General | |
---|---|
Designers | Deukjo Hong, Jung-Keun Lee, Dong-Chan Kim, Daesung Kwon, Kwon Ho Ryu, Dong-Geon Lee |
First published | 2013 |
Cipher detail | |
Key sizes | 128, 192, or 256 bits |
Block sizes | 128 bits |
Structure | ARX (modular Addition, bitwise Rotation, and bitwise XOR) |
Rounds | 24, 28, or 32 (depending on key size) |
Best public cryptanalysis | |
As of 2019, no successful attack on full-round LEA is known. |
The Lightweight Encryption Algorithm (also known as LEA) is a 128-bit block cipher developed by South Korea in 2013 to provide confidentiality in high-speed environments such as big data and cloud computing, as well as lightweight environments such as IoT devices and mobile devices. [1] LEA has three different key lengths: 128, 192, and 256 bits. LEA encrypts data about 1.5 to 2 times faster than AES, the most widely used block cipher in various software environments.
LEA is one of the cryptographic algorithms approved by the Korean Cryptographic Module Validation Program (KCMVP) and is the national standard of Republic of Korea (KS X 3246). LEA is included in the ISO/IEC 29192-2:2019 standard (Information security - Lightweight cryptography - Part 2: Block ciphers).
The block cipher LEA consisting of ARX operations (modular Addition: , bitwise Rotation: , , and bitwise XOR ) for 32-bit words processes data blocks of 128 bits and has three different key lengths: 128, 192, and 256 bits. LEA with a 128-bit key, LEA with a 192-bit key, and LEA with a 256-bit key are referred to as “LEA-128”, “LEA-192”, and “LEA-256”, respectively. The number of rounds is 24 for LEA-128, 28 for LEA-192, and 32 for LEA-256.
Let be a 128-bit block of plaintext and be a 128-bit block of ciphertext, where and () are 32-bit blocks. Let () be 192-bit round keys, where () are 32-bit blocks. Here is the number of rounds for the LEA algorithm. The encryption operation is described as follows:
The decryption operation is as follows:
The key schedule of LEA supports 128, 192, and 256-bit keys and outputs 192-bit round keys () for the data processing part.
Let be a 128-bit key, where () are 32-bit blocks. The key schedule for LEA-128 takes and four 32-bit constants () as inputs and outputs twenty-four 192-bit round keys (). The key schedule operation for LEA-128 is as follows:
Let be a 192-bit key, where () are 32-bit blocks. The key schedule for LEA-192 takes and six 32-bit constants () as inputs and outputs twenty-eight 192-bit round keys (). The key schedule operation for LEA-192 is as follows:
Let be a 256-bit key, where () are 32-bit blocks. The key schedule for LEA-192 takes and eight 32-bit constants () as inputs and outputs thirty-two 192-bit round keys (). The key schedule operation for LEA-256 is as follows:
The eight 32-bit constant values () used in the key schedule are given in the following table.
0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | |
0xc3efe9db | 0x44626b02 | 0x79e27c8a | 0x78df30ec | 0x715ea49e | 0xc785da0a | 0xe04ef22a | 0xe5c40957 |
As of 2019, no successful attack on full-round LEA is known. As is typical for iterated block ciphers, reduced-round variants have been attacked. The best published attacks on LEA in the standard attack model (CPA/CCA with unknown key) are boomerang attacks and differential linear attacks. The security margin to the whole rounds ratio is greater than 37% against various existing cryptanalytic techniques for block ciphers.
Attack type | Attacked rounds |
---|---|
Differential [2] | 14 |
Truncated differential [2] | 14 |
Linear [1] | 13 |
Zero correlation [1] | 10 |
Boomerang [1] | 15 |
Impossible differential [1] | 12 |
Integral [1] | 9 |
Differential linear [1] | 15 |
Related-key differential [1] | 13 |
Block ciphers | Rounds (Attacked / Total) | Security margins |
---|---|---|
LEA-128 | 15 / 24 | 37.50% |
LEA-192 | 16 / 28 | 42.85% |
LEA-256 | 18 / 32 | 43.75% |
LEA has very good performance in a general-purpose software environment. In particular, it is possible to encrypt at a rate of about 1.5 to 2 times on average, compared to AES, the most widely used block cipher in various software environments. The tables below compare the performance of LEA and AES using FELICS (Fair Evaluation of Lightweight Cryptographic Systems), [3] a benchmarking framework for evaluation of software implementations of lightweight cryptographic primitives.
Platform | LEA-128 | LEA-192 | LEA-256 | AES-128 | |
---|---|---|---|---|---|
AVR | Code | 1,684 | 2,010 | 2,150 | 3,010 |
RAM | 631 | 943 | 1,055 | 408 | |
Time | 61,020 | 80,954 | 92,194 | 58,248 | |
MSP | Code | 1,130 | 1,384 | 1,468 | 2,684 |
RAM | 626 | 942 | 1,046 | 408 | |
Time | 47,339 | 56,540 | 64,001 | 86,506 | |
ARM | Code | 472 | 536 | 674 | 3,050 |
RAM | 684 | 968 | 1,080 | 452 | |
Time | 17,417 | 20,640 | 24,293 | 83,868 |
Platform | LEA-128 | LEA-192 | LEA-256 | AES-128 | |
---|---|---|---|---|---|
AVR | Code | 906 | 1,210 | 1,306 | 1,246 |
RAM | 80 | 80 | 80 | 81 | |
Time | 4,023 | 4,630 | 5,214 | 3,408 | |
MSP | Code | 722 | 1,014 | 1,110 | 1,170 |
RAM | 78 | 78 | 78 | 80 | |
Time | 2,814 | 3,242 | 3,622 | 4,497 | |
ARM | Code | 628 | 916 | 1,012 | 1,348 |
RAM | 92 | 100 | 100 | 124 | |
Time | 906 | 1,108 | 1,210 | 4,044 |
Test vectors for LEA for each key length are as follows. [5] All values are expressed in hexadecimal form.
LEA is free for any use: public or private, commercial or non-commercial. The source code for distribution of LEA implemented in C, Java, and Python can be downloaded from KISA's website. [6] In addition, LEA is contained in Crypto++ library, a free C++ class library of cryptographic schemes. [7]
LEA is one of the cryptographic algorithms approved by the Korean Cryptographic Module Validation Program (KCMVP). [8]
LEA is included in the following standards.
In number theory, an arithmetic, arithmetical, or number-theoretic function is generally any function f(n) whose domain is the positive integers and whose range is a subset of the complex numbers. Hardy & Wright include in their definition the requirement that an arithmetical function "expresses some arithmetical property of n". There is a larger class of number-theoretic functions that do not fit this definition, for example, the prime-counting functions. This article provides links to functions of both classes.
The Mersenne Twister is a general-purpose pseudorandom number generator (PRNG) developed in 1997 by Makoto Matsumoto and Takuji Nishimura. Its name derives from the fact that its period length is chosen to be a Mersenne prime.
KASUMI is a block cipher used in UMTS, GSM, and GPRS mobile communications systems. In UMTS, KASUMI is used in the confidentiality (f8) and integrity algorithms (f9) with names UEA1 and UIA1, respectively. In GSM, KASUMI is used in the A5/3 key stream generator and in GPRS in the GEA3 key stream generator.
In cryptography, mod n cryptanalysis is an attack applicable to block and stream ciphers. It is a form of partitioning cryptanalysis that exploits unevenness in how the cipher operates over equivalence classes modulo n. The method was first suggested in 1999 by John Kelsey, Bruce Schneier, and David Wagner and applied to RC5P and M6. These attacks used the properties of binary addition and bit rotation modulo a Fermat prime.
Modular exponentiation is exponentiation performed over a modulus. It is useful in computer science, especially in the field of public-key cryptography, where it is used in both Diffie–Hellman key exchange and RSA public/private keys.
The Lenstra–Lenstra–Lovász (LLL) lattice basis reduction algorithm is a polynomial time lattice reduction algorithm invented by Arjen Lenstra, Hendrik Lenstra and László Lovász in 1982. Given a basis with n-dimensional integer coordinates, for a lattice L with , the LLL algorithm calculates an LLL-reduced lattice basis in time
The Rijndael S-box is a substitution box used in the Rijndael cipher, on which the Advanced Encryption Standard (AES) cryptographic algorithm is based.
Poly1305 is a universal hash family designed by Daniel J. Bernstein for use in cryptography.
In cryptography, higher-order differential cryptanalysis is a generalization of differential cryptanalysis, an attack used against block ciphers. While in standard differential cryptanalysis the difference between only two texts is used, higher-order differential cryptanalysis studies the propagation of a set of differences between a larger set of texts. Xuejia Lai, in 1994, laid the groundwork by showing that differentials are a special case of the more general case of higher order derivates. Lars Knudsen, in the same year, was able to show how the concept of higher order derivatives can be used to mount attacks on block ciphers. These attacks can be superior to standard differential cryptanalysis. Higher-order differential cryptanalysis has notably been used to break the KN-Cipher, a cipher which had previously been proved to be immune against standard differential cryptanalysis.
Disk encryption is a special case of data at rest protection when the storage medium is a sector-addressable device. This article presents cryptographic aspects of the problem. For an overview, see disk encryption. For discussion of different software packages and hardware devices devoted to this problem, see disk encryption software and disk encryption hardware.
In cryptography, Galois/Counter Mode (GCM) is a mode of operation for symmetric-key cryptographic block ciphers which is widely adopted for its performance. GCM throughput rates for state-of-the-art, high-speed communication channels can be achieved with inexpensive hardware resources.
Threefish is a symmetric-key tweakable block cipher designed as part of the Skein hash function, an entry in the NIST hash function competition. Threefish uses no S-boxes or other table lookups in order to avoid cache timing attacks; its nonlinearity comes from alternating additions with exclusive ORs. In that respect, it is similar to Salsa20, TEA, and the SHA-3 candidates CubeHash and BLAKE.
A locally testable code is a type of error-correcting code for which it can be determined if a string is a word in that code by looking at a small number of bits of the string. In some situations, it is useful to know if the data is corrupted without decoding all of it so that appropriate action can be taken in response. For example, in communication, if the receiver encounters a corrupted code, it can request the data be re-sent, which could increase the accuracy of said data. Similarly, in data storage, these codes can allow for damaged data to be recovered and rewritten properly.
Turingery or Turing's method was a manual codebreaking method devised in July 1942 by the mathematician and cryptanalyst Alan Turing at the British Government Code and Cypher School at Bletchley Park during World War II. It was for use in cryptanalysis of the Lorenz cipher produced by the SZ40 and SZ42 teleprinter rotor stream cipher machines, one of the Germans' Geheimschreiber machines. The British codenamed non-Morse traffic "Fish", and that from this machine "Tunny".
In 1997, Moni Naor and Omer Reingold described efficient constructions for various cryptographic primitives in private key as well as public-key cryptography. Their result is the construction of an efficient pseudorandom function. Let p and l be prime numbers with l |p−1. Select an element g ∈ of multiplicative order l. Then for each (n+1)-dimensional vector a = (a0,a1, ..., an)∈ they define the function
ACE is the collection of units, implementing both a public key encryption scheme and a digital signature scheme. Corresponding names for these schemes — «ACE Encrypt» and «ACE Sign». Schemes are based on Cramer-Shoup public key encryption scheme and Cramer-Shoup signature scheme. Introduced variants of these schemes are intended to achieve a good balance between performance and security of the whole encryption system.
Simon is a family of lightweight block ciphers publicly released by the National Security Agency (NSA) in June 2013. Simon has been optimized for performance in hardware implementations, while its sister algorithm, Speck, has been optimized for software implementations.
A biclique attack is a variant of the meet-in-the-middle (MITM) method of cryptanalysis. It utilizes a biclique structure to extend the number of possibly attacked rounds by the MITM attack. Since biclique cryptanalysis is based on MITM attacks, it is applicable to both block ciphers and (iterated) hash-functions. Biclique attacks are known for having weakened both full AES and full IDEA, though only with slight advantage over brute force. It has also been applied to the KASUMI cipher and preimage resistance of the Skein-512 and SHA-2 hash functions.
Kuznyechik is a symmetric block cipher. It has a block size of 128 bits and key length of 256 bits. It is defined in the National Standard of the Russian Federation GOST R 34.12-2015 and also in RFC 7801.
LSH is a cryptographic hash function designed in 2014 by South Korea to provide integrity in general-purpose software environments such as PCs and smart devices. LSH is one of the cryptographic algorithms approved by the Korean Cryptographic Module Validation Program (KCMVP). And it is the national standard of South Korea.