 8) ^ amul2[(B[0] >> 24)];
}
if (A[2] & 0x80000000) {
temp2 = (B[8] << 8) ^ amul3[(B[8] >> 24)];
} else {
temp2 = B[8];
}
nB[10] = temp1 ^ B[1] ^ B[6] ^ temp2;
if (mode == INIT)
nB[10] ^= NLF(B[10], L2, L1, A[0]);
2.5. Encryption and Decryption Scheme
In this section, we use the notation S(i) to specifically reference
the values of the internal state at i (where i >= 0), which is an
arbitrary, discrete temporal moment (aka cycle) after the
initialization.
2.5.1. Key Stream Generation
Given a 128-bit key K, a 128-bit initialization vector (IV),
KCipher-2 is initialized as follows:
S(0) = init(K, IV);
where S(0) is a state representation. With an initialized state
S(i), where i >= 0, a 64-bit key stream X(i) can be obtained using
the stream() operation, as follows:
X(i) = stream(S(i));
To generate a new key stream X(i + 1), use the next() operation and
the stream() operation as follows:
S(i + 1) = next(S(i), NORMAL);
X(i + 1) = stream(S(i + 1));
2.5.2. Encryption and Decryption of a Message
Given a 64-bit message block M and a key stream X, an encrypted
message E is obtained by
E = M ^ X;
Conversely, the decrypted message D is obtained by
D = E ^ X;
The original message M and the decrypted message D are identical when
the same key stream is used.
3. Security Considerations
We recommend reinitializing and rekeying after 2#58 cycles of
KCipher-2, which means after generating 2#64 key stream bits. It is
important to make sure that no IV is ever reused under the same key.
4. References
4.1. Normative References
[ISO18033] "Information technology -- Security techniques --
Encryption algorithms -- Part 4: Stream ciphers", ISO/
IEC 18033-4:2012 Ed. 2, December 2012.
[FIPS-AES] National Institute of Standards and Technology,
"Advanced Encryption Standard (AES)", FIPS PUB 197,
November 2001, <http://csrc.nist.gov/publications/
fips/fips197/fips-197.pdf>.
4.2. Informative References
[SECRYPT07] Kiyomoto, S., Tanaka, T., and K. Sakurai, "K2: A
Stream Cipher Algorithm Using Dynamic Feedback
Control", Proc. SECRYPT 2007, pp. 204-213.
[ICETE07] Kiyomoto, S., Tanaka, T., and K. Sakurai, "K2 Stream
Cipher", Proc. ICETE 2007, pp. 214-226.
[CRYPTEC] Bogdanov, A., Preneel, B., and V. Rijmen, "Security
Evaluation of the K2 Stream Cipher", 2010,
<http://www.cryptrec.go.jp/english/estimation.html>.
[CRYPTECLIST] "Cryptography Research and Evaluation Committees",
<http://www.cryptrec.go.jp/english/estimation.html>.
[SIIS11] Priemuth-Schmid, D., "Attacks on Simplified Versions
of K2", Proc. SIIS 2011, LNCS 7053, pp. 117-127.
[SASC07] Kiyomoto, S., Tanaka, T., and K. Sakurai, "A Word-
Oriented Stream Cipher Using Clock Control", Proc.
SASC 2007, pp. 260-274.
Appendix B. A Simple Implementation Example of KCipher-2
We provide an example implementation of KCipher-2 written in C. The
implementation is simple; we do not consider storage or time
complexity, nor do we consider software engineering-related issues,
such as encapsulation, modularity, and so on.
B.1. Code Components I - Definitions and Declarations
#include <stdio.h>
#include <stdint.h>
#define INIT 0
#define NORMAL 1
void init (unsigned int *, unsigned int *);
void next(int);
void stream (unsigned int *, unsigned int *);
static const uint8_t S_box[256] = {
...
// as defined in Section 2.4.3
};
static const uint32_t amul0[256] = {
...
// as defined in Appendix A.1
};
static const uint32_t amul1[256] = {
...
// as defined in Appendix A.2
};
static const uint32_t amul2[256] = {
...
// as defined in Appendix A.3
};
static const uint32_t amul3[256] = {
...
// as defined in Appendix A.4
};
/* Global variables */
// State S
uint32_t A[5]; // five 32-bit units
uint32_t B[11]; // eleven 32-bit units
uint32_t L1, R1, L2, R2; // one 32-bit unit for each
// The internal key (IK) and the initialization vector (IV)
uint32_t IK[12]; // (12*32) bits
uint32_t IV[4]; // (4*32) bits
B.2. Code Components II - Functions
/**
* Do multiplication in GF(2#8) of the irreducible polynomial,
* f(x) = x#8 + x#4 + x#3 + x + 1. The given parameter is multiplied
* by 2.
* @param t : (INPUT). 8 bits. The number will be multiplied by 2
* @return : (OUTPUT). 8 bits. The multiplication result
*/
uint8_t GF_mult_by_2 (uint8_t t) {
uint8_t q;
uint32_t lq;
lq = t << 1;
if ((lq & 0x100) != 0) lq ^= 0x011B;
q = lq ^ 0xFF;
return q;
}
/**
* Do multiplication in GF(2#8) of the irreducible polynomial,
* f(x) = x#8 + x#4 + x#3 + x + 1. The given parameter is multiplied
* by 3.
* @param t : (INPUT). 8 bits. The number will be multiplied by 3
* @return : (OUTPUT). 8 bits. The multiplication result
*/
uint8_t GF_mult_by_3 (uint8_t t) {
uint8_t q;
uint32_t lq;
lq = (t << 1) ^ t;
if ((lq & 0x100) != 0) lq ^= 0x011B;
q = lq ^ 0xFF;
return q;
}
B.3. Use Case
void main (void) {
// Set the key and the iv
uint32_t key[4] = ...;
uint32_t iv[4] = ...;
init(key, iv);
// produce a key stream
stream(&zh, &zl);
next(NORMAL);
// produce another key stream
stream(&zh, &zl);
next(NORMAL);
...
}
Appendix C. Test Vectors
This appendix provides running examples of KCipher-2 obtained from
the naive implementation. All values are written in hexadecimal
form.
C.1. Key Stream Generation Examples
The following is a series of the 64-bit key streams generated from
the given 8-bit keys (K) and 128-bit initialization vectors (IVs).
- K : 00000000 00000000 00000000 00000000
- IV: 00000000 00000000 00000000 00000000
- Generated key streams at S(i) are as follows
S(0): F871EBEF 945B7272
S(1): E40C0494 1DFF0537
S(2): 0B981A59 FBC8AC57
S(3): 566D3B02 C179DBB4
S(4): 3B46F1F0 33554C72
S(5): 5DE68BCC 9872858F
S(6): 57549602 4062F0E9
S(7): F932C998 226DB6BA
...
- K : A37B7D01 2F897076 FE08C22D 142BB2CF
- IV: 33A6EE60 E57927E0 8B45CC4C A30EDE4A
- Generated key streams at S(i) are as follows
S(0): 60E9A6B6 7B4C2524
C.2.24. S(0) after init(24)
A[0]: 2EB9213A A[1]: BE3CA984 A[2]: 974E6719
A[3]: 86916EFF A[4]: F52DACF9
B[0]: C57BED5B B[1] : 7BE2C520 B[2]: 1F48829C
B[3]: F95DD14F B[4] : D939E13E B[5]: 9970C980
B[6]: 3C517031 B[7] : D1439B63 B[8]: 9334E221
B[9]: 50EF13E7 B[10]: E0BD9F91
L1: 4370D8E6 R1: DABED76C L2: 11C1ACCB R2: C3BAAEDF
Note that the result of init(24) is also referred to as S(0) (in
Section 2.3.2). Since the state is S(0), the stream() operation (in
Section 2.3.3) can be applied and generate key streams.
Key stream at S(0) : 9FB6B580A6A5E7AF
Henceforth, a new key stream can be produced by 1) obtaining a new
state by applying the next() operation to the current state, and 2)
generating a new key stream by applying the stream() operation to the
new state.
C.2.25. S(1) and the Key Stream at S(1)
A[0]: BE3CA984 A[1]: 974E6719 A[2]: 86916EFF
A[3]: F52DACF9 A[4]: 960329B5
B[0]: 7BE2C520 B[1] : 1F48829C B[2]: F95DD14F
B[3]: D939E13E B[4] : 9970C980 B[5]: 3C517031
B[6]: D1439B63 B[7] : 9334E221 B[8]: 50EF13E7
B[9]: E0BD9F91 B[10]: 5318AEE1
L1: 8FD86092 R1: 4BBDC0F6 L2: 8D63A5EF R2: FEE0F24B
Key stream at S(1) : D1989DC6A77D5E28
