Camellia: A 128-Bit Block Cipher
Suitable for Multiple Platforms— Design and Analysis —Kazumaro Aoki† Tetsuya Ichikawa‡ Masayuki Kanda† Mitsuru Matsui‡
Shiho Moriai† Junko Nakajima‡ Toshio Tokita‡†Nippon Telegraph and Telephone Corporation
1-1 Hikarinooka, Yokosuka, Kanagawa, 239-0847 Japan{maro,kanda,shiho}@isl.ntt.co.jp‡Mitsubishi Electric Corporation
5-1-1 Ofuna, Kamakura, Kanagawa, 247-8501 Japan{ichikawa,matsui,june15,tokita}@iss.isl.melco.co.jp
High level of security. The recent advances incryptanalytic techniques are remarkable. A quantitative evaluation of security against powerful cryptanalytic techniques such as differential cryptanalysis [4] andlinear cryptanalysis [21] is considered to be essential
in designing any new block cipher. We evaluated the
security of Camellia by utilizing state-of-art cryptanalytic techniques. We have confirmed that Camellia has
no differential and linear characteristics that hold withprobability more than 2−128 . Moreover, Camellia wasdesigned to offer security against other advanced cryptanalytic attacks including higher order differential attacks [15, 12], interpolation attacks [12, 2], related-key
attacks [5, 18], truncated differential attacks [15, 26],
boomerang attacks [29], and slide attacks [6, 7].

Abstract. We present a new 128-bit block cipher
called Camellia. Camellia supports 128-bit block sizeand 128-, 192-, and 256-bit keys, i.e. the same interface specifications as the Advanced Encryption Standard (AES). Efficiency on both software and hardware
platforms is a remarkable characteristic of Camellia in
addition to its high level of security. It is confirmed that
Camellia provides strong security against differential
and linear cryptanalysis. Compared to the AES finalists, i.e. MARS, RC6, Rijndael, Serpent, and Twofish,
Camellia offers at least comparable encryption speed
in software and hardware. An optimized implementation of Camellia in assembly language can encrypt ona Pentium III (800MHz) at the rate of more than 276
Mbits per second, which is much faster than the speedof an optimized DES implementation. In addition, adistinguishing feature is its small hardware design. The
hardware design, which includes both encryption anddecryption, occupies approximately 11K gates, whichis the smallest among all existing 128-bit block ciphers
as far as we know.

1

Efficiency on multiple platforms. As cryptographic systems are needed in various applications, encryption algorithms that can be implemented efficiently
on a wide range of platforms are desirable, however, few
128-bit block ciphers are suitable for both software andhardware implementation. Camellia was designed to offer excellent efficiency in hardware and software implementations, including gate count for hardware design,
memory requirements in smart card implementations,as well as performance on multiple platforms.
Camellia consists of only 8-by-8-bit substitution tables (s-boxes) and logical operations that can be efficiently implemented on a wide variety of platforms.
Therefore, it can be implemented efficiently in software,
including the 8-bit processors used in low-end smart
cards, 32-bit processors widely used in PCs, and 64-bit
processors. Camellia doesn’t use 32-bit integer addi-

Introduction

This paper presents a 128-bit block cipher called
Camellia, which was jointly developed by NTT and
Mitsubishi Electric Corporation. Camellia supports
128-bit block size and 128-, 192-, and 256-bit key
lengths, and so offers the same interface specifications
as the Advanced Encryption Standard (AES). The design goals of Camellia are as follows.
1tions and multiplications, which are extensively usedin some software-oriented 128-bit block ciphers. Such
operations perform well on platforms providing a highdegree of support, e.g., Pentium II/III or Athlon, but
not as well on others. These operations can cause alonger critical path and larger hardware implementation requirements.
The s-boxes of Camellia are designed to minimize
hardware size. The four s-boxes are affine equivalent to
the inversion function in the finite field GF(28 ). Moreover, we reduced the inversion function in GF(28 ) toa few GF(24 ) arithmetic operations. It enabled us to
implement the s-boxes by fewer gate counts.
The key schedule is simple and shares part of its procedure with encryption. It supports on-the-key subkey generation and subkeys are computable in any order. The memory requirement for generating subkeys isquite small; an efficient implementation requires about
32-byte RAM for 128-bit keys and about 64-byte RAM
for 192- and 256-bit keys.

M(128)

kw1(64)kw2(64)

L 0(64)

R 0(64)

k 1(64), k 2(64), k 3(64),L
k1(64) 0(64)k 4(64), k 5(64), k 6(64)6-RoundLk 2(64) 1(64)kl1(64)

R 1(64)F

kl2(64)

FL -1

FL

L
k 3(64) 2(64)k 7(64), k 8(64), k 9(64),R 2(64)F

k10(64), k11(64), k 12(64)6-RoundL
k 4(64) 3(64)R 3(64)F

kl3(64)kl4(64)

FL -1

FL

L
k 5(64) 4(64)R 4(64)F

k13(64), k14(64), k15(64),k16(64), k17(64), k 18(64)Lk 6(64) 5(64)6-Round

R 5(64)F

L 18(64)

R18(64)kw3(64)

Future developments. NTT and Mitsubishi Electric Corporation will propose Camellia in response to
the call for contributions from ISO/IEC JTC 1/SC 27,
aiming at its being adopted as an international standard. We will submit Camellia to NESSIE (New European Schemes for Signature, Integrity, and Encryption)
project as a strong cryptographic primitive.

kw4(64)C(128)

Figure 1: Encryption procedure of Camellia for 128-bit
keys

2.1

Notations
XL
XR
⊕
||
>
>
>n
<
<
<n
∩
∪
0x

Outline of the paper. This paper is organized asfollows: Section 2 describes the notations and high-levelstructure of Camellia. Section 3 defines each components of the cipher. Section 4 describes the rationale
behind Camellia’s design. In Section 5 we evaluate
Camellia’s strength against known attacks. Section 6
contains the performance of Camellia. We conclude in
Section 7.

2

R 0(64)F

2.2

Structure of Camellia

the left-half data of X.
the right-half data of X.
bitwise exclusive-OR operation.
concatenation of two operands.
rotation to the right by n bits.
rotation to the left by n bits.
bitwise AND operation.
bitwise OR operation.
hexadecimal representation.

Encryption for 128-bit keys

First a 128-bit plaintext M is XORed with kw1 ||kw2
and separated into two 64-bit data L0 and R0 , i.e., M ⊕(kw1 ||kw2 ) = L0 ||R0 . Then, the following operations
are performed from r = 1 to 18, except for r = 6 and
12;Camellia uses an 18-round Feistel structure for 128bit keys, and a 24-round Feistel structure for 192- and256-bit keys, with additional input/output whitenings
and logical functions called the F L-function and F L−1 function inserted every 6 rounds. Figures 1 shows an
overview of encryption using 128-bit keys. The keyschedule generates 64-bit subkeys kwt (t = 1, 2, 3, 4)
for input/output whitenings, ku (u = 1, 2, . . . , r) for
round functions and klv (v = 1, 2, . . . , r/3 − 2) for F Land F L−1 -functions from the secret key K.

Lr
Rr

=
=

Rr−1 ⊕ F (Lr−1 , kr ),Lr−1 .

For r = 6 and 12, the following is carried out;
L0r
2

=

Rr−1 ⊕ F (Lr−1 , kr ),

Rr0

=

Lr−1 ,Lr=

F L(L0r , klr/3−1 ),Rr=

F L−1 (Rr0 , klr/3 ).

Table 1: The key schedule constants
Σ1
Σ2
Σ3
Σ4
Σ5
Σ6

Lastly, R18 and L18 are concatenated and XORedwith kw3 ||kw4 . The resultant value is the 128-bit ciphertext, i.e., C = (R18 ||L18 ) ⊕ (kw3 ||kw4 ).

2.3

Encryption for 192- and 256-bit
keys

Similarly to the encryption for 128-bit keys, first a 128bit plaintext M is XORed with kw1 ||kw2 and separated
into two 64-bit data L0 and R0 , i.e., M ⊕ (kw1 ||kw2 ) =L0 ||R0 . Then, the following operations are performed
from r = 1 to 24, except for r = 6, 12, and 18;
Lr=

Rr−1 ⊕ F (Lr−1 , kr ),Rr=

Lr−1 .

“keys” in the Feistel network. They are defined as continuous values from the second hexadecimal place to theseventeenth hexadecimal place of the hexadecimal representation of the square root of the i-th prime. These
constant values are shown in Table 1.
The 64-bit subkeys kwt , ku , and klv are generated
from KL , KR , KA , and KB . The subkeys are generated
by rotating KL , KR , KA , and KB and taking the leftor right-half of them. Details are shown in Tables 2
and 3.

For r = 6, 12, and 18, the following are performed;
L0r
Rr0

=
=

Rr−1 ⊕ F (Lr−1 , kr ),Lr−1 ,Lr=

F L(L0r , kl2r/6−1 ),Rr=

F L−1 (Rr0 , kl2r/6 ).

K L(128)

Lastly, R24 and L24 are concatenated and XORedwith kw3 ||kw4 . The resultant value is the 128-bit ciphertext, i.e., C = (R24 ||L24 ) ⊕ (kw3 ||kw4 ).

Σ 1(64)2.4

Σ 2(64)

K R(128)

F

DecryptionF

The decryption procedure of Camellia can be done in
the same way as the encryption procedure by reversing
the order of the subkeys, which is one of merits of Feistel networks. In Camellia, F L/F L−1 -function layers
are inserted every 6 rounds, but this property is stillpreserved.

2.5

0xA09E667F3BCC908B
0xB67AE8584CAA73B2
0xC6EF372FE94F82BE
0x54FF53A5F1D36F1C
0x10E527FADE682D1D
0xB05688C2B3E6C1FD

K R(128)
K L(128)
Σ 3(64)

Key ScheduleΣ 5(64)F

FF

F

K A(128)

K B(128)

Σ 4(64)

Figure 2 shows the key schedule of Camellia. Two 128bit variables KL and KR are defined as follows. For
128-bit keys, the 128-bit key K is used as KL and KR
is 0. For 192-bit keys, the left 128-bit of the key K is
used as KL , and concatenation of the right 64-bit of K
and the complement of the right 64-bit of K is used as
KR . For 256-bit keys, the left 128-bit of the key K is
used as KL and the right 128-bit of K is used as KR .
Two 128-bit variables KA and KB are generated fromKL and KR as shown in Figure 2. Note that KB is used
only if the length of the secret key is 192 or 256 bits.
The 64-bit constants Σi (i = 1, 2, . . . , 6) are used asΣ 6(64)

Figure 2: Key Schedule3

Table 2: Subkeys for 128-bit keys
subkeyvalue
Prewhitening
kw1 (KL <<<0 )Lkw2 (KL <<<0 )RF (Round1)
k1
(KA <
<
<0 )L
F (Round2)
k2
(KA <
<
<0 )R
F (Round3)
k3
(KL <
<
<15 )LF (Round4)
k4
(KL <
<
<15 )RF (Round5)
k5
(KA <
<
<15 )LF (Round6)
k6
(KA <
<
<15 )R
FL
kl1
(KA <
<
<30 )L
F L−1
kl2
(KA <
<
<30 )RF (Round7)
k7
(KL <
<
<45 )LF (Round8)
k8
(KL <
<
<45 )RF (Round9)
k9
(KA <
<
<45 )LF (Round10)
k10
(KL <
<
<60 )RF (Round11)
k11
(KA <
<
<60 )LF (Round12)
k12
(KA <
<
<60 )R
FL
kl3
(KL <
<
<77 )L
F L−1
kl4
(KL <
<
<77 )RF (Round13)
k13
(KL <
<
<94 )LF (Round14)
k14
(KL <
<
<94 )RF (Round15)
k15
(KA <
<
<94 )LF (Round16)
k16
(KA <
<
<94 )RF (Round17)
k17
(KL <
<
<111 )LF (Round18)
k18
(KL <
<
<111 )R
Postwhitening kw3 (KA <<<111 )Lkw4 (KA <<<111 )R

3

Components of Camellia

3.1

F -function

Table 3: Subkeys for 192/256-bit keys
subkeyvalue
Prewhitening
kw1 (KL <<<0 )Lkw2 (KL <<<0 )RF (Round1)
k1
(KB <
<
<0 )L
F (Round2)
k2
(KB <
<
<0 )R
F (Round3)
k3
(KR <
<
<15 )LF (Round4)
k4
(KR <
<
<15 )RF (Round5)
k5
(KA <
<
<15 )LF (Round6)
k6
(KA <
<
<15 )R
FL
kl1
(KR <
<
<30 )L
F L−1
kl2
(KR <
<
<30 )RF (Round7)
k7
(KB <
<
<30 )LF (Round8)
k8
(KB <
<
<30 )RF (Round9)
k9
(KL <
<
<45 )LF (Round10)
k10
(KL <
<
<45 )RF (Round11)
k11
(KA <
<
<45 )LF (Round12)
k12
(KA <
<
<45 )R
FL
kl3
(KL <
<
<60 )L
F L−1
kl4
(KL <
<
<60 )RF (Round13)
k13
(KR <
<
<60 )LF (Round14)
k14
(KR <
<
<60 )RF (Round15)
k15
(KB <
<
<60 )LF (Round16)
k16
(KB <
<
<60 )RF (Round17)
k17
(KL <
<
<77 )LF (Round18)
k18
(KL <
<
<77 )R
FL
kl5
(KA <
<
<77 )L
F L−1
kl6
(KA <
<
<77 )RF (Round19)
k19
(KR <
<
<94 )LF (Round20)
k20
(KR <
<
<94 )RF (Round21)
k21
(KA <
<
<94 )LF (Round22)
k22
(KA <
<
<94 )RF (Round23)
k23
(KL <
<
<111 )LF (Round24)
k24
(KL <
<
<111 )R
Postwhitening kw3 (KB <<<111 )Lkw4 (KB <<<111 )RThe F -function is shown in Figure 3.
The F function uses the SPN (Substitution-Permutation Network) structure. The S-function is the non-linear layer
and the P -function is the linear layer.

3.2

where functions f and h are affine functions and function g is the inversion function in GF(28 ) as given below.

S-function, s-boxes

The S-function consists of eight s-boxes and four different s-boxes, s1 , s2 , s3 , and s4 are used. All of them areaffine equivalent to the inversion function in GF(28 ).
The data of s2 , s3 , and s4 can be generated from thes1 table. The tables are shown in [1].

f : GF(2)8 → GF(2)8 , (a1 , a2 , . . . , a8 ) 7→ (b1 , b2 , . . . , b8 ),where

s1 : GF(2)8 → GF(2)8 ,x 7→ h(g(f (0xc5 ⊕ x))) ⊕ 0x6e<
<1s2 : GF(2)8 → GF(2)8 , x 7→ s1 (x)<88s3 : GF(2) → GF(2) , x 7→ s1 (x)>>>1s4 : GF(2)8 → GF(2)8 , x 7→ s1 (x<<<1 )b 1 = a6 ⊕ a2

b 5 = a7 ⊕ a4

b 2 = a7 ⊕ a1
b 3 = a8 ⊕ a5 ⊕ a3

b 6 = a5 ⊕ a2
b 7 = a8 ⊕ a1

b 4 = a8 ⊕ a3

b 8 = a6 ⊕ a4 .

h : GF(2)8 → GF(2)8 , (a1 , a2 , . . . , a8 ) 7→ (b1 , b2 , . . . , b8 ),4

F L-function

3.4
k i (64)x 8(8)y8

x 7(8)y7

x 6(8)y6

x 5(8)y5

x 4(8)y4

x 3(8)y3

x 2(8)y2

x 1(8)

y1

s1
s4
s3
s2
s4
s3
s2
s1

z8

z’ 8(8)z7

z’ 7(8)z6

z’ 6(8)z5

z’ 5(8)z4

z’ 4(8)z3

z’ 3(8)z2

z’ 2(8)z1

z’ 1(8)

S-Function

The F L-function is shown in Figure 4, and is defined
as follows.
F L : GF(2)64 × GF(2)64→

GF(2)64 ,(XL ||XR , klL ||klR ) 7→

YL ||YR ,

where
YR
YL

P-Function

3.5

Figure 3: F -function((XL ∩ klL )<<< 1 ) ⊕ XR
(YR ∪ klR ) ⊕ XL .

F L−1 -function

The F L−1 -function is shown in Figure 5. The following
equation holds.

whereb 1 = a5 ⊕ a6 ⊕ a2

b 5 = a7 ⊕ a3

b 2 = a6 ⊕ a2
b 3 = a7 ⊕ a4

b 6 = a8 ⊕ a1
b 7 = a5 ⊕ a1

b 4 = a8 ⊕ a2

b 8 = a6 ⊕ a3 .

F L−1 (F L(x, k), k) = x.

X (64)XL(32)

8

=
=

Y(64)
Y L(32)

XR(32)

8

g : GF(2) → GF(2) , (a1 , a2 , . . . , a8 ) 7→ (b1 , b2 , . . . , b8 ),kl i L(32)kl i R(32)kl i R(32)kl i L(32)

1

where
2

3

2

3

(b8 + b7 α + b6 α + b5 α ) + (b4 + b3 α + b2 α + b1 α )β=1((a8 +a7 α+a6 α2 +a5 α3 )+(a4 +a3 α+a2 α2 +a1 α3 )β)−1 .

This inversion is performed in GF(28 ) assuming 10 = 0,
where β is an element in GF(28 ) that satisfies β 8 + β 6 +
β 5 + β 3 + 1 = 0, and α = β 238 = β 6 + β 5 + β 3 + β 2 isan element in GF(24 ) that satisfies α4 + α + 1 = 0.

3.3

Y R(32)

Y L(32)

Y R(32)

XL(32)X (64)Y(64)Figure 4: F L-function

P -function

XR(32)

Figure 5: F L−1 -function

The P -function is defined as follows:
P : (GF(2)8 )8 → (GF(2)8 )8 ,(z1 , z2 , . . . , z8 ) 7→ (z10 , z20 , . . . , z80 ),
where

4

Design Rationale

4.1

F -function

The design strategy of the F -function of Camellia follows that of the F -function of E2 [28]. The main difference between E2 and Camellia is the adoption of the
1-round (conservative) SPN (Substitution-Permutation
Network), not the 2-round SPN, i.e. S-P-S. When the
1-round SPN is used as the round function in a Feistel
cipher, the theoretical evaluation of the upper boundof differential and linear characteristic probability becomes more complicated, but the speed under the samelevel of “real” security is expected to be improved. See
Section 6 for detailed discussions on security.

z10 = z1 ⊕ z3 ⊕ z4 ⊕ z6 ⊕ z7 ⊕ z8
z20 = z1 ⊕ z2 ⊕ z4 ⊕ z5 ⊕ z7 ⊕ z8
z30 = z1 ⊕ z2 ⊕ z3 ⊕ z5 ⊕ z6 ⊕ z8
z40 = z2 ⊕ z3 ⊕ z4 ⊕ z5 ⊕ z6 ⊕ z7
z50 = z1 ⊕ z2 ⊕ z6 ⊕ z7 ⊕ z8
z60 = z2 ⊕ z3 ⊕ z5 ⊕ z7 ⊕ z8

z70 = z3 ⊕ z4 ⊕ z5 ⊕ z6 ⊕ z8
z80 = z1 ⊕ z4 ⊕ z5 ⊕ z6 ⊕ z7 .
5

4.2

P -function

The design criteria of F L- and F L−1 -functions are
similar to those of the F L-function of MISTY [23]. The
difference between MISTY and Camellia is the additionof 1-bit rotation. This is expected to make bytewise
cryptanalysis harder, but it has no negative impact on
hardware size or speed. The design criteria are thatthese functions must be linear for any fixed key andthat their forms depend on key values. Since these functions are linear as long as the key is fixed, they do notmake the average differential and linear probabilities of
the cipher higher. Moreover, these functions are fast in
both software and hardware since they are constructedby logical operations such as AND, OR, XOR, and rotations.

The design rationale of the P -function is similar to thatof the P -function of E2. That is, for computational efficiency, it should be represented using only bytewise
exclusive-ORs and for security against differential andlinear cryptanalysis, its branch number should be optimal [19]. From among the linear transformations thatsatisfy these conditions, we chose one considering highly
efficient implementation on 32-processors [3] and highend smart cards, as well as 8-bit processors.

4.3

s-boxes

As the s-boxes we adopted functions affine equivalent to
the inversion function in GF(28 ) for enhanced security
and small hardware design.
It is well known that the smallest of the maximum differential probability of functions in GF(28 ) was provento be 2−6 , and the smallest of the maximum linear probability of functions in GF(28 ) is conjectured to be 2−6 .
There is a function affine equivalent to the inversion
function in GF(28 ) that achieves the best known of the
maximum differential and linear probabilities, 2−6 . We
choose this kind of functions as s-boxes. Moreover, thehigh degree of the Boolean polynomial of every output
bit of the s-boxes makes it difficult to attack Camellia by higher order differential attacks. The two affine
functions that are performed at the input and outputof the inversion function in GF(28 ) complicates the expressions of the s-boxes in GF(28 ), which is expected
to make interpolation attacks ineffective. Making thefour s-boxes different slightly improves security against
truncated differential cryptanalysis [26].
For small hardware design, the elements in GF(28 )can be represented as polynomials with coefficients inthe subfield GF(24 ). In other words, we can implement
the s-boxes by using a few operations in the subfield
GF(24 ) [25]. Two affine functions at the input andoutput of the inversion function in GF(28 ) also playa role in complicating the expressions of the s-boxes in
GF(24 ).

4.4

4.5

Key Schedule

The design criteria of the key schedule are as follows.
1. It should be simple and share part of its procedure
with encryption/decryption.
2. Subkey generation for 128-, 192- and 256-bit keys
can be performed by using the same key schedule(circuit). Moreover, the key schedule for 128-bit
keys can be performed by using a part of this circuit.
3. Key setup time should be shorter than encryption
time. In cases where large amounts of data are processed with a single secret key, the setup time forkey scheduling may be unimportant. On the other
hand, in applications in which the key is changed
frequently, key agility is a factor. One basic component of key agility is key setup time.
4. It should support on-the-fly subkey generation.
5. On-the-fly subkey generation should be computable in the same way in both encryption anddecryption. Some ciphers have separate key schedules for encryption and decryption. In other ciphers, e.g., Rijndael or Serpent, subkeys are computable in the forward direction only and require
unwinding for decryption.

F L- and F L−1 -functions

6. There should be no equivalent keys.

−1

F L- and F L -functions are “inserted” between every
6 rounds of a Feistel network to provide non-regularity
across rounds. One of the goals for such a design isto thwart future unknown attacks. It is one of meritsof regular Feistel networks that encryption and decryption procedures are the same except for the order ofthe subkeys. In Camellia, F L/F L−1 -function layers
are inserted every 6 rounds, but this property is stillpreserved.

7. There should be no related-key attacks or slide attacks.
Criteria 1 and 2 mainly address small hardware requirements, Criteria 3, 4, and 5 are advantageous interms of practical applications, and Criteria 6 and 7
are for security.
The memory requirement for generating subkeys isquite small. An efficient implementation of Camellia
6B = min(wH (x) + wH (P (x))),With the above-mentioned techniques, we prove that
Camellia offers immunity to these attacks by showing
the upper bounds of maximum differential/linear characteristic probabilities, since Camellia is a Feistel cipher
whose round function uses the S-P round function.
In the case of Camellia, the maximum differential/linear probabilities of the s-boxes are ps = qs =2−6 . The branch number of the linear transformation(P -function) is 5, i.e. B = 5. Letting p, q be themaximum differential/linear characteristic probabilities
of Camellia reduced to 16-round without F L- and2(2B+1)=
F L−1 -functions, respectively, we have p ≤ ps
2(2B+1)= (2−6 )22 = 2−132(2−6 )22 = 2−132 and q ≤ qs
from Theorems 1 and 2. Both probabilities are below
the security threshold of 128-bit block ciphers: 2−128 .
It follows that there is no effective differential characteristic or linear characteristic for Camellia reduced tomore than 15 rounds without F L- and F L−1 -functions.
Since F L- and F L−1 -functions are linear for any fixed
key, they do not make the average differential/linear
probabilities of the cipher higher. Hence, it is proventhat Camellia offers enough security against differential
and linear attacks.
Note that the result above are based on Theorems 1
and 2. Both theorems deal with general cases of Feistel ciphers with SPN round function, so we expectthat Camellia is actually more secure than shown by
the result above. As supporting evidence, we counted
the number of active s-boxes of Camellia with reduced
rounds. The counting algorithm is similar to that described in [24] except following three items.

where wH (x) denotes the bytewise Hamming weight ofx.

• Prepare the table for the number of active s-boxes
instead of transition probability table.

Definition 2 A differential active s-box is defined as
an s-box given a non-zero input difference. A linear active s-box is defined as an s-box given a non-zero output
mask value.

• Count the number of active s-boxes instead of computing transition probability.

for 128-bit keys requires 16 bytes (=128 bits) for theoriginal secret key, KL , and 16 bytes (=128 bits) for
the intermediate key, KA . Thus the required memoryis 32 bytes. Similarly, an efficient implementation of
Camellia for 192- and 256-bit keys needs only 64 bytes.

5

Security

5.1

Differential and Linear Cryptanalysis

The most well-known and powerful approaches to attacking many block ciphers are differential cryptanalysis, proposed by Biham and Shamir [4], and linear
cryptanalysis, introduced by Matsui [21]. There areseveral methods of evaluating security against these attacks, where there is a kind of “duality” relation between them [22, 9]: in other words, the security against
both attacks can be evaluated in similar ways.
It is known that the upper bounds of differential/linear characteristic probabilities can, for several
block ciphers, be estimated using the minimum numbers of differential/linear active s-boxes in some consecutive rounds. Kanda [13] shows the minimum numbersof differential/linear active s-boxes for Feistel cipherswith conservative SPN (S-P) round function. Hereafter,
we assume that linear transformation P is bijective.
Definition 1 The branch number B of linear transformation P is defined by
x6=0• F L- and F L−1 -functions set all elements to theminimum number of active s-boxes in the table.
This means that the algorithm gives consideration
to existence of weak subkeys inserted to F L- andF L−1 -functions, since there may be some possibility of connecting every later differential/linear
characteristic with the previous one with the highest probability, which is equivalent to the minimum
number of active s-boxes.

Theorem 1 The minimum number of differential/ linear active s-boxes in any eight consecutive rounds isequal or larger than 2B + 1.
Definition 3 Let ps and qs be the maximum differential/linear probabilities of all s-boxes {s1 , s2 , . . .}.
ps= max max Pr[si (x) ⊕ si (x ⊕ ∆x) = ∆y]qs= max max (2 Pr[x · Γx = si (x) · Γy] − 1)2ii∆x6=0,∆y x
Γy6=0,Γxx

Theorem 2 Let D and L be the minimum numbers of
total differential/linear active s-boxes. Then, the maximum differential/linear characteristic probabilities areLbounded by pD
s and qs , respectively.

As a result, we confirmed that 12-round Camellia
with F L- and F L-functions has no differential/linear
characteristic with probability higher than 2−128 (seeTables 4 and 5).
7

Table 4: Upper bounds of differential characteristic probability of Camellia# of rounds
1
2
3
4
5
6
7
8
9
10
11
12
Estimation based
2−12 2−30
2−42
2−66
2−96
on Th. 1 and 2(2) (5)
(7)
(11)
(16)
Camellia
1 2−6 2−12 2−42 2−54 2−66 2−72 2−72 2−78 2−108 2−120 2−132(0) (1) (2) (7) (9) (11) (12) (12) (13) (18) (20) (22)without F L/F L−1- 1 2−6 2−12 2−36 2−54 2−66 2−78 2−90 2−108 2−126 2−132
functions(0) (1) (2) (6) (9) (11) (13) (15) (18) (21) (22)Note: The numbers in brackets are the number of active s-boxes.
Table 5: Upper bounds of linear characteristic probability of Camellia# of rounds
1
2
3
4
5
6
7
8
9
10
11
12
Estimation based
2−12 2−30
2−42
2−66
2−96
on Th. 1 and 2(2) (5)
(7)
(11)
(16)
Camellia
1 2−6 2−12 2−36 2−54 2−66 2−72 2−72 2−78 2−102 2−120 2−132(0) (1) (2) (6) (9) (11) (12) (12) (13) (17) (20) (22)−1
without F L/F L - 1 2−6 2−12 2−36 2−54 2−66 2−78 2−84 2−108 2−120 2−132
functions(0) (1) (2) (6) (9) (11) (13) (14) (18) (20) (22)Note: The numbers in brackets are the number of active s-boxes.

5.2

of E2 with either IT -Function or F T -Function using
294 chosen plaintexts. In [27] we also show the attack
which distinguishes a 7-round variant of E2 with IT and F T -Functions from a random permutation using
291 chosen plaintexts.
Camellia is a byte-oriented cipher similar to E2, and
it is important to evaluate its security against truncateddifferential cryptanalysis. We searched for truncateddifferentials using an algorithm similar to the one described in [26, 27]. The main difference of the round
function between E2 and Camellia is the adoption of
the 1-round SPN not the 2-round SPN, i.e. S-P-S. In
the search for truncated differentials of E2, we used
about 2−8 as the probability of difference cancellation
in byte at the XOR of Feistel network. However, theround function of Camellia doesn’t have the second sboxes-layer, and the difference cancellation sometimes
occurs with probability 1. As a result, Camellia withmore than 10 rounds is indistinguishable from a random
permutation, in both cases with/without F L-/F L−1function layers.

Truncated Differential Cryptanalysis

The attacks using truncated differentials were introduced by Knudsen [15]. He defined them as differentials where only a part of the difference can be predicted. The notion of truncated differentials introducedby him is wide, but with a byte-oriented cipher it isnatural to study bytewise differentials as truncated differentials [26].
The maximum differential probability is considered
to provide the strict evaluation of security against differential cryptanalysis, but computing its value is impossible in general, since a differential is a set of all
differential characteristics with the same input difference and the same output difference for a Markov cipher [20]. On the other hand, a truncated differential
can be regarded as a subset of the differential characteristics which are exploitable in cryptanalysis. For someciphers, e.g., byte-oriented ciphers, the probability oftruncated differential can be computed easily and correctly, and it gives a more strict evaluation than the
maximum differential characteristic probability.
A truncated differential cryptanalysis of reducedround variants of E2 was presented by Matsui andTokita at FSE’99 [26]. Their analysis was based on
the “byte characteristic,” where the values to the difference in a byte are distinguished between non-zeroand zero. They found a 7-round byte characteristic,
which leads to a possible attack on an 8-round variantof E2 without IT -Function (the initial transformation)
and F T -Function (the final transformation). The best
attack of E2 shown in [27] breaks an 8-round variant

5.3

Truncated Linear Cryptanalysis

We introduce a new cryptanalysis called truncated linear cryptanalysis.
Due to the duality between differential and linear
cryptanalysis, we can evaluate security against truncated linear cryptanalysis by using a similar algorithm
to that above. To put it concretely, we can perform thesearch by replacing the matrix of P -function with thetransposed matrix. As a result, Camellia with morethan 10 rounds without F L-/F L−1 -function layers is
indistinguishable from a random permutation.
8

5.4

Cryptanalysis with Impossible Differential

Table 6: Smallest number of unknown coefficients for
128-, 192-, and 256-bit keys

The impossible differential means the differential whichholds with probability 0, or the differential which neverexists. Using such an impossible differential, it is possible to narrow down the candidates of the subkey. It
is known that there is at least one 5-round impossible differential in any Feistel network with a bijectiveround function. Since Camellia has the Feistel network(with F L- and F L−1 -functions inserted between every
6 rounds) and the round function is bijective, Camellia has 5-round impossible differentials. We have notfound impossible differentials with more than 6 rounds.
Moreover, we expect F L- and F L−1 -functions make attacking Camellia using impossible differentials difficult,since the functions change differential paths dependingon key values. In consequent, Camellia with full rounds
will not be broken by cryptanalysis using impossible differentials.

5.5

whitening×1 + round×r (r < 4)whitening×1 + round×4
More rounds

is known that the degree of the Boolean polynomial of
every output bit of the inversion function in GF(28 )is 7, but the degree for the s-boxes of Camellia is nottrivial, since affine functions are added at the input andoutput. We confirmed that the degree of the Boolean
polynomial of every output bit of the s-boxes is 7 byfinding Boolean polynomial for every output bit of thes-boxes. In Camellia, it is expected that the degree ofan intermediate bit in the encryption process increases
as the data pass through many s-boxes. For example, the degree becomes 73 > 128 after passing throughthree s-boxes. Therefore, we expect that higher order differential attacks fail against Camellia with fullrounds.

Boomerang Attack

Boomerang attack [29] requires 2 differentials. Let
the probability of the differentials be p∆ and p∇ . An
boomerang attack that is superior than exhaustive key
search requires(1)p∆ p∇ ≥ 2−64 .

5.7

Interpolation Attack and Linear
Sum Attack

The interpolation attack proposed in [12] is typicallyapplicable to attacking ciphers that use simple algebraic
functions.
The principle of interpolation attack is that, roughly
speaking, if the ciphertext is represented as a polynomial or rational expression of the plaintext whose number of unknown coefficients is N , the polynomial or
rational expression can be constructed using N pairsof plaintexts and ciphertexts. Once the attacker constructs the polynomial or rational expression, he canencrypt any plaintext into the corresponding ciphertext or decrypt any ciphertext into the corresponding
plaintext for the key without knowing the key. Since
N determines the complexity and the number of pairs
required for the attack, it is important to make N as
large as possible. If N is so large that it is impractical
for the attackers to gather N plaintext-ciphertext pairs,
the cipher is secure against interpolation attack.
Linear sum attack [2] is a generalization of the interpolation attack [12]. A practical algorithm that evaluates the security against linear sum attack was proposed in [2]. We searched for linear relations between
any plaintext byte and any ciphertext byte over GF(28 )using the algorithm. Table 6 summarizes the results.
Table 6 shows that Camellia is secure against linear
sum attack including interpolation attack. It also implies that Camellia is secure against Square attack [10]Using Table 4, there is no combination that satisfies
Inequality (1) for Camellia without F L- and F L−1 functions. The best boomerang probability for Camellia without F L- and F L−1 -functions reduced to 8-roundis bounded by 2−66 that is obtained by p∆ = 2−12 (3rounds) and p∇ = 2−54 (5 rounds). Since attackablerounds for Camellia without F L- and F L−1 -functions
is bounded by much shorter than the specification of
Camellia, 18 or 24, Camellia seems secure against aboomerang attack.

5.6

1
255
256

Higher Order Differential Attack

Higher order differential attack is generally applicableto ciphers that can be represented as Boolean polynomials of low degree. All intermediate bits in the encryption process can be represented as Boolean polynomials,
i.e. polynomials GF(2)[x1 , x2 , . . . , xn ] in the bits of theplaintext: {x1 , x2 , . . . , xn }. In the higher order differential attack described in [12, Theorem 1], if the intermediate bits are represented by Boolean polynomials ofdegree at least d, the (d + 1)-th order differential of theBoolean polynomial becomes 0.
For the degrees of Boolean polynomials of the s-boxesof Camellia, the functions affine equivalent to the inversion function in GF(28 ) are adopted as the s-boxes. It
9security directly derived from the specification, considering the current art. We hope that the study on power
analysis attack will be progressed in the near future.

followed by [2, Theorem 3].

5.8

No Equivalent Keys

Since the set of subkeys generated by the key schedule
contain the original secret key, there is no equivalent setof subkeys generated from distinct secret keys. Therefore, we expect that there are no distinct secret keys
both of which encrypt each of many plaintexts into thesame ciphertext.

5.9

Slide Attack

6.1

Software Implementations

6.2

Hardware Performance

We measured the hardware performance of 128bit-key
Camellia on ASIC (Application Specific Integrated Circuit) and FPGA (Field Programmable Gate Array).
Table 8 shows the environment of our hardware designand evaluation. We evaluated hardware performance ofthe three types: Type 1, Type 2 and Type 3 logic. The
hardware design policy of each type is as follows.
Type 1 Fast implementation from the viewpoint ofEnc(Dec) speed

Related-key Attack

We are convinced that the key schedule of Camellia
makes related-key attacks [5, 18] very difficult. In these
attacks, an attacker must be able to get encryptions
using several related keys. If the relation between, say,two keys, is known then if the corresponding relations
between the subkeys can be predetermined, it might
become possible to predict how the keys would encrypta pair of different plaintexts. However, since the subkeys depend on KA and KB , which are the results ofencryption of a secret key, and if an attacker wants tochange the secret key, he can’t get KA and KB desired,and vice versa, these subkey relations will be very hard
to control and predict.

5.11

Performance

Table 7 summarizes the current software implementations of Camellia. The table shows that Camellia canbe efficiently implemented on low-end smart cards, and32-bit and 64-bit processors. We use the abbreviations
M (mega) for 106 and m (milli) for 10−3 in the table.

In [6, 7] the slide attacks were introduced, based onearlier work in [5, 14]. In particular it was shown that
iterated ciphers with identical round functions, that is,equal structures and equal subkeys in the round functions, are susceptible to slide attacks.
In Camellia, F L- and F L−1 -functions are “inserted”
between every 6 rounds of a Feistel network to provide
non-regularity across rounds. Moreover, from the viewpoint of the key schedule, slide attacks seems to be very
unlikely to succeed (See Section 5.10).

5.10

6

Type 2 Small implementation from the viewpoint of
total logic size
Type 3 Small
FPGA)

implementation(special

case

for

Tables 9 through 12 summarize the hardware performance of 128bit-key Camellia on ASIC (Application
Specific Integrated Circuit) and FPGA (Field Programmable Gate Array).

7

Conclusion

We have presented Camellia, the rationale behind
its design, its suitability for both software andhardware implementation, and the results of ourcryptanalyses. For further information, please refer to the specification of Camellia [1] or full paper, which are available on the Camellia home page:
http://info.isl.ntt.co.jp/camellia/.
The performances shown in this paper leave room forfurther optimizations. The latest performance results
will be posted on the Camellia home page.
We have analyzed Camellia and found no important
weakness. The cipher has a conservative design and any
practical attacks against Camellia would require a major breakthrough in the area of cryptanalysis. We thinkthat Camellia is a very strong cipher, which matches the
security of the existing best block ciphers.

Implementation Attacks

It is well known that a poor implementation can leakinformation by timing attacks [16] or power analysis
attacks [17]. Using the classification proposed in [11],Camellia is in the group of “favorable” algorithms, since
it uses only logical operations and table-lookups andfixed rotations.
On the other hand, Chari et al. [8] claims that all AES
candidates are susceptible to power analysis attacks. As
these two papers contradict with each other, how to resist against power analysis attacks is not known, since
study on power analysis attacks has just begun. We
think that Camellia should be protected by the hardware techniques and should not be evaluated by the10Processor

Language

P IIIiAssembly

P IIj
AlphalANSI Ck
Assembly

8051m

Assembly

Table 7: Camellia software performance
Key len.
Timinga
Dynamicb
e fg h(bits)
Setup ( )Enc. ( )Setupe Enc.g
128
160 (4.4M) 371 (242M)
28
36
192
222 (3.2M) 494 (181M)
28
36
256
226 (3.1M) 494 (181M)
28
36
128
263 (1.1M)
577 (67M)
44
64
128
118 (5.7M) 339 (252M)
48
48
192
176 (3.7M) 445 (192M)
48
48
256
176 (3.7M) 445 (192M)
48
48
128
158 (4.2M) 326 (262M)
48
48
128
0 (0)
10217 (10m)
0
32

Codec
Setupe Enc.g
1,046
2,150
1,469
3,323
1,485
3,323
1,600
3,733
1,132
3,076
1,668
4,000
1,676
4,000
1,600
2,928
0
702

Tabled
8,224
8,240
8,240
4,128
16,528
16,528
16,52816,512288

a Number of cycles needed for setup or encryption.
b Dynamically used memory in bytes including stack area, excluding text and key area, which is usually located in RAM.
c Code size in bytes, which is sometimes located in ROM.
d Table size in bytes, which is sometimes located in ROM.
e Key schedule may be included.
f Seconds for 8051, and keys/s for other processors.
g Numbers of this column is the same as decryption, since Camellia is symmetric between encryption and decryption.
h Seconds for 8051, and b/s for other processors.
i IBM PC/AT compatible PC, Intel Pentium III (700MHz), 256KB on-die L2 cache, FreeBSD 4.0R, 128MB main memory.
j IBM PC/AT compatible PC, Intel Pentium II (300MHz), 512KB L2 cache, MS-Windows 95, 160MB main memory.
k Microsoft Visual C++ 6 with the optimization options /G6/Zp16 /ML /Ox /Ob2.

l COMPAQ Professional Workstation XP1000, Alpha 21264 (667MHz), Compaq Tru64 UNIX 4.0F, 2GB main memory.
m Intel 8051 (12MHz; 1 cycle = 12 oscillator periods) simulator on Unix.

Table 8: Hardware evaluation environment (ASIC, FPGA)
Language(ASIC, FPGA) Verilog-HDL
Simulator(ASIC, FPGA) Verilog-XL
Design library(ASIC) Mitsubishi Electric 0.35µ CMOS ASIC library(FPGA) Xilinx XC4000XL series
Login synthesis (ASIC) Design Compiler version 1998.08(FPGA) Synplify version 5.3.1 and ALLIANCE version 2.1i

Table 9: Hardware performance (Type 1: Fast implementation [ASIC(0.35µ CMOS)])
Algorithm
Area [Gate]
Key setup
Critical- Throughput
nameEnc.&Dec.a Key expan.b Total logicc
time [ns]path [ns]d[Mb/s]
DES
42,204
12,201
54,405—55.11
1161.31
Triple-DES
124,888
23,207
128,147—
157.09407.40MARS
690,654
2,245,096
2,935,754
1740.99567.49225.55RC6
741,641
901,382
1,643,037
2112.26627.57203.96
Rijndael
518,508
93,708612,834
57.39
65.64
1950.03
Serpent
298,533
205,096503,770
114.07137.40931.58
Twofish200,165
231,682
431,857
16.38
324.80394.08
Camellia
216,91155,907
272,81924.36
109.351170.55a including output registers
b including subkey registersc including buffers for fan-out adjustmentd Critical path of data encryption (or decryption)

11

Table 10: Hardware performance (Type 2: Small implementation [ASIC(0.35µ CMOS)])
Algorithm
Area [Gate]
Key setup
Critical- Throughput
nameEnc.&Dec.a Key sched.b Total logic ctime [ns]path [ns]d[Mb/s]
Camellia
6,367
4,979
11,350110.2
27.67
220.28a including output registers and data selectorb including subkey registers and a part of key expansion logic
c including buffers for fan-out adjustmentd Critical path of data encryption (or decryption)

Table 11: Hardware performance (Type 2: Small implementation [FPGA(XC4000XL series)])
Algorithm Area [CLBs]
CriticalThroughput
name
Total
path [ns]a[Mb/s]
Camellia
1,296
78.815
77.34

Table 12: Hardware performance (Type 3: Small implementation [FPGA(XC4000XL series)])
Algorithm Area [CLBs]
CriticalThroughput
name
Total
path [ns]a[Mb/s]
Camellia874
49.957122.01a Critical path of data encryption (or decryption)

12

References[12] T. Jakobsen and L. R. Knudsen, “The Interpolation Attack on Block Ciphers,” Fast Software Encryption, FSE’97, Lecture Notes in Computer Science 1267, pp.28–40, Springer-Verlag, 1997.

[1] K. Aoki, T. Ichikawa, M. Kanda, M. Matsui, S. Moriai, J. Nakajima, and T. Tokita, “Specificationof Camellia — a 128-bit Block Cipher,” 2000.
http://info.isl.ntt.co.jp/camellia/.

[13] M. Kanda, “Practical Security Evaluation against
Differential and Linear Attacks for Feistel Cipherswith SPN Round Function,” SAC2000, Seventh Annual Workshop on Selected Areas in Cryptography,
14-15 August 2000, Workshop Record, 2000.

[2] K. Aoki, “Practical Evaluation of Security against
Generalized Interpolation Attack,” IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences (Japan), Vol.E83-A,
No.1, pp.33–38, 2000. (A preliminary version waspresented at SAC’99.)[14] L.R.Knudsen, “Cryptanalysis of LOKI91,” Advances in Cryptology — AUSCRYPT’92, Lecture Notes in Computer Science 718, pp.196–208,
Springer-Verlag, 1993.

[3] K. Aoki and H. Ueda, “Optimized Software Implementations of E2,” IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences (Japan), Vol.E83-A, No.1, pp.101–
105, 2000.

[15] L.R.Knudsen, “Truncated and Higher Order Differentials,” Fast Software Encryption — Second International Workshop, Lecture Notes in Computer
Science 1008, pp.196–211, Springer-Verlag, 1995.

[4] E. Biham and A. Shamir, “Differential Cryptanalysis of the Data Encryption Standard,” SpringerVerlag, 1993.

[16] P.Kocher, “Timing Attacks on Implementationsof Diffie-Hellman, RSA, DSS, and Other Systems,” Advances in Cryptology — CRYPTO’96,
Lecture Notes in Computer Science 1109, pp.104–
113, Springer-Verlag, 1996.

[5] E. Biham, “New Types of Cryptanalytic Attacks
Using Related Keys,” Journal of Cryptology, Vol.7,
No.4, pp.229–246, Springer-Verlag, 1994.
[6] A. Biryukov and D. Wagner, “Slide Attacks,” Fast
Software Encryption — 6th International Workshop, FSE’99, Lecture Notes in Computer Science
1636, pp.245–259, Springer-Verlag, 1999.

[17] P.Kocher, J.Jaffe and B.Jun, “Differential Power
Analysis,” Advances in Cryptology — CRYPTO’99,
Lecture Notes in Computer Science 1666, pp.388–
397, Springer-Verlag, 1999.

[7] A. Biryukov and D. Wagner, “Advanced Slide
Attacks,” Advances in Cryptology — EUROCRYPT2000, Lecture Notes in Computer Science
1807, pp.589–606, Springer-Verlag, 2000.

[18] J.Kelsey, B.Schneier and D.Wagner, “KeySchedule Cryptanalysis of IDEA, G-DES, GOST,
SAFER, and Triple-DES,” Advances in Cryptology— CRYPTO’96, Lecture Notes in Computer Science 1109, pp.237–251, Springer-Verlag, 1996.

[8] S. Chari, C. Jutla, J. R. Rao and P. Rohatgi,“A Cautionary Note Regarding Evaluation of AES
Candidates on Smart-Cards,” Second Advanced Encryption Standard Candidate Conference, pp.133–
147, 1999”,[19] M.Kanda, Y.Takashima, T.Matsumoto, K.Aoki
and K.Ohta, “A Strategy for Constructing Fast
Round Functions with Practical Security against
Differential and Linear Cryptanalysis,” Selected
Areas in Cryptography, 5th Annual International
Workshop, SAC’98, Lecture Notes in Computer Science 1556, pp.264–279, Springer-Verlag, 1999.

[9] F. Chabaud and S. Vaudenay, “Links Between Differential and Linear Cryptanalysis,” Advances in
Cryptology — EUROCRYPT’94, Lecture Notes
in Computer Science 950, pp.356–365, SpringerVerlag, 1995.
[10] J. Daemen, L. R. Knudsen and V. Rijmen “TheBlock Cipher Square,” Fast Software Encryption,
FSE’97, Lecture Notes in Computer Science 1267,
pp.54–68, Springer-Verlag, 1997.

[20] X. Lai, J. L. Massey, and S. Murphy, “Markov Ciphers and Differential Cryptanalysis,” Advances in
Cryptology — EUROCRYPT’91, Lecture Notes in
Computer Science 547, pp.17–38, Springer-Verlag,
1991.

[11] J. Daemen and V. Rijmen, “Resistance Against
Implementation Attacks. A Comparative Study of
the AES Proposals,” Second Advanced Encryption
Standard Candidate Conference, 1999.

[21] M. Matsui, “Linear Cryptanalysis Method for
DES Cipher,” Advances in Cryptology — EUROCRYPT’93, Lecture Notes in Computer Science
765, pp.386–397, Springer-Verlag, 1994.
13

[22] M. Matsui, “On Correlation Between the Orderof S-boxes and the Strength of DES,” Advancesin Cryptology — EUROCRYPT’94, Lecture Notes
in Computer Science 950, pp.366–375, SpringerVerlag, 1995.
[23] M. Matsui, “New Block Encryption Algorithm
MISTY,” Fast Software Encryption, FSE’97, Lecture Notes in Computer Science 1267, pp.54–68,
Springer-Verlag, 1997.
[24] M. Matsui, “Differential Path Search of the Block
Cipher E2,” (in Japanese), Technical report of IEICE, ISEC99-19, pp.57–64, The Institute of Electronics, Information and Communication Engineers,
1999.
[25] M. Matsui, T. Inoue, A. Yamagishi, andH. Yoshida, “A note on calculation circuits over
GF(22n ),” Technical Report of IEICE, IT88-14, The
Institute of Electronics, Information and Communication Engineers, 1988. (in Japanese)[26] M. Matsui and T. Tokita, “Cryptanalysis of a Reduced Version of the Block Cipher E2,” Fast Software Encryption — 6th International Workshop,
FSE’99, Lecture Notes in Computer Science 1636,
pp.71–80, Springer-Verlag, 1999.
[27] S. Moriai, M. Sugita, K. Aoki, and M. Kanda,“Security of E2 against Truncated Differential
Cryptanalysis,” Selected Areas in Cryptography,
6th Annual International Workshop, SAC’99, Lecture Notes in Computer Science 1758, pp.106–117,
Springer-Verlag, 2000.
[28] Nippon Telegraph and Telephone Corporation,“Specification of E2 — a 128-bit Block Cipher,”
1999. http://info.isl.ntt.co.jp/e2/[29] D. Wagner, “The Boomerang Attack,” Fast Software Encryption — 6th International Workshop,
FSE’99, Lecture Notes in Computer Science 1636,
pp.156–170, Springer-Verlag, 1999.

14