M8 (cipher)
In cryptography, M8 is a block cipher designed by Hitachi in 1999. It is a modification of Hitachi's earlier M6 algorithm, designed for greater security and high performance in both hardware and 32-bit software implementations. M8 was registered by Hitachi in March 1999 as ISO/IEC 9979-0020. Like M6, M8 is a Feistel cipher with a block size of 64 bits. The round function can include 32-bit rotations, XORs, and modular addition, making it an early example of an ARX cipher. The cipher features a variable number of rounds (any positive integer N), each  of which has a structure determined by a round-specific "algorithm decision key". Making the rounds key-dependent is intended to make cryptanalysis more difficult (see FROG for a similar design philosophy). Cipher description. The round count can be set to any positive integer N, but a round count of at least 10 is recommended. The key consists of four components: a 64-bit data key, 256-bit key expansion key, a set of N 24-bit algorithm decision keys, and a set of N 96-bit algorithm expansion keys. The round function is used for both key expansion and  encryption/decryption. The key expansion process transforms the 64-bit data key and 256-bit key expansion key into a 256-bit execution key, consisting of 4 pairs of 32-bit numbers formula_1. The cipher has a typical Feistel cipher design. First, the 64-bit input block is split into two 32-bit halves. In each round, the left half undergoes a key-dependent transformation, and is then combined with the right half. Finally, the halves are swapped. In total, the round function consists of a sequence of nine customizable operations and three bitwise rotations: formula_2 formula_3 denotes the round  number, which takes inputs formula_4 and formula_5. formula_6 are the three 32-bit words of the round's algorithm expansion key. formula_7 are words from the execution key. formula_8 denotes a left bitwise rotation. formula_9 and formula_10 are defined by the 24-bit algorithm decision key as follows: where op1 to op9 are each one bit (0 = addition mod 2, 1 = XOR) and S1 to S3 are five bits each. Key expansion consists of eight cipher rounds, using the first eight algorithm decision and expansion keys, the key expansion key as the execution key, and the data key  as the input block. The eight intermediate outputs, formula_11 are used as the eight components of the execution key formula_1. Cipher implementation. The following is an implementation of the cipher in Python. M = 0xffffffff def add(x, y): def xor(x, y): def rol(x, s): def m8_round(L, R, ri, k, adk, aek): def m8_keyexpand(dk, kek, adks, aeks): def m8_encrypt(data, N, dk, kek, adks, aeks): result = m8_encrypt( assert result == 0xFE4B_1622_E446_36C0 Test vectors. The published version of ISO/IEC 9979-0020 includes the following test data: Cryptanalysis. The key-dependent behaviour of the cipher results in a large class of  weak key s which expose the cipher to a range of attacks, including differential cryptanalysis , linear cryptanalysis and mod n cryptanalysis . References. Category:Feistel ciphers