Method and apparatus for a symmetric block cipher using multiple stages with type-1 and type-3 feistel networks

[0002] 1. Related Invention

[0003] IBM application Ser. No. 09/027,765 entitled “Method and Apparatus for a Symmetric Block Cipher using Multiple Stages”, filed Feb. 23, 1998.

[0004] 2. Field of the Invention

[0005] The present invention relates to cryptography, and deals more particularly with a system and method for a symmetric key block cipher. This cipher uses multiple stages, where the stages have different structures and different subround functions. The cipher allows the block size, key size, and number of rounds per stage of ciphering to vary.

[0006] 3. Description of the Related Art

[0007] Cryptography is a security mechanism for protecting information from unintended disclosure by transforming the information into a form that is unreadable to humans, and unreadable to machines that are not specially adapted to reversing the transformation back to the original information content. The cryptographic transformation can be performed on data that is to be transmitted electronically, such as an electronic mail message, and is equally useful for data that is to be securely stored, such as the account records for customers of a bank or credit company.

[0008] In addition to preventing unintended disclosure, cryptography also provides a mechanism for preventing unauthorized alteration of data transmitted or stored in electronic form. After the data has been transformed cryptographically, an unauthorized person is unlikely to be able to determine how to alter the data, because the specific data portion of interest cannot be recognized. Even if the unauthorized user knew the position of the data portion within a data file or message, this position may have been changed by the transformation, preventing the unauthorized person from merely substituting data in place. If an alteration to the transformed data is made by the unauthorized user despite the foregoing difficulties, the fact of the alteration will be readily detectable, so that the data will be considered untrustworthy and not relied upon. This detection occurs when the transformation is reversed: the encrypted data will not reverse to its original contents properly if it has been altered. The same principle prevents unauthorized addition of characters to the data, and deletion of characters from the data, once it has been transformed.

[0009] The transformation process performed on the original data is referred to as “encryption”. The process of reversing the transformation, to restore the original data, is referred to as “decryption”. The terms “encipher” and “decipher” are also used to describe these processes, respectively. A mechanism that can both encipher and decipher is referred to as a “cipher”.

[0010] Data encryption systems are well known in the data processing art. In general, such systems operate by performing an encryption operation on a plaintext input block, using an encryption key, to produce a ciphertext output block. “Plaintext” refers to the fact that the data is in plain, unencrypted form. “Ciphertext” indicates that the data is in enciphered, or encrypted, form. The receiver of an encrypted message performs a corresponding decryption operation, using a decryption key, to recover the original plaintext block.

[0011] A cipher to be used in a computer system can be implemented in hardware, in software, or in a combination of hardware and software. Hardware chips are available that implement various ciphers. Software algorithms are known in the art as well.

[0012] Encryption systems fall into two general categories. Symmetric (or secret key) encryption systems use the same secret key for both encrypting and decrypting messages. An example of a symmetric encryption system is the Data Encryption Standard (DES) system, which is a United States federal standard described in NBS FIPS Pub 46. In the DES system, a key having 56 independently specifiable bits is used to convert 64-bit plaintext blocks to ciphertext blocks, or vice versa.

[0013] Asymmetric (or public key) encryption systems, on the other hand, use different keys that are not feasibly derivable from one another for encryption and decryption. A person wishing to receive messages generates a pair of corresponding encryption and decryption keys. The encryption key is made public, while the corresponding decryption key is kept secret. Anyone wishing to communicate with the receiver may encrypt a message using the receiver's public key. Only the receiver may decrypt the message, however, since only he has the private key. Perhaps the best-known asymmetric encryption system is the RSA encryption system, named after its originators Rivest, Shamir, and Adleman.

[0014] The category of symmetric encryption systems can be further subdivided into those which operate on fixed size blocks of data (block ciphers), and those which operate on arbitrary length streams of data (stream ciphers).

[0015] While there are many methods of symmetric key block encryption, most popular methods (for example, DES, CAST, RC5, and Blowfish) are based on Type-2 Feistel Networks. A Type-2 Feistel Network consists of dividing the data to be encrypted into two halves, and then performing some number of rounds, where each round consists of transforming the left half of the data based on the right half of the data, and then transforming the right half based on the modified left half. The two transformations are called subrounds; in the case of RC5, for example, there are two subrounds in each of 16 full rounds. These transformations must be invertible. That is, it must be possible to perform some set of operations during decryption that will reverse the transformations performed during encryption. In a standard Feistel network, some non-invertible function of one half of the data is simply exclusive-OR'd with the other half, as the exclusive OR operation provides invertibility, but any invertible function may be used in the general case.

[0016] Feistel Networks are not limited to this case of dividing the data into two equal halves. Alternatively, in a Type-1 Feistel the data is divided into n equal words, where n>2. If these words are labeled A(1) to A(n), then a full round consists of n subrounds, where each subround consists of transforming word A(i) based on the value of word A(i−1) (with A(1) transformed by A(n)).

[0017] Similarly, a Type-3 Feistel can be constructed in which the data is divided into n equal words, where n>2, but in which each word is used to transform more than one (possibly all) of the other words. For example, A(1) could be used to transform A(2), A(3), and A(4) in one subround. A full round consists of n such subrounds.

[0018] Feistel based ciphers typically add additional invertible transformations before, and/or after, each full round. For example, some ciphers exclusive or the entire data block with subkey data before the first round, to complicate certain attacks. “Subkey” refers to using a different key during different rounds, where the subkey values are derived from an input key.

[0019] The distinguishing features of different Feistel based ciphers are determined by the choice of the function used to modify a given data word in each subround. Different functions provide different tradeoffs between speed, data size, and security.

[0020] Many ciphers, such as DES and CAST, base their subround functions on a construct called a substitution box, or S-box, which is an array of data elements. In operation, a cipher block data word is used as an index into the S-box, and the value at that location is then used as the output value. The entries in the S-box are carefully chosen to have good properties for resistance to various attacks, including differential and linear analysis. Some desirable properties of S-boxes include that if the input words vary by one bit, on average, half the output bits should change, so that even small changes in the input data rapidly spread to all the output bits. Also, the entries in the S-box should be chosen to have little correlation to the index, to provide good resistance to linear attacks. While S-box based functions may provide excellent security, they tend to be slow in software implementations, especially on processors with small register sets, due to the costs of index calculation, and the corresponding higher use of register resources.

[0021] Other ciphers, such as RC5, base their subround functions on bit-wise rotations, in which one data word is used to specify an amount to rotate the target word. Data-dependent rotation provides a very fast subround function, as there are no index calculations and no memory references needed, and all the operations can be kept within the registers. Data-dependent rotations, however, tend to have relatively poor resistance to differential attacks, requiring more rounds to ensure security.

[0022] There are also a few ciphers, most notably IDEA and its variants, which use integer multiplication in their round functions. Because of the good diffusion properties of the multiplication operation, the round functions of these ciphers have very good resistance to differential attacks. On the other hand, to achieve this resistance these ciphers implement a multiplication in an algebraic field, which forces them to perform operations modulo some prime number. (Typically, this prime is chosen as 2¹⁶+1). This modular arithmetic complicates operation of the round function and causes a significant slowdown of the cipher. Also, the complicated round function of these ciphers, and in particular the fact that data words are multiplied by each other, makes it harder to analyze their properties and evaluate their security.

[0023] In view of the above, a stronger, more flexible algorithm is needed. One way to make a cipher stronger is to increase the number of rounds of ciphering performed: with each successive transformation, the resulting encryption becomes more difficult to break. Another way to increase the strength is to increase the size of the key. Since the contents of the key remain secret, increasing the size adds another level of difficulty for anyone trying to deduce what transformations may have been performed on the original data, because they are unlikely to guess the random number combination making up the key. Yet another way to increase algorithm strength is to increase the size of the “block” on which the cipher performs its transformations. A block is the unit of original data processed during one ciphering operation. The larger the block size, the more difficult it becomes for an adversary to construct a dictionary of plaintext and matching ciphertext, for a given key, large enough to pose a threat to the security of the algorithm. Further, different keys (i.e., subkeys) can be used for each round, increasing the number of random number combinations that would have to be correctly guessed in order to break the cipher.

[0024] It will be appreciated that when a cipher allows varying the number of rounds, the key size, the key values, and the block size at the same time, an incredibly difficult challenge is presented to a person attempting to discover the original data contents from an encrypted result. It will also be appreciated that the computations involved to cipher the data are quite complex, and that while performing more rounds of ciphering increases the strength of the result, it also causes computation time to increase. When data is very sensitive, this time spent in ciphering will be warranted. It may be, however, that less sensitive data does not warrant the added time and expense of many rounds of ciphering. By providing an algorithm where the number of rounds, the key size and values, and the block size are variable, the ultimate choice between the level of security required and the amount of computation time utilized rests with the user. By allowing the number of rounds per stage, key size, and block size to vary, the cipher of the present invention becomes, in effect, scalable in three dimensions.

[0025] Existing symmetric key block ciphers may provide for variation in the key size, the block size, and the number of rounds of ciphering, but these ciphers define a single type of round function, and iterate that function repeatedly. Existing ciphers tend to avoid use of data-dependent rotations, because reading the rotation amount from the storage location or register holding the data value is computationally very expensive. Further, use of S-boxes in existing ciphers tends to be inefficient, because subkeys are used as indices to access the S-boxes.

[0026] Accordingly, a need exists for an improved and more flexible symmetric block cipher which offers excellent resistance to linear and differential attacks; operates quickly and efficiently while using S-boxes; uses data-dependent rotation in a fast, efficient round function; and supports a variable length key, variable length block, and a variable number of rounds per stage.

[0027] The technique of the present invention achieves these objectives by using multiple stages while using the fast operations of table lookup, exclusive OR, addition, subtraction, and data-dependent rotation, thereby minimizing the time required to encrypt and decrypt data. Data-dependent rotation is fast because of a novel manner of locating the data value in a single, predetermined register. Table lookup using S-boxes is made faster because some rounds access the S-boxes without using subkeys. The data-independent sub-keys can be precomputed, further minimizing the time required for encryption and decryption. A minimal amount of computer storage is required for data used in the operation of the cipher.

[0028] An object of the present invention is to provide a technique whereby data can be encrypted in such a manner as to make discovery of the underlying data contents, other than by use of the corresponding decryption technique, computationally infeasible.

[0029] Another object of the present invention is to provide a technique whereby encryption is accomplished using a symmetric key block cipher with a strength better than that of existing symmetric block ciphers, with significantly improved efficiency.

[0030] Another object of the present invention is to provide a solution that does not use a significant amount of computer storage, in order to maximize the number of environments in which the solution can be used, including limited-storage devices such as those known as “Smart Cards”.

[0031] Another object of the present invention is to provide a technique whereby decryption of the encrypted data restores the data to its original contents, in an efficient and error-free manner.

[0032] Another object of the present invention is to provide a solution that can be implemented in hardware or in software.

[0033] Another object of the present invention is to provide a solution that allows precomputing the subkeys to be used for each round of ciphering, in order to minimize the time required for encrypting or decrypting an individual file or message.

[0034] Still another object of the present invention is to provide a technique whereby the cipher used for encryption and decryption uses multiple stages, where the stages have different structures and different subround functions. This use of differing structures makes the cipher much more resistant to attack, because an attack that is successful against one structure must then be successful against the next structure as well—which is incredibly difficult to accomplish. Thus, any weakness that exists in one of the structures will be cancelled out by the other structure(s).

[0035] A further object of the present invention is to provide a technique whereby the cipher uses a variable number of rounds per stage of processing during encryption and decryption, a variable length block of data as the unit to be encrypted and decrypted, and a variable length key. Allowing these factors to vary will provide the user with choices that will not only affect execution time and strength of security for any given use of the cipher, but will also allow variation between subsequent uses of the cipher, further increasing the difficulty of breaking encrypted data from a given source. The variation capability makes the cipher scalable in three dimensions, providing the user with flexibility to tune the algorithm to achieve the proper trade-off between execution time required and security achieved, in order to meet the needs of his particular application.

[0036] Yet another object of the present invention is to provide a technique whereby particular values for the variable information used by the algorithm—i.e., key length, block length, and number of rounds per stage—can be factored into the software or hardware implementation, as fixed values, in order to optimize performance.

[0037] This invention describes a novel Feistel based symmetric block cipher, using a hybrid structure where use of multiple stages provides both Type-1 and Type-3 rounds, and using different subround functions in different stages. By using several stages, each with rounds having different structure and functions, the overall cipher can provide a better combination of attributes than a cipher based on a single structure and round function.

[0038] In the preferred embodiment, this design divides the encryption operation into five stages. In the first and fifth stages, a single round is performed, in which a word of subkey data is added to each of the input data words. These first and last stages provide some resistance to chosen plaintext attacks. The second and fourth stages each consist of two full Type-3 Feistel rounds of (unkeyed) S-box based mixing, using two “8×32” S-boxes, each with 256 entries of 4-byte values. (“8×32” refers to the fact that the S-box takes an 8-bit input, and returns a 32-bit output.) These stages provide rapid mixing to offer resistance to differential attacks. By keeping these rounds unkeyed, the performance penalty of S-box operations is minimized, while still providing good differential properties.

[0039] In the preferred embodiment, the middle (third) stage consists of sixteen full rounds of Type-1 Feistel, each with four subrounds based on a novel method using keyed data-dependent rotations. This stage provides the bulk of the keyed non-linearity, with very fast rounds. A single, predefined register is used to specify the amount of rotation, thus eliminating the performance penalty associated with existing implementations of data-dependent rotation.

[0040] Other objects and advantages of the present invention will be set forth in part in the description and in the drawings which follow and, in part, will be obvious from the description or may be learned by practice of the invention.

[0041] To achieve the foregoing objects, and in accordance with the purpose of the invention as broadly described herein, the present invention provides a technique, system, and method for implementing a symmetric key block cipher supporting a plurality of stages, a variable length input key, a variable length block, and a variable number of rounds in each of the stages, and where the stages have differing structures and a plurality of subrounds in the rounds have differing subround functions, comprising a subprocess for accessing and retrieving values in two substitution boxes (S-boxes); a subprocess for generating a plurality of subkeys using the input key and a pseudorandom function; a subprocess for encrypting a plurality of input data words of a plurality of input data blocks of an input data file using the S-boxes and a plurality of the generated subkeys, producing a corresponding plurality of encrypted data words of a plurality of encrypted data blocks of an encrypted data file. The subprocess for encrypting comprises a first set of stages, wherein at least one of the structures comprises a Type-3 Feistel network, and at least one of the structures comprises a Type-1 Feistel network. The cipher further comprises a subprocess for decrypting each of the encrypted data words using the S-boxes and the plurality of generated subkeys, resulting in restoration of the plurality of input data words. The subprocess for decrypting comprises a second set of stages, wherein at least one of the structures comprises an inverse of the Type-3 Feistel network and at least one of the structures comprises an inverse of the Type-1 Feistel network. Preferably, each set of stages is comprised of five stages, where the first stage for encryption comprises a subprocess for performing addition using subkeys; the second stage comprises a subprocess for performing unkeyed Feistel Type-3 mixing using the S-boxes; the third stage comprises a subprocess for performing a Feistel Type-1 data-dependent rotation using subkeys; the fourth stage comprises a subprocess for performing a second unkeyed Feistel Type-3 mixing using the S-boxes; and the fifth stage comprises a subprocess for performing addition using subkeys. The stages for decryption are these inverse of these encryption stages. Preferably, the first and fifth stages comprise a single round; the second and fourth stages comprise two rounds, and the third stage comprises sixteen rounds. The subround operations preferably are taken from the set comprising table lookup using said S-boxes, exclusive OR, addition (with subtraction as an inverse), and data-dependent rotation. The table lookup operation is preferably performed without use of subkeys. A data-dependent rotation operation preferably places a value specifying an amount of rotation in a single register, where that register is used when performing the rotation. Optionally, the cipher implementation may be optimized by having values entered before a final production of the code, to fix one or more of the variables supported. One or more of the subprocesses may be embodied in a hardware chip.

[0042] The present invention will now be described with reference to the following drawings, in which like reference numbers denote the same element throughout.

[0043] FIG. 1 is a block diagram of a computer workstation environment in which the present invention may be practiced;

[0044] FIG. 2 is a diagram of a networked computing environment in which the present invention may be practiced;

[0045] FIG. 3 illustrates the stages of operation used by the present invention for encrypting a block of plaintext into a block of ciphertext;

[0046] FIG. 4 shows a flow diagram of the process used during Stage 2 of the preferred embodiment of the present invention, to complete a round of encryption;

[0047] FIG. 5 shows a flow diagram of the process used during Stage 4 to complete a round of encryption;

[0048] FIG. 6A shows a flow diagram of the process used during Stage 3 to complete an even-numbered round of encryption;

[0049] FIG. 6B shows a flow diagram of the process used during Stage 3 to complete an odd-numbered round of encryption; and

[0050] FIGS. 7A and 7B show an example of substitution boxes that may be used with the present invention.

[0051] FIG. 1 illustrates a representative workstation hardware environment in which the present invention may be practiced. The environment of FIG. 1 comprises a representative single user computer workstation 10, such as a personal computer, including related peripheral devices. The workstation 10 includes a microprocessor 12 and a bus 14 employed to connect and enable communication between the microprocessor 12 and the components of the workstation 10 in accordance with known techniques. The workstation 10 typically includes a user interface adapter 16, which connects the microprocessor 12 via the bus 14 to one or more interface devices, such as a keyboard 18, mouse 20, and/or other interface devices 22, which can be any user interface device, such as a touch sensitive screen, digitized entry pad, etc. The bus 14 also connects a display device 24, such as an LCD screen or monitor, to the microprocessor 12 via a display adapter 26. The bus 14 also connects the microprocessor 12 to memory 28 and long-term storage 30 which can include a hard drive, diskette drive, tape drive, etc.

[0052] The workstation 10 communicates via a communications channel 32 with other computers or networks of computers. The workstation 10 may be associated with such other computers in a local area network (LAN) or a wide area network, or the workstation 10 can be a client in a client/server arrangement with another computer, etc. All of these configurations, as well as the appropriate communications hardware and software, are known in the art.

[0053] FIG. 2 illustrates a data processing network 40 in which the present invention may be practiced. The data processing network 40 includes a plurality of individual networks, including LANs 42 and 44, each of which includes a plurality of individual workstations 10. Alternatively, as those skilled in the art will appreciate, a LAN may comprise a plurality of intelligent workstations coupled to a host processor.

[0054] Still referring to FIG. 2, the data processing network 40 may also include multiple mainframe computers, such as a mainframe computer 46, which may be preferably coupled to the LAN 44 by means of a communications link 48. The mainframe computer 46 may be implemented utilizing an Enterprise Systems Architecture/370, or an Enterprise Systems Architecture/390 computer available from the International Business Machines Corporation (IBM). Depending on the application, a midrange computer, such as an Application System/400 (also known as an AS/400) may be employed. “Enterprise Systems Architecture/370” is a trademark of IBM; “Enterprise Systems Architecture/390”, “Application System/400”, and “AS/400” are registered trademarks of IBM.

[0055] The mainframe computer 46 may also be coupled to a storage device 50, which may serve as remote storage for the LAN 44. Similarly, the LAN 44 may be coupled to a communications link 52 through a subsystem control unit/communication controller 54 and a communications link 56 to a gateway server 58. The gateway server 58 is preferably an individual computer or intelligent workstation which serves to link the LAN 42 to the LAN 44.

[0056] Those skilled in the art will appreciate that the mainframe computer 46 may be located a great geographic distance from the LAN 44, and similarly, the LAN 44 may be located a substantial distance from the LAN 42. For example, the LAN 42 may be located in California, while the LAN 44 may be located in Texas, and the mainframe computer 46 may be located in New York.

[0057] Software programming code which embodies the present invention is typically accessed by the microprocessor 12 of the workstation 10 from long-term storage media 30 of some type, such as a CD-ROM drive or hard drive. In a client-server environment, such software programming code may be stored with storage associated with a server. The software programming code may be embodied on any of a variety of known media for use with a data processing system, such as a diskette, hard drive, or CD-ROM. The code may be distributed on such media, or may be distributed to users from the memory or storage of one computer system over a network of some type to other computer systems for use by users of such other systems. Alternatively, the programming code may be embodied in the memory 28, and accessed by the microprocessor 12 using the bus 14. The techniques and methods for embodying software programming code in memory, on physical media, and/or distributing software code via networks are well known and will not be further discussed herein.

[0058] The encrypted data resulting from use of the present invention may be stored on any of the various media types used by the long-term storage 30, or may be sent from the workstation 10 to another computer or workstation of the network illustrated in FIG. 2 over the communications channel 32, for storage by that other computer or workstation. The encrypted data may be decrypted at the same computer or workstation where it was encrypted, or it may be decrypted at a different computer or workstation.

[0059] In a hardware solution, the present invention may be embodied in the processor 12 of the workstation 10. Techniques for implementing logic functions in processors are well known in the art.

[0060] The preferred embodiment of the present invention will now be discussed with reference to FIGS. 3 through 7.

[0061] In the preferred embodiment, the present invention is implemented as a computer software program. This software performs the derivation of subkeys from an input key for use during the rounds of the cipher, the encrypting of the data contents, and the decrypting of the data contents. The data may represent a message to be communicated over a network. The message may represent any of a number of types of information, such as conversational text sent as electronic mail, or a purchase request containing the buyer's credit card or account data. Alternatively, the data may be a conventional data file. Examples of this type of data include patient medical history, customer credit history, income tax and earnings data, and any conceivable stored information that needs to be protected from unintended disclosure. This type of data may be encrypted for transmission over a network, or it may be encrypted merely for secure storage. For ease of reference, the input data file or message will be referred to herein as an “input file”.

[0062] The present invention encrypts and subsequently decrypts the data using a symmetric key block-oriented cipher. The concepts of block-oriented ciphers and symmetric keys are well known in the art.

[0063] The present invention also provides a technique for using variable block sizes, variable key sizes, and a variable number of rounds of cipher processing per stage. The purpose of allowing these variables is to give the user of the cipher the flexibility to choose trade-offs between the increased computing time required (for example, as the number of processing rounds increases) and the strength of the resulting encryption.

[0064] Optionally, the present invention allows the software or hardware implementation of the cipher algorithm to be optimized for particular values of the variables. This is done by allowing a user of the cipher to enter values for block size, key size, and/or number of rounds per stage before the final step of producing the cipher implementation. The final implementation then treats the values as being fixed, and is optimized for those fixed values.

[0065] Decryption of data is accomplished in the present invention using the inverse of the data encryption, where the stages used for encryption are performed in reverse order, and the operations performed in each stage are inverted. By performing inverse processing, in inverse order, the encrypted data is restored to its original content.

[0066] The inventive concepts of the present invention define a general approach which can be used with data blocks and keys of differing sizes, and with varying number of rounds per stage. For the description of the preferred embodiment, specific values will be used to facilitate description of the processing, although the same methods can be applied with other values. The descriptions will all use “C” programming language syntax. (Standard “C” language coding has been used, except where indicated by the phrase “pseudo-code”. Refer to any “C” language programming manual for an explanation of the syntax used in the “C” language statements.)

[0067] Specific functions are shown for each of the round functions in the 5 stages of the preferred embodiment. However, changes may be made to those round functions without deviating from the inventive concepts of the present invention.

[0068] For this description of the design, the variables w, k, d, r1, r2, and n have the following definitions, and are described using the following values:

[0069] w number of bits per word=32,

[0070] k=number of words in the key=4, (for a 128-bit key)

[0071] d=number of words in the data block=4, (for a 128-bit block)

[0072] r1=number of rounds in each mixing stage=2,

[0073] r2=number of rounds in the center stage=16, and

[0074] n=number of words in the expanded key array=d * (r2+2).

[0075] Arrays K[k], D[d], E[n], S0[256], and S1[256] are defined as follows:

[0076] K[k] is the key (an array of k w-bit words),

[0077] D[d] is the data (an array of d w-bit words),

[0078] E[n] is the expanded key (an array of n w-bit words),

[0079] S1[256] is S-box 0 (an array of 256 w-bit words), and

[0080] S1[256] is S-box 1 (an array of 256 w-bit words). (FIGS. 7A and 7B show possible examples of S0 and S1 that were randomly generated. Other values may be used instead of those shown, without deviating from the inventive concepts of the present invention.)

[0081] The cipher uses two rotation functions, which are defined as follows:

[0082] ROTATE (x, y, w) rotates the w-bit word x by (y mod w) locations to the left;

[0083] IROTATE (x, y, w) rotates the w-bit word x by (y mod w) locations to the right.

[0084] The cipher has three major component functions: key setup, encryption, and decryption.

[0085] Note that the processes shown for the stages do not show a user entering particular values to be used for the variables (defining the block size, key size, and number of rounds per stage), nor a value to be used for the key. The user will have been prompted to enter these values upon invoking the cipher function, or the values will be read from a file. Alternatively, if an optimized implementation of the cipher is being used, the user will have been prompted to enter one or more of these values before the final step of producing the cipher implementation (e.g. compiling the cipher code) has been completed. Techniques for entering values required by an implementation are well known in the art.

[0086] Subkeys are generated using an input key. A user of the invention may be prompted, for example from a computer terminal, to enter the input key. Alternatively, the input key could be read from a file stored on disk, or passed as a parameter to a computer program embodying the present invention. The key setup phase may be performed immediately prior to the encryption phase when encrypting a particular input file, or the subkeys may be generated well in advance of the encryption. In the latter case, the subkeys would be stored for later use, in order to minimize the time required to encrypt a data file. Regardless of when the subkeys are generated, the generation process follows the same steps.

[0087] An expansion process is performed on the input key, to create an expanded key array (as previously defined). Expanding the input key in this manner allows greater randomness for the subkeys used during the encryption rounds, without requiring a key of very large size to be input to the cipher. For example, in the preferred embodiment, the input key is 128 bits long (4 words, each having 32 bits), whereas the expanded key is 2304 bits long (using the formulas defined above, 72 words each having 32 bits). The entries in this expanded key array are then used as subkeys in the key-dependent rounds of encryption, and the corresponding rounds of decryption. Techniques for key expansion are well known in the art. The following is one way of expanding keys for use with the present invention.

[0088] Key setup is performed by filling the expanded key array with values generated using iterated pseudorandom functions that use a counter, i, and the input key K as parameters, as specified with the following pseudo-code:

[0089] for (i=0; i<n; i++)

[0090] E[i]=PRF (i, K);

[0091] where PRF is some pseudorandom function using the concatenation of input parameters i and K, returning a word. It will be understood by one skilled in the art that this pseudo-code indicates that the value used for the counter begins at zero; increases by one for each iteration; and that the iterative process is repeated for each value from zero up through and including the value (n−1). Thus, a value is assigned to each of the n words of the expanded key array. Alternatively, a pseudorandom function may be used that returns more than one word. In that situation, the pseudo-code would need to be changed. The following example assumes a different pseudorandom function, referred to as PRF1, which uses the concatenation of input parameters i and K, and returns a value of size x:

[0092] In the preferred embodiment, the pseudorandom function is the secure hashing function commonly referred to as “SHA-1”. This hashing function is defined in NIST FIPS 180-1, titled “Secure Hash Standard”. The SHA-1 function returns a 5-word result each time it is invoked. For this function, and any other pseudorandom function which returns more than one word, the preferred embodiment key setup phase “tiles” the output values into the expanded key array, as indicated by the pseudo-code shown above using PRF1. That is, the multi-word output is used as multiple sequential array elements, following the sequential group of elements created from the prior invocation of the pseudorandom function. For example, the value returned from the first invocation of SHA-1 is used as elements E[0] through E[4], the value returned from the second invocation is used as elements E[5] through E[9], etc. When the pseudorandom function returns more than one word, the preferred embodiment discards any unneeded words from the end of the returned value that exceed the dimension of the expanded key array. Using the dimensions given previously as values for describing the preferred embodiment, the expanded key array has 72 words. Since this is not a multiple of 5, only the first 2 words of the final invocation are used.

[0093] Encryption is performed in multiple stages. According to the preferred embodiment, five stages are used, as diagramed in FIG. 3. Each of these five stages is performed for each input block of plaintext. FIG. 3 shows that from the plaintext words (referred to as D[0] through D[3] in FIG. 3), application of the five stages creates the output block of ciphertext (referred to as c[0] through c[3] in FIG. 3). As previously stated, the number of words per block used by the present invention is variable: four-word blocks are shown in FIG. 3 as an illustrative block size.

[0094] While the preferred embodiment is described using five stages, more stages may be added without deviating from the inventive concepts of the present invention. For example, the operations of Stage 1 could be repeated following operation of Stage 2, and the operation of Stage 5 could be performed prior to operation of Stage 4 as well as after Stage 4.

[0095] The stages of the preferred embodiment are described using a general approach to subkey usage, whereby subkeys are accessed in sequential groups. Alternative approaches to selecting subkeys may be used without deviating from the inventive concepts of the present invention. For example, instead of using each subkey sequentially within a group, an index might be used to cause selection of every other subkey, or every third subkey, or perhaps generating an index number randomly. When the subkeys are chosen from a greater range of indices in this manner, then the size of the subkey group used will need to expand accordingly; or, the group size might be retained, with the subkeys within that group being re-used. The description of the encryption stages gives more detail about how subkey selection might be altered to fit within the approach defined for that stage. It will be obvious to one of ordinary skill in the art that any such alterations to the preferred embodiment subkey selection for encryption must be reflected also in the decryption stages.

[0096] Each of the five stages of the preferred embodiment will now be described in detail.

[0097] Stages 1 and 5 of the preferred embodiment consist of simply adding one subkey word to each of the data words, which in “C” code can be specified as:

[0098] As will be understood by one skilled in the art, the result of the “C” code for stage 1 is to iterate d times, where d is the number of words in each block, using an iteration counter, j. The d iterations together comprise the single round of Stage 1 processing of the preferred embodiment. Each word D[0] through D[d−1] from the data block has the corresponding word E[0] through E[d−1] from the expanded key array added to it. The result of this addition is then used as the new value of the data block word D[0] through D[d−1]. When 4-word blocks are used, the first 4 subkeys (elements E[0] through E[3]) are used each time the Stage 1 process is performed.

[0099] The result of the “C” code for stage 5 is also to iterate d times, using an iteration counter j. These d iterations comprise the single round of Stage 5 processing of the preferred embodiment. Each word D[0] through D[d−1] from the data block has the corresponding word E[d*(r2+1)] through E[(d * (r2+1))+d−1] from the expanded key array added to it. The result of this addition is then used as the new value of the data block word D[0] through D[d−1]. When 4-word blocks are used, the last 4 subkeys (elements E[n−3] through E[n]) are used each time the Stage 5 process is performed.

[0100] While the preferred embodiment of Stages 1 and 5 uses 1 round (having d subrounds), the number of rounds can be increased without deviating from the inventive concepts of the present invention. For example, another round of subkey addition could be performed, using a different group of subkeys.

[0101] Subkey selection for Stages 1 and 5 might be altered to use different subkeys. Instead of using j as an index into the subkey array, Stage 1 might use (2*j), or (3*j), etc. If a sufficiently large value is used, then the computation needs to ensure that indices beyond the maximum size of the expanded key array are adjusted, to select a subkey within the proper range. For example, if the computation result is described as some value “x”, then the index [x mod (d*(r2+2))] will ensure that x is a valid index for the expanded key array. Since Decryption Stage 5 uses the same subkeys used by Encryption Stage 1, in the same order, any changes made to the selection computation need to be factored into the decryption computations as well. For example, if (2*j) is used in encryption, then (2*j) is used in decryption to select those same subkeys.

[0102] As shown in FIG. 3, the new data block created by operation of Stage 1 becomes the input to Stage 2. The input to Stage 5 comes from the output of Stage 4, and the output of Stage 5 is used as the resulting ciphertext block for the block of data being encrypted.

[0103] Stages 2 and 4 each perform an unkeyed Type-3 Feistel mixing, each using r1 rounds of mixing. In the preferred embodiment, r1=2. For each round of mixing, each subround consists of taking one of the data words, and using each of its bytes as an index into an S-box, then taking the word in that S-box entry, and either adding or exclusive OR'ing it into one of the other data words. Each full round consists of doing d such subrounds, where each subround uses a different data word as source.

[0104] Between the subrounds, 2 simple feedback addition or subtraction operations are added. This provides some of the strength of a full round, without the expense.

[0105] In the preferred embodiment, each data word has 4 bytes, and each round has 4 subrounds. A diagram of a full Stage 2 mixing round using 4-byte data words and 4 subrounds is given in FIG. 4, and a full Stage 4 mixing round is shown in FIG. 5. In “C” code, Stages 2 and 4 can be specified as:

[0106] As can be seen from these “C” language statements, Stage 2 and Stage 4 are very similar, but with a different ordering. There are many ways in which ordering could be changed without deviating from the inventive concepts of the present invention: the preferred embodiment shows one example, which is to use inversion.

[0107] The function “mixSubRound”, used for each of the four subrounds of Stage 2 as shown above, is specified in “C” code as:

[0108] The function “inverseMixSubRound”, used for each of the four subrounds of Stage 4 as shown above, is specified in “C” code as:

[0109] As will be understood by one skilled in the art, the processing of Stage 2 as defined by the above “C” language statements (and as shown in FIG. 4) performs one subround for each data word of the data block. Four subrounds are shown, for the example where each data block has 4 data words. The first subround mixes word D[0]; the second subround mixes D[1]; the third subround mixes D[2]; and the fourth subround mixes D[3].

[0110] As an example of the operation of the subround function, consider the first subround of Stage 2, using data blocks which have 4 data words each. This first subround invokes the mixing function using the parameters (D, 0, 1, 2, 3), as shown above. The first operation of the mixing function “mixSubRound”, shown as the first line of “C” code, masks off all but the low-order 8 bits of D[0], by performing an AND operation where the two operands are D[0] and 255. Thus, the last byte of D[0] is isolated from the other bytes. The value in this byte is then used as the 8-bit index into S-box zero. A 32-bit value is retrieved as a result of this index operation. That 32-bit value is exclusive OR'd with the 32-bit value in D[1]. The result of this exclusive OR operation becomes the new value of D[1]. The second operation of the mixing function, shown as the second line of “C” code, rotates D[0] 8 positions to the left. The third operation of the mixing function, shown as the third line of “C” code, uses this rotated D[0] and again masks off all but the low-order 8 bits. Because of the prior rotation, a different byte of D[0] is now isolated by this masking operation. That byte is used as an index into S-box one. The 32-bit value retrieved is added to the value of D[1], and the result becomes the new value of D[1]. In the fourth operation, D[0] is again rotated 8 positions to the left, so that the fifth operation will isolate a different byte. In the fifth operation, the low-order byte from D[0] is used to index into S-box zero, and the value retrieved is added to D[2], forming the new value for D[2]. In the sixth operation, D[0] is rotated a final time, so that the remaining unused byte rotates into the low-order 8 bits. The seventh operation isolates this byte, and uses it to index into S-box one. The retrieved value is then exclusive OR'd with D[3], forming a new value for D[3]. Invocation of mixSubRound is then complete, and control returns to the main processing routine of Stage 2. As seen in the “C” code, after returning to the main processing, the value now stored in D[3] is added to the value in D[0]as the first-described feedback operation, forming a new value for D[0].

[0111] The other three subrounds of processing in Stage 2 are analogous to the first, with two exceptions. First, the data words are passed as parameters in different orders in each subround, as indicated. Second, an addition operation is used for feedback following the first and second invocations of mixSubRound (as shown in the “C” code and described above for subround 1), but no such addition operation is used following the third or fourth invocations.

[0112] It will be obvious to one skilled in the art how to change the definition and invocation of mixSubRound if blocks of different size, or data words of different size, are used. For example, if blocks of 8 words were used (instead of blocks of 4 words), mixSubRound would be invoked 8 times. (In other words, there would be 8 subrounds, each subround comprising an invocation of the mixing function.) The value passed as the parameter designated “src” would typically begin at 0, and proceed sequentially through 7. The parameters designated “dst1”, “dst2”, and “dst3” could be left as they are, passing various combinations of the values between 0 and 3. Alternatively, each invocation could use 3 parameters chosen from the range 0 through 7 (and chosen to be distinct from the value used for “src”), meaning that each of the 8 words is being used in transformation, but not to transform every one of the seven other words. Or, mixSubRound could be redefined to accept more parameters. If it was desired to use all 8 words to mix every other word, then 4 more parameters would be added to the definition of (and to each invocation of) mixSubRound, so that all 8 words were passed on each invocation, in varying order. Additional statements would need to be added to mixSubRound to use the additional parameters. For example, each exclusive OR and each addition operation might be replaced by two such operations, while still using 4 retrieved S-box values, so that each retrieved value was factored into 2 different parameters. Or, the rotation operations could be changed to use 4 bit positions, giving 8 different values to use for indexing the S-boxes. Then, a different retrieved value could be used in each of 8 exclusive OR or addition operations, each operation being performed on a different parameter.

[0113] As will be understood by one skilled in the art, the processing of Encryption Stage 4 as defined by the above “C” language statements performs one subround for each data word of the data block. Four subrounds are shown, for the example where each data block has 4 data words. The first subround inversely mixes word D[3]; the second subround inversely mixes D[2]; the third subround inversely mixes D[1]; and the fourth subround inversely mixes D[0].

[0114] As stated previously, the operation of Stage 4 is similar to that of Stage 2, except that a different ordering is used. In the preferred embodiment, inversion is used. Therefore, 2 subtraction operations are used as the 2 feedback operations between rounds, instead of 2 addition operations. The function “inverseMixSubRound” rotates values to the right, instead of to the left, and replaces the addition operations of “mixSubRound” with subtraction.

[0115] As an example of the operation of the subround function during Stage 4, consider the first subround, using data blocks which have 4 data words each. This first subround invokes the inverse mixing function using the parameters (D, 3, 0, 1, 2), as shown above. The first operation of the inverse mixing function “inverseMixSubRound”, shown as the first line of “C” code, masks off all but the low-order 8 bits of D[3], by performing an AND operation where the two operands are D[3] and 255. Thus, the last byte of D[3] is isolated from the other bytes. The value in this byte is then used as the 8-bit index into S-box one. A 32-bit value is retrieved as a result of this index operation. That 32-bit value is exclusive OR'd with the 32-bit value in D[2]. The result of this exclusive OR operation becomes the new value of D[2]. The second operation of the inverse mixing function, shown as the second line of “C” code, uses the function IROTATE to rotate D[3] 8 positions to the right. The third operation of the inverse mixing function, shown as the third line of “C” code, uses this rotated D[3] and again masks off all but the low-order 8 bits. Because of the prior rotation, a different byte of D[3] is now isolated by this masking operation. That byte is used as an index into S-box zero. The 32-bit value retrieved is subtracted from the value of D[1], and the result becomes the new value of D[1]. In the fourth operation, D[3] is again rotated 8 positions to the right, so that the fifth operation will isolate a different byte. In the fifth operation, the low-order byte from D[3] is used to index into S-box one, and the value retrieved is subtracted from D[0], forming the new value for D[0]. In the sixth operation, D[3] is rotated a final time, so that the remaining unused byte rotates into the low-order 8 bits. The seventh operation isolates this byte, and uses it to index into S-box zero. The retrieved value is then exclusive OR'd with D[0], forming a new value for D[0]. Invocation of inverseMixSubRound is then complete, and control returns to the main processing routine of Stage 4.

[0116] The other three subrounds of processing in Stage 4 are analogous to the first, with two exceptions. First, the data words are passed as parameters in different orders in each subround, as indicated. Second, a subtraction operation is used as a feedback operation following the second and third invocations of inverseMixSubRound (as shown in the “C” code), but no such subtraction operation is used following the first or fourth invocations.

[0117] It will be obvious to one skilled in the art how to change the definition and invocation of inverseMixSubRound if blocks of different size, or data words of different size, are used. It will also be obvious that if the definition and invocation of mixSubRound is changed for Stage 2, as described above, then corresponding changes would be made to Stage 4. Refer to the prior discussion of changing mixSubRound for a discussion of possible changes that might be made.

[0118] The output of Stage 2 is used as the input to Stage 3, as shown in FIG. 3; similarly, the input to Stage 4 is the output of Stage 3.

[0119] The mixing operations of Stages 2 and 4 increase resistance of the cipher output to differential attacks. Since subkeys are not used in these stages, the processing within each stage is very fast.

[0120] Stage 3 consists of r2 rounds of a keyed Type-1 Feistel. In the preferred embodiment, r2=16, and the round functions are based on data-dependent rotations. Because data-dependent rotation may be susceptible to differential attack, a higher number of rounds of processing is needed to guarantee a strong encryption result. For efficiency on common processors, the same data word is always used to specify the amount of the rotation, with Type-1 structure provided by adding one of the other data words into this rotation value word for each subround. Using the same data word to specify the rotation value enables an implementation to be optimized, in that a single, predefined register always contains the rotation value. Adding another data word into this value allows the amount of rotation to change, providing more randomness, without the performance penalty associated with multiple sources for rotation values.

[0121] In accordance with the approach used for a Type-1 Feistel, d subrounds of processing are performed during each round, where d is the number of words in the data block.

[0122] The structure used for Stage 3 is diagramed in FIGS. 6A and 6B, and can be specified by the following “C” code:

[0123] As will be understood by one skilled in the art, this “C” language code specifies the processing for 2 rounds. The first set of statements is used for an even-numbered round, and corresponds to the flow diagram in FIG. 6A. The second set of statements is used for an odd-numbered round, and corresponds to the flow diagram in FIG. 6B.

[0124] The processing for an even-numbered round begins with a subround that performs an exclusive OR operation, where the two operands are the data words D[1] and D[2]. The result becomes the new value of D[1]. Next, D[1] is rotated 7 positions to the left. A subkey from the expanded key array is added to this rotated value, forming yet another new value for D[1]. A different subkey is used in each subround processed during Stage 3. This is achieved by initializing the subkey index, n, to the value of the variable d when encryption begins, and incrementing the value of this index each time it is used. (The subkey index begins at d in Stage 3 because the subkeys preceding d in the expanded key array were previously used in Stage 1 of encryption. If the subkey selection process of Stage 1 is changed, the index calculation of this Stage 3 does not necessarily need to change. If it is desired to used a different key for each subround, then the value used for n will need to change to align with the values used in Stage 1, using the appropriate mathematical equation that will be obvious to one of ordinary skill in the art. If subkeys may be re-used, then the value used for n does not need to change from being initialized to the value of d, and incrementing for each subround.)

[0125] In the second subround, the new value of D[1] is then exclusive OR'd with D[0], forming a new value for D[0]. The data word in D[3] is then added to D[1], replacing the existing value of D[1]. This new value of D[1] is used as the next rotation value, where the word to be rotated this time is D[0]. After the rotation, the next subkey is added to the rotated value, with the result used as a new value for D[0]. Since the value of D[3] was added to D[1] to generate the rotation value used when rotating D[0], D[3] is affecting the word in D[0] according to the approach of a Feistel Type-1. However, it can be seen that when a rotation value in Stage 3 is data-dependent, that data is always located in D[1]. This allows the software or hardware implementing the present invention to operate more efficiently, by referring to a single source (the location where D[1] is stored) to determine the rotation value. This approach provides a significant advantage over existing symmetric block Feistel ciphers which perform data-dependent rotation, which refer to multiple sources for the rotation values and thereby suffer poor performance on processors having a limited number of registers.

[0126] The third and fourth subrounds for the even-numbered rounds are similar. In the third subround, D[0] is exclusive OR'd with D[3], forming a new D[3]. Next, D[2] is added to D[1], so that D[2] can be used as the next value to impact the data-dependent rotation. D[3] is the word to be rotated in this subround. After the rotation, a word from the expanded key array is added to D[3]. In the fourth subround, D[3] is exclusive OR'd with D[2]. D[0] is then added to D[1], so that D[0] will also impact data-dependent rotation. D[2] is the final word to be rotated, after which a word from the expanded key array is added to the D[2] value.

[0127] By the end of this even-numbered round, all of the data words have been rotated, the value of each data word has impacted a rotation operation, each data word has been exclusive OR'd with another data word, and each data word has a new value.

[0128] For an odd-numbered round, the processing is similar to that just described for even rounds. The only difference is the order in which the different data words are used by the operations, as shown by the “C” language statements.

[0129] As stated earlier, a different approach to subkey selection may be used within the operations of this stage without deviating from the inventive concepts of this invention. For example, instead of incrementing the subkey index by one for each usage (in the statements invoking the ROTATE function), the amount of increment could be some different number, such as even numbers in sequence, or odd numbers in sequence, etc. Corresponding changes must then be made to the Stage 3 decryption subkey selection computations.

[0130] Decryption is simply the reverse of encryption, running the same operations in the reverse order, reversing the addition and subtraction operations. Referring to the diagrams in FIGS. 3-6, the decryption process corresponds to using the operations shown in the diagrams, with these changes: (1) the order of the stages is reversed; (2) the operations are processed from the bottom of the diagrams towards the top; (3) each addition or subtraction operation is replaced by a subtraction or addition operation, respectively; and (4) each rotation operation rotates to the right instead of to the left. This process will now be described in detail, using “C” language statements to describe the preferred embodiment.

[0131] The preferred embodiment of the decryption phase is described using five stages, to correspond to the preferred embodiment on the encryption phase which was described using five stages. It will be understood by one skilled in the art that any changes made to the preferred embodiment of the encryption phase (according to the alternatives discussed herein, for example changing the block size) must be reflected by corresponding changes to the decryption phase. Note that the stage numbering used to describe the decryption phase uses numbers 1 through 5, in that order (where the decryption stages 1 through 5 correspond to encryption stages 5 though 1, in descending order).

[0132] Decryption Stages 1 and 5 of the preferred embodiment consist of simply subtracting one subkey word from each of the data words, which in “C” code can be specified as:

[0133] As will be understood by one skilled in the art, the result of the “C” code for stage 1 is to iterate d times, where d is the number of words in each block, using an iteration counter, j. The d iterations together comprise the single round of Stage 1 processing of the preferred embodiment. Each word D[0] through D[d−1] from the data block has the corresponding word E[d*(r2+1)] through E[(d*(r2+1))+d−1] from the expanded key array subtracted from it. The result of this subtraction is then used as the new value of the data block word D[0] through D[d−1]. When 4-word blocks are used, the last 4 subkeys (elements E[n−3] through E[n]) are used each time the Stage 1 process is performed.

[0134] The result of the “C” code for stage 5 is also to iterate d times, using an iteration counter j. These d iterations comprise the single round of Stage 5 processing of the preferred embodiment. Each word D[0] through D[d−1] from the data block has the corresponding word E[0] through E[d−1] from the expanded key array subtracted from it. The result of this subtraction is then used as the new value of the data block word D[0] through D[d−1]. When 4-word blocks are used, the first 4 subkeys (elements E[0] through E[3]) are used each time the Stage 5 process is performed.

[0135] The new data block created by operation of Stage 1 becomes the input to Stage 2. The input to Stage 5 comes from the output of Stage 4, and the output of Stage 5 is used as the resulting plaintext block for the block of data being decrypted.

[0136] Stages 2 and 4 are identical to Stages 2 and 4 of encryption. Stage 2 decryption uses mixing, with addition and left rotation. This corresponds to the inverse of Encryption Stage 4. Stage 4 decryption uses inverse mixing, with subtraction and right rotation. This corresponds to the inverse of Encryption Stage 2. Again, each of these stages uses r1 rounds of inverse mixing. In the preferred embodiment, r1=2. Each full round consists d subrounds, where each subround uses a different data word as source.

[0137] Refer to the description of Encryption Stages 2 and 4, above, for “C” language statements showing a specification that can be used for Decryption Stages 2 and 4, respectively, and for a detailed description of the operation of the stages.

[0138] As stated previously, the diagram shown in FIG. 4 for encryption Stage 2 can be used to illustrate decryption, for decryption Stage 4, by reading the diagram from the bottom up, changing addition to subtraction, and changing left rotation to right rotation. Similarly, the diagram shown in FIG. 5 for encryption Stage 4 can be used to illustrate decryption Stage 2, by making similar changes as for FIG. 4.

[0139] The output of Stage 2 is used as the input to Stage 3, as shown in FIG. 3; similarly, the input to Stage 4 is the output of Stage 3.

[0140] Decryption Stage 3 consists of r2 rounds of a keyed Type-1 Feistel, based on data-dependent rotations. In the preferred embodiment, r2=16. For efficiency on common processors, the same data word is always used to specify the amount of the rotation, as previously described for encryption. Subtracting another data word from this value allows the amount of rotation to change, providing more randomness, without the performance penalty associated with multiple sources for rotation values.

[0141] In accordance with the approach used for a Type-1 Feistel, d subrounds of processing are performed during each round, where d is the number of words in the data block.

[0142] The structure used for Decryption Stage 3 can be specified by the following “C” code:

[0143] As will be understood by one skilled in the art, this “C” language code specifies the processing for 2 rounds. The first set of statements is used for an even-numbered round, and the second set of statements is used for an odd-numbered round. As previously indicated, these statements correspond to the diagrams shown for encryption in FIGS. 6B and 6A, respectively, if those diagrams are read from the bottom up, addition is changed to subtraction, and left rotation is changed to right rotation.

[0144] The stage begins by first initializing the subkey index, to point to the last subkey from a group of 8 subkeys that were used during encryption for one iteration through the Stage 3 processing. Then processing for an even-numbered round of decryption begins, and that subkey value is subtracted from D[3]. The subkey index is decremented. Then, D[3] is rotated to the right, where the amount of rotation is determined using the value in D[1]. Next, the value of D[0] is subtracted from D[1]. Finally, this subround performs an exclusive OR operation, where the two operands are the data words D[2] and D[3]. The result becomes the new value of D[3].

[0145] In the second subround, the next-preceding subkey (that is, the one indexed by the previously-decremented value) is subtracted from D[2], and the index is again decremented The new value of D[2] is then rotated to the right, with the amount of rotation again specified by the value in D[1]. The value in D[3] is then subtracted from D[1]. Finally, D[0] is exclusive OR'd with D[2], forming a new value for D[2].

[0146] The third and fourth subrounds for the even-numbered rounds are similar. In the third subround, the next preceding subkey is subtracted from D[0]; D[0] is rotated to the right by the amount indicated by D[1]; D[2] is subtracted from D[1]; and D[1] is exclusive OR'd with D[0], forming a new D[0]. In the fourth subround, the next preceding subkey is subtracted from D[1]; D[1] is rotated 7 positions to the right; and D[3] is exclusive OR'd with D[1], forming a new value for D[1].

[0147] By the end of this even-numbered round, all of the data words have been rotated, the value of each data word has impacted a rotation operation, each data word has been exclusive OR'd with another data word, and each data word has a new value.

[0148] For an odd-numbered round, the processing is similar to that just described for even rounds. The only difference is the order in which the different data words are used by the operations, as shown by the “C” language statements.

[0149] While the preferred embodiment of the present invention has been described, additional variations and modifications in that embodiment may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims shall be construed to include both the preferred embodiment and all such variations and modifications as fall within the spirit and scope of the invention.