Report on Present State ofCIPHERUNICORN-E
Cipher Evaluation(full evaluation)
January 28, 2002
Toshio Tokita, Member
Symmetric-Key Cryptography Subcommittee
1

CIPHERUNICORN-E• CIPHERUNICORN-E was presented by NEC
Corporation in 1998.
• Symmetric-key block cipher(block length: 64 bits; key length: 128 bits)• Registered in ISO9979 (1998)• Continual evaluation cipher from CRYPTREC2000• Features– Feistel structure (16 rounds) + auxiliary functions (inserted every 2rounds)– Round function with dual structure consisting of a main stream
and a temporary key generation mechanism.
– Round function designed by cipher evaluation support system(NEC proprietary development).
2

CRYPTREC2000 evaluation results• So far, no security-related problems have been discovered.
– In general terms, given that the specification has 16 rounds, it would seem impossible
to cryptanalyze the cipher using current theoretical cryptanalysis techniques.

• In terms of processing speed, CIPHERUNICORN-E is classified as aslow group among 64-bit block ciphers– Among the 64-bit block ciphers which are in CRYPTREC2000 continual evaluation,
this cipher belongs to the slow group. (Speed is approximately 3/5 that of Triple DES
in a PC environment.)––––––––––––• Because this cipher is a complex round function, accurate evaluation
is difficult, so continual evaluation is considered necessary.
– It is difficult to accurately evaluate and analyze security against theoretical
cryptanalysis techniques such as differential cryptanalysis and linear cryptanalysis.
– It is necessary to conduct a more-detailed evaluation, replacing the (simplified) mF
function with the actual round function.
3

Evaluation procedure• Continual evaluation this fiscal year:– We requested four specialists (teams) in cipher research in Japanand abroad to conduct a security evaluation based on the following
perspectives:• Security against differential cryptanalysis, from the perspectiveof differential characteristic probability• Security against linear cryptanalysis, from the perspective oflinear characteristic probability• Appropriateness of conducting evaluation using mF function• Other noted security-related issues

4Overview of security evaluation

Block length: 64 bits
Key length: 128 bits

Key length

Secure ciphers
Calculations required for
cryptanalysis

2128

80

(2 )

Ciphers with no practicalproblems, but which could
theoretically be
cryptanalyzed
Ciphers thatcan becryptanalyzed

Dependent on
computing capability
Dependent on usage
environment

Dependent on inverse ofdifferential characteristic
probability or linear
characteristic probability

(232)

64

2128

Plaintext-ciphertext pairs required for
cryptanalysis

Block length5Comments of Evaluator 1• It is difficult to imagine that CIPHERUNICORN-E, with 16 rounds,
could be attacked by differential cryptanalysis or linear cryptanalysis.
– Security against differential cryptanalysis• Upper bound of maximum characteristic probability for round
function: ≤ 2-21
（Upper bound of maximum characteristic probability for 13 rounds: ≤2-126）• Conclusion: CIPHERUNICORN-E with 16-round specifications
cannot be cryptanalyzed by differential cryptanalysis.
– Security against linear cryptanalysis• The cipher seems more secure against linear cryptanalysis thanagainst differential cryptanalysis.
• Upper bound of characteristic probability for round function: ≤ 2-24.64（Upper bound of maximum characteristic probability for 13 rounds: ≤2-147.84）• Conclusion: CIPHERUNICORN-E with 16-round specifications
cannot be cryptanalyzed by linear cryptanalysis.
6Comments of Evaluator 2• I found no grounds for suspecting any problems related tosecurity against differential cryptanalysis and linear
cryptanalysis.
– Security against differential cryptanalysis• My calculated results differed from the evaluation results in the selfevaluation(upper bound of characteristic probability with mF function: ≤ 2-72.0)• However, at present it seems impossible to attack the cipher withdifferential cryptanalysis.
– Security against linear cryptanalysis• My calculated results differed from the evaluation results in the selfevaluation(upper bound of characteristic probability with mF function : ≤ 2-62.0)• However, at present it seems impossible to attack the cipher withlinear cryptanalysis.
7Comments of Evaluator 3• Differential cryptanalysis: My evaluation results differed from theresults in the self-evaluation, but I see no problem in terms of security.
– I calculated an upper bound value different from the value in the self-evaluation forthe differential characteristic probability.
– Upper bound for maximum characteristic probability with mF function: ≤ 2-14
– Upper bound for characteristic probability with 15 rounds: ≤ 2-98
– Given that CIPHERUNICORN-E has 16 rounds, it seems secure against differential
cryptanalysis.

• Linear cryptanalysis: My evaluation results differed from the results inthe self-evaluation, but I see no problem in terms of security.
– I calculated an upper bound value different from the value in the self-evaluation forthe linear characteristic probability.
– Upper bound for maximum characteristic probability with mF function: ≤ 2-27.309– Upper bound for maximum characteristic probability with 15 rounds: ≤ 2-191.163– Given that CIPHERUNICORN-E has 16 rounds, it seems secure against linear
cryptanalysis.

8Comments of Evaluator 4• I evaluated whether the 16-round CIPHERUNICORN-E canbe attacked by differential cryptanalysis or linearcryptanalysis.
– Differential cryptanalysis: I believe 16 rounds cannot be attacked.
• Upper bound for characteristic probability of round function: ≤ 2-16
• This does not contradict the results in the self-evaluation, in terms ofevaluation based on an upper bound value.
• I believe that there are no effective differential characteristics for 10rounds or more.

– Linear cryptanalysis: I believe 16 rounds cannot be attacked.
• Upper bound for characteristic probability of round function: ≤ 2-16
• I believe the upper bound value (2-63.90) for the round function in theself-evaluation is not appropriate. However, this does not change theconclusion that 16 rounds cannot be attacked.
• I believe that there are no effective linear characteristics for 10 rounds
or more.
9Conclusion• Based on this fiscal year’s follow-up
evaluation results, so far no security-relatedproblems have been discovered inCIPHERUNICORN-E with 16 rounds,
which is the number of rounds in thespecifications.
– The evaluators obtained evaluation results (upper bound values in allcases) that differed from the evaluation results in the self-evaluation,with respect to the evaluation of the round function’s
differential/linear characteristic probability, etc. However, in no casewas there an indication that the number of rounds in thespecifications (16 rounds) could be attacked.
10