The 128-bit Blockcipher CLEFIA
Speciﬁcation

Version 1.0

Sony Corporation

January 29, 2010

Revision History
Jan 29, 2010

version 1.0

Contents
1 Design Strategy
1.1 Design Strategy of CLEFIA . . . . . . . . . . . . . . . . . . .
1.2 Advantages of CLEFIA . . . . . . . . . . . . . . . . . . . . .

44
5

2 Algorithm Speciﬁcation
2.1 Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.2 Deﬁnition of GFNd,r . . . . . . . . . . . . . . . . . . . . . . .
2.2.1 F-functions . . . . . . . . . . . . . . . . . . . . . . . .
2.2.2 S-boxes . . . . . . . . . . . . . . . . . . . . . . . . . .
2.2.3 Diﬀusion Matrices . . . . . . . . . . . . . . . . . . . .
2.3 Data Processing Part . . . . . . . . . . . . . . . . . . . . . . .
2.3.1 Overall Structure . . . . . . . . . . . . . . . . . . . . .
2.3.2 The Numbers of Rounds . . . . . . . . . . . . . . . . .
2.4 Key Scheduling Part . . . . . . . . . . . . . . . . . . . . . . .
2.4.1 Overall Structure . . . . . . . . . . . . . . . . . . . . .
2.4.2 Key Scheduling for a 128-bit Key . . . . . . . . . . . .
2.4.3 Key Scheduling for a 192-bit Key . . . . . . . . . . . .
2.4.4 Key Scheduling for a 256-bit Key . . . . . . . . . . . .
2.4.5 Constant Values . . . . . . . . . . . . . . . . . . . . .
2.5 Test Vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.5.1 Test Vectors (Intermediate Values) . . . . . . . . . . .

8
8
9
10
10
14
15
15
15
17
17
17
18
19
22
29
30

3 Implementation Techniques45
3.1 Software Implementations . . . . . . . . . . . . . . . . . . . . 45
3.1.1 Optimization Techniques for Encryption . . . . . . . . 45
3.1.2 Optimization Techniques for Decryption . . . . . . . . 51
3.1.3 Optimization Techniques for Key Scheduling . . . . . 51
3.2 Hardware Implementations . . . . . . . . . . . . . . . . . . . 51
3.2.1 Optimization Techniques in F-functions . . . . . . . . 51
3.2.2 Optimization Techniques in Key Scheduling Part . . . 55
4 Version Information

58

2

CONTENTS
5 Existing Level of Adoption and Recommended Use59
5.1 Existing Level of Adoption . . . . . . . . . . . . . . . . . . . 59
5.1.1 Standardization . . . . . . . . . . . . . . . . . . . . . . 59
5.1.2 Adoption in products and systems . . . . . . . . . . . 59
5.2 Recommended Use . . . . . . . . . . . . . . . . . . . . . . . . 59

3

Chapter 1

Design Strategy
1.1

Design Strategy of CLEFIA

A lot of secure and high performance blockciphers have been designed beneﬁted from advancing research on design and cryptanalysis. However, newcryptanalytic techniques are evolved day by day; techniqeus on algebraic
attacks and related-key attacks are advanced in these years [1–4], and new
designs considering these new cryptanalytic techniques are required. Furthermore, cryptographic technology is applied to wider area including constrained environments, e.g. smart cards and RFID, and demand for lightweight
cryptography suitable for such environments is increasing.
In order to satisfy these needs, we designed a 128-bit blockcipher CLEFIA based on current state-of-the-art techniques. CLEFIA supports a block
length of 128 bits and key lengths of 128, 192 and 256 bits, which are compatible with AES.
Our design strategy of CLEFIA is to realize good balance on three fundamental directions required for practical ciphers:• Security• Speed• Cost for implementations
In order to achieve this goal, several novel ideas are contributed to CLEFIA.
Summary of the ideas is listed as follows.
Structure CLEFIA employs a 4-branch Type-2 generalized Feistel structure [11]. The type-2 Feistel structure has two F-functions in one roundfor the four data lines case. The type-2 Feistel structure has the following
features:• F-functions are smaller than that of the traditional Feistel structure4CHAPTER 1. DESIGN STRATEGY• Plural F-functions can be processed simultaneously• Tends to require more rounds than the traditional Feistel structure
The ﬁrst feature is a great advantage for software and hardware implementations, and the second one is suitable for eﬃcient implementation especiallyin hardware. We conclude that the advantages of the type-2 Feistel structure surpass the disadvantage of the third one for our blockcipher design.
Moreover, the new design technique, which is explained in the next, enables
to reduce the number of rounds eﬀectively.
Diﬀusion Switching Mechanism (DSM) One of novel design approachesof CLEFIA is that F-functions employ the Diﬀusion Switching Mechanism(DSM) [6, 7]: these F-functions use diﬀerent diﬀusion matrices to obtainstronger immunity against diﬀerential and linear cryptanalyses. Consequently, the required number of rounds can be reduced.
Two S-boxes system CLEFIA employs two diﬀerent S-boxes based on
diﬀerent algebraic structures, which is expected to increase algebraic immunity.
Secure and compact key scheduling algorithm We introduce a new
key scheduling design. The key scheduling part uses a generalized Feistel
structure, and it is possible to share it with the data processing part. Moreover, this structure facilitates easy analysis, and security against related-key
attacks is evaluated. The DoubleSwap function used in the key schedulingpart is low cost but has a good diﬀusion property. By using the DoubleSwap
function, round keys are generated sequentially and eﬃciently from the intermediate key both in encryption and decryption.
Designs for eﬃcient implementations CLEFIA can be implemented
eﬃciently both in hardware and software. In Table 1.1, we summarize thedesign aspects for eﬃcient implementations.

1.2

Advantages of CLEFIA

According to the application guide, we describe CLEFIA’s advantages overthe block ciphers which are included in the current e-Government Recommended Ciphers List.
Security evaluation against all known cryptanalyses We consideredimmunity against all known cryptanalyses as far as we knew in designing
CLEFIA. We conﬁrmed that CLEFIA has no weakness for each cryptanalysis in security evaluation.
5

CHAPTER 1. DESIGN STRATEGY

Table 1.1: Design Aspects for Eﬃcient Implementations
Generalized
Feistel Network
SP-type F-function
DSM
S-boxes
Matrices
Key Schedule· Small size F-functions (32-bit in/out)· No need for the inverse F-functions· Enabling fast table implementation in software· Reducing the numbers of rounds· Very small footprint of S0 and S1 in hardware· Using elements with low hamming weights only
· Same structure with the data processing part· Only a 128-bit register is required for CLEFIA
with 128-bit keys
· Small footprint of DoubleSwap function

CLEFIA employs the Diﬀusion Switching Mechanism (DSM) to enhance
the immunity against diﬀerential attacks and linear attacks by using two different diﬀusion matrices. Moreover, we demonstrate qualitative evaluationof immunity against these attacks.
Consideration of state-of-the-art cryptanalyses Cryptanalytic techniques for blockciphers are evolved day by day. CLEFIA was designed basedon the state-of-the-art techniques on design and analysis of block ciphers,
including updates after the block ciphers in the current e-Government Recommended Ciphers List were designed.
In particular, recent researches of related-key attacks make remarkableprogress. These attacks are serious threats for blockciphers with simple keyscheduling part such as AES. The key scheduling part of CLEFIA employs
the type-2 generalized Feistel structure which is the same structure as thedata processing part. This design enables security evaluation of the keyscheduling part itself (against diﬀerential and linear attacks), and it makes
diﬃcult to apply related-key attacks to CLEFIA.
Moreover, CLEFIA has two diﬀerent types of S-boxes allocated in Ffunctions. This design enhances the immunity against algebraic attacks
including the XSL attack.
High eﬃciency CLEFIA was designed to achieve high eﬃciency in both
software and hardware implementations as well as to hold enough security
based on the current cryptanalyses. The hardware performance of CLEFIA
is particularly advantageous among other blockciphers.
In software, CLEFIA with 128-bit keys achieves about 13 cycles/byte,
1.48 Gbps on a 2.4 GHz AMD Athlon 64. This result shows that software
performace of CLEFIA is classiﬁed into the fastest class among block ciphers

6CHAPTER 1. DESIGN STRATEGY

in the current e-Government Recommended Ciphers List.
In hardware, an implementation of CLEFIA with 128-bit keys is verysmall, occupying less than 5K gates by 0.09 μm CMOS ASIC library. This
is in the smallest class among block ciphers in the current e-Government
Recommended Ciphers List.
For speed optimized implementations, the performance of CLEFIA achieves
1.6 Gbps with about 6 Kgates and 3 Gbps with about 12 Kgates. Fromthese results, CLEFIA is unique in hardware eﬃciency, which is deﬁned bythroughput per gate.
In 2007, Sugawara el al. [9,10] compared hardware performance in ASICs
with ISO/IEC 18033-3 block ciphers, which showed CLEFIA’s advantage in
hardware eﬃciency, i.e. throughput per area.

7

Chapter 2

Algorithm Speciﬁcation
This chapter describes the speciﬁcation of the blockcipher CLEFIA. CLEFIA is a 128-bit blockcipher with its key length being 128, 192 and 256
bits, which is compatible to AES. CLEFIA consists of two parts: a dataprocessing part and a key scheduling part. CLEFIA employs a generalized
Feistel structure with four data lines, and the width of each data line is 32
bits. Additionally, there are key whitening parts at the beginning and theend of the cipher. The numbers of rounds of CLEFIA are 18, 22 and 26 for
128-bit, 192-bit and 256-bit keys, respectively.

2.1

NotationsThis section describes mathematical notations, conventions and symbols
used throughout this paper.
0x: A preﬁx for a binary string in a hexadecimal form
: b denotes the bit length of aa(b)a|b or (a|b): Concatenation(a, b) or (a b) : Vector style representation of a|ba←b: Updating a value of a by a value of bta
: Transposition of a vector or a matrix aa⊕b: Bitwise exclusive-OR. Addition in GF(2n )a·b: Multiplication in GF(2n )a: Logical negationa≪b: b-bit left cyclic shitft operation

8

CHAPTER 2. ALGORITHM SPECIFICATION

2.2

Deﬁnition of GFNd,r

We ﬁrst deﬁne a function GFNd,r which is a fundamental structure for CLEFIA, followed by deﬁnitions of a data processing part and a key schedulingpart.
CLEFIA uses a 4-branch and an 8-branch generalized Feistel network.
We denote d-branch r-round generalized Feistel network employed in CLEFIA as GFNd,r . GFNd,r uses two diﬀerent 32-bit F-functions F0 and F1
whose input/output are deﬁned as follows.
{0, 1}32 × {0, 1}32 → {0, 1}32
F0 , F1 :(RK(32) , x(32) ) → y(32)For d 32-bit input Xi and output Yi (0 ≤ i < d), and dr/2 32-bit roundkeys RKi (0 ≤ i < dr/2), GFNd,r (d = 4, 8) are deﬁned as follows.

GFN4,r :{{0, 1}32 }2r × {{0, 1}32 }4 → {{0, 1}32 }4(RK0(32) , . . . , RK2r−1(32) , X0(32) , . . . , X3(32) ) → Y0(32) , . . . , Y3(32)Step 1. T0 | T1 | T2 | T3 ← X0 | X1 | X2 | X3
Step 2. For i = 0 to r − 1 do the following:
Step 2.1 T1 ← T1 ⊕ F0 (RK2i , T0 ),T3 ← T3 ⊕ F1 (RK2i+1 , T2 )Step 2.2 T0 | T1 | T2 | T3 ← T1 | T2 | T3 | T0
Step 3. Y0 | Y1 | Y2 | Y3 ← T3 | T0 | T1 | T2

GFN8,r :{{0, 1}32 }4r × {{0, 1}32 }8 → {{0, 1}32 }8(RK0(32) , . . . , RK4r−1(32) , X0(32) , . . . , X7(32) ) → Y0(32) , . . . , Y7(32)Step 1. T0 | T1 | . . . | T7 ← X0 | X1 | . . . | X7
Step 2. For i = 0 to r − 1 do the following:
Step 2.1 T1 ← T1 ⊕ F0 (RK4i , T0 ),T3 ← T3 ⊕ F1 (RK4i+1 , T2 ),T5 ← T5 ⊕ F0 (RK4i+2 , T4 ),T7 ← T7 ⊕ F1 (RK4i+3 , T6 )Step 2.2 T0 | T1 | . . . | T6 | T7 ← T1 | T2 | . . . | T7 | T0
Step 3. Y0 | Y1 | . . . | Y6 | Y7 ← T7 | T0 | . . . | T5 | T6
The inverse function GFN−1
4,r is obtained by changing the order of RKi
and the direction of word rotation at Step 2.2 and Step 3.
GFN−1
4,r :



{{0, 1}32 }2r × {{0, 1}32 }4 → {{0, 1}32 }4(RK0(32) , . . . , RK2r−1(32) , X0(32) , . . . , X3(32) ) → Y0(32) , . . . , Y3(32)9CHAPTER 2. ALGORITHM SPECIFICATION

Step 1. T0 | T1 | T2 | T3 ← X0 | X1 | X2 | X3
Step 2. For i = 0 to r − 1 do the following:
Step 2.1 T1 ← T1 ⊕ F0 (RK2(r−i)−2 , T0 ),T3 ← T3 ⊕ F1 (RK2(r−i)−1 , T2 )Step 2.2 T0 | T1 | T2 | T3 ← T3 | T0 | T1 | T2
Step 3. Y0 | Y1 | Y2 | Y3 ← T1 | T2 | T3 | T0

2.2.1

F-functions

Two F-functions F0 and F1 used by GFNd,r are deﬁned as follows:
F0 : (RK(32) , x(32) ) → y(32)Step 1. T ← RK ⊕ x
Step 2. Let T = T0 | T1 | T2 | T3 , Ti ∈ {0, 1}8
T0 ← S0 (T0 ),T1 ← S1 (T1 ),T2 ← S0 (T2 ),T3 ← S1 (T3 )Step 3. Let y = y0 | y1 | y2 | y3 , yi ∈ {0, 1}8t (y , y , y , y ) = M t (T , T , T , T )0 1 2 30
0 1 2 3
F1 : (RK(32) , x(32) ) → y(32)Step 1. T ← RK ⊕ x
Step 2. Let T = T0 | T1 | T2 | T3 , Ti ∈ {0, 1}8
T0 ← S1 (T0 ),T1 ← S0 (T1 ),T2 ← S1 (T2 ),T3 ← S0 (T3 )Step 3. Let y = y0 | y1 | y2 | y3 , yi ∈ {0, 1}8t (y , y , y , y ) = M t (T , T , T , T )0 1 2 31
0 1 2 3S0 and S1 are nonlinear 8-bit S-boxes, and M0 and M1 are 4 × 4 matrices deﬁned later in this section. In each F-function, two S-boxes are usedin the diﬀerent order, and diﬀerent matrix is used. Figure 2.1 shows theconstruction of the F-functions.

2.2.2

S-boxes

CLEFIA employs two diﬀerent types of 8-bit S-boxes: one is based on four
4-bit random S-boxes, and the other is based on the inverse function over
GF(28 ).
Tables 2.1 and 2.2 show the output values of S0 and S1 , respectively.
In these tables all values are expressed in a hexadecimal form. For an 8bit input of an S-box, the upper 4-bit indicates a row and the lower 4-bit
10

CHAPTER 2. ALGORITHM SPECIFICATION
k0 k 1 k 2 k 3
8/ 8/ 8/ 8/

x0

8

/

S0

x1

8

/

S1

x2

8

S0

x3

8

/
/

8

/

y0

8

/

y1

8

/

y2

S1

8

/

y3

8

/

y0

8

/

y1

8

/

y2

8

y3

M0

F0
k0 k1 k2 k3
8/ 8/ 8/ 8/

x0

8

/

S1

x1

8

S0

x2

8

/

S1

x3

8

S0

/
/

M1

/

F1

Figure 2.1: F-functions
indicates a column. For example, if a value 0xab is input, 0x7e is output by
S0 because it is on the cross line of the row indexed by ’a.’ and the column
indexed by ’.b’.
S-box S0 S0 is generated by combining four 4-bit S-boxes SS0 , SS1 , SS2
and SS3 in the following way. The values of these S-boxes are deﬁned as
Table 2.3.
{0, 1}8 → {0, 1}8
S0 :x(8) → y(8)Step 1. t0 ← SS0 (x0 ), t1 ← SS1 (x1 ), where x = x0 |x1 , xi ∈ {0, 1}4
Step 2. u0 ← t0 ⊕ 0x2 · t1 , u1 ← 0x2 · t0 ⊕ t1
Step 3. y0 ← SS2 (u0 ), y1 ← SS3 (u1 ), where y = y0 |y1 , yi ∈ {0, 1}4
The multiplication in 0x2 · ti is performed in GF(24 ) deﬁned by thelexicographically ﬁrst primitive polynomial z 4 + z + 1. Figure 2.2 shows theconstruction of S0 .

11

CHAPTER 2. ALGORITHM SPECIFICATION

Table 2.1: S0
0.
1.
2.
3.
4.
5.
6.
7.
8.
9.
a.
b.
c.
d.
e.
f.

.0
57
28
bf
42
a4
30
d6
e9
cd
03
fc
15
7b
6e
81
9a

.1
49
d0
a1
5d
be
98
2a
c7
e2
75
1b
f3
0c
84
6f
36

.2
d1
4b
19
2e
fd
cc
53
9f
34
86
a0
ba
68
72
07
e5

.3
c6
92
65
e8
8c
dd
37
4a
50
f1
04
7f
1e
bb
a3
29

.4
2f
5c
f7
d4
12
eb
45
31
9e
6a
b8
a6
80
0d
79
c3

.5
33
ee
7a
9b
00
54
c1
25
dc
a7
8d
69
b2
18
f6
4f

0.
1.
2.
3.
4.
5.
6.
7.
8.
9.
a.
b.
c.
d.
e.
f.

.0
6c
bf
12
91
fb
25
6e
cf
55
9a
7e
7a
b5
f8
d4
f7

.1
da
74
eb
11
f5
5d
54
ea
04
37
6a
4b
22
5f
75
e4

.2
c3
94
cd
c7
de
9b
15
ed
c4
06
b6
c2
47
ab
66
79

.3
e9
8f
b3
3f
20
31
62
78
86
24
71
2f
3a
f1
bb
96

.4
4e
b7
92
2a
c6
e8
f6
33
39
64
a0
db
d5
1b
68
a2

.5
9d
9c
e7
8e
a7
3e
35
58
77
7c
70
5a
10
42
9f
fc

x
SS0 (x)SS1 (x)SS2 (x)SS3 (x)

0
e
6
b
a

1
6
4
8
2

.6
74
85
32
0f
97
b3
6c
fe
11
40
e6
c8
5a
d9
2d
ab

.7
fb
b1
20
13
da
8f
ae
7c
05
c2
59
4d
e7
96
38
64

.8
95
c4
06
3c
78
4e
ef
d3
2b
b9
62
87
ad
f0
1a
51

.9
6d
0a
ce
89
e1
16
70
a2
b7
2c
93
3b
d5
5f
44
f8

.a
82
76
e4
67
cf
fa
08
bd
a9
db
35
9c
23
41
5e
10

.b
ea
3d
83
c0
6b
22
99
56
48
1f
7e
01
f4
ac
b5
d7

.c
0e
63
9d
71
39
a5
8b
14
ff
58
ca
e0
46
27
d2
bc

.d
b0
f9
5b
aa
43
77
1d
88
66
94
21
de
3f
c5
ec
02

.e
a8
17
4c
b6
55
09
f2
60
8a
3e
df
24
91
e3
cb
7d

.f
1c
af
d8
f5
26
61
b4
0b
73
ed
47
52
c9
3a
90
8e

.9
36
07
21
c8
65
ff
16
c0
18
08
8c
17
00
44
3c
03

.a
b4
49
27
c5
51
69
d3
c1
90
85
23
2d
f9
29
7f
e1

.b
38
4f
3b
0f
c9
8a
28
46
97
d0
1c
f4
e0
a6
8d
2e

.c
13
98
e6
5b
a4
ba
32
1e
59
61
f0
cb
fd
57
1a
7d

.d
34
2c
19
f3
ef
0b
fa
df
dd
26
ee
b1
e2
b9
88
14

.e
0c
b0
d2
87
43
73
aa
a9
83
ca
89
4a
fe
af
bd
95

.f
d9
93
0e
8b
53
5c
5e
99
1f
6f
ad
a8
ae
f2
ac
1d

d
9
7
0
f

e
d
5
d
c

f
3
1
9
1

Table 2.2: S1
.6
0a
e5
41
a1
84
0d
30
09
82
a5
05
4d
4c
81
50
6d

.7
3d
dc
60
bc
ce
d7
52
7b
ec
56
d1
76
72
d6
02
b2

.8
b8
9e
e3
2b
d8
80
a3
63
40
48
45
67
cc
be
01
6b

Table 2.3: SSi (0 ≤ i < 4)
2
c
0
5
6

3
a
d
e
d

4
8
2
a
3

5
7
b
6
4

6
2
a
4
5

7
f
3
c
e

8
b
9
f
0

9
1
c
7
7

a
4
e
2
8

b
0
f
3
9

c
5
8
1
b

12

CHAPTER 2. ALGORITHM SPECIFICATION

x0

4

/

SS0

SS2

4

/

y0

4

y1

×2

x1

×2

4

/

SS3

SS1

/

Figure 2.2: S0
S-box S1

S1 is deﬁned as follows:{0, 1}8S1 :x(8)g(f (x)−1 )y=g(0)→ {0, 1}8→y(8)if f (x) = 0.
if f (x) = 0

The inverse function is performed in GF(28 ) deﬁned by a primitive polynomial z 8 + z 4 + z 3 + z 2 + 1. f (·) and g(·) are aﬃne transformations overGF(2), which are deﬁned as follows.
{0, 1}8 → {0, 1}8f:x(8) → y(8)
⎛

⎞ ⎛
y0
0
⎜ y1 ⎟ ⎜ 0⎜⎟ ⎜⎜ y2 ⎟ ⎜ 0⎜⎟ ⎜⎜ y3 ⎟ ⎜ 0⎜⎟ ⎜⎜ y4 ⎟ = ⎜ 0⎜⎟ ⎜⎜ y5 ⎟ ⎜ 0⎜⎟ ⎜⎝ y6 ⎠ ⎝ 0
y7
1

0
1
0
0
1
1
1
0

0
0
0
0
1
0
1
0


g:
⎛

⎞ ⎛
y0
0
⎜ y1 ⎟ ⎜ 0⎜⎟ ⎜⎜ y2 ⎟ ⎜ 0⎜⎟ ⎜⎜ y3 ⎟ ⎜ 0⎜⎟ ⎜⎜ y4 ⎟ = ⎜ 0⎜⎟ ⎜⎜ y5 ⎟ ⎜ 0⎜⎟ ⎜⎝ y6 ⎠ ⎝ 1
y7
0

0
1
1
0
0
0
0
1

0
0
0
1
1
0
0
0

1
1
0
0
0
1
0
0

1
0
0
0
0
1
0
0

0
0
0
1
1
1
0
0

0
0
0
1
0
0
0
0

⎞ ⎛ ⎞
⎞⎛
0
0
x0
⎟
⎟
⎜
⎜
1 ⎟ ⎜ x1 ⎟ ⎜ 0 ⎟
⎟
⎟ ⎜ ⎟
⎜
1 ⎟
⎟ ⎜ x2 ⎟ ⎜ 0 ⎟
⎟ ⎜ ⎟
⎜
0 ⎟
⎟ ⎜ x3 ⎟ + ⎜ 1 ⎟⎟⎜ ⎟⎜1 ⎟ ⎜ x4 ⎟⎟ ⎜ 1 ⎟⎟ ⎜ ⎟⎜0 ⎟⎟ ⎜ x5 ⎟ ⎜ 1 ⎟⎠⎝x6 ⎠ ⎝ 1 ⎠
0
1

x7

0

{0, 1}8 → {0, 1}8x(8) → y(8)
0
0
1
0
1
0
1
0

1
0
1
0
0
0
0
0

0
0
0
0
0
0
0
1

1
0
0
0
0
1
0
0

⎞ ⎛ ⎞
⎞⎛
0
0
x0
⎜ x1 ⎟ ⎜ 1 ⎟
1 ⎟
⎟⎜
⎟ ⎜ ⎟
⎜
⎟ ⎜ ⎟
0 ⎟
⎟ ⎜ x2 ⎟ ⎜ 1 ⎟
⎜
⎟ ⎜ ⎟
0 ⎟
⎟ ⎜ x3 ⎟ + ⎜ 0 ⎟⎟⎜⎜ ⎟0 ⎟ ⎜ x4 ⎟⎟ ⎜ 1 ⎟⎟⎜⎟⎟
0 ⎟ ⎜ x5 ⎟ ⎜
⎜ 0 ⎟
⎠
⎝
⎠
⎝
x6
0
0 ⎠
x7
0
1
13

CHAPTER 2. ALGORITHM SPECIFICATION
Here, x = x0 |x1 |x2 |x3 |x4 |x5 |x6 |x7 and y = y0 |y1 |y2 |y3 |y4 |y5 |y6 |y7 , xi , yi ∈{0, 1}. The constants in f and g can be represented as 0x1e and 0x69,
respectively.

2.2.3

Diﬀusion Matrices

Two matrices M0 and M1 used in each F-function are deﬁned as follows.
⎛

0x01⎜ 0x02M0 = ⎜⎝ 0x04
0x06

0x02
0x01
0x06
0x04

0x04
0x06
0x01
0x02

⎞
0x06
0x04 ⎟⎟,
0x02 ⎠
0x01

⎛

0x01
⎜ 0x08
M1 = ⎜⎝ 0x02
0x0a

0x08
0x01
0x0a
0x02

0x02
0x0a
0x01
0x08

⎞
0x0a
0x02 ⎟⎟ .
0x08 ⎠
0x01

The multiplications of a matrix and a vector are performed in GF(28 )deﬁned by the lexicographically ﬁrst primitive polynomial z 8 +z 4 +z 3 +z 2 +1.

14

CHAPTER 2. ALGORITHM SPECIFICATION

2.3

Data Processing Part

2.3.1

Overall Structure

The data processing part of CLEFIA consists of ENCr for encryption andDECr for decryption. ENCr and DECr are based on the 4-branch generalized Feistel structure GFN4,r . Let P, C ∈ {0, 1}128 be a plaintext anda ciphertext, and let Pi , Ci ∈ {0, 1}32 (0 ≤ i < 4) be divided plaintext
and ciphertext where P = P0 |P1 |P2 |P3 and C = C0 |C1 |C2 |C3 , and let
WK0 , WK1 , WK2 , WK3 ∈ {0, 1}32 be whitening keys and RKi ∈ {0, 1}32
(0 ≤ i < 2r) be round keys provided by the key scheduling part. Then,r-round encryption function ENCr is deﬁned as follows:⎧⎨ {{0, 1}32 }4 × {{0, 1}32 }2r × {{0, 1}32 }4 → {{0, 1}32 }4(WK0(32) , . . . , WK3(32) , RK0(32) , . . . , RK2r−1(32) , P0(32) , . . . , P3(32) )ENCr :⎩
→ C0(32) , . . . , C3(32)Step 1. T0 | T1 | T2 | T3 ← P0 | (P1 ⊕ WK0 ) | P2 | (P3 ⊕ WK1 )Step 2. T0 | T1 | T2 | T3 ← GFN4,r (RK0 , . . . , RK2r−1 , T0 , T1 , T2 , T3 )Step 3. C0 | C1 | C2 | C3 ← T0 | (T1 ⊕ WK2 ) | T2 | (T3 ⊕ WK3 )The decryption function DECr is deﬁned as follows:⎧⎨ {{0, 1}32 }4 × {{0, 1}32 }2r × {{0, 1}32 }4 → {{0, 1}32 }4(WK0(32) , . . . , WK3(32) , RK0(32) , . . . , RK2r−1(32) , C0(32) , . . . , C3(32) )DECr :⎩
→ P0(32) , . . . , P3(32)Step 1. T0 | T1 | T2 | T3 ← C0 | (C1 ⊕ WK2 ) | C2 | (C3 ⊕ WK3 )Step 2. T0 | T1 | T2 | T3 ← GFN−1
4,r (RK0 , . . . , RK2r−1 , T0 , T1 , T2 , T3 )Step 3. C0 | C1 | C2 | C3 ← T0 | (T1 ⊕ WK0 ) | T2 | (T3 ⊕ WK1 )Figure 2.3 illustrates both of ENCr and DECr .

2.3.2

The Numbers of Rounds

The number of rounds, r, is 18, 22 and 26 for 128-bit, 192-bit and 256-bit
keys, respectively. The total number of RKi depends on the key length. The
data processing part requires 36, 44 and 52 round keys for 128-bit, 192-bit
and 256-bit keys, respectively.

15

CHAPTER 2. ALGORITHM SPECIFICATION

P0

P1

P2

P3

C0

C1

C2

C3

32/

32/

32/

32/

32/

32/

32/

32/

RK0

RK1

WK0

WK1

RK2r−2WK2 RK2r−1

F0

F1

F0

F1

RK2

RK3

RK2r−4RK2r−3

F0

F1

F0

F1

RK4

RK5

RK2r−6

RK2r−5

F0

F1

F0

F1

..
.
. RK2r−6 ..

..
.
. RK2r−5 ..

..
. RK4

F0

F1

F0

F1

RK2r−4RK2r−3

RK2

RK3

F0

F1

F0

F1

RK2r−2RK2r−1

RK0

RK1

F0

F1

F0

F1

WK2

..
. RK5

..
.

WK3

WK3

..
.

WK0

WK1

32/

32/

32/

32/

32/

32/

32/

32/

C0

C1

C2

C3

P0

P1

P2

P3

ENCr

DECr

Figure 2.3: Structures of Data Processing Part16

CHAPTER 2. ALGORITHM SPECIFICATION

2.4

Key Scheduling PartThe key scheduling part of CLEFIA supports 128, 192 and 256-bit keys andoutputs whitening keys WKi (0 ≤ i < 4) and round keys RKj (0 ≤ j < 2r)
for the data processing part. We ﬁrst deﬁne the DoubleSwap function which
is used in the key scheduling part.
Deﬁnition 2.1 The DoubleSwap Function Σ
The DoubleSwap function Σ : {0, 1}128 → {0, 1}128 is defined as follows:X(128) → Y(128)Y = X[7 − 63] | X[121 − 127] | X[0 − 6] | X[64 − 120] ,where X[a − b] denotes a bit string cut from the a-th bit to the b-th bit of X.
0-th bit is the most significant bit.
The DoubleSwap function is illustrated in Fig 2.4.
128 bits
7

57

57

7

57

7 7

57

Figure 2.4: DoubleSwap Function Σ

2.4.1

Overall Structure

The key scheduling part of CLEFIA provides whitening keys and round keys
for the data processing part. Let K be the key and L be an intermediate
key, and the key scheduling part consists of the following two steps.
1. Generating L from K.
2. Expanding K and L (Generating WKi and RKj ).
To generate L from K, the key schedule for a 128-bit key uses a 128-bit
permutation GFN4,12 , while the key schedules for 192/256-bit keys use a
256-bit permutation GFN8,10 .

2.4.2

Key Scheduling for a 128-bit Key

The 128-bit intermediate key L is generated by applying GFN4,12 which(128)(0 ≤ i < 24) as roundtakes twenty-four 32-bit constant values CONi
17

CHAPTER 2. ALGORITHM SPECIFICATION
keys and K = K0 |K1 |K2 |K3 as an input. Then K and L are used togenerate WKi (0 ≤ i < 4) and RKj (0 ≤ j < 36) in the following steps. In(128)(24 ≤ i < 60) are
the latter part, thirty-six 32-bit constant values CONi
(128)
are explained in Sect 2.4.5.
used. The generation steps of CONi
(Generating L from K)
(128)
(128)
Step 1. L ← GFN4,12 (CON0 , . . . , CON23 , K0 , . . . , K3 )(Expanding K and L)
Step 2. WK0 |WK1 |WK2 |WK3 ← K
Step 3. For i = 0 to 8 do the following:
(128)
(128)
(128)
(128)
T ← L ⊕ (CON24+4i | CON24+4i+1 | CON24+4i+2 | CON24+4i+3 )L ← Σ(L)if i is odd: T ← T ⊕ K
RK4i |RK4i+1 |RK4i+2 |RK4i+3 ← T
Figure 2.5 shows the relationship between generated round keys andrelated data.
WK0 WK1 WK2 WK3 ←K
(128)
(128)
(128)
(128)
RK0 RK1 RK2 RK3 ←L⊕(CON24 |CON25 |CON26 |CON27 )
(128)
(128)
(128)
(128)
RK4 RK5 RK6 RK7 ←Σ(L) ⊕K⊕(CON28 |CON29 |CON30 |CON31 )
(128)
(128)
(128)
(128)
RK8 RK9 RK10 RK11 ←Σ2 (L)⊕(CON32 |CON33 |CON34 |CON35 )
(128)
(128)
(128)
(128)
RK12 RK13 RK14 RK15 ←Σ3 (L)⊕K⊕(CON36 |CON37 |CON38 |CON39 )
(128)
(128)
(128)
(128)
RK16 RK17 RK18 RK19 ←Σ4 (L)⊕(CON40 |CON41 |CON42 |CON43 )
(128)
(128)
(128)
(128)
RK20 RK21 RK22 RK23 ←Σ5 (L)⊕K⊕(CON44 |CON45 |CON46 |CON47 )
(128)
(128)
(128)
(128)
RK24 RK25 RK26 RK27 ←Σ6 (L)⊕(CON48 |CON49 |CON50 |CON51 )
(128)
(128)
(128)
(128)
RK28 RK29 RK30 RK31 ←Σ7 (L)⊕K⊕(CON52 |CON53 |CON54 |CON55 )
(128)
(128)
(128)
(128)
RK32 RK33 RK34 RK35 ←Σ8 (L)⊕(CON56 |CON57 |CON58 |CON59 )Figure 2.5: Expanding K and L (128-bit key)

2.4.3

Key Scheduling for a 192-bit Key

Two 128-bit values KL , KR are generated from a 192-bit key K = K0 |K1 |K2|K3 |K4 |K5 , Ki ∈ {0, 1}32 . Then two 128-bit values LL , LR are generated(192)(0 ≤ i < 40) as round keys andby applying GFN8,10 which takes CONi
KL |KR as a 256-bit input. Figure 2.6 shows the construction of GFN8,10 .
Then KL , KR and LL , LR are used to generate WKi (0 ≤ i < 4) andRKj (0 ≤ j < 44) in the following steps. In the latter part, forty-four 32-bit(192)(40 ≤ i < 84) are used.
constant values CONi
The following steps show the 192-bit/256-bit key scheduling. For the 192-bit
key scheduling, the value of k is set as 192.
18

CHAPTER 2. ALGORITHM SPECIFICATION(Generating LL , LR from KL , KR for a k-bit key)
Step 1. Set k = 192 or k = 256
Step 2. If k = 192: KL ← K0 |K1 |K2 |K3 , KR ← K4 |K5 |K0 |K1
else if k = 256 : KL ← K0 |K1 |K2 |K3 , KR ← K4 |K5 |K6 |K7
Step 3. Let KL = KL0 |KL1 |KL2 |KL3 , KR = KR0 |KR1 |KR2 |KR3
LL |LR ←(k)(k)
GFN8,10 (CON0 , . . . , CON39 , KL0 , . . . , KL3 , KR0 , . . . , KR3 )(Expanding KL , KR and LL , LR for a k-bit key)
Step 4. WK0 |WK1 |WK2 |WK3 ← KL ⊕ KR
Step 5. For i = 0 to 10 (if k = 192), or 12 (if k = 256) do the following:
If (i mod 4) = 0 or 1:
(k)
(k)
(k)
(k)
T ← LL ⊕ (CON40+4i | CON40+4i+1 | CON40+4i+2 | CON40+4i+3 )LL ← Σ(LL )if i is odd: T ← T ⊕ KR
else:
(k)
(k)
(k)
(k)
T ← LR ⊕ (CON40+4i | CON40+4i+1 | CON40+4i+2 | CON40+4i+3 )LR ← Σ(LR )if i is odd: T ← T ⊕ KL
RK4i |RK4i+1 |RK4i+2 |RK4i+3 ← T
Figure 2.7 shows the relationship between generated round keys andrelated data.

2.4.4

Key Scheduling for a 256-bit Key

The key scheduling for a 256-bit key is almost the same as that for 192-bit
key, except for constant values, required number of RKi , and initializationof KR .
For a 256-bit key, the value of k is set as 256, and the steps are almost(256)
the same as in the 192-bit key case. The diﬀerence is that we use CONi
(0 ≤ i < 40) as round keys to generate LL and LR , and then to generate
(256)
(40 ≤
RKj (0 ≤ j < 52), we use ﬁfty-two 32-bit constant values CONi
i < 92).
Figure 2.8 shows the relationship between generated round keys andrelated data.

19

CHAPTER 2. ALGORITHM SPECIFICATION

KL0

KL1

KL2

KL3

KR0

KR1

KR2

KR3

32/

32/

32/

32/

32/

32/

32/

32/

(k)
CON0

(k)
CON1

F0

(k)
CON2

F1

(k)

(k)
CON3

F0

F1

(k)

(k)

(k)

CON4

CON5

CON6

CON7

F0

F1

F0

F1

(k)

(k)

(k)

(k)

CON8

CON9

CON10

CON11

F0

F1

F0

F1

..
.

(k)

..
.

..
.

(k)

..
.

..
.

(k)

..
.

..
.

(k)

CON28

CON29

CON30

CON31

F0

F1

F0

F1

(k)

(k)

(k)

(k)

CON32

CON33

CON34

CON35

F0

F1

F0

F1

(k)

(k)

(k)

..
.

(k)

CON36

CON37

CON38

CON39

F0

F1

F0

F1

32/

32/

32/

32/

32/

32/

32/

32/

LL0

LL1

LL2

LL3

LR0

LR1

LR2

LR3

Figure 2.6: Structure of GFN8,10

20

CHAPTER 2. ALGORITHM SPECIFICATIONWK0 WK1 WK2 WK3 ←KL
⊕KR
(192)
(192)
(192)
(192)
RK0 RK1 RK2 RK3 ←LL⊕(CON40 |CON41 |CON42 |CON43 )
(192)
(192)
(192)
(192)
RK4 RK5 RK6 RK7 ←Σ(LL ) ⊕KR ⊕(CON44 |CON45 |CON46 |CON47 )
(192)
(192)
(192)
(192)
RK8 RK9 RK10 RK11 ←LR⊕(CON48 |CON49 |CON50 |CON51 )
(192)
(192)
(192)
(192)
RK12 RK13 RK14 RK15 ←Σ(LR ) ⊕KL ⊕(CON52 |CON53 |CON54 |CON55 )
(192)
(192)
(192)
(192)
RK16 RK17 RK18 RK19 ←Σ2 (LL )⊕(CON56 |CON57 |CON58 |CON59 )
(192)
(192)
(192)
(192)
RK20 RK21 RK22 RK23 ←Σ3 (LL )⊕KR ⊕(CON60 |CON61 |CON62 |CON63 )
(192)
(192)
(192)
(192)
RK24 RK25 RK26 RK27 ←Σ2 (LR )⊕(CON64 |CON65 |CON66 |CON67 )
(192)
(192)
(192)
(192)
RK28 RK29 RK30 RK31 ←Σ3 (LR )⊕KL ⊕(CON68 |CON69 |CON70 |CON71 )
(192)
(192)
(192)
(192)
RK32 RK33 RK34 RK35 ←Σ4 (LL )⊕(CON72 |CON73 |CON74 |CON75 )
(192)
(192)
(192)
(192)
RK36 RK37 RK38 RK39 ←Σ5 (LL )⊕KR ⊕(CON76 |CON77 |CON78 |CON79 )
(192)
(192)
(192)
(192)
RK40 RK41 RK42 RK43 ←Σ4 (LR )⊕(CON80 |CON81 |CON82 |CON83 )Figure 2.7: Expanding KL , KR , LL and LR (192-bit key)

WK0 WK1 WK2 WK3 ←KL
⊕KR
(256)
(256)
(256)
(256)
RK0 RK1 RK2 RK3 ←LL⊕(CON40 |CON41 |CON42 |CON43 )
(256)
(256)
(256)
(256)
RK4 RK5 RK6 RK7 ←Σ(LL ) ⊕KR ⊕(CON44 |CON45 |CON46 |CON47 )
(256)
(256)
(256)
(256)
RK8 RK9 RK10 RK11 ←LR⊕(CON48 |CON49 |CON50 |CON51 )
(256)
(256)
(256)
(256)
RK12 RK13 RK14 RK15 ←Σ(LR ) ⊕KL ⊕(CON52 |CON53 |CON54 |CON55 )
(256)
(256)
(256)
(256)
RK16 RK17 RK18 RK19 ←Σ2 (LL )⊕(CON56 |CON57 |CON58 |CON59 )
(256)
(256)
(256)
(256)
RK20 RK21 RK22 RK23 ←Σ3 (LL )⊕KR ⊕(CON60 |CON61 |CON62 |CON63 )
(256)
(256)
(256)
(256)
RK24 RK25 RK26 RK27 ←Σ2 (LR )⊕(CON64 |CON65 |CON66 |CON67 )
(256)
(256)
(256)
(256)
RK28 RK29 RK30 RK31 ←Σ3 (LR )⊕KL ⊕(CON68 |CON69 |CON70 |CON71 )
(256)
(256)
(256)
(256)
RK32 RK33 RK34 RK35 ←Σ4 (LL )⊕(CON72 |CON73 |CON74 |CON75 )
(256)
(256)
(256)
(256)
RK36 RK37 RK38 RK39 ←Σ5 (LL )⊕KR ⊕(CON76 |CON77 |CON78 |CON79 )
(256)
(256)
(256)
(256)
RK40 RK41 RK42 RK43 ←Σ4 (LR )⊕(CON80 |CON81 |CON82 |CON83 )
(256)
(256)
(256)
(256)
RK44 RK45 RK46 RK47 ←Σ5 (LR )⊕KL ⊕(CON84 |CON85 |CON86 |CON87 )
(256)
(256)
(256)
(256)
RK48 RK49 RK50 RK51 ←Σ6 (LL )⊕(CON88 |CON89 |CON90 |CON91 )Figure 2.8: Expanding KL , KR , LL and LR (256-bit key)21

CHAPTER 2. ALGORITHM SPECIFICATION

2.4.5

Constant Values(k)32-bit constant values CONi are used in the key scheduling algorithm. We
need 60, 84 and 92 constant values for 128, 192 and 256-bit keys, respectively.
Let P(16) = 0xb7e1 (= (e−2)·216 ) and Q(16) = 0x243f (= (π−3)·216 ), where
e is the base of the natural logarithm (2.71828...) and π is the circle ratio(k)(3.14159...). CONi , for k = 128, 192, 256, are generated by the following
way (See Table 2.4 for the repetition numbers l(k) and the initial values
IV (k) ).
Step 1. T0 ← IV (k)Step 2. For i = 0 to l(k) − 1 do the following:(k)
Step 2.1. CON2i ← (Ti ⊕ P) | (Ti <<< 1)(k)Step 2.2. CON2i+1 ← (Ti ⊕ Q) | (Ti <<< 8)Step 2.3. Ti+1 ← Ti · 0x0002−1
In Step 2.3, the multiplications are performed in the ﬁeld GF(216 ) deﬁned
by a primitive polynomial z 16 + z 15 + z 13 + z 11 + z 5 + z 4 + 1 (=0x1a831)5.
Table 2.4: Required Numbers of Constant Values
k
128
192
256

(k)

# of CONi
60
84
92

l(k)
30
42
46

IV (k)
0x428a0x71370xb5c0√3(= ( √
2 − 1) · 216 )3(= ( √3 − 1) · 216 )(= ( 3 5 − 1) · 216 )Tables 2.5-2.7 show the values of Ti , and Tables 2.8-2.12 show the values(k)of CONi .

√The lower 16-bit value is defined as 0xa831=( 3 101 − 4) · 216 . ‘101’ is the smallest
prime number satisfying the primitive polynomial condition in this form.
522

CHAPTER 2. ALGORITHM SPECIFICATION(128)

Table 2.5: Ti
i
(128)
Ti

i
(128)
Ti

i
(128)
Ti

i
(128)
Ti

0
428a
8
5159
16
87aa
24
649a

1
2145
9
fcb4
17
43d5
25
324d

2
c4ba
10
7e5a
18
f5f2
26
cd3e

3
625d
11
3f2d
19
7af9
27
669f

4
e536
12
cb8e
20
e964
28
e757

5
729b
13
65c7
21
74b2
29
a7b3

6
ed55
14
e6fb
22
3a59

7
a2b2
15
a765
23
c934

5
214d
13
25ed
21
c4f7
29
5b96
37
2a2e

6
c4be
14
c6ee
22
b663
30
2dcb
38
1517

7
625f
15
6377
23
8f29
31
c2fd
39
de93

(192)

Table 2.6: Ti
i
(192)
Ti

i
(192)
Ti

i
(192)
Ti

i
(192)
Ti

i
(192)
Ti

i
(192)
Ti

0
7137
8
e537
16
e5a3
24
938c
32
b566
40
bb51

1
ec83
9
a683
17
a6c9
25
49c6
33
5ab3
41
89b0

2
a259
10
8759
18
877c
26
24e3
34
f941

3
8534
11
97b4
19
43be
27
c669
35
a8b8

4
429a
12
4bda
20
21df
28
b72c
36
545c

23

CHAPTER 2. ALGORITHM SPECIFICATION(256)

Table 2.7: Ti
i
(256)
Ti

i
(256)
Ti

i
(256)
Ti

i
(256)
Ti

i
(256)
Ti

i
(256)
Ti

0
b5c0
8
bea1
16
cf8d
24
9b17
32
d0db
40
0f69

1
5ae0
9
8b48
17
b3de
25
9993
33
bc75
41
d3ac

2
2d70
10
45a4
18
59ef
26
98d1
34
8a22
42
69d6

3
16b8
11
22d2
19
f8ef
27
9870
35
4511
43
34eb

4
0b5c
12
1169
20
a86f
28
4c38
36
f690
44
ce6d

5
05ae
13
dcac
21
802f
29
261c
37
7b48
45
b32e

6
02d7
14
6e56
22
940f
30
130e
38
3da4

7
d573
15
372b
23
9e1f
31
0987
39
1ed2

24

CHAPTER 2. ALGORITHM SPECIFICATION(128)(0 ≤ i < 60)1
994a8a42
5
1f7abac4
9
3ef636e5
13369555ed
17
8a995951
21
a59a5a7e25
104e8ecb
29
3d3bfbe633
5c6aaa87
37
2e32f2f541
32a464e945
e199593a49
bf5a9a64
53
16fe3ecd57
3c9757e72
96a4bd75
6
d5bc3b45
10
c57a1ac9141553ba9a18
4b55069622
88cc81a526d226347130
1084b134
34
f434785538
cd180a0d42c353169b46
7ed56d9650
85ac9b6554
d17e32c1
58
1052b098

Table 2.8: CONi
i
(128)
CONi
i
(128)
CONi
i
(128)
CONi
i
(128)
CONi
i
(128)
CONi
i
(128)
CONi
i
(128)
CONi
i
(128)
CONi
i
(128)
CONi
i
(128)
CONi
i
(128)
CONi
i
(128)
CONi
i
(128)
CONi
i
(128)
CONi
i
(128)
CONi

0
f56b7aeb
4735b768a852d73592
12
5ab42554
16
e6b85d4d20
c9bb034b24
7c6f68e2
28
511a320832
304bf0aa
364213141a40
5e852d3644
8db88b4d48
d37b36cb
52
7adf6582
56
50b63150

3
fa854521
7
b99d5d6211
a95b9b72
157972b2a2
192774b4fc
23
e4ed2d3f
27
be07c765
31
7ca565a7359815d543
39
a139f97a43
af72b27447
12f434c951e98d4d32
55
bd5f9f66
59
7c73b3a725

CHAPTER 2. ALGORITHM SPECIFICATION(192)(0 ≤ i < 60)

1
aaf73771
5799959a2
9995a9a42
13
1f7ebec4
17
3ef737e5215c99598725
901ada4b29
1d2eeec6
33
3e63a3e537
5cbc7c87
41
fa1fdf2145
6da363b6
49484c8c93
53
ff23e32457
6cec2cb7

2
5b6226f8
632d5f596
1096acbd65
14
d5be3b41
181162b2f8222055d09626
920cb425
30
d496391134
1128b26c
38
f45f7883
4273167610
46
38c8e1ac50fe276c73
547188732c
58
ec7748d3

Table 2.9: CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi

0
c6d61d91
4
15b8bb4c8
f57b7acb
12735f7682
16
52d63590
2030b8f14c24
fc3b684b
28
710f7222
32
524234b8
36309df10640
963ebc41
440182933848
246dd8e6529302b639
56
00cd91a6

3374383ec
7
5ef4348511
fa8d4d2115
b99f5f62
19
7d4383a6
23
4c74b497
27
fe2ded25
31
b8b77763
35
7d09c9a6
39987ebe43
43
1f37f7c4
4754e9298f
51
9206c649
55
1da969c6598056965b26

CHAPTER 2. ALGORITHM SPECIFICATION(192)

Table 2.10: CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi
i
(192)
CONi

60
9a2aa469
6402879532
68
4ea00d7c72
e3bd5747
76
a2f6d5d1
80
0cb0895c

61
f60bcb2d65
6ea666b5
69228141f973
8f9c5c5477
ced71715
81609151bb(256)

Table 2.11: CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi

0
0221947e
4
9a91a51f
8
bcbde94712
b536fa51
16
094082bc
20
f24574b7

1
6e00c0b5
5
f6b0702d9
d09c5c0b13d917d702
176561a1be21
9e64a445(60 ≤ i < 84)62751c7a04
66
ed524a99
70
1f59ae8e74
9dcfaba3
78697242d882
3e51ec9e

63
193dfdc2
678173b35a
71
7378b8a875
f1ee2e2a79055393de83
5270b089(0 ≤ i < 24)2
ed014a3f
6
a159d28f
10
b24ff4a3
1462925518
18
3ca9e96e
229533ba5b38120e05a7
cd78b81611de6eae05
15
0eb373d5
195088488b
23
f912d222

27

CHAPTER 2. ALGORITHM SPECIFICATION(256)

Table 2.12: CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi
i
(256)
CONi

24
a688dd2d28
d9b72353
32
786c60e4
36
ee0e4c21
40
1f8eaf20
44
23eed7e048
2cf6c9d052
2f30ce5c
56
fbd9678f
60
a4efd9e364673a5e48
68
3dc3ebba
72
417112de76
8a4584b780b888e12d84
de372c53
88
798c632425
caa9691129b596566e33
144d8dcf
37822fef59
41
73af6fa845
4fcf0f94
49
40d7179b
53
4311d19857
97f8384c61
c8ce0e1365
0b1bdbd069
51e2228a73
2d5090f6
77
e664a43d81
d4a9690f
85
b216d669
89
15ad6dce(24 ≤ i < 92)26
6b4d46a630
80ca91a9
34
043f9842
38
4f0e0e204237ceffa0
46
29fec3c050
2e72ccd8
54
2f91cf1e
58
91fdb3c762
be66ecf1
66
0b948714
70
f2f075dd74
cca9096f
78
a933c25b82
644d58a6
86
830a962990
04cf99a2

27
076cacdc
31
eceb2b37
35
681edeb339232feff8
43
5bef2f80
47
45df1f9e
514253939955
43b07098
59
fddc1c26
63
d2478709
67
67b575bc
71
9ed1114575
a088487b79
c512d21e
83
086cacd387
ef2beb3491
68ee2eb328

CHAPTER 2. ALGORITHM SPECIFICATION

2.5

Test Vectors

We give test vectors of CLEFIA for each key length. The data are expressedin hexadecimal form.
128-bit key:
key
plaintext
ciphertext
192-bit key:
key
plaintext
ciphertext
256-bit key:
key
plaintext
ciphertext

ffeeddcc bbaa9988 77665544 33221100
00010203 04050607 08090a0b 0c0d0e0f
de2bf2fd 9b74aacd f1298555 459494fd

ffeeddcc bbaa9988 77665544 33221100
f0e0d0c0 b0a09080
00010203 04050607 08090a0b 0c0d0e0f
e2482f64 9f028dc4 80dda184 fde181ad

ffeeddcc bbaa9988 77665544 33221100
f0e0d0c0 b0a09080 70605040 30201000
00010203 04050607 08090a0b 0c0d0e0f
a1397814 289de80c 10da46d1 fa48b38a29

CHAPTER 2. ALGORITHM SPECIFICATION

2.5.1

Test Vectors (Intermediate Values)

128-bit key:
key
plaintext
ciphertext

ffeeddcc bbaa9988 77665544 33221100
00010203 04050607 08090a0b 0c0d0e0f
de2bf2fd 9b74aacd f1298555 459494fd

L

8f89a61b 9db9d0f3 93e65627 da0d027e

W K0,1,2,3
RK0,1,2,3
RK4,5,6,7
RK8,9,10,11
RK12,13,14,15
RK16,17,18,19
RK20,21,22,23
RK24,25,26,27
RK28,29,30,31
RK32,33,34,35

ffeeddcc bbaa9988 77665544 33221100
f3e6cef9 8df75e38 41c06256 640ac51b
6a27e20a 5a791b90 e8c528dc 00336ea3
59cd17c4 28565583 312a37cc c08abd77
7e8e7eec 8be7e949 d3f463d6 a0aad6aa
e75eb039 0d657eb9 018002e2 9117d009
9f98d11e babee8cf b0369efa d3aaef0d
3438f93b f9cea4a0 68df9029 b869b4a7
24d6406d e74bc550 41c28193 16de4795
a34a20f5 33265d14 b19d0554 5142f434

30

CHAPTER 2. ALGORITHM SPECIFICATION
plaintext
initial whitening key
after whitening
Round 1 input
F-function
input
round keyafter key add
after S
after M
Round 2 input
F-function
input
round keyafter key add
after S
after M
Round 3 input
F-function
input
round keyafter key add
after S
after M
Round 4 input
F-function
input
round keyafter key add
after S
after M
Round 5 input
F-function
input
round keyafter key add
after S
after M
Round 6 input
F-function
input
round keyafter key add
after S
after M

00010203
00010203
0001020304050607
ffeeddcc
fbebdbcb
fbebdbcb

F000010203
f3e6cef9f3e7ccfa
290246e1
547a3193
af91ea58 08090a0b
F0
af91ea58
41c06256
ee51880e
cb5d2b0c
f51cebb3
fd15e1b8 1c56b7f7
F0
fd15e1b8
6a27e20a
973203b2
c2c7c6c2
d8dfd8de
c4896f29 82dee144F0c4896f29
e8c528dc
2c4c47f5
9da4dafc
b5b28e96376c6fd2 4ecf4244
F0376c6fd2
59cd17c4
6ea17816
f26ad3e5
29f08afd
673fc8b9 4b49b022
F0
673fc8b9
312a37cc
5615ff75
b39c8e585999a79e

08090a0b08090a0b08090a0b0c0d0e0f
bbaa9988
b7a79787
b7a79787

F108090a0b8df75e3885fe5433
777de8e8
abf12070
1c56b7f7 00010203
F1
1c56b7f7640ac51b
785c72ec
63a5edd2
82dfe347
82dee144 af91ea58
F182dee144
5a791b90
d8a7fad4
be59e10de15ea81c4ecf4244 fd15e1b8
F1
4ecf4244
00336ea3
4efc2ce7
43bce638
b65c519a
4b49b022 c4896f29
F1
4b49b022
28565583
631fe5a1
62af9f1b
be01d127
7a88be0e 376c6fd2
F1
7a88be0e
c08abd77ba020379
2dd1e9a2
0429b329

31

CHAPTER 2. ALGORITHM SPECIFICATION

Round 7

Round 8Round 9Round 10

Round 11

Round 12input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M

12d017bc

7a88be0eF012d017bc
7e8e7eec6c5e6950
8b737025
6ed11b091459a507 3345dcfb
F01459a507
d3f463d6
c7adc6d1
e7ee5a5f
8c9d011c
bfd8dde7 b8ec058b
F0
bfd8dde7
e75eb039
58866dde
4e821daf
e6d6501e5e3a5595 81b85950
F05e3a5595
018002e2
5fba5777
612d8f7b3a1b0e97
bba357c7 79019cb3
F0
bba357c7
9f98d11e243b86d9
f70f1144
28974052
5196dce1 066ca42f
F05196dce1b0369efa
e1a0421b
6f7efd4f
ffb5db32

3345dcfb

673fc8b9
F13345dcfb
8be7e949
b8a235b2
67a08eba
dfd3cd32
b8ec058b 12d017bc
F1
b8ec058ba0aad6aa
1846d321
9e97f1a1
93684eec
81b85950 1459a507
F1
81b85950
0d657eb98cdd27e959c56044
6d5839b4
79019cb3 bfd8dde7
F179019cb3
9117d009
e8164cba
0185a49c
b9b479c8
066ca42f 5e3a5595
F1
066ca42f
babee8cf
bcd24ce0
cb72a481
4a6700b1
145d5524 bba357c7
F1
145d5524d3aaef0d
c7f7ba29
72642dce
907d3820

32

CHAPTER 2. ALGORITHM SPECIFICATION

Round 13

input
F-function
input
round keyafter key add
after S
after M
Round 14 input
F-function
input
round keyafter key add
after S
after M
Round 15 input
F-function
input
round keyafter key add
after S
after M
Round 16 input
F-function
input
round keyafter key add
after S
after M
Round 17 input
F-function
input
round keyafter key add
after S
after M
Round 18 input
F-function
input
round keyafter key add
after S
after M
outputfinal whitening key
after whitening
ciphertext

f9d97f1d

145d5524F0
f9d97f1d
3438f93b
cde18626
3f751141
0a744c28
1e29190c 2bde6fe7F01e29190c
68df9029
76f68925
fe6db7e7
aaa2c803
817ca7e4 4da8e442
F0817ca7e4
24d6406d
a5aae789
8d233818
7bd4cced
367c28af 3de82490
F0367c28af
41c28193
77bea93c
7c4a935b598e6940
64664dd0 f4ebe9f7
F064664dd0
a34a20f5
c72c6d25e7e61de7
2ac01b0ade2bf2fd 4065c77b
F0
de2bf2fd
b19d0554
6fb6f7a9
b44d648c
ac7738f2
de2bf2fd ec12ff89
77665544
de2bf2fd 9b74aacd
de2bf2fd 9b74aacd

2bde6fe75196dce1
F12bde6fe7
f9cea4a0d210cb47
ab28e0da
1c3e38a3
4da8e442 f9d97f1d
F1
4da8e442b869b4a7
f5c150e5
fc0c25f6
c4315b8d3de82490 1e29190cF13de82490
e74bc550
daa3e1c02904757beac2f0fb
f4ebe9f7 817ca7e4
F1
f4ebe9f7
16de4795
e235ae62669b8953
c119609f
4065c77b 367c28af
F14065c77b
33265d1473439a6f
788c85b4
c755adfa
f1298555 64664dd0
F1f1298555
5142f434
a06b7161
7e99ea2a12d0c82df1298555 76b685fd
33221100
f1298555 459494fd
f1298555 459494fd

33

CHAPTER 2. ALGORITHM SPECIFICATION
192-bit key:
key
plaintext
ciphertext

ffeeddcc bbaa9988 77665544 33221100
f0e0d0c0 b0a09080
00010203 04050607 08090a0b 0c0d0e0f
e2482f64 9f028dc4 80dda184 fde181ad

LL
LR

db05415a 800082db 7cb8186c d788c5f3
1ca9b2e1 b4606829 c92dd35e 2258a432

W K0,1,2,3
RK0,1,2,3
RK4,5,6,7
RK8,9,10,11
RK12,13,14,15
RK16,17,18,19
RK20,21,22,23
RK24,25,26,27
RK28,29,30,31
RK32,33,34,35
RK36,37,38,39
RK40,41,42,43

0f0e0d0c 0b0a0908 77777777 77777777
4d3bfd1b 7a1f5dfa 0fae6e7c c8bf3237
73c2eeb8 dd429ec5 e220b3af c9135e73
38c46a07 fc2ce4ba 370abf2d b05e627b
38351b2f 74bd6e1e 1b7c7dce 92cfc98e
509b31a6 4c5ad53c 6fc2ba33 e1e5c878
419a74b9 1dd79e0e 240a33d2 9dabfd09
6e3ff82a 74ac3ffd b9696e2e cc0b3a38
ed785cbd 9c077c13 04978d83 2ec058ba
4bbd5f6a 31fe8de8 b76da574 3a6fa8e7
521213ce 4f1f59d8 c13624f6 ee91f6a4
17f68fde f6c360a9 6288bc72 c0ad856b

34

CHAPTER 2. ALGORITHM SPECIFICATION
plaintext
initial whitening key
after whitening
Round 1 input
F-function
input
round keyafter key add
after S
after M
Round 2 input
F-function
input
round keyafter key add
after S
after M
Round 3 input
F-function
input
round keyafter key add
after S
after M
Round 4 input
F-function
input
round keyafter key add
after S
after M
Round 5 input
F-function
input
round keyafter key add
after S
after M
Round 6 input
F-function
input
round keyafter key add
after S
after M

00010203
00010203
0001020304050607
0f0e0d0c0b0b0b0b0b0b0b0bF000010203
4d3bfd1b4d3aff18
43c58e9eb5021a3b
be091130 08090a0b
F0be0911300fae6e7cb1a77f4c
f3d10ba4
9fba69c1
97b363ca c490f12c
F097b363ca
73c2eeb8
e4718d72
79ea66ed
61c21ea5a552ef89 6682c8e0F0a552ef89
e220b3af
47725c26
daeda541
28a43c63
4e26f483 ac0717d2
F0
4e26f483
38c46a07
76e29e84fe663e39
5ce7dafe
f0e0cd2c 5ca9d6b9
F0
f0e0cd2c
370abf2d
c7ea7201
e77f9fdab986927008090a0b08090a0b08090a0b0c0d0e0f0b0a0908
07070707
07070707

F108090a0b7a1f5dfa
721657f1
ed85d736
c397f62b
c490f12c 00010203
F1
c490f12c
c8bf3237
0c2fc31b
13d83a3d
6683cae36682c8e0 be091130
F16682c8e0dd429ec5
bbc05625
f47b0d7a120e06e2
ac0717d2 97b363ca
F1
ac0717d2
c9135e73651449a1
355c651b
cb1ab573
5ca9d6b9 a552ef89
F1
5ca9d6b9
fc2ce4ba
a0853203
7edcc7c6
ac7f4e3e092da1b7 4e26f483
F1
092da1b7
b05e627b
b973c3cc
174a3a46
8fc7e089

35

CHAPTER 2. ALGORITHM SPECIFICATION

Round 7

Round 8Round 9Round 10

Round 11

Round 12input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M

e52f44c9092da1b7
F0
e52f44c938351b2f
dd1a5fe6c5496150
33d8590f
3af5f8b8 c1e1140a
F0
3af5f8b8
1b7c7dce
21898576
a118dc09
f091202d
31703427 16ce743f
F031703427
509b31a6
61eb0581
2a8d3304
f9639a90
efadeeaf e1d6acee
F0efadeeaf
6fc2ba33
806f549c
cd5eeb61
a100e35b40d64fb5 b11e0685
F040d64fb5
419a74b9
014c3b0c
49a4c013
51c0208f
e0de260a 17d4d54a
F0
e0de260a240a33d2
c4d415d8
801beebe
8a9aef34

c1e1140af0e0cd2cF1c1e1140a74bd6e1eb55c7a14
5aa5c15ce62eb913
16ce743f e52f44c9
F1
16ce743f
92cfc98e
8401bdb1
3949b1f3
04f9e827
e1d6acee 3af5f8b8
F1
e1d6acee
4c5ad53c
ad8c79d2
eeffc072
8bebfe3db11e0685 31703427
F1
b11e0685
e1e5c87850fbcefd
25d7fe02
26a4e16d
17d4d54a efadeeaf
F1
17d4d54a
1dd79e0e0a034b44
b4c6c912
f1a2c339
1e0f2d96 40d64fb5
F1
1e0f2d96
9dabfd09
83a4d09f
86b8f8ed
3e451646

36

CHAPTER 2. ALGORITHM SPECIFICATION

Round 13

Round 14

Round 15

Round 16

Round 17

Round 18

input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M

9d4e3a7e

1e0f2d96
F0
9d4e3a7e
6e3ff82a
f371c254
29ea68e817524741
095d6ad7 7e9359f3
F0
095d6ad7b9696e2eb03404f9
152a2f03
f7ee818b
897dd878 ab524674
F0897dd878
ed785cbd
640584c5459d9e104034defc
eb669888 e44cc995
F0eb669888
04978d83
eff1150b90e4ee38
4a678609
ae2b4f9c 0b75d703
F0ae2b4f9c
4bbd5f6ae59610f6
f6a5286d
720df49d
7978239e 8ccf6cd1
F07978239eb76da574
ce1586ea
919c117f
ef24fe567e9359f3

e0de260aF1
7e9359f3
74ac3ffd
0a3f660e
b4f530a8
4b8c607e
ab524674 9d4e3a7eF1ab524674
cc0b3a38
67597c4c
52161e397902f3eb
e44cc995 095d6ad7
F1e44cc995
9c077c13
784bb586
636b5a110228bdd4
0b75d703 897dd878
F10b75d703
2ec058ba
25b58fb9
e7691f3b
05b2b4a9
8ccf6cd1 eb669888
F1
8ccf6cd1
31fe8de8
bd31e139
b15d7589
bad65e2251b0c6aa ae2b4f9c
F1
51b0c6aa
3a6fa8e7
6bdf6e4d
283aaa430891610337

CHAPTER 2. ALGORITHM SPECIFICATION

Round 19

input
F-function
input
round keyafter key add
after S
after M
Round 20 input
F-function
input
round keyafter key add
after S
after M
Round 21 input
F-function
input
round keyafter key add
after S
after M
Round 22 input
F-function
input
round keyafter key add
after S
after M
outputfinal whitening key
after whitening
ciphertext

63eb9287

51b0c6aaF0
63eb9287
521213ce
31f98149
5d03e265b7464b63
e6f68dc9 a6ba2e9f
F0
e6f68dc9c13624f6
27c0a93f
20b5938b3cae819e
9a14af01 98a8a539
F0
9a14af01
17f68fde
8de220df
6666bff2
7ae08a5d
e2482f64 d5e856d3
F0e2482f646288bc72
80c09316
cdb5f1e5
3d9dac60
e2482f64 e875fab3
77777777
e2482f64 9f028dc4
e2482f64 9f028dc4

a6ba2e9f

7978239eF1
a6ba2e9f
4f1f59d8
e9a57747
3c8d7bda
e1d086a7
98a8a539 63eb9287
F1
98a8a539
ee91f6a4
7639539d
09893194b603c454d5e856d3 e6f68dc9
F1d5e856d3
f6c360a9
232b367ab383a1bd
662b2c4d
80dda184 9a14af01
F180dda184
c0ad856b
407024ef
fbe99290
108259db
80dda184 8a96f6da
77777777
80dda184 fde181ad
80dda184 fde181ad

38

CHAPTER 2. ALGORITHM SPECIFICATION
256-bit key:
key
plaintext
ciphertext

ffeeddcc bbaa9988 77665544 33221100
f0e0d0c0 b0a09080 70605040 30201000
00010203 04050607 08090a0b 0c0d0e0f
a1397814 289de80c 10da46d1 fa48b38a

LLLR

477e8f09 66ee5378 2cc2be04 bf55e28f
d6c10b89 4eeab575 84bd5663 cc933940

W K0,1,2,3
RK0,1,2,3
RK4,5,6,7
RK8,9,10,11
RK12,13,14,15
RK16,17,18,19
RK20,21,22,23
RK24,25,26,27
RK28,29,30,31
RK32,33,34,35
RK36,37,38,39
RK40,41,42,43
RK44,45,46,47
RK48,49,50,51

0f0e0d0c 0b0a0908 07060504 03020100
58f02029 15413cd0 1b0c41a4 e4bacd0f
6c498393 8846231b 1fc716fc 7c81a45b
fa37c259 0e3da2ee aacf9abb 8ec0aad9
b05bd737 8de1f2d0 8ffee0f6 b70b47ea
581b3e34 03263f89 2f7100cd 05cee171b523d4e9 176d7c44 6d7ba5d7 f797b2f3
25d80df2 a646bba2 6a3a95e1 3e3a47f0
b304eb20 44f8824e c7557cbc 47401e21
d71ff7e9 aca1fb0c 2deff35d 6ca3a830
4dd7cfb7 ae71c9f6 4e911fef 90aa95de
2c664a7a 8cb5cf6b 14c8de1e 43b9caef
568c5a33 07ef7ddd 608dc860 ac9e50f8
c0c18358 4f53c80e 33e01cb9 80251e1c

39

CHAPTER 2. ALGORITHM SPECIFICATION
plaintext
initial whitening key
after whitening
Round 1 input
F-function
input
round keyafter key add
after S
after M
Round 2 input
F-function
input
round keyafter key add
after S
after M
Round 3 input
F-function
input
round keyafter key add
after S
after M
Round 4 input
F-function
input
round keyafter key add
after S
after M
Round 5 input
F-function
input
round keyafter key add
after S
after M
Round 6 input
F-function
input
round keyafter key add
after S
after M

00010203
00010203
0001020304050607
0f0e0d0c0b0b0b0b0b0b0b0bF000010203
58f02029
58f1222a4ee41927
2db2101b
26b91b10 08090a0bF026b91b10
1b0c41a4
3db55ab4
aa5afadb
317e029c
39770897 df79e01f
F039770897
6c498393
553e8b04
5487484e
c3a7ac1d
1cde4c02 c0cd94b9
F0
1cde4c02
1fc716fc
03195afe
c607fa95
5edee0ce
9e137477 5c594394
F0
9e137477
fa37c259
6424b62e4592c8d2
adfd33ae
f1a4703a 758c0607
F0
f1a4703a
aacf9abb
5b6bea8122285e04
0fa52ed4

08090a0b08090a0b08090a0b0c0d0e0f0b0a0908
07070707
07070707

F108090a0b15413cd0
1d4836db
2c78a1ac
d87ee718
df79e01f 00010203
F1
df79e01f
e4bacd0f
3bc32d10
0f1e1928
c0cc96ba
c0cd94b9 26b91b10
F1
c0cd94b98846231b
488bb7a2d84876a0
7ae05884
5c594394 39770897
F1
5c594394
7c81a45b
20d8e7cf
12f002c9
4cfb0e90758c0607 1cde4c02
F1
758c0607
0e3da2ee
7bb1a4e9
46f3a044
42450650
5e9b4a52 9e137477
F1
5e9b4a52
8ec0aad9
d05be08b
f822d448
aa7a0a9c40CHAPTER 2. ALGORITHM SPECIFICATION

Round 7

Round 8Round 9Round 10

Round 11

Round 12input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M

7a2928d3

5e9b4a52
F0
7a2928d3
b05bd737
ca72ffe4
23ed8e688b158630
d58ecc62 34697eeb
F0
d58ecc62
8ffee0f6
5a702c94
facf9d64
72c2027e
46ab7c95 c2ea5ac8
F0
46ab7c95
581b3e34
1eb042a1
177afd6a51d5740a
933f2ec2 dfabfd23
F0
933f2ec2
2f7100cd
bc4e2e0f
e0434cd9
a768d32a78c32e09 c48c4bb5
F0
78c32e09b523d4e9
cde0fae0
3fd410d4
08bd9b01
cc31d0b4 f00533be
F0
cc31d0b4
6d7ba5d7
a14a7563
1b512562
7c2c762b

34697eeb

f1a4703a
F1
34697eeb
8de1f2d0b9888c3b172b59c0334e2af2
c2ea5ac8 7a2928d3
F1
c2ea5ac8b70b47ea
75e11d22
586f2c19
a582d5f0
dfabfd23 d58ecc62
F1
dfabfd2303263f89
dc8dc2aa
57664735
110287d7
c48c4bb5 46ab7c95
F1
c48c4bb5
05cee171c142aac4
22fd2380
b6ae4f2b
f00533be 933f2ec2
F1
f00533be176d7c44
e7684ffa
02ef5310
2fdb3f65
bce411a7 78c32e09
F1
bce411a7
f797b2f3
4b73a354
c94a71eb
81ca0b59

41

CHAPTER 2. ALGORITHM SPECIFICATION

Round 13

Round 14

Round 15

Round 16

Round 17

Round 18

input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M

8c294595

bce411a7
F08c294595
25d80df2
a9f14867
93e47852
4a87c858
f663d9ff f9092550
F0f663d9ff
6a3a95e1
9c594c1e
58ff39b0
d82301d4
212a2484 988db861
F0
212a2484b304eb20
922ecfa4
86d2c9a0
dbf56073
4378d812 847415b0
F04378d812
c7557cbc
842da4ae
9e19b889
6791a3e3e3e5b653 71817f5d
F0
e3e5b653
d71ff7e9
34fa41ba
d4e1be2d2743ef2d
56c29070 c05df72c
F056c29070
2deff35d
7b2d632d
56193719
ee6316fa

f9092550

cc31d0b4
F1
f9092550
a646bba2
5f4f9ef2
5c26cae5
54bc68d5
988db861 8c294595
F1
988db861
3e3a47f0
a6b7ff91
054d1d75
085d5025
847415b0 f663d9ff
F1847415b0
44f8824e
c08c97feb5ff567d87e2a6a2
71817f5d 212a2484
F171817f5d
47401e21
36c1617c
a10c5414e177d3a8
c05df72c 4378d812
F1
c05df72c
aca1fb0c
6cfc0c20
32bc13bf
6fec0aab
2c94d2b9 e3e5b653
F1
2c94d2b9
6ca3a830
40377a89
fb13c1b7
5e3245b742

CHAPTER 2. ALGORITHM SPECIFICATION

Round 19

Round 20

Round 21

Round 22

Round 23

Round 24input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M
input
F-function
input
round keyafter key add
after S
after M

2e3ee1d6

2c94d2b9F0
2e3ee1d6
4dd7cfb7
63e92e61373c4c54
87aab08e
ab3e6237 bdd7f3e4
F0
ab3e6237
4e911fef
e5af7dd8
f6ad88be
0889df33
b55e2cd7 d94f8683
F0b55e2cd7
2c664a7a993866ad2c2b6cee8999e772
50d661f1 da262999
F050d661f1
14c8de1e441ebfef
12b052ac
f5efd89e
2fc9f107 716a77e5
F0
2fc9f107568c5a33
7945ab34
a2a77e2a
e84f6d9b
99251a7e c114b03aF099251a7e
608dc860
f9a8d21e
f84572b020634b77

bdd7f3e456c29070
F1
bdd7f3e4
ae71c9f6
13a63a128fe6c54b
8f8d16f3
d94f8683 2e3ee1d6
F1
d94f8683
90aa95de49e5135d
65f68f77
f418c84f
da262999 ab3e6237
F1da2629998cb5cf6b
5693e6f2
0df150e5da5415d2
716a77e5 b55e2cd7
F1716a77e543b9caef
32d3bd0ac7bbb182
744a9ced
c114b03a 50d661f1
F1
c114b03a
07ef7ddd
c6fbcde7
4cd7e238
ce67e20a
9eb183fb 2fc9f107
F1
9eb183fb
ac9e50f8
322fd303
c7d8f1c6
591b3f55

43

CHAPTER 2. ALGORITHM SPECIFICATION

Round 25

input
F-function
input
round keyafter key add
after S
after M
Round 26 input
F-function
input
round keyafter key add
after S
after M
outputfinal whitening key
after whitening
ciphertext

e177fb4d

9eb183fb
F0
e177fb4d
c0c18358
21b67815a14dd39c
3f88fbef
a1397814 76d2ce52
F0a1397814
33e01cb9
92d964ad
864445ee5949235aa1397814 2f9bed08
07060504
a1397814 289de80c
a1397814 289de80c

76d2ce52

99251a7eF176d2ce52
4f53c80e3981065cc8e20aa5
89ff5caf
10da46d1 e177fb4d
F1
10da46d1
80251e1c
90ff58cd
9a8e803f
183d49c7
10da46d1 f94ab28a
03020100
10da46d1 fa48b38a
10da46d1 fa48b38a

44

Chapter 3

Implementation TechniquesThis chapter describes optimization techniques of software implementations
and hardware implementations of CLEFIA.

3.1

Software Implementations

This section describes optimization techniques of software implementationsof CLEFIA. CLEFIA can be implemented eﬃciently in software on various
platforms including 32-bit and 64-bit processors.

3.1.1

Optimization Techniques for Encryption

This subsection describes how to implement the encryption part of CLEFIA
with 128-bit key eﬃciently. We don’t refer to CLEFIA with 192/256-bit key
because the same techniques are applicable to them except the number ofrounds.
We present 6 implementation types suitable for either 32-bit or 64-bit
processors: 2 types (Type-1, 2) for 32-bit processors and 4 types (Type-3,
4, 5, 6) for 64-bit processors. First, we show the notations used in thissubsection.
Notations
Let (x0 , x1 , x2 , x3 ) be an input of the F-function F0 without the key addition
layer and (y0 , y1 , y2 , y3 ) be an output of F0 . Similarly, let (x4 , x5 , x6 , y7 ) and(y4 , y5 , y6 , y7 ) be an input and an output of the F-function F1 without the
key addition layer, respectively. The relationship of the input and the output

45

CHAPTER 3. IMPLEMENTATION TECHNIQUES(x0 , x1 , x2 , x3 )F0(x4 , x5 , x6 , x7 )(y0 , y1 , y2 , y3 )F1

(y4 , y5 , y6 , y7 )Figure 3.1: A round function of encryption for implementations on 64-bit
processors
is described as follows:⎞⎛y0⎜ y1 ⎟⎟⎜⎝ y2 ⎠ =y3⎞⎛y4⎜ y5 ⎟⎟⎜⎝ y6 ⎠ =
y7

⎛

01
⎜ 02
⎜
⎝ 04
06
⎛
01
⎜ 08
⎜
⎝ 02
0A

02
01
06
04

04
06
01
02

08
01
0A
02

02
0A
01
08

⎞⎛
⎞
06
S0 (x0 )⎜⎟04 ⎟⎟ ⎜ S1 (x1 ) ⎟02 ⎠ ⎝ S0 (x2 ) ⎠01
S1 (x3 )⎞⎞⎛0AS1 (x4 )⎟⎜02 ⎟⎟ ⎜ S0 (x5 ) ⎟⎠⎝S1 (x6 ) ⎠08
S0 (x7 )01

The elements of the above matrices are represented in hexadecimal form.
For implementations on 64-bit processors, a round function of encryptionof CLEFIA with 128-bit key can be transformed equivalently as shown in
Figure 3.1.
Type-1
Type-1 is a straight-forward implementation suitable for 32-bit processors.
If a 32-bit processor has a suﬃciently large primary cache, we can use four
tables of an 8-bit input and a 32-bit output per F-function for fast implementation. This implementation requires the following 8 tables:
S0 (x), {02} × S0 (x), {04} × S0 (x), {06} × S0 (x) )T00 (x) = (S1 (x), {06} × S1 (x), {04} × S1 (x) )T01 (x) = ( {02} × S1 (x),S0 (x), {02} × S0 (x) )T02 (x) = ( {04} × S0 (x), {06} × S0 (x),S1 (x) )T03 (x) = ( {06} × S1 (x), {04} × S1 (x), {02} × S1 (x),S1 (x), {08} × S1 (x), {02} × S1 (x), {0A} × S1 (x) )T10 (x) = (S0 (x), {0A} × S0 (x), {02} × S0 (x) )T11 (x) = ( {08} × S0 (x),S1 (x), {08} × S1 (x) )T12 (x) = ( {02} × S1 (x), {0A} × S1 (x),S0 (x) )T13 (x) = ( {0A} × S0 (x), {02} × S0 (x), {08} × S0 (x),46

CHAPTER 3. IMPLEMENTATION TECHNIQUES

Next, we compute the following equations:(y0 , y1 , y2 , y3 ) = T00 (x0 ) ⊕ T01 (x1 ) ⊕ T02 (x2 ) ⊕ T03 (x3 )(y4 , y5 , y6 , y7 ) = T10 (x4 ) ⊕ T11 (x5 ) ⊕ T12 (x6 ) ⊕ T13 (x7 )The required operations for Type-1 are estimated as follows:
Size of table (KB):
8
Operation per round (18 rounds in total)# of table lookups:
8# of XORs in F-function:
6# of XORs out of F-function:2# of XORs for round key addition: 2# of XORs for key whitening:4Type-2We show another implementation technique on a 32-bit processor which can
reduce the size of table to half of Type-1 by introducing rotation operations.
Type-2 is preferable when the processor has a smaller primary cache than 8
KB and a rotation operation on the processor is relatively fast.
In the implementation, the tables T02 (x), T03 (x), T12 (x) and T13 (x) in
Type-1 are not required to prepare. The tables are generated from the othertables as follows:
T02 (x) = T00 (x) <<< 16
T03 (x) = T01 (x) <<< 16
T12 (x) = T10 (x) <<< 16
T13 (x) = T11 (x) <<< 16
The required operations for Type-2 are estimated as follows:
Size of table (KB):
4
Operation per round (18 rounds in total)# of table lookups:
8# of rotation:
4# of XORs in F-function:
6# of XORs out of F-function:2# of XORs for round key addition: 2# of XORs for key whitening:
4Note that the size of table is reduced to half, from 8KB to 4KB, compared
to Type-1.

47

CHAPTER 3. IMPLEMENTATION TECHNIQUES

Type-3Type-3 is a straight-forward implementation suitable for 64-bit processors.
If a 64-bit processor has a primary cache whose size is equal to or more than
16KB, we can use eight tables of an 8-bit input and a 64-bit output for around function as follows.
T00 (x) = (S0 (x), {02} × S0 (x), {04} × S0 (x), {06} × S0 (x), 0, 0, 0, 0 )T01 (x) = ( {02} × S1 (x),S1 (x), {06} × S1 (x), {04} × S1 (x), 0, 0, 0, 0 )T02 (x) = ( {04} × S0 (x), {06} × S0 (x),S0 (x), {02} × S0 (x), 0, 0, 0, 0 )S1 (x), 0, 0, 0, 0 )T03 (x) = ( {06} × S1 (x), {04} × S1 (x), {02} × S1 (x),S1 (x), {08} × S1 (x), {02} × S1 (x), {0A} × S1 (x) )T10 (x) = ( 0, 0, 0, 0,
T11 (x) = ( 0, 0, 0, 0, {08} × S0 (x),S0 (x), {0A} × S0 (x), {02} × S0 (x) )S1 (x), {08} × S1 (x) )T12 (x) = ( 0, 0, 0, 0, {02} × S1 (x), {0A} × S1 (x),T13 (x) = ( 0, 0, 0, 0, {0A} × S0 (x), {02} × S0 (x), {08} × S0 (x),S0 (x) )Using these tables, we compute the following equation:(y0 , y1 , y2 , y3 , y4 , y5 , y6 , y7 ) = T00 (x0 ) ⊕ T01 (x1 ) ⊕ T02 (x2 ) ⊕ T03 (x3 ) ⊕T10 (x4 ) ⊕ T11 (x5 ) ⊕ T12 (x6 ) ⊕ T13 (x7 )The required operations for Type-3 are estimated as follows:
Size of table (KB):
16
Operation per round (18 rounds in total)# of table lookups:
8# of XORs in F-function:
7# of XORs out of F-function:1# of XORs for round key addition:1# of swap (rotation):1# of XORs for key whitening:2
Note that the rotation operations are required in order to swap (x0 , x1 , x2 , x3 )and (x4 , x5 , x6 , x7 ) as shown in Figure 3.1 .
Type-4
If a 64-bit processor has a suﬃciently large primary cache, e.g. 32KB, we
can avoid a swap operation per round by adding the following tables toType-3.

48

CHAPTER 3. IMPLEMENTATION TECHNIQUES

T04 (x) = ( 0, 0, 0, 0,
S0 (x), {02} × S0 (x), {04} × S0 (x), {06} × S0 (x) )T05 (x) = ( 0, 0, 0, 0, {02} × S1 (x),S1 (x), {06} × S1 (x), {04} × S1 (x) )T06 (x) = ( 0, 0, 0, 0, {04} × S0 (x), {06} × S0 (x),S0 (x), {02} × S0 (x) )S1 (x) )T07 (x) = ( 0, 0, 0, 0, {06} × S1 (x), {04} × S1 (x), {02} × S1 (x),S1 (x), {08} × S1 (x), {02} × S1 (x), {0A} × S1 (x), 0, 0, 0, 0 )T14 (x) = (T15 (x) = ( {08} × S0 (x),S0 (x), {0A} × S0 (x), {02} × S0 (x), 0, 0, 0, 0 )S1 (x), {08} × S1 (x), 0, 0, 0, 0 )T16 (x) = ( {02} × S1 (x), {0A} × S1 (x),T17 (x) = ( {0A} × S0 (x), {02} × S0 (x), {08} × S0 (x),S0 (x), 0, 0, 0, 0 )We appropriately select one of the following equations round by round.
(y0 , y1 , y2 , y3 , y4 , y5 , y6 , y7 ) = T00 (x0 ) ⊕ T01 (x1 ) ⊕ T02 (x2 ) ⊕ T03 (x3 ) ⊕T10 (x4 ) ⊕ T11 (x5 ) ⊕ T12 (x6 ) ⊕ T13 (x7 )(y0 , y1 , y2 , y3 , y4 , y5 , y6 , y7 ) = T04 (x0 ) ⊕ T05 (x1 ) ⊕ T06 (x2 ) ⊕ T07 (x3 ) ⊕T14 (x4 ) ⊕ T15 (x5 ) ⊕ T16 (x6 ) ⊕ T17 (x7 )The required operations for Type-4 are estimated as follows:
Size of table (KB):
32
Operation per round (18 rounds in total)# of table lookups:
8# of XORs in F-function:
7# of XORs out of F-function:1# of XORs for round key addition:1# of XORs for key whitening:
2
The advantage of this implementation over Type-3 is that we require noswap operation.
Type-5We show another implementation on a 64-bit processor which can reduce
the size of table to half of Type-3 by merging tables T0i and T1i into thefollowing table T2i for 0 ≤ i ≤ 3.
S0 (x),
S1 (x), {02} × S0 (x), {08} × S1 (x) ,{04} × S0 (x), {02} × S1 (x), {06} × S0 (x), {0A} × S1 (x) )S1 (x),S0 (x) ,T21 (x) = ( {02} × S1 (x), {08} × S0 (x),{06} × S1 (x), {0A} × S0 (x), {04} × S1 (x), {02} × S0 (x) )T22 (x) = ( {04} × S0 (x), {02} × S1 (x), {06} × S0 (x), {0A} × S1 (x) ,S1 (x), {02} × S0 (x), {08} × S1 (x) )S0 (x),
T23 (x) = ( {06} × S1 (x), {0A} × S0 (x), {04} × S1 (x), {02} × S0 (x) ,S1 (x),S0 (x) ){02} × S1 (x), {08} × S0 (x),T20 (x) = (49

CHAPTER 3. IMPLEMENTATION TECHNIQUES

We compute the following equation using mask operations.
(y0 , y1 , y2 , y3 , y4 , y5 , y6 , y7 )= (T20 (x0 ) ⊕ T21 (x1 ) ⊕ T22 (x2 ) ⊕ T23 (x3 )) & 0xFF00FF00FF00FF00) ⊕(T20 (x4 ) ⊕ T21 (x5 ) ⊕ T22 (x6 ) ⊕ T23 (x7 )) & 0x00FF00FF00FF00FF)

The required operations for Type-5 are estimated as follows:
Size of table (KB):
8
Operation per round (18 rounds in total)# of table lookups:
8# of XORs in F-function:
7# of XORs out of F-function:1# of mask operations (ANDs):
2# of XORs for round key addition: 1# of swap (rotation):1# of XORs for key whitening:2

Type-6The size of table in Type-5 can be reduced by using rotation operations.
This implementation is eﬃcient when the processor has only a small primarycache. In the implementation, the tables T22 (x) and T23 (x) in Type-5 are
not required. The outputs of these tables are generated using other tables
as follows:
T22 (x) = T20 (x) <<< 32
T23 (x) = T21 (x) <<< 32
The required operations for Type-6 are estimated as follows:
Size of table (KB):
4
Operation per round (18 rounds in total)# of table lookups:
8# of XORs in F-function:
7# of XORs out of F-function:1# of mask operations (ANDs):
2# of rotation:
4# of XORs for round key addition: 1# of swap (rotation):1# of XORs for key whitening:
250

CHAPTER 3. IMPLEMENTATION TECHNIQUES

3.1.2

Optimization Techniques for Decryption

As described in Sections 2.2 and 2.3.1, CLEFIA does not have complete
involution property. If both of the encryption function and the decryptionfunction can be implemented separately, the best performance in speed is
expected. If we need to merge them into a single function because of code
size limitation or other reasons, we can use the following techniques without
large reduction of performance.
• Change address of a look-up table of F-function in even rounds bywhether it is used in encryption or decryption step.
• Change round keys in even rounds according to F-function.
• Swap the ﬁnal output only in decryption step.

3.1.3

Optimization Techniques for Key Scheduling

Key scheduling operation consists of two parts: generating L from a secret
key K, and expanding K and L. The former utilizes a round function of
encryption, where the same techniques as described in the previous sections
are applicable. The latter requires relatively light operations including bit
rotation like operations.

3.2

Hardware Implementations

This section describes optimization techniques of hardware implementationsof CLEFIA including optimization techniques of the F-functions and the keyscheduling part.

3.2.1

Optimization Techniques in F-functions

We discuss optimization techniques of each component in the F-functions
F0 , F1 including S-boxes S0 , S1 and diﬀusion matrices M0 , M1 .
S-box S0
The 8-bit S-box S0 consists of three layers: substitution layer 1, linear transformation layer, and substitution layer 2.
Substitution layer 1 can be implemented by parallel location of two 4-bit
S-box circuits. Each 4-bit S-box circuit is automatically generated by logic
synthesis tool according to each 16 entries × 4 bits table. Linear transformation layer is a linear (2, 2) multipermutation over GF(24 ) deﬁned by aprimitive polynomial z 4 + z + 1. This layer requires only 10 XOR (exclusiveOR) logic gates with maximum delay of 2 XOR gates. Substitution layer 2
can be implemented in the same manner with substitution layer 1. Therefore, the total circuit area of S-box S0 counts the area of four 4-bit S-boxes51

CHAPTER 3. IMPLEMENTATION TECHNIQUES

and 10 XORs; the maximum delay is equivalent to that of two 4-bit S-boxes
and 2 XORs.
S-box S1
The 8-bit S-box S1 consists of three layers: an aﬃne transformation f , aninversion over GF(28 ), and an aﬃne transformation g as shown in the left
ﬁgure of Figure 3.2. The inversion is performed in GF(28 ) deﬁned by a primitive polynomial p(z) = z 8 + z 4 + z 3 + z 2 + 1. It is well known that signiﬁcantreduction of gate area is achieved by using inversion over composite ﬁelds
instead of inversion over GF(28 ) [5]. For our implementation, we choose thecomposite ﬁeld GF((24 )2 ) deﬁned by the following irreducible polynomials:
: q0 (z) = z 4 + z + 1
GF(24 ),
4
2
GF((2 ) ) : q1 (z) = z 2 + z + λ (λ = ω 3 )where ω is a root of q0 (z). We deﬁne an isomorphic mapping φ from GF(28 )to GF((24 )2 ) as
φ : x0 α7 + x1 α6 + x2 α5 + x3 α4 + x4 α3 + x5 α2 + x6 α + x7

→ (y0 ω 3 + y1 ω 2 + y2 ω + y3 )β + (y4 ω 3 + y5 ω 2 + y6 ω + y7 )
⎞ ⎛
⎞
⎞⎛
⎛
0 0 1 0 0 0 0 0x0y0⎜ y1 ⎟ ⎜ 0 0 1 1 1 0 1 0 ⎟ ⎜ x1 ⎟
⎟ ⎜
⎟
⎟⎜
⎜
⎜ y2 ⎟ ⎜ 0 1 1 0 0 1 0 0 ⎟ ⎜ x2 ⎟
⎟ ⎜
⎟
⎟⎜
⎜
⎜ y3 ⎟ ⎜ 1 1 1 1 0 1 0 0 ⎟ ⎜ x3 ⎟
⎟=⎜
⎟⎜
⎟
⎜
⎜ y4 ⎟ ⎜ 1 0 1 0 1 1 0 0 ⎟ ⎜ x4 ⎟ ,
⎟ ⎜
⎟⎜
⎟
⎜
⎜ y5 ⎟ ⎜ 1 0 1 0 1 1 1 0 ⎟ ⎜ x5 ⎟
⎟ ⎜
⎟
⎟⎜
⎜
⎝ y6 ⎠ ⎝ 0 0 0 0 1 0 1 0 ⎠ ⎝ x6 ⎠y7
x7
1 1 1 0 1 1 1 1

where α and β are a root of p(z) and q1 (z), respectively. Its inverse isomorphic mapping φ−1 from GF((24 )2 ) to GF(28 ) is described as
φ−1 : (x0 ω 3 + x1 ω 2 + x2 ω + x3 )β + (x4 ω 3 + x5 ω 2 + x6 ω + x7 )→ y0 α7 + y1 α6 + y2 α5 + y3 α4 + y4 α3 + y5 α2 + y6 α + y7
⎛
⎞ ⎛
⎞
⎞⎛
y0
1 1 1 1 0 0 1 0
x0⎜ y1 ⎟ ⎜ 1 1 0 1 0 1 0 0 ⎟ ⎜ x1 ⎟
⎜
⎟ ⎜
⎟
⎟⎜
⎜ y2 ⎟ ⎜ 1 0 0 0 0 0 0 0 ⎟ ⎜ x2 ⎟
⎜
⎟ ⎜
⎟
⎟⎜
⎜ y3 ⎟ ⎜ 1 1 0 0 0 0 1 0 ⎟ ⎜ x3 ⎟
⎜
⎟=⎜
⎟⎜
⎟
⎜ y4 ⎟ ⎜ 0 0 0 0 1 1 1 0 ⎟ ⎜ x4 ⎟ .
⎜
⎟ ⎜
⎟
⎟⎜
⎜ y5 ⎟ ⎜ 0 1 1 1 0 1 0 0 ⎟ ⎜ x5 ⎟
⎜
⎟ ⎜
⎟⎜
⎟
⎝ y6 ⎠ ⎝ 0 0 0 0 1 1 0 0 ⎠ ⎝ x6 ⎠y7
x7
1 1 0 1 0 0 0 1

52

CHAPTER 3. IMPLEMENTATION TECHNIQUES

aﬃne fmerge tosingle matrix

aﬃne faﬃne f+ isomorphism Áisomorphism Á
inversionover GF(28 )changebase ﬁeld

inversionover GF((24 )2 )inversionover GF((24 )2 )inverseisomorphism Á−1merge tosingle matrix

aﬃne gaﬃne ginverseisomorphism Á−1+ aﬃne g

Figure 3.2: Optimized Implementation of S-box S1
The aﬃne transformation f and the isomorphic mapping φ is merged toa single matrix operation as
φ ◦ f : x0 α7 + x1 α6 + x2 α5 + x3 α4 + x4 α3 + x5 α2 + x6 α + x7

 (y0 ω 3 + y1 ω 2 + y2 ω + y3 )β + (y4 ω 3 + y5 ω 2 + y6 ω + y7 )
→
⎞ ⎛
⎞ ⎛ ⎞
⎞⎛
⎛
0 0 0 0 0 0 0 1
0x0
y0⎜ y1 ⎟ ⎜ 0 0 0 0 0 0 1 0 ⎟ ⎜ x1 ⎟ ⎜ 1 ⎟
⎟ ⎜
⎟ ⎜ ⎟
⎟⎜
⎜
⎜ y2 ⎟ ⎜ 0 0 0 0 1 1 0 0 ⎟ ⎜ x2 ⎟ ⎜ 1 ⎟
⎟ ⎜
⎟ ⎜ ⎟
⎟⎜
⎜
⎜ y3 ⎟ ⎜ 0 0 0 1 0 0 1 0 ⎟ ⎜ x3 ⎟ ⎜ 0 ⎟
⎟ ⎜
⎟⎜
⎟ ⎜ ⎟
⎜
⎜ y4 ⎟ = ⎜ 0 0 1 0 0 0 0 0 ⎟ ⎜ x4 ⎟ + ⎜ 0 ⎟ .
⎟ ⎜
⎟ ⎜ ⎟
⎟⎜
⎜
⎜ y5 ⎟ ⎜ 0 1 0 0 0 0 0 0 ⎟ ⎜ x5 ⎟ ⎜ 1 ⎟
⎟ ⎜
⎟⎜
⎟ ⎜ ⎟
⎜
⎝ y6 ⎠ ⎝ 0 0 0 0 0 1 0 1 ⎠ ⎝ x6 ⎠ ⎝ 0 ⎠y7

1 0 0 1 0 0 0 0x7

1The inverse isomorphic mapping φ−1 and the aﬃne transformation g is also
merged to a single matrix operation asg ◦ φ−1 : (x0 ω 3 + x1 ω 2 + x2 ω + x3 )β + (x4 ω 3 + x5 ω 2 + x6 ω + x7 )→ y0 α7 + y1 α6 + y2 α5 + y3 α4 + y4 α3 + y5 α2 + y6 α + y7
⎛
⎞ ⎛
⎞ ⎛ ⎞
⎞⎛
y0
0 0 0 0 0 0 1 00x0⎜ y1 ⎟ ⎜ 0 0 0 0 0 1 0 1 ⎟ ⎜ x1 ⎟ ⎜ 1 ⎟
⎜
⎟ ⎜
⎟⎜
⎟ ⎜ ⎟
⎜ y2 ⎟ ⎜ 0 0 0 1 1 0 0 0 ⎟ ⎜ x2 ⎟ ⎜ 1 ⎟
⎜
⎟ ⎜
⎟⎜
⎟ ⎜ ⎟
⎜ y3 ⎟ ⎜ 1 0 0 0 0 0 0 0 ⎟ ⎜ x3 ⎟ ⎜ 0 ⎟
⎜
⎟=⎜
⎟⎜
⎟ ⎜ ⎟
⎜ y4 ⎟ ⎜ 0 1 0 0 0 0 1 0 ⎟ ⎜ x4 ⎟ + ⎜ 1 ⎟ .
⎜
⎟ ⎜
⎟⎜
⎟ ⎜ ⎟
⎜ y5 ⎟ ⎜ 0 0 0 0 1 1 0 0 ⎟ ⎜ x5 ⎟ ⎜ 0 ⎟
⎜
⎟ ⎜
⎟⎜
⎟ ⎜ ⎟
⎝ y6 ⎠ ⎝ 0 0 1 1 0 0 0 0 ⎠ ⎝ x6 ⎠ ⎝ 0 ⎠y7
x7
1 0 1 0 0 0 0 0153

CHAPTER 3. IMPLEMENTATION TECHNIQUES
These merged mappings φ ◦ f and g ◦ φ−1 require 2 XORs + 2 XNORs + 2
NOTs and 2 XORs + 4 XNORs, respectively, where XNOR is an exclusiveNOR logic gate and NOT is a logical NOT gate.
For an arbitrary element a0 β + a1 of GF((24 )2 ) where a0 , a1 ∈ GF(24 ),the inversion b0 β + b1 = (a0 β + a1 )−1 (b0 , b1 ∈ GF(24 )) can be computed asfollows:
b0 = a0 Δ−1 ,b1 = (a0 + a1 )Δ−1 ,Δ = (a0 + a1 )a1 + λa20 .

These calculations are performed in GF(24 ). We summarize our optimized
implementation of S-box S1 in the right ﬁgure of Figure 3.2.
Diﬀusion Matrices M0 and M1
Diﬀusion matrices M0 and M1 are multiplied to the outputs of S-boxes as alinear (4, 4) multipermutation over GF(28 ), which is deﬁned by a primitive
polynomial z 8 + z 4 + z 3 + z 2 + 1.
An addition of two elements in GF(28 ), denoted by ⊕, is equivalent toa bitwise XOR operation of their representation as an 8-bit binary string,which costs 8 XOR logic gates. A multiplication in GF(28 ), denoted by ×,corresponds to the multiplication of polynomials modulo z 8 +z 4 +z 3 +z 2 +1.
For an element a in GF(28 ), {02} × a, {04} × a and {08} × a require 3, 5
and 8 XOR logic gates, respectively.
For an input vector (X0 , X1 , X2 , X3 ) and an output vector (Y0 , Y1 , Y2 , Y3 ),the multiplication by M0 is decomposed into three matrices whose non-zeroelements are only one of the values {01, 02, 04} shown in the following equations.
⎞
⎛
⎞⎛
⎞
⎛
01 02 04 06
X0
Y0⎜ 02 01 06 04 ⎟ ⎜ X1 ⎟⎜ Y1 ⎟⎟⎜⎟⎜⎟⎜⎝ Y2 ⎠ = ⎝ 04 06 01 02 ⎠ ⎝ X2 ⎠Y3
X3
06 04 02 01
⎞ ⎛
⎞⎛
⎞
⎛
⎞⎛
00 02 00 02
X0
01 00 00 00
X0⎜ 00 01 00 00 ⎟ ⎜ X1 ⎟ ⎜ 02 00 02 00 ⎟ ⎜ X1 ⎟
⎟ ⎜
⎟⎜
⎟
⎟⎜
= ⎜
⎝ 00 00 01 00 ⎠ ⎝ X2 ⎠ + ⎝ 00 02 00 02 ⎠ ⎝ X2 ⎠X3
X3
02 00 02 00
00 00 00 01⎞⎛⎞⎛
00 00 04 04
X0⎜ 00 00 04 04 ⎟ ⎜ X1 ⎟⎟⎟⎜+ ⎜⎝ 04 04 00 00 ⎠ ⎝ X2 ⎠X3
04 04 00 00
The property of an Hadamard-type matrix M0 allows intermediate values to54

CHAPTER 3. IMPLEMENTATION TECHNIQUES

be fully shared as follows, and thus contributes to reduction of XOR gates.
⎧
C0 = {02} × B0 ⎪Y0 = C1 ⊕ D1 ⊕ X0
A0 = X0 ⊕ X1
⎪
⎨
A
=
X
⊕
X
C
=
{02}
×
B
Y
2
3
1
1 = C0 ⊕ D1 ⊕ X1
 1
 1
Y = C1 ⊕ D0 ⊕ X2
B0 = X0 ⊕ X2
D0 = {04} × A0 ⎪⎪⎩ 2
B1 = X1 ⊕ X3
D1 = {04} × A1
Y3 = C0 ⊕ D0 ⊕ X3
The total number and the maximum depth of XOR gates required for multiplication by M0 are 112 and 4, respectively.
For an input vector (X0 , X1 , X2 , X3 ) and an output vector (Z0 , Z1 , Z2 , Z3 ),the multiplication by M1 is decomposed into three matrices whose non-zeroelements are only one of the values {01, 02, 08} shown in the following equations.
⎞
⎛
⎞⎛
⎞
⎛
01 08 02 0A
X0
Z0
⎜
⎟⎜
⎟
⎜ Z1 ⎟⎟ = ⎜ 08 01 0A 02 ⎟ ⎜ X1 ⎟⎜⎝ 02 0A 01 08 ⎠ ⎝ X2 ⎠⎝ Z2 ⎠Z3
X3
0A 02 08 01
⎞ ⎛
⎞⎛
⎞
⎛
⎞⎛
00 00 02 02
X0
01 00 00 00
X0⎜ 00 01 00 00 ⎟ ⎜ X1 ⎟ ⎜ 00 00 02 02 ⎟ ⎜ X1 ⎟
⎟ ⎜
⎟⎜
⎟
⎟⎜
= ⎜
⎝ 00 00 01 00 ⎠ ⎝ X2 ⎠ + ⎝ 02 02 00 00 ⎠ ⎝ X2 ⎠X3
X3
02 02 00 00
00 00 00 01⎞⎞⎛⎛
00 08 00 08
X0⎜ 08 00 08 00 ⎟ ⎜ X1 ⎟⎟⎟⎜+ ⎜⎝ 00 08 00 08 ⎠ ⎝ X2 ⎠X308 00 08 00
In the same way to the multiplication by M0 , intermediate values can be
fully shared as follows:⎧
C0 = {02} × A0 ⎪Z0 = C1 ⊕ D1 ⊕ X0
A0 = X0 ⊕ X1⎪⎨
Z1 = C1 ⊕ D0 ⊕ X1
 A1 = X2 ⊕ X3
 C1 = {02} × A1
Z = C0 ⊕ D1 ⊕ X2
B0 = X0 ⊕ X2
D0 = {08} × B0 ⎪⎪⎩ 2
B1 = X1 ⊕ X3
D1 = {08} × B1
Z3 = C0 ⊕ D0 ⊕ X3
The number of XOR gates required for multiplication by M1 counts 118 andits maximum depth is 4.
For the compact architecture where the two F-functions F0 and F1 aremerged, the multiplications by M0 and M1 are merged into a single M0 /M1
circuit. The number of XOR gates and 2:1 selector gates required for thecircuit are 188 and 32, respectively, and its maximum delay is equivalent tothat of 4 XOR gates and a 2:1 selector gate.

3.2.2

Optimization Techniques in Key Scheduling Part

This section introduces optimization techniques in the key scheduling part of
CLEFIA. The details are shown in [8]. The key scheduling part of CLEFIA
55

CHAPTER 3. IMPLEMENTATION TECHNIQUES

is divided into the following two steps: generating an intermediate key Lfrom a key K (step 1) and generating 32-bit whitening keys W Ki and 32-bit
round keys RKj from K and L (step 2).
In step 1, it is possible to generate L by using the data processing part.
For CLEFIA with 128-bit key, GF N4,12 which takes K as an input andconstant values as round keys can be implemented by sharing a round function with encryption. For CLEFIA with 192/256-bit key, GF N8,10 can be
implemented by sharing F-functions F0 and F1 with GF N4,r .
In step 2, a register for intermediate keys is updated by applying DoubleSwap
function per 2 rounds. 32-bit round keys RKj are generated by XORing
round constants and adaptively-chosen 32 bits of a secret key K into 32
bits of the key register. Thus, if K is ﬁxed as an input key during encryption and decryption, the key scheduling part of CLEFIA with 128-bit and192/256-bit key requires only a 128-bit and 256-bit register, respectively.
Next, we focus on how to implement DoubleSwap function eﬃciently for
CLEFIA with 128-bit key. The same technique can be applicable to CLEFIA
with 192/256-bit key. DoubleSwap function Σ is a 128-bit permutation
function deﬁned as follows:Σ : X → Y
Y = X[7-63] | X[121-127] | X[0-6] | X[64-120]
where X[a-b] denotes a bit string cut from the a-th bit to the b-th bit of X.
0-th bit is the most signiﬁcant bit.
An intermediate key L is generated and stored into a 128-bit key registerin key setup. In straightforward implementation of encryption, the key
register is updated by applying DoubleSwap function Σ per 2 rounds, andthen round keys are generated by using the most signiﬁcant 64-bit and theleast signiﬁcant 64-bit of the key register at the round of odd order and evenorder, respectively. After the last round of encryption, we can re-store L into
the key register by applying Σ−8 which corresponds to a function repeating
the inversion function Σ−1 of Σ eight times. In case of decryption, Σ8 (L) is
generated by applying Σ8 which corresponds to a function repeating Σ eighttimes at the beginning of decryption. After that, the key register is updated
by applying Σ−1 per 2 rounds, and then round keys are generated by using
the least signiﬁcant 64-bit and the most signiﬁcant 64-bit of the key registerat the round of odd order and even order, respectively. Thus, we require 4functions Σ, Σ−1 , Σ8 and Σ−8 for encryption and decryption.
In order to reduce a number of functions required in encryption anddecryption, we decompose DoubleSwap function Σ into the following Swap

56

CHAPTER 3. IMPLEMENTATION TECHNIQUES
function Ω and SubSwap function Ψ as Σ = Ψ ◦ Ω.
Ω : X → Y
Y = X[64-127] | X[0-63]
Ψ : X → Y
Y = X[71-127] | X[57-70] | X[0-56]
We note that Ω is the function swapping the most signiﬁcant 64-bit and theleast signiﬁcant 64-bit, and the inversion functions of Ω and Ψ are equivalentto Ω and Ψ themselves, respectively. The key register is updated by applyingΩ and Ψ at the round of odd order and even order, respectively. Round keys
are always generated from the most signiﬁcant 64-bit of the key register at
every round. After the ﬁnal round of encryption, we can re-store L into the
key register by applying the following F inalSwap function Φ.
Φ : X → Y
Y = X[49-55] | X[42-48] | X[35-41] | X[28-34] | X[21-27] | X[14-20] |X[7-13] | X[0-6] | X[64-71] | X[56-63] | X[121-127] | X[114-120] |X[107-113] | X[100-106] | X[93-99] | X[86-92] | X[79-85] | X[72-78]

We note that the inversion of Φ is equivalent to Φ itself. In case of decryption, round keys are always generated from the most signiﬁcant 64-bit of
the key register at every round by applying the inversion functions of Ω, Ψand Φ in reverse order of encryption. Since the inversion functions of Ω, Ψand Φ are equivalent to themselves, the key register is updated by applyingΦ at the beginning of decryption, Ω at the round of odd order and Ψ at
the round of even order. Thus, we require only 3 functions Ω, Ψ and Φ forencryption and decryption This optimization technique enables us to reduce
not only a 128-bit selector for selection of the above functions, but also a
64-bit selector required for selection of the most signiﬁcant 64-bit and theleast signiﬁcant 64-bit of the 128-bit key register.

57

Chapter 4

Version Information
The CLEFIA algorithm is uniquely speciﬁed by this speciﬁcation and there
is no other version.
CLEFIA has been presented and published as follows under the same
name and the same speciﬁcation.
Publications• Technical report of IEICE
Taizo Shirai, Kyoji Shibutani, Toru Akishita, Shiho Moriai, and Tetsu
Iwata, “128-bit Blockcipher CLEFIA” (in Japanese), IEICE Technical
Report Vol.107, No.44, pp. 1-9, May 11, 2007.
• Fast Software Encryption 2007
Taizo Shirai, Kyoji Shibutani, Toru Akishita, Shiho Moriai, Tetsu
Iwata, “The 128-bit Blockcipher CLEFIA”, FSE 2007, LNCS 4593,
pp. 181-195, Springer-Verlag, 2007.
• IETF Internet Draft
M. Katagi, S. Moriai, “The 128-bit Blockcipher CLEFIA”, October
19, 2009. http://tools.ietf.org/html/draft-katagi-cleﬁa-00• CLEFIA website
Sony Corporation, “The 128-bit Blockcipher CLEFIA : Algorithm
Speciﬁcation, Version 1.0, 2007. http://www.sony.net/cleﬁa58

Chapter 5

Existing Level of Adoption
and Recommended Use
5.1

Existing Level of Adoption

5.1.1

Standardization

CLEFIA is proposed and under consideration in the following standardation
bodies. The proposed speciﬁcation is the same as this speciﬁcation.
ISO/IEC JTC 1/SC27 ISO/IEC 29192 – Information technology – Security techniques – Lightweight cryptography – Part 2: Block ciphers
IETF Internet Draft:
M. Katagi, S. Moriai, “The 128-bit Blockcipher CLEFIA”, October 19,
2009. http://tools.ietf.org/html/draft-katagi-cleﬁa-00
The Internet Draft above will be expired on April 22, 2010, and is going
to be updated.

5.1.2

Adoption in products and systems

There is no publicly-available information on adoption in products and systems as of January, 2010. Please contact the contact person of the submission for latest information.

5.2

Recommended Use

CLEFIA is a 128-bit blockcipher supporting key lengths of 128, 192, and 256
bits, and achieves high performance both in software and hardware. Therefore, CLEFIA is suitable for all applications in Japan e-Government systems
that require high level of security and high implementation performance.
59

CHAPTER 5. EXISTING LEVEL OF ADOPTION AND
RECOMMENDED USE
Furthermore, CLEFIA has advantages in compact hardware implementations. So it is recommended to use CLEFIA in products and systems withconstrained environments.

60

Bibliography[1] E. Biham, O. Dunkelman, and N. Keller, “Related-Key Impossible Differential Attacks on 8-Round AES-192.” in Topics in Cryptology – CTRSA 2006, The Cryptographers’ Track (D. Pointcheval, ed.), no. 3860
in LNCS, pp. 21–33, Springer-Verlag, 2006.
[2] A. Biryukov and D. Khovratovich, “Related-Key Cryptanalysis of theFull AES-192 and AES-256.” in Advances in Cryptology – ASIACRYPT
2009 (M. Matsui, ed.), no. 5912 in LNCS, pp. 1–18, Springer-Verlag,
2009.
[3] A. Biryukov, D. Khovratovich, and I. Nikolić, “Distinguisher andRelated-Key Attack on the Full AES-256.” in Advances in Cryptology – CRYPTO 2009 (S. Halevi, ed.), no. 5677 in LNCS, pp. 231–249,
Springer-Verlag, 2009.
[4] N. Courtois and J. Pieprzyk, “Cryptanalysis of block ciphers withoverdeﬁned systems of equations.” in Proceedings of ASIACRYPT’02(Y. Zheng, ed.), no. 2501 in LNCS, pp. 267–287, Springer-Verlag, 2002.
[5] A. Rudra, P. K. Dubey, C. S. Jutla, V. Kumar, J. R. Rao, and P. Rohatgi, “Eﬃcient Rijndael encryption implementation with composite
ﬁeld arithmetic.” in Proceedings of Cryptographic Hardware and Embedded Systems – CHES 2001 (Ç. Koç, D. Naccache, and C. Paar,eds.), no. 2162 in LNCS, pp. 171–184, Springer-Verlag, 2001.
[6] T. Shirai and B. Preneel, “On Feistel ciphers using optimal diﬀusion
mappings across multiple rounds.” in Proceedings of ASIACRYPT’04(P. J. Lee, ed.), no. 3329 in LNCS, pp. 1–15, Springer-Verlag, 2004.
[7] T. Shirai and K. Shibutani, “On Feistel structures using a diﬀusion
switching mechanism.” in Proceedings of Fast Software Encryption –FSE’06 (M. Robshaw, ed.), no. 4047 in LNCS, pp. 41–56, SpringerVerlag, 2006.
[8] T. Shirai, K. Shibutani, T. Akishita, S. Moriai, and T. Iwata, “Hardware Implementations of the 128-bit Blockcipher CLEFIA.” in ISECTechnical Report – ISEC2007-49 (in Japanese), 2007.
61

BIBLIOGRAPHY[9] T. Sugawara, N. Homma, T. Aoki, and A. Satoh, “ASIC Implementations of the 128-bit Block Cipher CLEFIA.” in Proceedings of Computer
Security Symposium 2007 – CSS2007 (in Japanese), pp. 175–180, 2007.
[10] T. Sugawara, N. Homma, T. Aoki, and A. Satoh, “ASIC Performance
Comparison for the ISO Standard Block Ciphers.” in Proceedings of the
2nd Joint Workshop on Information security –JWIS2007 , pp. 485–498,
2007.
[11] Y. Zheng, T. Matsumoto, and H. Imai, “On the Construction of Block
Ciphers Provably Secure and Not Relying on Any Unproved Hypotheses.” in Proceedings of CRYPTO 89 (G. Brassard, ed.), no. 435 in
LNCS, pp. 461–480, Springer-Verlag, 1989.

62

CopyrightSony Corporation owns the copyright of this document. c 2010 Sony Corporation

63