Network Working Group J. Lee
Internet Draft J. Lee
Intended status: Informational J. Kim
Expires: November 15, 2009 D. Kwon
C. Kim
NSRI
May 14, 2009
A Description of the ARIA Encryption Algorithm
draft-nsri-aria-00.txt
Status of this Memo
This Internet-Draft is submitted to IETF in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html
This Internet-Draft will expire on November 15, 2009.
Copyright Notice
Copyright (c) 2009 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents in effect on the date of
publication of this document (http://trustee.ietf.org/license-info).
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.
Lee, et al. Expires November 15, 2009 [Page 1]
Internet-Draft The ARIA Encryption Algorithm May 2009
Abstract
This document describes the ARIA encryption algorithm. ARIA is a 128-
bit block cipher with 128-, 192-, and 256-bit keys. The algorithm
consists of key scheduling part and data randomizing part.
1. Introduction
1.1. ARIA Overview
ARIA is a general-purpose block cipher algorithm developed by Korean
cryptographers in 2003. It is an iterated block cipher with 128-,
192-, and 256-bit keys and encrypts 128-bit blocks in 12, 14, and 16
rounds, depending on the key size. It is secure and suitable for most
software and hardware implementations on 32-bit and 8-bit processors.
It was established as a Korean standard block cipher algorithm in
2004 [ARIAKS] and has been widely used in Korea, especially for
government-to-public services. It was included in PKCS #11 in 2007
[ARIAPKCS].
2. Algorithm Description
The algorithm consists of key scheduling part and data randomizing
part.
2.1. Notations
The following notations are used in this document to describe the
algorithm.
^ bitwise XOR operation.
<<< left circular rotation.
>>> right circular rotation.
|| concatenation of bit strings.
0x hexadecimal representation
2.2. Key Scheduling Part
Let K denote a master key of 128, 192 or 256 bits. Given the master
key K, we first define 128-bit values KL and KR as follows.
KL || KR = K || 0 ... 0,
where the number of zeros is 128, 64 or 0, depending on the size of K.
Then, we define four 128-bit values W0, W1, W2 and W3 as the
Lee, et al. Expires November 15, 2009 [Page 2]
Internet-Draft The ARIA Encryption Algorithm May 2009
intermediate round values appearing in the encryption of KL || KR by
a 3-round 256-bit Feistel cipher.
W0 = KL,
W1 = FO(W0, CK1) ^ KR,
W2 = FE(W1, CK2) ^ W0,
W3 = FO(W2, CK3) ^ W1.
Here, FO and FE, respectively called odd and even round functions,
are defined in Section 2.4.1. CK1, CK2 and CK3 are 128-bit constants,
taking one of the following values.
C1 = 0x517cc1b727220a94fe13abe8fa9a6ee0
C2 = 0x6db14acc9e21c820ff28b1d5ef5de2b0
C3 = 0xdb92371d2126e9700324977504e8c90e
These values are obtained from the first 128*3 bits of the fractional
part of 1/PI, where PI is the circle ratio. Now the constants CK1,
CK2, and CK3 are defined by the following table.
Key size CK1 CK2 CK3
128 C1 C2 C3
192 C2 C3 C1
256 C3 C1 C2
For example, if the key size is 192 bits, CK1 = C2, CK2 = C3 and CK3
= C1.
Once W0, W1, W2 and W3 are determined, we compute encryption round
keys ek1,...,ek17 as follows.
ek1 = W0 ^(W1 >>> 19),
ek2 = W1 ^(W2 >>> 19),
ek3 = W2 ^(W3 >>> 19),
ek4 = (W0 >>> 19) ^ W3,
ek5 = W0 ^ (W1 >>> 31),
ek6 = W1 ^ (W2 >>> 31),
ek7 = W2 ^ (W3 >>> 31),
ek8 = (W0 >>> 31) ^ W3,
ek9 = W0 ^ (W1 <<< 61),
ek10 = W1 ^ (W2 <<< 61),
ek11 = W2 ^ (W3 <<< 61),
ek12 = (W0 <<< 61) ^ W3,
ek13 = W0 ^ (W1 <<< 31),
ek14 = W1 ^ (W2 <<< 31),
ek15 = W2 ^ (W3 <<< 31),
ek16 = (W0 <<< 31) ^ W3,
Lee, et al. Expires November 15, 2009 [Page 3]
Internet-Draft The ARIA Encryption Algorithm May 2009
ek17 = W0 ^ (W1 <<< 19).
The number of rounds depends on the size of the master key as follows.
Key size Number of Rounds
128 12
192 14
256 16
Due to an extra key addition layer in the last round, 12-, 14-, and
16-round algorithms require 13, 15, and 17 round keys, respectively.
Decryption round keys are derived from the encryption round keys.
dk1 = ek{n+1},
dk2 = A(ek{n}),
dk3 = A(ek{n-1}),
...,
dk{n}= A(ek2),
dk{n+1}= ek1.
Here, A and n denote the diffusion layer of ARIA and the number of
rounds, respectively. The diffusion layer A is defined in Section
2.4.3.
2.3 Data Randomizing Part
The data randomizing part of the ARIA algorithm consists of the
encryption and decryption processes. The encryption and decryption
processes use functions FO, FE, A, SL1, and SL2. These functions are
defined in Section 2.4.
2.3.1. Encryption Process
2.3.1.1. Encryption for 128-bit keys
Let P be a 128-bit plaintext and K be a 128-bit master key. Let
ek1,..., ek13 be the encryption round keys defined by K. Then the
ciphertext C is computed by the following algorithm.
P1 = FO(P , ek1 ); // Round 1
P2 = FE(P1 , ek2 ); // Round 2
P3 = FO(P2 , ek3 ); // Round 3
P4 = FE(P3 , ek4 ); // Round 4
P5 = FO(P4 , ek5 ); // Round 5
P6 = FE(P5 , ek6 ); // Round 6
P7 = FO(P6 , ek7 ); // Round 7
Lee, et al. Expires November 15, 2009 [Page 4]
Internet-Draft The ARIA Encryption Algorithm May 2009
P8 = FE(P7 , ek8 ); // Round 8
P9 = FO(P8 , ek9 ); // Round 9
P10 = FE(P9 , ek10); // Round 10
P11 = FO(P10, ek11); // Round 11
C = SL2(P11 ^ ek12) ^ ek13; // Round 12
2.3.1.2. Encryption for 192-bit keys
Let P be a 128-bit plaintext and K be a 192-bit master key. Let
ek1,..., ek15 be the encryption round keys defined by K. Then the
ciphertext C is computed by the following algorithm.
P1 = FO(P , ek1 ); // Round 1
P2 = FE(P1 , ek2 ); // Round 2
P3 = FO(P2 , ek3 ); // Round 3
P4 = FE(P3 , ek4 ); // Round 4
P5 = FO(P4 , ek5 ); // Round 5
P6 = FE(P5 , ek6 ); // Round 6
P7 = FO(P6 , ek7 ); // Round 7
P8 = FE(P7 , ek8 ); // Round 8
P9 = FO(P8 , ek9 ); // Round 9
P10 = FE(P9 , ek10); // Round 10
P11 = FO(P10, ek11); // Round 11
P12 = FE(P11, ek12); // Round 12
P13 = FO(P12, ek13); // Round 13
C = SL2(P13 ^ ek14) ^ ek15; // Round 14
2.3.1.3. Encryption for 256-bit keys
Let P be a 128-bit plaintext and K be a 256-bit master key. Let
ek1,..., ek17 be the encryption round keys defined by K. Then the
ciphertext C is computed by the following algorithm.
P1 = FO(P , ek1 ); // Round 1
P2 = FE(P1 , ek2 ); // Round 2
P3 = FO(P2 , ek3 ); // Round 3
P4 = FE(P3 , ek4 ); // Round 4
P5 = FO(P4 , ek5 ); // Round 5
P6 = FE(P5 , ek6 ); // Round 6
P7 = FO(P6 , ek7 ); // Round 7
P8 = FE(P7 , ek8 ); // Round 8
P9 = FO(P8 , ek9 ); // Round 9
P10= FE(P9 , ek10); // Round 10
P11= FO(P10, ek11); // Round 11
P12= FE(P11, ek12); // Round 12
P13= FO(P12, ek13); // Round 13
P14= FE(P13, ek14); // Round 14
Lee, et al. Expires November 15, 2009 [Page 5]
Internet-Draft The ARIA Encryption Algorithm May 2009
P15= FO(P14, ek15); // Round 15
C = SL2(P15 ^ ek16) ^ ek17; // Round 16
2.3.2 Decryption Process
The decryption process of ARIA is the same as the encryption process
except that encryption round keys are replaced by decryption round
keys. For example, encryption round keys ek1,..., ek13 of the 12-
round ARIA algorithm are replaced by decryption round keys dk1,...,
dk13, respectively.
2.4 Components of ARIA
2.4.1. Round Functions
There are two types of round functions for ARIA. One is called an odd
round function, and denoted FO. It takes as input a pair (D,RK) of
two 128-bit strings and outputs
FO(D,RK) = A(SL1(D ^ RK)).
The other is called an even round function, and denoted FE. It takes
as input a pair (D,RK) of two 128-bit strings and outputs
FE(D,RK) = A(SL2(D ^ RK)).
Functions SL1 and SL2, called substitution layers, are described in
Section 2.4.2. Function A, called a diffusion layer, is described in
Section 2.4.3.
2.4.2. Substitution Layers
ARIA has two types of substitution layers which alternate between
rounds. Type 1 is used in the odd rounds, and type 2 in the even
rounds.
Type 1 substitution layer SL1 is an algorithm which takes as input a
16-byte string x0 || x1 ||...|| x15 and outputs a 16-byte string y0
|| y1 ||...|| y15 as follows.
y0 = SB1(x0), y1 = SB2(x1), y2 = SB3(x2), y3 = SB4(x3),
y4 = SB1(x4), y5 = SB2(x5), y6 = SB3(x6), y7 = SB4(x7),
y8 = SB1(x8), y9 = SB2(x9), y10= SB3(x10), y11= SB4(x11),
y12= SB1(x12), y13= SB2(x13), y14= SB3(x14), y15= SB4(x15).
Lee, et al. Expires November 15, 2009 [Page 6]
Internet-Draft The ARIA Encryption Algorithm May 2009
Type 2 substitution layer SL2 is an algorithm which takes as input a
16-byte string x0 || x1 ||...|| x15 and outputs a 16-byte string y0
|| y1 ||...|| y15 as follows.
y0 = SB3(x0), y1 = SB4(x1), y2 = SB1(x2), y3 = SB2(x3),
y4 = SB3(x4), y5 = SB4(x5), y6 = SB1(x6), y7 = SB2(x7),
y8 = SB3(x8), y9 = SB4(x9), y10= SB1(x10), y11= SB2(x11),
y12= SB3(x12), y13= SB4(x13), y14= SB1(x14), y15= SB2(x15).
Here, SB1, SB2, SB3, and SB4 are S-boxes which take as input an 8-bit
string and output an 8-bit string. These S-boxes are defined by the
following look-up tables.
SB1:
0 1 2 3 4 5 6 7 8 9 a b c d e f
00 63 7c 77 7b f2 6b 6f c5 30 01 67 2b fe d7 ab 76
10 ca 82 c9 7d fa 59 47 f0 ad d4 a2 af 9c a4 72 c0
20 b7 fd 93 26 36 3f f7 cc 34 a5 e5 f1 71 d8 31 15
30 04 c7 23 c3 18 96 05 9a 07 12 80 e2 eb 27 b2 75
40 09 83 2c 1a 1b 6e 5a a0 52 3b d6 b3 29 e3 2f 84
50 53 d1 00 ed 20 fc b1 5b 6a cb be 39 4a 4c 58 cf
60 d0 ef aa fb 43 4d 33 85 45 f9 02 7f 50 3c 9f a8
70 51 a3 40 8f 92 9d 38 f5 bc b6 da 21 10 ff f3 d2
80 cd 0c 13 ec 5f 97 44 17 c4 a7 7e 3d 64 5d 19 73
90 60 81 4f dc 22 2a 90 88 46 ee b8 14 de 5e 0b db
a0 e0 32 3a 0a 49 06 24 5c c2 d3 ac 62 91 95 e4 79
b0 e7 c8 37 6d 8d d5 4e a9 6c 56 f4 ea 65 7a ae 08
c0 ba 78 25 2e 1c a6 b4 c6 e8 dd 74 1f 4b bd 8b 8a
d0 70 3e b5 66 48 03 f6 0e 61 35 57 b9 86 c1 1d 9e
e0 e1 f8 98 11 69 d9 8e 94 9b 1e 87 e9 ce 55 28 df
f0 8c a1 89 0d bf e6 42 68 41 99 2d 0f b0 54 bb 16
SB2:
0 1 2 3 4 5 6 7 8 9 a b c d e f
00 e2 4e 54 fc 94 c2 4a cc 62 0d 6a 46 3c 4d 8b d1
10 5e fa 64 cb b4 97 be 2b bc 77 2e 03 d3 19 59 c1
20 1d 06 41 6b 55 f0 99 69 ea 9c 18 ae 63 df e7 bb
30 00 73 66 fb 96 4c 85 e4 3a 09 45 aa 0f ee 10 eb
40 2d 7f f4 29 ac cf ad 91 8d 78 c8 95 f9 2f ce cd
50 08 7a 88 38 5c 83 2a 28 47 db b8 c7 93 a4 12 53
60 ff 87 0e 31 36 21 58 48 01 8e 37 74 32 ca e9 b1
70 b7 ab 0c d7 c4 56 42 26 07 98 60 d9 b6 b9 11 40
80 ec 20 8c bd a0 c9 84 04 49 23 f1 4f 50 1f 13 dc
90 d8 c0 9e 57 e3 c3 7b 65 3b 02 8f 3e e8 25 92 e5
a0 15 dd fd 17 a9 bf d4 9a 7e c5 39 67 fe 76 9d 43
b0 a7 e1 d0 f5 68 f2 1b 34 70 05 a3 8a d5 79 86 a8
c0 30 c6 51 4b 1e a6 27 f6 35 d2 6e 24 16 82 5f da
Lee, et al. Expires November 15, 2009 [Page 7]
Internet-Draft The ARIA Encryption Algorithm May 2009
d0 e6 75 a2 ef 2c b2 1c 9f 5d 6f 80 0a 72 44 9b 6c
e0 90 0b 5b 33 7d 5a 52 f3 61 a1 f7 b0 d6 3f 7c 6d
f0 ed 14 e0 a5 3d 22 b3 f8 89 de 71 1a af ba b5 81
SB3:
0 1 2 3 4 5 6 7 8 9 a b c d e f
00 52 09 6a d5 30 36 a5 38 bf 40 a3 9e 81 f3 d7 fb
10 7c e3 39 82 9b 2f ff 87 34 8e 43 44 c4 de e9 cb
20 54 7b 94 32 a6 c2 23 3d ee 4c 95 0b 42 fa c3 4e
30 08 2e a1 66 28 d9 24 b2 76 5b a2 49 6d 8b d1 25
40 72 f8 f6 64 86 68 98 16 d4 a4 5c cc 5d 65 b6 92
50 6c 70 48 50 fd ed b9 da 5e 15 46 57 a7 8d 9d 84
60 90 d8 ab 00 8c bc d3 0a f7 e4 58 05 b8 b3 45 06
70 d0 2c 1e 8f ca 3f 0f 02 c1 af bd 03 01 13 8a 6b
80 3a 91 11 41 4f 67 dc ea 97 f2 cf ce f0 b4 e6 73
90 96 ac 74 22 e7 ad 35 85 e2 f9 37 e8 1c 75 df 6e
a0 47 f1 1a 71 1d 29 c5 89 6f b7 62 0e aa 18 be 1b
b0 fc 56 3e 4b c6 d2 79 20 9a db c0 fe 78 cd 5a f4
c0 1f dd a8 33 88 07 c7 31 b1 12 10 59 27 80 ec 5f
d0 60 51 7f a9 19 b5 4a 0d 2d e5 7a 9f 93 c9 9c ef
e0 a0 e0 3b 4d ae 2a f5 b0 c8 eb bb 3c 83 53 99 61
f0 17 2b 04 7e ba 77 d6 26 e1 69 14 63 55 21 0c 7d
SB4:
0 1 2 3 4 5 6 7 8 9 a b c d e f
00 30 68 99 1b 87 b9 21 78 50 39 db e1 72 9 62 3c
10 3e 7e 5e 8e f1 a0 cc a3 2a 1d fb b6 d6 20 c4 8d
20 81 65 f5 89 cb 9d 77 c6 57 43 56 17 d4 40 1a 4d
30 c0 63 6c e3 b7 c8 64 6a 53 aa 38 98 0c f4 9b ed
40 7f 22 76 af dd 3a 0b 58 67 88 06 c3 35 0d 01 8b
50 8c c2 e6 5f 02 24 75 93 66 1e e5 e2 54 d8 10 ce
60 7a e8 08 2c 12 97 32 ab b4 27 0a 23 df ef ca d9
70 b8 fa dc 31 6b d1 ad 19 49 bd 51 96 ee e4 a8 41
80 da ff cd 55 86 36 be 61 52 f8 bb 0e 82 48 69 9a
90 e0 47 9e 5c 04 4b 34 15 79 26 a7 de 29 ae 92 d7
a0 84 e9 d2 ba 5d f3 c5 b0 bf a4 3b 71 44 46 2b fc
b0 eb 6f d5 f6 14 fe 7c 70 5a 7d fd 2f 18 83 16 a5
c0 91 1f 05 95 74 a9 c1 5b 4a 85 6d 13 07 4f 4e 45
d0 b2 0f c9 1c a6 bc ec 73 90 7b cf 59 8f a1 f9 2d
e0 f2 b1 00 94 37 9f d0 2e 9c 6e 28 3f 80 f0 3d d3
f0 25 8a b5 e7 42 b3 c7 ea f7 4c 11 33 03 a2 ac 60
For example, SB1(0x23) = 0x26 and SB4(0xef) = 0xd3. Note that SB3 and
SB4 are the inverse functions of SB1 and SB2, respectively, and
accordingly SL2 is the inverse of SL1.
Lee, et al. Expires November 15, 2009 [Page 8]
Internet-Draft The ARIA Encryption Algorithm May 2009
2.4.3. Diffusion Layer
Diffusion layer A is an algorithm which takes as input a 16-byte
string x0 || x1 || ... || x15 and outputs a 16-byte string y0 || y1
||...|| y15 by the following equations.
y0 = x3 ^ x4 ^ x6 ^ x8 ^ x9 ^ x13 ^ x14,
y1 = x2 ^ x5 ^ x7 ^ x8 ^ x9 ^ x12 ^ x15,
y2 = x1 ^ x4 ^ x6 ^ x10 ^ x11 ^ x12 ^ x15,
y3 = x0 ^ x5 ^ x7 ^ x10 ^ x11 ^ x13 ^ x14,
y4 = x0 ^ x2 ^ x5 ^ x8 ^ x11 ^ x14 ^ x15,
y5 = x1 ^ x3 ^ x4 ^ x9 ^ x10 ^ x14 ^ x15,
y6 = x0 ^ x2 ^ x7 ^ x9 ^ x10 ^ x12 ^ x13,
y7 = x1 ^ x3 ^ x6 ^ x8 ^ x11 ^ x12 ^ x13,
y8 = x0 ^ x1 ^ x4 ^ x7 ^ x10 ^ x13 ^ x15,
y9 = x0 ^ x1 ^ x5 ^ x6 ^ x11 ^ x12 ^ x14,
y10 = x2 ^ x3 ^ x5 ^ x6 ^ x8 ^ x13 ^ x15,
y11 = x2 ^ x3 ^ x4 ^ x7 ^ x9 ^ x12 ^ x14,
y12 = x1 ^ x2 ^ x6 ^ x7 ^ x9 ^ x11 ^ x12,
y13 = x0 ^ x3 ^ x6 ^ x7 ^ x8 ^ x10 ^ x13,
y14 = x0 ^ x3 ^ x4 ^ x5 ^ x9 ^ x11 ^ x14,
y15 = x1 ^ x2 ^ x4 ^ x5 ^ x8 ^ x10 ^ x15.
Note that A is an involution. That is, for any 16-byte input string x,
x = A(A(x)) holds.
3. Security Considerations
ARIA is designed to be resistant to all known attacks on block
ciphers [ARIA03]. Its security was analyzed by the COSIC group of
K.U.Leuven in Belgium [ARIAEVAL] and no security flaw has been found.
4. Informative References
[ARIAEVAL] A. Biryukov et al., "Security and Performance Analysis of
ARIA", K.U.Leuven (2003), available at
http://www.cosic.esat.kuleuven.be/publications/article-
500.pdf
[ARIA03] D. Kwon et al., "New Block Cipher: ARIA", ICISC 2003,
pp. 432-445.
[ARIAKS] Korean Agency for Technology and Standards (KATS), "128
bit block encryption algorithm ARIA", KS X 1213:2004,
December 2004 (In Korean)
Lee, et al. Expires November 15, 2009 [Page 9]
Internet-Draft The ARIA Encryption Algorithm May 2009
[ARIAPKCS] RSA Laboratories, PKCS #11 v2.20 Amendment 3 Revision 1:
Additional PKCS #11 Mechanisms, January 2007.
Appendix A. Example Data of ARIA
Here are test data for ARIA in hexadecimal form.
128-bit key
Key : 000102030405060708090a0b0c0d0e0f
Plaintext : 00112233445566778899aabbccddeeff
Ciphertext: d718fbd6ab644c739da95f3be6451778
192-bit key
Key : 000102030405060708090a0b0c0d0e0f
1011121314151617
Plaintext : 00112233445566778899aabbccddeeff
Ciphertext: 26449c1805dbe7aa25a468ce263a9e79
256-bit key
Key : 000102030405060708090a0b0c0d0e0f
101112131415161718191a1b1c1d1e1f
Plaintext : 00112233445566778899aabbccddeeff
Ciphertext: f92bd7c79fb72e2f2b8f80c1972d24fc
Authors' Addresses
Jungkeun Lee
National Security Research Institute
P.O.Box 1, Yuseong, Daejeon, 305-350, Korea
Email: jklee@ensec.re.kr
Jooyoung Lee
National Security Research Institute
P.O.Box 1, Yuseong, Daejeon, 305-350, Korea
Email: jlee05@ensec.re.kr
Jaeheon Kim
National Security Research Institute
P.O.Box 1, Yuseong, Daejeon, 305-350, Korea
Email: jaeheon@ensec.re.kr
Lee, et al. Expires November 15, 2009 [Page 10]
Internet-Draft The ARIA Encryption Algorithm May 2009
Daesung Kwon
National Security Research Institute
P.O.Box 1, Yuseong, Daejeon, 305-350, Korea
Email: ds_kwon@ensec.re.kr
Choonsoo Kim
National Security Research Institute
P.O.Box 1, Yuseong, Daejeon, 305-350, Korea
Email: jbr@ensec.re.kr
Lee, et al. Expires November 15, 2009 [Page 11]