Internet Draft S. Kiyomoto Intended status: Informational W. Shin Expires: October 2011 KDDI R&D Laboratories, Inc. April 8, 2011 A Description of KCipher-2 Encryption Algorithm draft-kiyomoto-kcipher2-01.txt Abstract This document describes the KCipher-2 encryption algorithm. KCipher-2 is a stream cipher with a 128-bit key and a 128-bit initialization vector. Since the algorithm for KCipher-2 was published in 2007, security and efficiency have been rigorously evaluated through academic and industrial studies. No security vulnerability has been found as of the time this document was written. KCipher-2 offers fast encryption and decryption by means of simple operations that enable efficient implementation. KCipher-2 has been used for industrial applications, especially for mobile health monitoring and diagnostic services in Japan. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. This document may not be modified, and derivative works of it may not be created, and it may not be published except as an Internet-Draft. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on October 8, 2011. Copyright Notice Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved. Kiyomoto & Shin Expires October 8, 2011 [Page 1] Internet-Draft KCipher-2 Stream Cipher April 2011 This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction...................................................3 2. Algorithm Description..........................................4 2.1. Notations.................................................4 2.2. Internal State............................................4 2.2.1. Feedback Shift Registers.............................4 2.2.2. Internal registers...................................5 2.3. Operations................................................5 2.3.1. The Next operation...................................5 2.3.2. Init.................................................7 2.3.3. Stream...............................................8 2.4. Subroutines...............................................8 2.4.1. NLF..................................................8 2.4.2. SubK2................................................8 2.4.3. S-Box................................................9 2.4.4. Multiplications in GF(2^32).........................10 2.5. Encryption/Decryption scheme.............................11 2.5.1. Key stream generation...............................11 2.5.2. Encryption/Decryption of a message..................11 3. Security Considerations.......................................12 4. References....................................................12 4.1. Normative References.....................................12 4.2. Informative References...................................12 Appendix A. Tables for multiplication in GF(2^32)................13 A.1. The table amul0..........................................13 A.2. The table amul1..........................................14 A.3. The table amul2..........................................16 A.4. The table amul3..........................................17 Appendix B. Test Vectors.........................................19 Appendix A....................................................19 Appendix B....................................................19 B.1. Key stream generation examples...........................19 B.2. Another key stream generation with the state values......20 B.2.1. S after Init(1).....................................20 B.2.2. S after Init(2).....................................20 Kiyomoto & Shin Expires October 8, 2011 [Page 2] Internet-Draft KCipher-2 Stream Cipher April 2011 B.2.3. S after Init(3).....................................21 B.2.4. S after Init(4).....................................21 B.2.5. S after Init(5).....................................21 B.2.6. S after Init(6).....................................21 B.2.7. S after Init(7).....................................22 B.2.8. S after Init(8).....................................22 B.2.9. S after Init(9).....................................22 B.2.10. S after Init(10)...................................22 B.2.11. S after Init(11)...................................23 B.2.12. S after Next(12)...................................23 B.2.13. S after Init(13)...................................23 B.2.14. S after Init(14)...................................23 B.2.15. S after Init(15)...................................24 B.2.16. S after Init(16)...................................24 B.2.17. S after Init(17)...................................24 B.2.18. S after Init(18)...................................24 B.2.19. S after Init(19)...................................25 B.2.20. S after Init(20)...................................25 B.2.21. S after Init(21)...................................25 B.2.22. S after Init(22)...................................25 B.2.23. S after Init(23)...................................26 B.2.24. S(0) after Init(24)................................26 B.2.25. S(1) and the key stream at S(1)....................26 B.2.26. S(2) and the key stream at S(2)....................27 1. Introduction KCipher-2 is a stream cipher that uses 128-bit secret key and a 128- bit initialization vector. Since the algorithm for KCipher-2 was published in 2007 [SASC07], it has received attention from academia and industries. The security and performance of KCipher-2 have been rigorously evaluated by the developers and other institutions [SECRYPT07], [ICETE07], [CRYPTEC], [KDDI]. No attack has been found on KCipher-2 as of this date. KCipher-2 can be efficiently implemented in software to provide fast encryption and decryption, owing to the uncomplicated design. Only four simple operations are used: exclusive-OR, addition, shift, and table lookup. When the algorithm is implemented in hardware, internal computations can be parallel aiming for greater efficiency. Moreover, since its internal state representation only amounts to several hundreds of bits, KCipher-2 is suitable for resource-limited environments. KCipher-2 has been actively used in several industrial applications in Japan and has been submitted to an international standardization body (ISO/IEC 18033) [ISO18033] and evaluated to be a Japanese e- Government recommended cipher [CRYPTECLIST]. Kiyomoto & Shin Expires October 8, 2011 [Page 3] Internet-Draft KCipher-2 Stream Cipher April 2011 2. Algorithm Description In this section, we will describe the internal components of KCipher- 2 and define the operations for deriving key streams from an input key and an initialization vector. 2.1. Notations All values in this document are stored in big-endian order (a. k. a., network byte order). We use the following notations in the description of KCipher-2. XOR Bitwise exclusive OR ^ Power operator +n Integer addition modulo 2^n <>n Right circular rotation by n bits 0x Hexadecimal representation E[i] The (i + 1)th element of E when E is composed of consecutive multiple elements. GF Galois field. GF(2^x) means the finite field of exactly 2^n elements. ** Multiplication of elements on the finite field GF(2^32) 2.2. Internal State The internal state of KCipher-2 can be denoted by S. The internal state consists of its six sub-components: two feedback shift registers, FSR-A and FSR-B, and four internal registers, L1, R1, L2, and R2. We, therefore, often write S = (A, B, L1, R1, L2, R2), where A and B respectively refer FSR-A and FSR-B. 2.2.1. Feedback Shift Registers The two feedback shift registers (FSR) are separately called Feedback Shift Register A (FSR-A) and Feedback Shift Register B (FSR-B). FSR-A is composed of five 32-bit units that are consecutively arranged. Each of the units can be identified by A[0], A[1], A[2], A[3], and A[4]. Likewise, FSR-B is composed of eleven consecutive 32-bit units, Kiyomoto & Shin Expires October 8, 2011 [Page 4] Internet-Draft KCipher-2 Stream Cipher April 2011 B[0], ..., B[10]. All values stored in each 32-bit unit of FSR is in GF(2^32). 2.2.2. Internal registers Besides FSR, KCipher-2 has four internal registers to store intermediate computation results during operation. The four registers are named L1, R1, L2, and R2. 2.3. Operations There are three major operations that constitute the behavior of KCipher-2: Init, Next, and Stream. The Init operation initializes the internal values of the system. The Next operation derives new values of S' from the values of S, where S' and S refer the internal state. The Stream operation derives a key stream from the current state S. 2.3.1. The Next operation The Next operation takes the current state input S = (A, B, L1, R1, L2, R2) as input. The size of the input amounts to twenty of the 32- bit units in total (five units for A, eleven for B, and one for L1, R1, L2, and R2). It produces the next state S' = (A', B', L1', R1', L2', R2'). This operation is mainly used to generate secure key streams by applying non-linear functions for every cycle of KCipher-2. Besides, it is also used to initialize the system. The behaviors are distinguished by the input parameter that indicates the operation modes. The operation takes the following inputs: o S = (A, B, L1, R1, L2, R2) o mode = {INIT, NORMAL}, where INIT means the operation is used for initialization and NORMAL means it is used for generating secure key streams. It outputs a new state, o S' = (A', B', L1', R1', L2', R2') by performing the below steps: 1. Set registers in the nonlinear functions set L1' = SubK2(R2 +32 B[4]); R1' = SubK2(L2 +32 B[9]); Kiyomoto & Shin Expires October 8, 2011 [Page 5] Internet-Draft KCipher-2 Stream Cipher April 2011 R2' = SubK2(R1); L2' = SubK2(L1); for m from 0 to 3 A'[m] = A[m + 1]; for m from 0 to 9 B'[m] = B[m + 1]; * NOTE: SubK2 is a substitution function described in Section 2.4.2. 2. Depending on the value of the operation mode, do the following: a. When the mode is INIT, do as follows: A'[4] = (a0 ** A[0]) XOR A[3] XOR NLF(B[0], R2, R1, A[4]); if A[2][30] is 1: B'[10] = (a1 ** B[0]) XOR B[1] XOR B[6] XOR ((a3 ^ A[2][31]) ** B[8]) XOR NLF(B[10], L2, L1, A[0]); else if A[2][30] is 0: B'[10] = (a2 ** B[0]) XOR B[1] XOR B[6] XOR ((a3 ^ A[2][31]) ** B[8]) XOR NLF(B[10], L2, L1, A[0]); * NOTE: The function NLF is described in Section 2.4.1. b. When the mode is NORMAL, NLF is not used, as follows: A'4 = (a0 ** A[0]) XOR A[3]; if A[2][30] is 1: B'[10] = (a1 ** B[0]) XOR B[1] XOR B[6] XOR ((a3 ^ A[2][31]) ** B[8]); else if A[2][30] is 0: B'[10] = (a2 ** B[0]) XOR B[1] XOR B[6] XOR ((a3 ^ A[2][31]) ** B[8]); * Note that A[2] is a 32-bit unit. Thus, A[2][j] is the value of the jth least significant bit of A[2], where 0 <= j <= 31. * Note that the operation ** to elements a0, a1, a2, and a3 are described in Section 2.4.4. 3. Output S' = (A', B', L1', R1', L2', R2'). Kiyomoto & Shin Expires October 8, 2011 [Page 6] Internet-Draft KCipher-2 Stream Cipher April 2011 2.3.2. Init The Init operation takes a 128-bit key (K) and a 128-bit initialization vector (IV), and prepares the values of the state variables for generating key streams. o K = (K[0], K[1], K[2], K[3]), where each K[i] is a 32-bit unit and 0 <= i <= 3 o IV =(IV[0], IV[1], IV[2], IV[3]), where each IV[i] is a 32-bit unit and 0 <= i <= 3, and the output is an initialized state S, which will be referenced as S(0). The output is derived from the following steps: 1. K is expanded to the 384-bit internal key IK = (IK[0], ..., IK[11]), where IK[i] is a 32-bit unit and 0 <= i <= 11. The expansion procedure is as follows: for m from 0 to 11 if m is 0, 1, 2, or 3: IK[m] = K[m]; else if m is 5, 6, 7, 9, 10, or 11: IK[m] = IK[m - 4] XOR IK[m - 1]; else if m is 4: IK[4] = IK[0] XOR SubK2((IK[3] <<32 8) XOR (IK[3] >>32 24)) XOR (0x01, 0x00, 0x00, 0x00); else if m is 8: IK[8] = IK[4] XOR SubK2((IK[7] <<32 8) XOR (IK[7] >>32 24)) XOR (0x02, 0x00, 0x00, 0x00); * NOTE: SubK2 is the substitution function described in Section 2.4.2. 2. Initialize the feedback shift registers and the internal registers using the values of IK and IV as follows: for m from 0 to 4 A[m] = IK[4 - m]; B[0] = IK[10]; B[1] = IK[11]; B[2] = IV[0]; B[3] = IV[1]; B[4] = IK[8]; B[5] = IK[9]; B[6] = IV[2]; B[7] = IV[3]; B[8] = IK[7]; B[9] = IK[5]; B[10] = IK[6]; L1 = R1 = L2 = R2 = 0x00000000; Kiyomoto & Shin Expires October 8, 2011 [Page 7] Internet-Draft KCipher-2 Stream Cipher April 2011 Set S as (A, B, L1, R1, L2, R2). 3. Prepare the state values by applying the Next operation twenty- four times repeatedly as follows: for m from 1 to 24 Set S' as Next(S, INIT); Set S as S'; 4. Output S. 2.3.3. Stream The Stream function derives a 64-bit key stream, Z, from the state values. Its input is an initialized state, o S = (A, B, L1, R1, L2, R2) , and its output is Z = (ZH, ZL), where ZH and ZL are 32-bit units. Stream performs the following: 1. Set register values ZH = NLF(B[10], L2, L1, A[0]); ZL = NLF(B[0], R2, R1, A[4]); 2. Output Z = (ZH, ZL). * NOTE: The function NLF is described in Section 2.4.1. 2.4. Subroutines We explain the several functions used above: SubK2, NLF, and S-Box. 2.4.1. NLF NLF is a non-linear function that takes the four 32-bit values, A, B, C, D, and outputs the 32-bit value, Q. The output Q is calculated by Q = (A +32 B) XOR C XOR D; 2.4.2. SubK2 SubK2 is a substitution function, which is a permutation of GF(2^32), based on components from the Advanced Encryption Standard(AES) [FIPS- AES]. Its input is a 32-bit value divided into four 8-bit strings. Inside SubK2, an 8-to-8 bit substitution function, S-Box, is applied Kiyomoto & Shin Expires October 8, 2011 [Page 8] Internet-Draft KCipher-2 Stream Cipher April 2011 to each 8-bit separately, and then a 32-to-32 bit linear permutation is applied to the whole 32-bit string. Our S-Box function is identical to the S-Box operation of AES, and our linear permutation is identical to the AES Mix Column operation. Consider the input of SubK2 as a 32-bit value W = (w[3], w[2], w[1], w[0]), where each sub-element of w is an 8-bit unit. Prepare two 32- bit temporary storages T = (t[3], t[2], t[1], t[0]) and Q = (q[3], q[2], q[1], q[0]), where t[i] and q[i] are 8-bit units and 0 <= i <= 3. The 32-bit output Q is obtained from the following procedures: 1. Apply S-Box to each 8-bit input string. Note that S-Box will be defined in Section 2.4.3. for m from 0 to 3 t[m] = S-Box(w[m]); 2. Calculate q by the matrix multiplication, Q = M * T in GF(2^8) of the irreducible polynomial f(x) = x^8 + x^4 + x^3 + x + 1, where o Q is an 1 by 4 matrix, (q[0], q[1], q[2], q[3)) o M is a 4 by 4 matrix, (02, 03, 01, 01, 01, 02, 03, 01, 01, 01, 02, 03, 03, 01, 01, 02) o T is an 1 by 4 matrix, (t[0], t[1], t[2], t[3]). Namely, Q can be calculated like as follows: q[0] = 2 * t[0] + 3 * t[1] + t[2] + t[3]; q[1] = t[0] + 2 * t[1] + 3 * t[2] + t[3]; q[2] = t[0] + t[1] + 2 * t[2] + 3 * t[3]; q[3] = 3 * t[0] + t[1] + t[2] + 2 * t[3]; 3. Output Q = (q[3], q[2], q[1], q[0]). 2.4.3. S-Box S-Box is a substitution that can be done by a simple table lookup operation. Thus, S-Box can be defined by the following value table: Kiyomoto & Shin Expires October 8, 2011 [Page 9] Internet-Draft KCipher-2 Stream Cipher April 2011 S-Box[256] = { 0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76, 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0, 0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15, 0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75, 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84, 0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf, 0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8, 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2, 0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73, 0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb, 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79, 0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08, 0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a, 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e, 0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf, 0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16 }; 2.4.4. Multiplications in GF(2^32) In the Init operation, 32-bit values are multiplied to a0, a1, a2, or a3 in GF(2^32). The multiplication can be simply done with the table look-up operation when the tables described in Appendix A are used. For example, consider the input as a 32-bit value w, which represents an element of GF(2^32), the output 32-bit string w' = a0 ** w can be obtained by w' = (w <<32 8) XOR amul0[w >>32 24]; The amul0 table is defined in Appendix A.1. Kiyomoto & Shin Expires October 8, 2011 [Page 10] Internet-Draft KCipher-2 Stream Cipher April 2011 Likewise, multiplications of (a1 ** w), (a2 ** w), and (a3 ** w) can be obtained using the same procedure. The only difference is that each of the multiplications uses different tables, amul1, amul2, and amul3, and these tables are shown in Appendix A.2, A.3, and A.4, respectively. 2.5. Encryption/Decryption scheme In this section, we use the notation S(i) to specifically reference the values of the internal state at an arbitrary, discrete temporal moment (a.k.a., a cycle) i (i >= 0) after the initialization. 2.5.1. Key stream generation Given a 128-bit key K, a 128-bit initialization vector IV, KCipher-2 is initialized as follows: S(0) = Init(K, IV); , where S(0) is a state representation. With an initialized state S(i), where i >= 0, a 64-bit key stream X(i) can be obtained using the Stream operation, as follows: X(i) = Stream(S(i)); To generate a new key stream X(i + 1), use the Next operation and the Stream operation as follows: S(i + 1) = Next(S(i), NORMAL); X(i + 1) = Stream(S(i + 1)); 2.5.2. Encryption/Decryption of a message Given a 64-bit message block M and a key stream X, an encrypted message E is obtained by E = M XOR X; Conversely, the decrypted message D is obtained by D = E XOR X; The original message M and the decrypted message D are identical when the same key stream is used. Kiyomoto & Shin Expires October 8, 2011 [Page 11] Internet-Draft KCipher-2 Stream Cipher April 2011 3. Security Considerations We recommend that re-initializing and re-keying after 2^58 cycles of KCipher-2, which means after generating 2^64 key stream bits. 4. References 4.1. Normative References [ISO18033] "Information technology - Security techniques - Encryption algorithms - Part 4: Stream ciphers", ISO/IEC 18033-4, 2011. [FIPS-AES] "Specification for the Advanced Encryption Standard (AES)", Federal Information Processing Standard (FIPS) Publication 197, November 2001. 4.2. Informative References [SASC07] S. Kiyomoto, T. Tanaka, and K. Sakurai, "A Word-Oriented Stream Cipher Using Clock Control", Proc. SASC 2007 pp. 260-274. [SECRYPT07] S. Kiyomoto, T. Tanaka, and K. Sakurai, "K2: A Stream Cipher Algorithm Using Dynamic Feedback Control", Proc. SECRYPT 2007 pp. 204-213. [ICETE07] S. Kiyomoto, T. Tanaka, and K. Sakurai, "K2 Stream Cipher", Proc. ICETE 2007 pp. 214-226. [CRYPTEC] A. Bogdanov, B. Preneel, and V. Rijmen, "Security Evaluation of the K2 Stream Cipher", 2010. http://www.cryptrec.go.jp/english/estimation.html [CRYPTECLIST] Cryptography Research and Evaluation Committees. http://www.cryptrec.go.jp/english/estimation.html [KDDI] B. Roy, "Evaluation of the Word-Oriented Stream Cipher: K2", 2009. http://www.kddilabs.jp/kcipher2/kcipher2.htm Kiyomoto & Shin Expires October 8, 2011 [Page 12] Internet-Draft KCipher-2 Stream Cipher April 2011 Appendix A. Tables for multiplication in GF(2^32) A.1. The table amul0 amul0[256] = { 0x00000000,0xB6086D1A,0xAF10DA34,0x1918B72E, 0x9D207768,0x2B281A72,0x3230AD5C,0x8438C046, 0xF940EED0,0x4F4883CA,0x565034E4,0xE05859FE, 0x646099B8,0xD268F4A2,0xCB70438C,0x7D782E96, 0x31801F63,0x87887279,0x9E90C557,0x2898A84D, 0xACA0680B,0x1AA80511,0x03B0B23F,0xB5B8DF25, 0xC8C0F1B3,0x7EC89CA9,0x67D02B87,0xD1D8469D, 0x55E086DB,0xE3E8EBC1,0xFAF05CEF,0x4CF831F5, 0x62C33EC6,0xD4CB53DC,0xCDD3E4F2,0x7BDB89E8, 0xFFE349AE,0x49EB24B4,0x50F3939A,0xE6FBFE80, 0x9B83D016,0x2D8BBD0C,0x34930A22,0x829B6738, 0x06A3A77E,0xB0ABCA64,0xA9B37D4A,0x1FBB1050, 0x534321A5,0xE54B4CBF,0xFC53FB91,0x4A5B968B, 0xCE6356CD,0x786B3BD7,0x61738CF9,0xD77BE1E3, 0xAA03CF75,0x1C0BA26F,0x05131541,0xB31B785B, 0x3723B81D,0x812BD507,0x98336229,0x2E3B0F33, 0xC4457C4F,0x724D1155,0x6B55A67B,0xDD5DCB61, 0x59650B27,0xEF6D663D,0xF675D113,0x407DBC09, 0x3D05929F,0x8B0DFF85,0x921548AB,0x241D25B1, 0xA025E5F7,0x162D88ED,0x0F353FC3,0xB93D52D9, 0xF5C5632C,0x43CD0E36,0x5AD5B918,0xECDDD402, 0x68E51444,0xDEED795E,0xC7F5CE70,0x71FDA36A, 0x0C858DFC,0xBA8DE0E6,0xA39557C8,0x159D3AD2, 0x91A5FA94,0x27AD978E,0x3EB520A0,0x88BD4DBA, 0xA6864289,0x108E2F93,0x099698BD,0xBF9EF5A7, 0x3BA635E1,0x8DAE58FB,0x94B6EFD5,0x22BE82CF, 0x5FC6AC59,0xE9CEC143,0xF0D6766D,0x46DE1B77, 0xC2E6DB31,0x74EEB62B,0x6DF60105,0xDBFE6C1F, 0x97065DEA,0x210E30F0,0x381687DE,0x8E1EEAC4, 0x0A262A82,0xBC2E4798,0xA536F0B6,0x133E9DAC, 0x6E46B33A,0xD84EDE20,0xC156690E,0x775E0414, 0xF366C452,0x456EA948,0x5C761E66,0xEA7E737C, 0x4B8AF89E,0xFD829584,0xE49A22AA,0x52924FB0, 0xD6AA8FF6,0x60A2E2EC,0x79BA55C2,0xCFB238D8, 0xB2CA164E,0x04C27B54,0x1DDACC7A,0xABD2A160, 0x2FEA6126,0x99E20C3C,0x80FABB12,0x36F2D608, 0x7A0AE7FD,0xCC028AE7,0xD51A3DC9,0x631250D3, 0xE72A9095,0x5122FD8F,0x483A4AA1,0xFE3227BB, 0x834A092D,0x35426437,0x2C5AD319,0x9A52BE03, 0x1E6A7E45,0xA862135F,0xB17AA471,0x0772C96B, 0x2949C658,0x9F41AB42,0x86591C6C,0x30517176, 0xB469B130,0x0261DC2A,0x1B796B04,0xAD71061E, Kiyomoto & Shin Expires October 8, 2011 [Page 13] Internet-Draft KCipher-2 Stream Cipher April 2011 0xD0092888,0x66014592,0x7F19F2BC,0xC9119FA6, 0x4D295FE0,0xFB2132FA,0xE23985D4,0x5431E8CE, 0x18C9D93B,0xAEC1B421,0xB7D9030F,0x01D16E15, 0x85E9AE53,0x33E1C349,0x2AF97467,0x9CF1197D, 0xE18937EB,0x57815AF1,0x4E99EDDF,0xF89180C5, 0x7CA94083,0xCAA12D99,0xD3B99AB7,0x65B1F7AD, 0x8FCF84D1,0x39C7E9CB,0x20DF5EE5,0x96D733FF, 0x12EFF3B9,0xA4E79EA3,0xBDFF298D,0x0BF74497, 0x768F6A01,0xC087071B,0xD99FB035,0x6F97DD2F, 0xEBAF1D69,0x5DA77073,0x44BFC75D,0xF2B7AA47, 0xBE4F9BB2,0x0847F6A8,0x115F4186,0xA7572C9C, 0x236FECDA,0x956781C0,0x8C7F36EE,0x3A775BF4, 0x470F7562,0xF1071878,0xE81FAF56,0x5E17C24C, 0xDA2F020A,0x6C276F10,0x753FD83E,0xC337B524, 0xED0CBA17,0x5B04D70D,0x421C6023,0xF4140D39, 0x702CCD7F,0xC624A065,0xDF3C174B,0x69347A51, 0x144C54C7,0xA24439DD,0xBB5C8EF3,0x0D54E3E9, 0x896C23AF,0x3F644EB5,0x267CF99B,0x90749481, 0xDC8CA574,0x6A84C86E,0x739C7F40,0xC594125A, 0x41ACD21C,0xF7A4BF06,0xEEBC0828,0x58B46532, 0x25CC4BA4,0x93C426BE,0x8ADC9190,0x3CD4FC8A, 0xB8EC3CCC,0x0EE451D6,0x17FCE6F8,0xA1F48BE2 }; A.2. The table amul1 amul1[256] = { 0x00000000,0xA0F5FC2E,0x6DC7D55C,0xCD322972, 0xDAA387B8,0x7A567B96,0xB76452E4,0x1791AECA, 0x996B235D,0x399EDF73,0xF4ACF601,0x54590A2F, 0x43C8A4E5,0xE33D58CB,0x2E0F71B9,0x8EFA8D97, 0x1FD646BA,0xBF23BA94,0x721193E6,0xD2E46FC8, 0xC575C102,0x65803D2C,0xA8B2145E,0x0847E870, 0x86BD65E7,0x264899C9,0xEB7AB0BB,0x4B8F4C95, 0x5C1EE25F,0xFCEB1E71,0x31D93703,0x912CCB2D, 0x3E818C59,0x9E747077,0x53465905,0xF3B3A52B, 0xE4220BE1,0x44D7F7CF,0x89E5DEBD,0x29102293, 0xA7EAAF04,0x071F532A,0xCA2D7A58,0x6AD88676, 0x7D4928BC,0xDDBCD492,0x108EFDE0,0xB07B01CE, 0x2157CAE3,0x81A236CD,0x4C901FBF,0xEC65E391, 0xFBF44D5B,0x5B01B175,0x96339807,0x36C66429, 0xB83CE9BE,0x18C91590,0xD5FB3CE2,0x750EC0CC, 0x629F6E06,0xC26A9228,0x0F58BB5A,0xAFAD4774, 0x7C2F35B2,0xDCDAC99C,0x11E8E0EE,0xB11D1CC0, 0xA68CB20A,0x06794E24,0xCB4B6756,0x6BBE9B78, 0xE54416EF,0x45B1EAC1,0x8883C3B3,0x28763F9D, 0x3FE79157,0x9F126D79,0x5220440B,0xF2D5B825, 0x63F97308,0xC30C8F26,0x0E3EA654,0xAECB5A7A, Kiyomoto & Shin Expires October 8, 2011 [Page 14] Internet-Draft KCipher-2 Stream Cipher April 2011 0xB95AF4B0,0x19AF089E,0xD49D21EC,0x7468DDC2, 0xFA925055,0x5A67AC7B,0x97558509,0x37A07927, 0x2031D7ED,0x80C42BC3,0x4DF602B1,0xED03FE9F, 0x42AEB9EB,0xE25B45C5,0x2F696CB7,0x8F9C9099, 0x980D3E53,0x38F8C27D,0xF5CAEB0F,0x553F1721, 0xDBC59AB6,0x7B306698,0xB6024FEA,0x16F7B3C4, 0x01661D0E,0xA193E120,0x6CA1C852,0xCC54347C, 0x5D78FF51,0xFD8D037F,0x30BF2A0D,0x904AD623, 0x87DB78E9,0x272E84C7,0xEA1CADB5,0x4AE9519B, 0xC413DC0C,0x64E62022,0xA9D40950,0x0921F57E, 0x1EB05BB4,0xBE45A79A,0x73778EE8,0xD38272C6, 0xF85E6A49,0x58AB9667,0x9599BF15,0x356C433B, 0x22FDEDF1,0x820811DF,0x4F3A38AD,0xEFCFC483, 0x61354914,0xC1C0B53A,0x0CF29C48,0xAC076066, 0xBB96CEAC,0x1B633282,0xD6511BF0,0x76A4E7DE, 0xE7882CF3,0x477DD0DD,0x8A4FF9AF,0x2ABA0581, 0x3D2BAB4B,0x9DDE5765,0x50EC7E17,0xF0198239, 0x7EE30FAE,0xDE16F380,0x1324DAF2,0xB3D126DC, 0xA4408816,0x04B57438,0xC9875D4A,0x6972A164, 0xC6DFE610,0x662A1A3E,0xAB18334C,0x0BEDCF62, 0x1C7C61A8,0xBC899D86,0x71BBB4F4,0xD14E48DA, 0x5FB4C54D,0xFF413963,0x32731011,0x9286EC3F, 0x851742F5,0x25E2BEDB,0xE8D097A9,0x48256B87, 0xD909A0AA,0x79FC5C84,0xB4CE75F6,0x143B89D8, 0x03AA2712,0xA35FDB3C,0x6E6DF24E,0xCE980E60, 0x406283F7,0xE0977FD9,0x2DA556AB,0x8D50AA85, 0x9AC1044F,0x3A34F861,0xF706D113,0x57F32D3D, 0x84715FFB,0x2484A3D5,0xE9B68AA7,0x49437689, 0x5ED2D843,0xFE27246D,0x33150D1F,0x93E0F131, 0x1D1A7CA6,0xBDEF8088,0x70DDA9FA,0xD02855D4, 0xC7B9FB1E,0x674C0730,0xAA7E2E42,0x0A8BD26C, 0x9BA71941,0x3B52E56F,0xF660CC1D,0x56953033, 0x41049EF9,0xE1F162D7,0x2CC34BA5,0x8C36B78B, 0x02CC3A1C,0xA239C632,0x6F0BEF40,0xCFFE136E, 0xD86FBDA4,0x789A418A,0xB5A868F8,0x155D94D6, 0xBAF0D3A2,0x1A052F8C,0xD73706FE,0x77C2FAD0, 0x6053541A,0xC0A6A834,0x0D948146,0xAD617D68, 0x239BF0FF,0x836E0CD1,0x4E5C25A3,0xEEA9D98D, 0xF9387747,0x59CD8B69,0x94FFA21B,0x340A5E35, 0xA5269518,0x05D36936,0xC8E14044,0x6814BC6A, 0x7F8512A0,0xDF70EE8E,0x1242C7FC,0xB2B73BD2, 0x3C4DB645,0x9CB84A6B,0x518A6319,0xF17F9F37, 0xE6EE31FD,0x461BCDD3,0x8B29E4A1,0x2BDC188F }; Kiyomoto & Shin Expires October 8, 2011 [Page 15] Internet-Draft KCipher-2 Stream Cipher April 2011 A.3. The table amul2 amul2[256] = { 0x00000000,0x5BF87F93,0xB6BDFE6B,0xED4581F8, 0x2137B1D6,0x7ACFCE45,0x978A4FBD,0xCC72302E, 0x426E2FE1,0x19965072,0xF4D3D18A,0xAF2BAE19, 0x63599E37,0x38A1E1A4,0xD5E4605C,0x8E1C1FCF, 0x84DC5E8F,0xDF24211C,0x3261A0E4,0x6999DF77, 0xA5EBEF59,0xFE1390CA,0x13561132,0x48AE6EA1, 0xC6B2716E,0x9D4A0EFD,0x700F8F05,0x2BF7F096, 0xE785C0B8,0xBC7DBF2B,0x51383ED3,0x0AC04140, 0x45F5BC53,0x1E0DC3C0,0xF3484238,0xA8B03DAB, 0x64C20D85,0x3F3A7216,0xD27FF3EE,0x89878C7D, 0x079B93B2,0x5C63EC21,0xB1266DD9,0xEADE124A, 0x26AC2264,0x7D545DF7,0x9011DC0F,0xCBE9A39C, 0xC129E2DC,0x9AD19D4F,0x77941CB7,0x2C6C6324, 0xE01E530A,0xBBE62C99,0x56A3AD61,0x0D5BD2F2, 0x8347CD3D,0xD8BFB2AE,0x35FA3356,0x6E024CC5, 0xA2707CEB,0xF9880378,0x14CD8280,0x4F35FD13, 0x8AA735A6,0xD15F4A35,0x3C1ACBCD,0x67E2B45E, 0xAB908470,0xF068FBE3,0x1D2D7A1B,0x46D50588, 0xC8C91A47,0x933165D4,0x7E74E42C,0x258C9BBF, 0xE9FEAB91,0xB206D402,0x5F4355FA,0x04BB2A69, 0x0E7B6B29,0x558314BA,0xB8C69542,0xE33EEAD1, 0x2F4CDAFF,0x74B4A56C,0x99F12494,0xC2095B07, 0x4C1544C8,0x17ED3B5B,0xFAA8BAA3,0xA150C530, 0x6D22F51E,0x36DA8A8D,0xDB9F0B75,0x806774E6, 0xCF5289F5,0x94AAF666,0x79EF779E,0x2217080D, 0xEE653823,0xB59D47B0,0x58D8C648,0x0320B9DB, 0x8D3CA614,0xD6C4D987,0x3B81587F,0x607927EC, 0xAC0B17C2,0xF7F36851,0x1AB6E9A9,0x414E963A, 0x4B8ED77A,0x1076A8E9,0xFD332911,0xA6CB5682, 0x6AB966AC,0x3141193F,0xDC0498C7,0x87FCE754, 0x09E0F89B,0x52188708,0xBF5D06F0,0xE4A57963, 0x28D7494D,0x732F36DE,0x9E6AB726,0xC592C8B5, 0x59036A01,0x02FB1592,0xEFBE946A,0xB446EBF9, 0x7834DBD7,0x23CCA444,0xCE8925BC,0x95715A2F, 0x1B6D45E0,0x40953A73,0xADD0BB8B,0xF628C418, 0x3A5AF436,0x61A28BA5,0x8CE70A5D,0xD71F75CE, 0xDDDF348E,0x86274B1D,0x6B62CAE5,0x309AB576, 0xFCE88558,0xA710FACB,0x4A557B33,0x11AD04A0, 0x9FB11B6F,0xC44964FC,0x290CE504,0x72F49A97, 0xBE86AAB9,0xE57ED52A,0x083B54D2,0x53C32B41, 0x1CF6D652,0x470EA9C1,0xAA4B2839,0xF1B357AA, 0x3DC16784,0x66391817,0x8B7C99EF,0xD084E67C, 0x5E98F9B3,0x05608620,0xE82507D8,0xB3DD784B, 0x7FAF4865,0x245737F6,0xC912B60E,0x92EAC99D, Kiyomoto & Shin Expires October 8, 2011 [Page 16] Internet-Draft KCipher-2 Stream Cipher April 2011 0x982A88DD,0xC3D2F74E,0x2E9776B6,0x756F0925, 0xB91D390B,0xE2E54698,0x0FA0C760,0x5458B8F3, 0xDA44A73C,0x81BCD8AF,0x6CF95957,0x370126C4, 0xFB7316EA,0xA08B6979,0x4DCEE881,0x16369712, 0xD3A45FA7,0x885C2034,0x6519A1CC,0x3EE1DE5F, 0xF293EE71,0xA96B91E2,0x442E101A,0x1FD66F89, 0x91CA7046,0xCA320FD5,0x27778E2D,0x7C8FF1BE, 0xB0FDC190,0xEB05BE03,0x06403FFB,0x5DB84068, 0x57780128,0x0C807EBB,0xE1C5FF43,0xBA3D80D0, 0x764FB0FE,0x2DB7CF6D,0xC0F24E95,0x9B0A3106, 0x15162EC9,0x4EEE515A,0xA3ABD0A2,0xF853AF31, 0x34219F1F,0x6FD9E08C,0x829C6174,0xD9641EE7, 0x9651E3F4,0xCDA99C67,0x20EC1D9F,0x7B14620C, 0xB7665222,0xEC9E2DB1,0x01DBAC49,0x5A23D3DA, 0xD43FCC15,0x8FC7B386,0x6282327E,0x397A4DED, 0xF5087DC3,0xAEF00250,0x43B583A8,0x184DFC3B, 0x128DBD7B,0x4975C2E8,0xA4304310,0xFFC83C83, 0x33BA0CAD,0x6842733E,0x8507F2C6,0xDEFF8D55, 0x50E3929A,0x0B1BED09,0xE65E6CF1,0xBDA61362, 0x71D4234C,0x2A2C5CDF,0xC769DD27,0x9C91A2B4 }; A.4. The table amul3 amul3[256] = { 0x00000000,0x4559568B,0x8AB2AC73,0xCFEBFAF8, 0x71013DE6,0x34586B6D,0xFBB39195,0xBEEAC71E, 0xE2027AA9,0xA75B2C22,0x68B0D6DA,0x2DE98051, 0x9303474F,0xD65A11C4,0x19B1EB3C,0x5CE8BDB7, 0xA104F437,0xE45DA2BC,0x2BB65844,0x6EEF0ECF, 0xD005C9D1,0x955C9F5A,0x5AB765A2,0x1FEE3329, 0x43068E9E,0x065FD815,0xC9B422ED,0x8CED7466, 0x3207B378,0x775EE5F3,0xB8B51F0B,0xFDEC4980, 0x27088D6E,0x6251DBE5,0xADBA211D,0xE8E37796, 0x5609B088,0x1350E603,0xDCBB1CFB,0x99E24A70, 0xC50AF7C7,0x8053A14C,0x4FB85BB4,0x0AE10D3F, 0xB40BCA21,0xF1529CAA,0x3EB96652,0x7BE030D9, 0x860C7959,0xC3552FD2,0x0CBED52A,0x49E783A1, 0xF70D44BF,0xB2541234,0x7DBFE8CC,0x38E6BE47, 0x640E03F0,0x2157557B,0xEEBCAF83,0xABE5F908, 0x150F3E16,0x5056689D,0x9FBD9265,0xDAE4C4EE, 0x4E107FDC,0x0B492957,0xC4A2D3AF,0x81FB8524, 0x3F11423A,0x7A4814B1,0xB5A3EE49,0xF0FAB8C2, 0xAC120575,0xE94B53FE,0x26A0A906,0x63F9FF8D, 0xDD133893,0x984A6E18,0x57A194E0,0x12F8C26B, 0xEF148BEB,0xAA4DDD60,0x65A62798,0x20FF7113, 0x9E15B60D,0xDB4CE086,0x14A71A7E,0x51FE4CF5, 0x0D16F142,0x484FA7C9,0x87A45D31,0xC2FD0BBA, Kiyomoto & Shin Expires October 8, 2011 [Page 17] Internet-Draft KCipher-2 Stream Cipher April 2011 0x7C17CCA4,0x394E9A2F,0xF6A560D7,0xB3FC365C, 0x6918F2B2,0x2C41A439,0xE3AA5EC1,0xA6F3084A, 0x1819CF54,0x5D4099DF,0x92AB6327,0xD7F235AC, 0x8B1A881B,0xCE43DE90,0x01A82468,0x44F172E3, 0xFA1BB5FD,0xBF42E376,0x70A9198E,0x35F04F05, 0xC81C0685,0x8D45500E,0x42AEAAF6,0x07F7FC7D, 0xB91D3B63,0xFC446DE8,0x33AF9710,0x76F6C19B, 0x2A1E7C2C,0x6F472AA7,0xA0ACD05F,0xE5F586D4, 0x5B1F41CA,0x1E461741,0xD1ADEDB9,0x94F4BB32, 0x9C20FEDD,0xD979A856,0x169252AE,0x53CB0425, 0xED21C33B,0xA87895B0,0x67936F48,0x22CA39C3, 0x7E228474,0x3B7BD2FF,0xF4902807,0xB1C97E8C, 0x0F23B992,0x4A7AEF19,0x859115E1,0xC0C8436A, 0x3D240AEA,0x787D5C61,0xB796A699,0xF2CFF012, 0x4C25370C,0x097C6187,0xC6979B7F,0x83CECDF4, 0xDF267043,0x9A7F26C8,0x5594DC30,0x10CD8ABB, 0xAE274DA5,0xEB7E1B2E,0x2495E1D6,0x61CCB75D, 0xBB2873B3,0xFE712538,0x319ADFC0,0x74C3894B, 0xCA294E55,0x8F7018DE,0x409BE226,0x05C2B4AD, 0x592A091A,0x1C735F91,0xD398A569,0x96C1F3E2, 0x282B34FC,0x6D726277,0xA299988F,0xE7C0CE04, 0x1A2C8784,0x5F75D10F,0x909E2BF7,0xD5C77D7C, 0x6B2DBA62,0x2E74ECE9,0xE19F1611,0xA4C6409A, 0xF82EFD2D,0xBD77ABA6,0x729C515E,0x37C507D5, 0x892FC0CB,0xCC769640,0x039D6CB8,0x46C43A33, 0xD2308101,0x9769D78A,0x58822D72,0x1DDB7BF9, 0xA331BCE7,0xE668EA6C,0x29831094,0x6CDA461F, 0x3032FBA8,0x756BAD23,0xBA8057DB,0xFFD90150, 0x4133C64E,0x046A90C5,0xCB816A3D,0x8ED83CB6, 0x73347536,0x366D23BD,0xF986D945,0xBCDF8FCE, 0x023548D0,0x476C1E5B,0x8887E4A3,0xCDDEB228, 0x91360F9F,0xD46F5914,0x1B84A3EC,0x5EDDF567, 0xE0373279,0xA56E64F2,0x6A859E0A,0x2FDCC881, 0xF5380C6F,0xB0615AE4,0x7F8AA01C,0x3AD3F697, 0x84393189,0xC1606702,0x0E8B9DFA,0x4BD2CB71, 0x173A76C6,0x5263204D,0x9D88DAB5,0xD8D18C3E, 0x663B4B20,0x23621DAB,0xEC89E753,0xA9D0B1D8, 0x543CF858,0x1165AED3,0xDE8E542B,0x9BD702A0, 0x253DC5BE,0x60649335,0xAF8F69CD,0xEAD63F46, 0xB63E82F1,0xF367D47A,0x3C8C2E82,0x79D57809, 0xC73FBF17,0x8266E99C,0x4D8D1364,0x08D445EF }; Kiyomoto & Shin Expires October 8, 2011 [Page 18] Internet-Draft KCipher-2 Stream Cipher April 2011 Appendix B. Test Vectors This appendix provides running examples of KCipher-2. All values are written in hexadecimal form. B.1. Key stream generation examples The followings demonstrate series of the 64-bit key streams generated from given 128-bit keys (K) and 128-bit initialization vectors (IV). - K : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - IV: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - Generated key streams at S(i) are as follows; S(0): F8 71 EB EF 94 5B 72 72 S(1): E4 0C 04 94 1D FF 05 37 S(2): 0B 98 1A 59 FB C8 AC 57 S(3): 56 6D 3B 02 C1 79 DB B4 S(4): 3B 46 F1 F0 33 55 4C 72 S(5): 5D E6 8B CC 98 72 85 8F S(6): 57 54 96 02 40 62 F0 E9 S(7): F9 32 C9 98 22 6D B6 BA ... - K : A3 7B 7D 01 2F 89 70 76 FE 08 C2 2D 14 2B B2 CF - IV: 33 A6 EE 60 E5 79 27 E0 8B 45 CC 4C A3 0E DE 4A - Generated key streams at S(i) are as follows; S(0): 60 E9 A6 B6 7B 4C 25 24 S(1): FE 72 6D 44 AD 5B 40 2E S(2): 31 D0 D1 BA 5C A2 33 A4 S(3): AF C7 4B E7 D6 06 9D 36 S(4): 4A 75 BB 6C D8 D5 B7 F0 S(5): 38 AA AA 28 4A E4 CD 2F S(6): E2 E5 31 3D FC 6C CD 8F S(7): 9D 24 84 F2 0F 86 C5 0D ... - K : 3D 62 E9 B1 8E 5B 04 2F 42 DF 43 CC 71 75 C9 6E - IV: 77 7C EF E4 54 13 00 C8 AD CA CA 8A 0B 48 CD 55 - Generated key streams at S(i) are as follows; S(0): 69 0F 10 8D 84 F4 4A C7 S(1): BF 25 7B D7 E3 94 F6 C9 S(2): AA 11 92 C3 8E 20 0C 6E S(3): 07 3C 80 78 AC 18 AA D1 S(4): D4 B8 DA DE 68 80 23 68 S(5): 2F A4 20 76 83 DE A5 A4 S(6): 4C 1D 95 EA E9 59 F5 B4 Kiyomoto & Shin Expires October 8, 2011 [Page 19] Internet-Draft KCipher-2 Stream Cipher April 2011 S(7): 26 11 F4 1E A4 0F 0A 58 ... B.2. Another key stream generation with the state values In this section, the initialization procedure and the key stream generation are illustrated in detail. The given 128-bit key (K) and the 128-bit initialization vector (IV) are as follows: - K : 0F 1E 2D 3C 4B 5A 69 78 87 96 A5 B4 C3 D2 E1 F0 - IV: F0 E0 D0 C0 B0 A0 90 80 70 60 50 40 30 20 10 00. Based on K and IV, the Init operation, in Section 2.3.2, sets up the internal state values, S = (A, B, L1, R1, L2, R2), as follows: A[0]: 0F 1E 2D 3C A[1]: 4B 5A 69 78 A[2]: 87 96 A5 B4 A[3]: C3 D2 E1 F0 A[4]: 79 93 A6 A2 B[0]: B5 5F 6A 6E B[1] : 32 C9 CF DA B[2]: 76 8D 8B 9E B[3]: 30 20 10 00 B[4] : 70 60 50 40 B[5]: 8D F4 5D 75 B[6]: BF 3D 92 AF B[7] : B0 A0 90 80 B[8]: F0 E0 D0 C0 B[9]: 4E 26 BC 85 B[10]: 38 AB 37 1B L1: 00 00 00 00 R1: 00 00 00 00 L2: 00 00 00 00 R2: 00 00 00 00 To complete the initialization, the Next operation is repeatedly applied to the state values for 24 times (in Section 2.3.2, Step 3). Let us denote each of the repeated application of the Next operation by Init(i), where 1 <= i <= 24. The internal state values resulting from each Init(i) are shown in Section B.2.1 - B.2.24. B.2.1. S after Init(1) A[0]: 37 07 0F 7F A[1]: 0F 1E 2D 3C A[2] : 4B 5A 69 78 A[3]: 87 96 A5 B4 A[4]: C3 D2 E1 F0 B[0]: 64 DE FF 24 B[1] : B5 5F 6A 6E B[2]: 32 C9 CF DA B[3]: 76 8D 8B 9E B[4] : 30 20 10 00 B[5]: 70 60 50 40 B[6]: 8D F4 5D 75 B[7] : BF 3D 92 AF B[8]: B0 A0 90 80 B[9]: F0 E0 D0 C0 B[10]: 4E 26 BC 85 L1: F3 60 86 0C R1: E8 19 07 D5 L2: 63 63 63 63 R2: 63 63 63 63 B.2.2. S after Init(2) A[0]: 25 BC F9 81 A[1]: 37 07 0F 7F A[2]: 0F 1E 2D 3C A[3]: 4B 5A 69 78 A[4]: 87 96 A5 B4 Kiyomoto & Shin Expires October 8, 2011 [Page 20] Internet-Draft KCipher-2 Stream Cipher April 2011 B[0]: 7E 65 CB 6A B[1] : 64 DE FF 24 B[2]: B5 5F 6A 6E B[3]: 32 C9 CF DA B[4] : 76 8D 8B 9E B[5]: 30 20 10 00 B[6]: 70 60 50 40 B[7] : 8D F4 5D 75 B[8]: BF 3D 92 AF B[9]: B0 A0 90 80 B[10]: F0 E0 D0 C0 L1: 1B 95 42 ED R1: 9B 25 9D 28 L2: 39 C3 6E 1D R2: 97 16 10 F6 B.2.3. S after Init(3) A[0]: FA 2D D9 D3 A[1]: 25 BC F9 81 A[2]: 37 07 0F 7F A[3]: 0F 1E 2D 3C A[4]: 4B 5A 69 78 B[0]: 08 57 37 32 B[1] : 7E 65 CB 6A B[2]: 64 DE FF 24 B[3]: B5 5F 6A 6E B[4] : 32 C9 CF DA B[5]: 76 8D 8B 9E B[6]: 30 20 10 00 B[7] : 70 60 50 40 B[8]: 8D F4 5D 75 B[9]: BF 3D 92 AF B[10]: B0 A0 90 80 L1: 1F 41 CD FB R1: CF AE 13 F3 L2: BC C7 DC 5B R2: 15 28 DD A1 B.2.4. S after Init(4) A[0]: AB 82 00 31 A[1]: FA 2D D9 D3 A[2]: 25 BC F9 81 A[3]: 37 07 0F 7F A[4]: 0F 1E 2D 3C B[0]: 40 94 1D 82 B[1] : 08 57 37 32 B[2]: 7E 65 CB 6A B[3]: 64 DE FF 24 B[4] : B5 5F 6A 6E B[5]: 32 C9 CF DA B[6]: 76 8D 8B 9E B[7] : 30 20 10 00 B[8]: 70 60 50 40 B[9]: 8D F4 5D 75 B[10]: BF 3D 92 AF L1: 8D 71 00 A7 R1: AA 6C 8F 89 L2: B4 F4 30 81 R2: 81 26 4A F3 B.2.5. S after Init(5) A[0]: D8 F5 99 5F A[1]: AB 82 00 31 A[2]: FA 2D D9 D3 A[3]: 25 BC F9 81 A[4]: 37 07 0F 7F B[0]: 1A 8D A7 FB B[1] : 40 94 1D 82 B[2]: 08 57 37 32 B[3]: 7E 65 CB 6A B[4] : 64 DE FF 24 B[5]: B5 5F 6A 6E B[6]: 32 C9 CF DA B[7] : 76 8D 8B 9E B[8]: 30 20 10 00 B[9]: 70 60 50 40 B[10]: 8D F4 5D 75 L1: D3 15 A9 1D R1: 75 1B C8 87 L2: 9E 85 39 E3 R2: 92 9B 1D 3C B.2.6. S after Init(6) A[0]: F6 97 B5 BB A[1]: D8 F5 99 5F A[2]: AB 82 00 31 A[3]: FA 2D D9 D3 A[4]: 25 BC F9 81 Kiyomoto & Shin Expires October 8, 2011 [Page 21] Internet-Draft KCipher-2 Stream Cipher April 2011 B[0]: 13 B5 E7 F3 B[1] : 1A 8D A7 FB B[2]: 40 94 1D 82 B[3]: 08 57 37 32 B[4] : 7E 65 CB 6A B[5]: 64 DE FF 24 B[6]: B5 5F 6A 6E B[7] : 32 C9 CF DA B[8]: 76 8D 8B 9E B[9]: 30 20 10 00 B[10]: 70 60 50 40 L1: 88 65 8E 94 R1: 7F 1C 02 3D L2: B1 6F 94 02 R2: 5F 06 AB 3F B.2.7. S after Init(7) A[0]: 6B 0A 70 12 A[1]: F6 97 B5 BB A[2]: D8 F5 99 5F A[3]: AB 82 00 31 A[4]: FA 2D D9 D3 B[0]: D7 6A BD 2C B[1] : 13 B5 E7 F3 B[2]: 1A 8D A7 FB B[3]: 40 94 1D 82 B[4] : 08 57 37 32 B[5]: 7E 65 CB 6A B[6]: 64 DE FF 24 B[7] : B5 5F 6A 6E B[8]: 32 C9 CF DA B[9]: 76 8D 8B 9E B[10]: 30 20 10 00 L1: 21 BF 88 13 R1: 74 3F 68 DE L2: A1 F6 03 E6 R2: 3D 1E A4 99 B.2.8. S after Init(8) A[0]: 23 99 5B 7E A[1]: 6B 0A 70 12 A[2]: F6 97 B5 BB A[3]: D8 F5 99 5F A[4]: AB 82 00 31 B[0]: 99 7C 3F 70 B[1] : D7 6A BD 2C B[2]: 13 B5 E7 F3 B[3]: 1A 8D A7 FB B[4] : 40 94 1D 82 B[5]: 08 57 37 32 B[6]: 7E 65 CB 6A B[7] : 64 DE FF 24 B[8]: B5 5F 6A 6E B[9]: 32 C9 CF DA B[10]: 76 8D 8B 9E L1: B4 8E A0 8C R1: 65 7C 8F FD L2: AA B5 0B 58 R2: 28 1F 9A 12 B.2.9. S after Init(9) A[0]: F8 53 2F 87 A[1]: 23 99 5B 7E A[2]: 6B 0A 70 12 A[3]: F6 97 B5 BB A[4]: D8 F5 99 5F B[0]: 95 FF F6 57 B[1] : 99 7C 3F 70 B[2]: D7 6A BD 2C B[3]: 13 B5 E7 F3 B[4] : 1A 8D A7 FB B[5]: 40 94 1D 82 B[6]: 08 57 37 32 B[7] : 7E 65 CB 6A B[8]: 64 DE FF 24 B[9]: B5 5F 6A 6E B[10]: 32 C9 CF DA L1: A2 04 0C 44 R1: EF 19 DC 4E L2: 54 3A 19 67 R2: 05 D0 CF 60 B.2.10. S after Init(10) A[0]: BE DF 1D EF A[1]: F8 53 2F 87 A[2]: 23 99 5B 7E A[3]: 6B 0A 70 12 A[4]: F6 97 B5 BB Kiyomoto & Shin Expires October 8, 2011 [Page 22] Internet-Draft KCipher-2 Stream Cipher April 2011 B[0]: 6D 2C 2F A3 B[1] : 95 FF F6 57 B[2]: 99 7C 3F 70 B[3]: D7 6A BD 2C B[4] : 13 B5 E7 F3 B[5]: 1A 8D A7 FB B[6]: 40 94 1D 82 B[7] : 08 57 37 32 B[8]: 7E 65 CB 6A B[9]: 64 DE FF 24 B[10]: B5 5F 6A 6E L1: C7 AE 66 B0 R1: 9C 07 5D B9 L2: 55 54 CB E7 R2: 86 60 80 C4 B.2.11. S after Init(11) A[0]: 98 3D 37 CB A[1] : BE DF 1D EF A[2]: F8 53 2F 87 A[3]: 23 99 5B 7E A[4] : 6B 0A 70 12 B[0]: A0 21 27 BE B[1] : 6D 2C 2F A3 B[2]: 95 FF F6 57 B[3]: 99 7C 3F 70 B[4] : D7 6A BD 2C B[5]: 13 B5 E7 F3 B[6]: 1A 8D A7 FB B[7] : 40 94 1D 82 B[8]: 08 57 37 32 B[9]: 7E 65 CB 6A B[10]: 64 DE FF 24 L1: 29 F3 22 A2 R1: 01 F7 71 D9 L2: 72 56 70 A2 R2: D4 F2 44 63 B.2.12. S after Next(12) A[0]: 52 6A 11 0D A[1] : 98 3D 37 CB A[2]: BE DF 1D EF A[3]: F8 53 2F 87 A[4] : 23 99 5B 7E B[0]: 49 F9 90 42 B[1] : A0 21 27 BE B[2]: 6D 2C 2F A3 B[3]: 95 FF F6 57 B[4] : 99 7C 3F 70 B[5]: D7 6A BD 2C B[6]: 13 B5 E7 F3 B[7] : 1A 8D A7 FB B[8]: 40 94 1D 82 B[9]: 08 57 37 32 B[10]: 7E 65 CB 6A L1: 51 53 6D F4 R1: 66 11 1E 6A L2: 81 47 B5 72 R2: 6C C2 AC 80 B.2.13. S after Init(13) A[0]: A5 EE B8 AE A[1] : 52 6A 11 0D A[2]: 98 3D 37 CB A[3]: BE DF 1D EF A[4] : F8 53 2F 87 B[0]: 40 6C E6 2C B[1] : 49 F9 90 42 B[2]: A0 21 27 BE B[3]: 6D 2C 2F A3 B[4] : 95 FF F6 57 B[5]: 99 7C 3F 70 B[6]: D7 6A BD 2C B[7] : 13 B5 E7 F3 B[8]: 1A 8D A7 FB B[9]: 40 94 1D 82 B[10]: 08 57 37 32 L1: 95 82 D9 12 R1: 69 53 AF E8 L2: B2 2A 3A 1D R2: 90 3A 48 23 B.2.14. S after Init(14) A[0]: 70 A5 B5 BA A[1]: A5 EE B8 AE A[2]: 52 6A 11 0D A[3]: 98 3D 37 CB A[4]: BE DF 1D EF Kiyomoto & Shin Expires October 8, 2011 [Page 23] Internet-Draft KCipher-2 Stream Cipher April 2011 B[0]: C5 7B ED 5B B[1] : 40 6C E6 2C B[2]: 49 F9 90 42 B[3]: A0 21 27 BE B[4] : 6D 2C 2F A3 B[5]: 95 FF F6 57 B[6]: 99 7C 3F 70 B[7] : D7 6A BD 2C B[8]: 13 B5 E7 F3 B[9]: 1A 8D A7 FB B[10]: 40 94 1D 82 L1: EB 77 DD 2D R1: 63 3C FD 8F L2: 32 A4 BC EF R2: CB 33 BC B2 B.2.15. S after Init(15) A[0]: B1 14 5F 18 A[1]: 70 A5 B5 BA A[2]: A5 EE B8 AE A[3]: 52 6A 11 0D A[4]: 98 3D 37 CB B[0]: 7B E2 C5 20 B[1] : C5 7B ED 5B B[2]: 40 6C E6 2C B[3]: 49 F9 90 42 B[4] : A0 21 27 BE B[5]: 6D 2C 2F A3 B[6]: 95 FF F6 57 B[7] : 99 7C 3F 70 B[8]: D7 6A BD 2C B[9]: 13 B5 E7 F3 B[10]: 1A 8D A7 FB L1: E1 14 20 CC R1: 67 30 A9 56 L2: 8E C8 AC EF R2: C7 FC 06 0A B.2.16. S after Init(16) A[0]: FA 75 2F DC A[1]: B1 14 5F 18 A[2]: 70 A5 B5 BA A[3]: A5 EE B8 AE A[4]: 52 6A 11 0D B[0]: 1F 48 82 9C B[1] : 7B E2 C5 20 B[2]: C5 7B ED 5B B[3]: 40 6C E6 2C B[4] : 49 F9 90 42 B[5]: A0 21 27 BE B[6]: 6D 2C 2F A3 B[7] : 95 FF F6 57 B[8]: 99 7C 3F 70 B[9]: D7 6A BD 2C B[10]: 13 B5 E7 F3 L1: 0D 95 C9 4D R1: 82 38 B0 5F L2: 7B 00 D3 56 R2: 0E FE 85 96 B.2.17. S after Init(17) A[0]: DB 29 19 0A A[1]: FA 75 2F DC A[2]: B1 14 5F 18 A[3]: 70 A5 B5 BA A[4]: A5 EE B8 AE B[0]: F9 5D D1 4F B[1] : 1F 48 82 9C B[2]: 7B E2 C5 20 B[3]: C5 7B ED 5B B[4] : 40 6C E6 2C B[5]: 49 F9 90 42 B[6]: A0 21 27 BE B[7] : 6D 2C 2F A3 B[8]: 95 FF F6 57 B[9]: 99 7C 3F 70 B[10]: D7 6A BD 2C L1: 26 26 87 B5 R1: 9B 9A C5 E9 L2: 7C 08 EB 5C R2: 8C 13 00 A3 B.2.18. S after Init(18) A[0]: 35 62 3C DA A[1]: DB 29 19 0A A[2]: FA 75 2F DC A[3]: B1 14 5F 18 A[4]: 70 A5 B5 BA Kiyomoto & Shin Expires October 8, 2011 [Page 24] Internet-Draft KCipher-2 Stream Cipher April 2011 B[0]: D9 39 E1 3E B[1] : F9 5D D1 4F B[2]: 1F 48 82 9C B[3]: 7B E2 C5 20 B[4] : C5 7B ED 5B B[5]: 40 6C E6 2C B[6]: 49 F9 90 42 B[7] : A0 21 27 BE B[8]: 6D 2C 2F A3 B[9]: 95 FF F6 57 B[10]: 99 7C 3F 70 L1: E4 78 DE F0 R1: 06 F8 45 03 L2: 71 35 0E 88 R2: 14 EF 8E 61 B.2.19. S after Init(19) A[0]: 74 6B 4A E8 A[1]: 35 62 3C DA A[2]: DB 29 19 0A A[3]: FA 75 2F DC A[4]: B1 14 5F 18 B[0]: 99 70 C9 80 B[1] : D9 39 E1 3E B[2]: F9 5D D1 4F B[3]: 1F 48 82 9C B[4] : 7B E2 C5 20 B[5]: C5 7B ED 5B B[6]: 40 6C E6 2C B[7] : 49 F9 90 42 B[8]: A0 21 27 BE B[9]: 6D 2C 2F A3 B[10]: 95 FF F6 57 L1: C2 AC 94 C4 R1: C7 08 FA E8 L2: FC 49 00 F1 R2: 7C 26 0B 6A B.2.20. S after Init(20) A[0]: 2E B9 21 3A A[1]: 74 6B 4A E8 A[2]: 35 62 3C DA A[3]: DB 29 19 0A A[4]: FA 75 2F DC B[0]: 3C 51 70 31 B[1] : 99 70 C9 80 B[2]: D9 39 E1 3E B[3]: F9 5D D1 4F B[4] : 1F 48 82 9C B[5]: 7B E2 C5 20 B[6]: C5 7B ED 5B B[7] : 40 6C E6 2C B[8]: 49 F9 90 42 B[9]: A0 21 27 BE B[10]: 6D 2C 2F A3 L1: 8F 00 7D E9 R1: B2 AE 08 89 L2: DD 68 D5 EA R2: 3C 87 57 AC B.2.21. S after Init(21) A[0]: BE 3C A9 84 A[1]: 2E B9 21 3A A[2]: 74 6B 4A E8 A[3]: 35 62 3C DA A[4]: DB 29 19 0A B[0]: D1 43 9B 63 B[1] : 3C 51 70 31 B[2]: 99 70 C9 80 B[3]: D9 39 E1 3E B[4] : F9 5D D1 4F B[5]: 1F 48 82 9C B[6]: 7B E2 C5 20 B[7] : C5 7B ED 5B B[8]: 40 6C E6 2C B[9]: 49 F9 90 42 B[10]: A0 21 27 BE L1: AF C4 E3 2F R1: 98 FB C8 7F L2: 58 B2 2D 36 R2: 48 1D C7 D6 B.2.22. S after Init(22) A[0]: 97 4E 67 19 A[1]: BE 3C A9 84 A[2]: 2E B9 21 3A A[3]: 74 6B 4A E8 A[4]: 35 62 3C DA Kiyomoto & Shin Expires October 8, 2011 [Page 25] Internet-Draft KCipher-2 Stream Cipher April 2011 B[0]: 93 34 E2 21 B[1] : D1 43 9B 63 B[2]: 3C 51 70 31 B[3]: 99 70 C9 80 B[4] : D9 39 E1 3E B[5]: F9 5D D1 4F B[6]: 1F 48 82 9C B[7] : 7B E2 C5 20 B[8]: C5 7B ED 5B B[9]: 40 6C E6 2C B[10]: 49 F9 90 42 L1: F9 C4 33 57 R1: E5 53 9E A2 L2: C0 B7 6A 7C R2: 06 EE 4E D5 B.2.23. S after Init(23) A[0] : 86 91 6E FF A[1] : 97 4E 67 19 A[2] : BE 3C A9 84 A[3] : 2E B9 21 3A A[4] : 74 6B 4A E8 B[0] : 50 EF 13 E7 B[1] : 93 34 E2 21 B[2] : D1 43 9B 63 B[3] : 3C 51 70 31 B[4] : 99 70 C9 80 B[5] : D9 39 E1 3E B[6] : F9 5D D1 4F B[7] : 1F 48 82 9C B[8] : 7B E2 C5 20 B[9] : C5 7B ED 5B B[10]: 40 6C E6 2C L1: 30 95 27 ED R1: C4 73 D8 14 L2: 1B 10 7B 6D R2: 01 80 D9 5D B.2.24. S(0) after Init(24) A[0]: F5 2D AC F9 A[1] : 86 91 6E FF A[2]: 97 4E 67 19 A[3]: BE 3C A9 84 A[4] : 2E B9 21 3A B[0]: E0 BD 9F 91 B[1] : 50 EF 13 E7 B[2]: 93 34 E2 21 B[3]: D1 43 9B 63 B[4] : 3C 51 70 31 B[5]: 99 70 C9 80 B[6]: D9 39 E1 3E B[7] : F9 5D D1 4F B[8]: 1F 48 82 9C B[9]: 7B E2 C5 20 B[10]: C5 7B ED 5B L1: 43 70 D8 E6 R1: DA BE D7 6C L2: 11 C1 AC CB R2: C3 BA AE DF Note that the result of Init(24) is also referred as S(0) (in Section 2.3.2). Since the state S(0), the Stream operation (in Section 2.3.3) can be applied and generate key streams. Key stream at S(0) : 9F B6 B5 80 A6 A5 E7 AF Henceforth, a new key stream can be produced by; 1) obtain a new state by applying the Next operation to the current state, and 2) generate a new key stream by applying the Stream operation to the new state. B.2.25. S(1) and the key stream at S(1) A[0]: 96 03 29 B5 A[1]: F5 2D AC F9 A[2]: 86 91 6E FF A[3]: 97 4E 67 19 A[4]: BE 3C A9 84 Kiyomoto & Shin Expires October 8, 2011 [Page 26] Internet-Draft KCipher-2 Stream Cipher April 2011 B[0]: 53 18 AE E1 B[1] : E0 BD 9F 91 B[2]: 50 EF 13 E7 B[3]: 93 34 E2 21 B[4] : D1 43 9B 63 B[5]: 3C 51 70 31 B[6]: 99 70 C9 80 B[7] : D9 39 E1 3E B[8]: F9 5D D1 4F B[9]: 1F 48 82 9C B[10]: 7B E2 C5 20 L1: 8F D8 60 92 R1: 4B BD C0 F6 L2: 8D 63 A5 EF R2: FE E0 F2 4B Key stream at S(1) : D1 98 9D C6 A7 7D 5E 28 B.2.26. S(2) and the key stream at S(2) A[0]: 1A 3D B2 4E A[1]: 96 03 29 B5 A[2]: F5 2D AC F9 A[3]: 86 91 6E FF A[4]: 97 4E 67 19 B[0]: C8 6C 2C 77 B[1] : 53 18 AE E1 B[2]: E0 BD 9F 91 B[3]: 50 EF 13 E7 B[4] : 93 34 E2 21 B[5]: D1 43 9B 63 B[6]: 3C 51 70 31 B[7] : 99 70 C9 80 B[8]: D9 39 E1 3E B[9]: F9 5D D1 4F B[10]: 1F 48 82 9C L1: 96 86 FE 8C R1: FA F8 92 51 L2: 86 C8 24 E7 R2: 7B C2 10 98 Key stream at S(2) : 4E FC C8 CB 7B CF B3 2B Authors' Addresses Shinsaku Kiyomoto KDDI R&D Laboratories, Inc. 2-1-15 Ohara, Fujimino-shi, Saitama 356-8502, Japan. Phone: +81-49-278-7885 Fax: +81-49-278-7510 Email: kiyomoto@kddilabs.jp Wook Shin KDDI R&D Laboratories, Inc. 2-1-15 Ohara, Fujimino-shi, Saitama 356-8502, Japan. Email: wookshin@kddilabs.jp Kiyomoto & Shin Expires October 8, 2011 [Page 27]