CIPHERUNICORN-A and -E are symmetric ciphers. They belong to the CIPHERUNICORN family developed by NEC Corporation.

"CIPHERUNICORN" is a registered trademark of NEC Corporation in Japan.

Abstract

CIPHERUNICORN-E is common key encryption technology with a Feistel structure using a data block length of 64 bits and a key length of 128 bits. 

Two typical methods used for attacking common key encryption are linear cryptanalysis and differential cryptanalysis. These methods use shuffling bias in the data randomizer function to infer information on a key. Shuffling bias often originates in the base shuffling process. A structure in which shuffling bias cannot be detected in the base process is therefore desirable. In CIPHERUNICORN-E, the base process in data shuffling is the round function, and it has been confirmed by a cipher-strength evaluation system that we have developed that this function exhibits no shuffling bias.

Y.Tsunoo, H.Kubo, H.Miyauchi and K.Nakamura, "A Secure Cipher Evaluated by Statistical Methods, " SCIS'98-4.2.B, The 1998 Symposium on Cryptography and Information Security Hamanako, Japan, January 28-31, 1998, The Institute of Electronics, Information and Communication Engineers, 1998. (In Japanese)

Design Principle and Criteria

Two methods that have been found to be effective in mounting attacks on block ciphers of any structure are linear cryptanalysis and differential cryptanalysis. These methods use shuffling bias in the data randomizer function to infer information on a key. Shuffling bias often originates in the base shuffling process. A structure in which shuffling bias cannot be detected in the base process is therefore desirable.

Against the above background, we decided to design CIPHERUNICORN-E so that shuffling bias does not appear in the round function, the base process of data shuffling. This was evaluated by statistically investigating the relationship between input and output.

In addition, to perform a uniform evaluation of encryption algorithms in the design process, we established a common evaluation scale in examining input and output with the encryption algorithm treated as a black box. We specified, in particular, the following items as constituting a state with no bias and sufficient shuffling, and we checked for this state using a statistical technique that we adopted for this purpose.

Data randomizer

1.Feistel structure

The Feistel structure has been adopted as the base structure of this cipher because of the following advantages. 

2.Initial, final, and intermediate processing

To prevent input to the 1st round function and input to the last round function from becoming known and making an attack easy to mount, and to defend against an attack of unknown type, 64-bit-wide functions are added before the first round and after the last round and to every two rounds.

Round function

1.Dual structure

The round function adopts a dual structure that guarantees the security of one part of the structure if the other should be cracked. It consists of a main stream section and temporary key generation mechanism that input extended keys (function key and seed key, respectively). A temporary key is created by the temporary key generation mechanism and combined with the main stream. 

2.Main stream

The structure of the main stream has the following properties. 

3.Temporary key generation mechanism

The structure of the temporary key generation mechanism has the following properties. 

4.Operators

Considering a 32-bit processor to be the basic form of implementation for this cipher, we have adopted operators that can be processed at high speed on this kind of platform. We have also combined operations having different algebraic structures with the aim of making the cipher stronger 

5.Operation units

As a countermeasure to truncated differential attack, two types of operation units are used: 8 and 32 bits.

Substitution tables

Four 8-bit input/output tables are used as a set of substitution tables. Each of these 8-bit input/output tables must satisfy the following conditions. 

The method adopted here to generate a substitution table that satisfies the above conditions is to use an inverse function over a Galois field (GF) of 28 in combination with an affine transformation.

An inverse function over a GF (2⁸) is a bijective function with an algebraic degree of 7 known to have a maximum linear and differential probability of 2^-6 (best case). The degree of its input/output polynomials is also high at 254. By incorporating an affine transformation, the number of terms in the input /output polynomials can be expected to increase.

In order to use a combination of four 8-bit input/output tables, moreover, a different irreducible polynomial was adopted for each table.

The following equation is used to generate a substitution table.

S(x) ＝ matrixA{ (x ＋ c)-1 mod g } ＋ d

matrixA ： GF(2) 8 x 8 bijective matrix
c,d ： 8-bit constants (other than 0)
g ： 8th-degree irreducible polynomial

After selecting matrixA, c, d, and g by random numbers, a search is made for a substitution table that satisfies the above conditions. 

Key scheduler

The structure of the key scheduler has the following properties.