Report on Present State ofCIPHERUNICORN-A
Cipher Evaluation(full evaluation)
January 28, 2002
Masayuki Kanda, Member
Symmetric-Key Cryptography Subcommittee

1

CIPHERUNICORN-Az CIPHERUNICORN-A was presented by NEC

Corporation in 2000.
z Symmetric-key block cipherz Block length: 128 bits; key length: 128/192/256 bits
z Follow-up evaluation cipher from CRYPTREC2000
z Features
 Feistel structure (16 rounds) + whitening Roundfunction with dual structure consisting of a mainstream and a temporary key generation mechanism.
 Round function designed by cipher-robustness evaluation
support system (NEC proprietary development).
2

CRYPTREC2000 evaluation resultsz

So far, no security-related problems have been discovered.
z

In general terms, given that the specification defines the number of rounds as 16,
it would seem impossible to cryptanalyze the cipher using current theoretical
cryptanalysis techniques.

Because this cipher has a complex round function, accurate
evaluation is difficult, so follow-up evaluation is considerednecessary.
It is difficult to accurately evaluate and analyze security against theoretical
cryptanalysis techniques such as differential cryptanalysis and linear
cryptanalysis.
 It is necessary to conduct a more-detailed evaluation, replacing the (simplified)
mF function with the actual round function.
z

In terms of processing speed, CIPHERUNICORN-A is among theslower.
Among the 128-bit block ciphers which are in CRYPTREC2000 continualevaluation, this cipher belongs to the slowest group. (Speed is on par with Triple
DES.)

3

Evaluation procedurez Full evaluation:

We requested four specialists (teams) in cipher researchin Japan and abroad to conduct an evaluation based on
the following perspectives: Appropriateness of conducting evaluation using mF

function
 Security against differential cryptanalysis, from theperspective of differential characteristic probability
 Security against linear cryptanalysis, from theperspective of linear characteristic probability
 Other noted security-related issues
4Overview of security evaluation Block length and key
length are both 128 bits
Key length

Calculations required for
cryptanalysis

Secure ciphers
2128

Ciphers with no practicalproblems, but which could
theoretically becryptanalyzed(280)

Dependent on inverseof differential
characteristic
probability or linear
characteristic
probability

Ciphers thatcan becryptanalyzed

Dependent on
computing capability
Dependent on
usage environment

(232)

2128

Plaintext-ciphertext pairs required for
cryptanalysis

Block length5Comments of Evaluator 1z

Supporting evidence is provided indicating the cipher issecure against differential cryptanalysis and linear
cryptanalysis
 Security against differential cryptanalysis

Upper bound of characteristic probability with round function: ≤ 2-21-126
z Upper bound of characteristic probability with 13 rounds: ≤ 2z

 Security against linear cryptanalysis

The cipher seems more secure against linear cryptanalysis than against
differential cryptanalysis
z Assuming the security in the self-evaluation is correct, the following upperbound values are calculated.
-13.9− Upper bound of characteristic probability with round function ≤ 2-83.4− Upper bound of characteristic probability with 13 rounds: ≤ 2z The obtained results contradict the security in the self-evaluation.
− The possibility of a higher upper bound of linear characteristic
probability with the round function exists.
z There is almost no consideration for the effects of the A3 function, constantmultiplication unit, and temporary key generating mechanism.
z6

Comments of Evaluator 2z

I found no grounds for suspecting any problems related tosecurity against differential cryptanalysis and linear
cryptanalysis
 Security against differential cryptanalysis
z Upper bound of characteristic probability of the round function without A3 function andmultiplication: ≤ 2-14.4
z There cannot be any cases where the characteristic probability with the round function
greatly exceeds 2-12. In addition, the A3 function and constant multiplication can beexpected to contribute to improved security.
 Security against linear cryptanalysis
z The characteristic probability upper bound in the security self-evaluation is incorrect.
z Upper bound of characteristic probability with mF function: ≤ 2-21.68
z The A3 function and constant multiplication can be expected to contribute to improved
security.

zExistence of weak keys
 All 32-bit subkeys are identical to the first 32 bits in the secretkey{ 0x61db99c8, 0x9f3d618, 0x9f3d618, 0x9f3d618, … }This becomes the exact subkey value
7

Comments of Evaluator 3z

The evidence is not so strong as to provide clear proof ofsecurity against differential cryptanalysis
Discovered differential characteristics more efficient than those in thesecurity self-evaluation.
 Upper bound of characteristic probability with mF function: ≤ 2-7
 Upper bound of characteristic probability with 15 rounds: ≤ 2-70
(Upper bound of characteristic probability with 13 rounds: ≤ 2-56 ) The above results are from a byte-level search. Therefore, thecharacteristic probability (upper bound) may fluctuate if the effects ofconstant multiplication and the A3 function are studied in detail.
The cipher seems secure against linear cryptanalysis
The characteristic probability upper bound in the security self-evaluation
is incorrect.
 Upper bound of characteristic probability with mF function: ≤ 2-21.37
 Upper bound of characteristic probability with 15 rounds: ≤ 2-149.58(Upper bound of characteristic probability with 13 rounds: ≤ 2-128.22 )8Comments of Evaluator 4
z Supporting evidence is provided indicating the cipher issecure against differential cryptanalysis
 Evaluation using round function (main stream section only)

excluding the effects of the temporary key generation
mechanismz Upper bound of characteristic probability: ≤ 2-7

z Upper bound of characteristic probability with 6-round iterative
expression: ≤ 2-56

z Upper bound of characteristic probability with 13 rounds: ≤ 2-119

 Effects of temporary key generation mechanismz The

temporary key generation mechanism has characteristicsopposite those of the A3 function, so it can be expected tocontribute to improved security.

9Summary of evaluations
Attack method

Evaluator 1 Evaluator 2 Evaluator 3 Evaluator 4

Differential
cryptanalysis
Linear cryptanalysis

Model

Full

mF function

mF function

Main stream
section, 6-round
iterative

Characteristic probability
upper bound with round
function≤ 2-21≤ 2-14.4

≤ 2-7

≤ 2-7

Characteristic probability
upper bound with 13 rounds≤ 2-126≤ 2-115≤ 2-56≤ 2-119

ModelmF function

mF function

mF function---

Characteristic probability
upper bound with roundfunction≤ 2-13.9(see note)≤ 2-21.6≤ 2-21.3---

Characteristic probability
upper bound with 13 rounds≤ 2-83.5(see note)≤ 2-130≤ 2-128---

Note: These results assume the designer’s evaluation is correct. 10

Conclusionz The cipher’s security level is not high enough tocompletely eliminate all security concerns
 In terms of security against differential cryptanalysis andlinear cryptanalysis, the possibility of problems occurring, atleast in practical use, is extremely low.
Supporting evidence has been obtained suggesting that attacks basedon these cryptanalysis methods would probably not succeed.
z The evidence is not so strong as to prove clearly that the cipher istheoretically secure against these cryptanalysis methods.
z The existence of weak keys that seem non-trivial wasdiscovered
There is at least one secret key in which only the first 32 bits are used
for all subkeys
z The level of impact of this on security is not known at the presenttime.
z11