Symmetric Ciphers

Also see the notes for block cipher modes and KeyGenerators.

Key scheduling

Ciphers that have different key schedules, but are otherwise identical are given different names (for example, SAFER-K and SAFER-SK). Sometimes it is useful to bypass the normal key scheduling process, and specify the subkeys (which should be random and independent) directly in the input key. The name of such a cipher is derived by adding "-Direct" to the standard name (except that if part of the name already specifies the key schedule, that part is dropped). For example, "DES-Direct" and "SAFER-Direct" refer to DES and SAFER respectively with independent subkeys. This convention can also be used for experimental ciphers that have no defined key schedule. [A previous version of SCAN specified "-ISK" instead of "-Direct". This is a backward-incompatible change, although an alias has been added for "Blowfish-ISK".]

If the subkeys are not in fact random and independent (to a close-enough approximation), the cipher may become vulnerable to related-key attacks, and therefore particular care is needed from the application designer in choosing how to generate subkeys.

Subkeys are encoded in the order in which they are used for encryption (or if this is ambiguous, the order in which they are presented or numbered in the original document specifying the cipher). Where applicable, they have the same byte order as is used in the rest of the cipher. However, in some cases these conventions may still not be sufficient to decide how to encode the subkeys; if you wish to use a "-Direct" algorithm where the subkey encoding is not clear, ask for a comment to be added to the algorithm definition.

3-Way Block Cipher
Designer:
Joan Daemen
Published:
1994
Alias:
"ThreeWay" (use for identifiers)
References:
Key length:
96 bits.
Block size:
12 bytes.
Comment:
The byte ordering convention is as follows: within each 12-byte block, the 32-bit words are represented in the same order as they are written in chapter 7 of Joan Daemen's thesis. Within each 32-bit word, the bytes are in big-endian order. This is consistent with the four test vectors in Crypto++ (note that the same four test vectors are included on page 659 of Applied Cryptography, 2nd edition, with the words written in the opposite order).

For reference, the fourth test vector in this set is: 

   key        = <D2F05B5ED6144138CAB920CD>
   plaintext  = <4059C76E83AE9DC4AD21ECF7>
   ciphertext = <478EA8716B13F17C15B155ED>
Security comment:
3-Way is vulnerable to related-key attacks, and therefore it should only be used with keys that are generated by a strong RNG, or by a source of bits that are sufficiently uncorrelated (such as the output of a hash function).

AES128 Block Cipher
Designers:
Joan Daemen, Vincent Rijmen
Alias:
"OpenPGP.Cipher.7"
Object Identifiers:
Description:
AES128 is defined as Rijndael with a 128-bit block size and 10 rounds.
References:
Key length:
128 bits.
Block size:
16 bytes.

AES192 Block Cipher
Designers:
Joan Daemen, Vincent Rijmen
Alias:
"OpenPGP.Cipher.8"
Object Identifiers:
Description:
AES192 is defined as Rijndael with a 128-bit block size and 12 rounds.
References:
[see references for AES128 and Rijndael]
Key length:
192 bits.
Block size:
16 bytes.

AES256 Block Cipher
Designers:
Joan Daemen, Vincent Rijmen
Alias:
"OpenPGP.Cipher.9"
Object Identifiers:
Description:
AES256 is defined as Rijndael with a 128-bit block size and 14 rounds.
References:
[see references for AES128 and Rijndael]
Key length:
256 bits.
Block size:
16 bytes.

Anubis Block Cipher
Designers:
Paulo Barreto, Vincent Rijmen
Published:
November 2000
References:
Key length:
Minimum 128, maximum 320, multiple of 32 bits; default 128 bits.
Block size:
16 bytes.

Blowfish Block Cipher
Designer:
Bruce Schneier
Published:
1994
Alias:
"OpenPGP.Cipher.4"
References:
Key length:
Minimum 32, maximum 448, multiple of 8 bits; default 128 bits.
Block size:
8 bytes.
Security comment:
The weak keys described in Vaudenay's paper do not appear to be significant for full (16-round) Blowfish.
Variant:
"Blowfish-Direct" or "Blowfish-ISK" - the subkeys are specified (using the notation of Applied Cryptography) as P1..18 first, followed by S1, 0..255, S2, 0..255, S3, 0..255, and S4, 0..255. Each entry is represented as 4 bytes in big-endian order.

Weak keys may be avoided by ensuring that no S-box has duplicate entries (i.e. that there does not exist i, j, k where j != k such that Si, j = Si, k).

BMGL Stream Cipher
Designers:
Johan Håstad, Mats Näslund
Published:
October 2000
Description:
BMGL is an alias for "Rijndael-256/KFB(40)"; that is, Rijndael with a 256-bit block size, used in KFB mode, with 40 bits of keystream taken for each application of Rijndael. See the description of KFB mode for further detail.
References:
Key length:
Minimum 128, maximum 320, multiple of 32 bits; default 128 bits.
Security comment:
The security bounds proven for BMGL in Corollary 13 of Håstad and Näslund's paper, hold provided that less than 230 bits (128 MBytes) of output are used. The "provable security" referred to in the paper is in the sense of a proven reduction from predicting the keystream generator, to breaking Rijndael-256 as a one-way function.

CAST-128 Block Cipher
Designers:
Carlisle Adams, Stafford Tavares
Published:
1997
Aliases:
"CAST5", "OpenPGP.Cipher.3"
References:
Key length:
Minimum 40, maximum 128, multiple of 8 bits; default 128 bits.
Block size:
8 bytes.
Comment:
Strictly speaking the alias "CAST5" only applies to CAST-128 with a key size of 80 or 128 bits. Implementations MAY enforce this.
Patent status:
The design procedure that was used to obtain the CAST S-boxes is patented by Entrust Technologies, Inc.. However, quoting from RFC 2144,
The CAST-128 cipher described in this document is available worldwide on a royalty-free basis for commercial and non-commercial uses.

CAST-256 Block Cipher
Designer:
Carlisle Adams, Howard Heys, Stafford Tavares, Michael Wiener
Published:
June 1998
Alias:
"CAST6"
References:
Key length:
Minimum 128, maximum 256, multiple of 32 bits; default 128 bits.
Block size:
16 bytes.
Patent status:
The design procedure that was used to obtain the CAST S-boxes is patented by Entrust Technologies, Inc.. However, quoting from RFC 2612,
The CAST-256 cipher described in this document is available worldwide on a royalty-free and licence-free basis for commercial and non-commercial uses.

CRYPTON-0.5 Block Cipher
Designer:
Chae Hoon Lim
Published:
1998
Alias:
"CRYPTONv05" (use for identifiers)
Description:
This is the version of CRYPTON originally submitted to NIST as an AES candidate.
References:
Comment:
"CRYPTON: A New 128-bit Block Cipher - Specification and Analysis" contains an error in the description of the byte permutation phi: on the right hand side of figure 4, b33 should be b03.
Key length:
Minimum 64, maximum 256, multiple of 32 bits; default 128 bits.
Block size:
16 bytes.
Security comments:

CRYPTON-1.0 Block Cipher
Designer:
Chae Hoon Lim
Published:
December 1998
Alias:
"CRYPTONv10" (use for identifiers)
Description:
This is version 1.0 of CRYPTON (the current version, at time of writing).
References:
Key length:
Minimum 0, maximum 256, multiple of 8 bits; default 128 bits.
(Note that this is different from CRYPTON-0.5.)
Block size:
16 bytes.

CS-Cipher Block Cipher
Designers:
Jacques Stern, Serge Vaudenay
Published:
1998
References:
Key length:
Minimum 0, maximum 128, multiple of 8 bits; default 128 bits.
Block size:
8 bytes.
Patent status:
CS-Cipher may be subject to patents by the Compagnie des Signaux.

DEAL Block Cipher
Designer:
Lars Knudsen
Published:
May 1998
References:
Key length:
128, 192 or 256 bits; default 128 bits.
Block size:
16 bytes.
Comment:
The paper "DEAL: A 128-bit Block Cipher" contains an error in the description of key scheduling: the three occurrences of "<4>" should be replaced by "<3>", and the two occurrences of "<8>" should be replaced by "<4>". In other words, the constants to be XOR'd with the input keys are 0x8000000000000000, 0x4000000000000000, 0x2000000000000000 and 0x1000000000000000.
Security comments:

DES Block Cipher
Designers:
Don Coppersmith, Horst Feistel, Walt Tuchmann, U.S. National Security Agency
Published:
1976
References:
Key length:
64 bits as encoded; 56 bits excluding parity bits.
Block size:
8 bytes.
Comment:
Implementations MUST ignore (i.e. not check) the parity bits of keys. KeyGenerators for DES MUST, however, output keys with correct parity.
Security comment:
The fixed 56-bit effective key length is too short to prevent brute-force attacks.

DESede Block Cipher
Designers:
Whitfield Diffie, Martin Hellman, Walt Tuchmann
Published:
1978-79
Aliases:
References:
Key length:
128 or 192 bits, as encoded (112 or 168 bits excluding parity). The default key length depends on the name of the KeyGenerator: 128 bits for DES-EDE2, and 192 bits for DES-EDE3 or OpenPGP.Cipher.2.

The default key length for DESede and the other aliases is implemented inconsistently between different providers, and therefore if an application needs to create a specific length of DESede key in a way that is guaranteed to work across providers, it should explicitly create a SecretKeySpec.

Block size:
8 bytes.
Comments:
Security comment:
Quoting from the paper "Attacking Triple Encryption" cited above:
[A]bout 2108 steps of computation are sufficient to break three-key triple DES. If one concentrates on the number of single DES operations and assumes the other operations to be much faster, 290 of these are enough.
Better attacks than this are available against two-key triple DES (which should only be used for backward compatibility, if at all).

DESX Block Cipher
Designer:
Ron Rivest
Description:
If K, K1 and K2 are the subkeys encoded as described below, then encryption and decryption are defined by:
EDESX[K, K1, K2](P) = EDES[K](P XOR K1) XOR K2
DDESX[K, K1, K2](C) = DDES[K](C XOR K3) XOR K2
If the user key length is 24 bytes, the first 8 bytes represent the key K used for the DES operation, and the two subsequent blocks of 8 bytes represent the "whitening" keys K1 and K2, in that order.

If the user key length is 16 bytes, the first 8 bytes represent the key K used for the DES operation, the second 8 bytes represent the whitening key K1, and K2 is derived from K and K1 as specified in the first reference below.

References:
Key length:
128 or 192 bits; default 192 bits, as encoded. See security comments for the effective key length.
Block size:
8 bytes.
Comments:
Security comments:

DFC Block Cipher
Designers:
Henri Gilbert, Marc Girault, Philippe Hoogvorst, Fabrice Noilhan, Thomas Pornin, Guillaume Poupard, Jacques Stern, Serge Vaudenay
Published:
May 1998
References:
Key length:
Minimum 0, maximum 256 bits, multiple of 8 bits; default 128 bits.
Block size:
16 bytes.
Patent status:
DFC itself is unpatented, but the decorrelation technique it uses may be covered by the patent application referenced above.

DFCv2-128(rounds,s) Block Cipher
Designers:
Louis Granboulan, Phong Nguyen, Fabrice Noilhan, Serge Vaudenay
Published:
August 2000
References:
Parameters:
Key length:
128, 192 or 256 bits; default 128 bits.
Block size:
16 bytes.
Comments:
Note that DFCv2 is not the same as the algorithm defined in the "DFC Update" paper (which did not have a sufficiently well-specified key schedule). That paper is included in the references only for comparison.
Patent status:
DFCv2 itself is unpatented, but the decorrelation technique it uses may be covered by the patent application referenced above.

Diamond2(rounds) Block Cipher
Designer:
Michael Paul Johnson
Published:
1995
References:
Parameters:
Key length:
Minimum 8, maximum 65536, multiple of 8 bits; default 128 bits.
Block size:
16 bytes.
Comments:

E2 Block Cipher
Designers:
Kazumaro Aoki, Masayuki Kanda, Tsutomu Matsumoto, Shiho Moriai, Kazuo Ohta, Miyako Ookubo, Youichi Takashima, Hiroki Ueda
Published:
June 1998
References:
Key length:
128, 192 or 256 bits; default 128 bits.
Block size:
16 bytes.
Patent status:
NTT has several patents pending on E2 (see references).

? FROG[(blockSize[,rounds])] Block Cipher
Designers:
Dianelos Georgoudis, Damian Leroux, Billy Simón Chaves
Published:
1998
References:
Parameters:
Key length:
Minimum 40, maximum 1000, multiple of 8 bits; default 128 bits.
Block size:
As given by the blockSize parameter (in bytes).
Missing information:
Test vectors for block sizes other than 16 bytes.
Comment:
The original C reference code uses an unconventional byte order when printing test vectors (the order of bytes is reversed across the whole block). The correct byte order is that defined by the Java reference implementation, and by the NIST test vectors referenced above.
Security comment:
The paper "Cryptanalysis of FROG" describes the following attacks on weak keys:

? GOST Block Cipher
Alias:
"GOST-28147-89"
Published:
1989
References:
Parameters:
Key length:
256 bits.
Block size:
8 bytes.
Missing information:
Test vectors.
Security comment:
The paper "A chosen key attack against the secret S-boxes of GOST" cited above describes how to recover the S-boxes in about 232 encryptions. The main significance of this is on tamperproof hardware implementations where the S-boxes were assumed to be secret; for a software implementation, they should be assumed to be public in any case.

HPC-1(blockSize[,backup]) Block Cipher
Designer:
Rich Schroeppel
Published:
1998
Description:
This is the original HPC cipher submitted as a first round AES candidate.
References:
Parameters:
Key length:
Minimum 0, maximum 65536 bits; default 128 bits.
Block size:
As given by the blockSize parameter (in bytes). Note that while HPC supports block sizes that are not a multiple of 8 bits, the JCE API does not.
Comment:
The convention for encoding keys that are not a multiple of 8 bits in length, is for the last (effectiveBitLength % 8) bits of the key to be packed in the high-order bits of the last byte of the encoding. Any unused low-order bits of the last byte are ignored. For example, the key given by the 11-bit sequence <01010101 010>2, would be encoded as the byte array { 0x55, 0x40 | junk }, where junk & 0xE0 == 0. The value of the key's effectiveBitLength parameter is used to determine how many bits of the encoding are significant.
Security comments:

? HPC-2(blockSize[,backup]) Block Cipher
Designer:
Rich Schroeppel
Published:
June 1999
Description:
This is the "tweaked" version of HPC, with a modified key schedule.
References:
Parameters:
Key length:
Minimum 0, maximum 65536 bits; default 128 bits.
Block size:
As given by the blockSize parameter (in bytes). Note that while HPC supports block sizes that are not a multiple of 8 bits, the JCE API does not.
Missing information:
Test vectors.
Comment:
[see comment for HPC-1]
Security comment:

ICE Block Cipher
Designer:
Matthew Kwan
Published:
1997
References:
Key length:
Minimum 64, multiple of 64 bits; default 128 bits.
Block size:
8 bytes.
Comment:
The length of the key defines the "level" parameter (note that the "Thin ICE" variant is not included).
Security comment:
The paper "Differential cryptanalysis of the ICE encryption algorithm" describes several differential attacks, including an attack against a variant reduced to 15 rounds, with 256 work and at most 256 chosen plaintexts. (The full algorithm has n/4 rounds when the key length is n bits.) The paper concludes:
[...] The main conclusion of this paper is that keyed permutation does not prevent differential cryptanalysis. Although the analysis is more complicated and becomes key dependent, in our opinion the intention of the design has not been reached. The best 3-round iterative characteristic that can be used in our attack has a probability of 2-13, which is higher than the probability of 2-16 of the best 3-round characteristic for LOKI91 (a similar block cipher that makes use of four identical 12 to 8-bit S-boxes).
These attacks are probably not practical when the number of rounds is 32 or higher (i.e. the key is 128 bits or longer). However, in that case ICE is slower than DES.

IDEA Block Cipher
Designers:
Xuejia Lai, James Massey
Published:
1992
Alias:
"OpenPGP.Cipher.1"
Object Identifiers:
References:
Key length:
128 bits.
Block size:
8 bytes.
Comments:
Security comment:
IDEA is vulnerable to key schedule attacks, and therefore it should only be used with keys that are generated by a strong RNG, or by a source of bits that are sufficiently uncorrelated (such as the output of a hash function).
Patent status:
IDEA is patented in the U.S and 9 European countries by Ascom Systec Ltd., with a patent pending in Japan.

× ISAAC-BE Stream Cipher
Designer:
Robert J. Jenkins Jr.
Published:
1996
References:
Key length:
?
Missing information:
ISAAC does not appear to have a standard key schedule; this would need to be specified for it to be usable as a SCAN algorithm. Test vectors would also be needed.

× ISAAC-LE Stream Cipher
Designer:
Robert J. Jenkins Jr.
Published:
1996
References:
[see references for ISAAC-BE]
Key length:
?
Missing information:
[see ISAAC-BE]

× ISAAC-64-BE Stream Cipher
Designer:
Robert J. Jenkins Jr.
Published:
1996
References:
Key length:
?
Missing information:
ISAAC-64 does not appear to have a standard key schedule; this would need to be specified for it to be usable as a SCAN algorithm. Test vectors would also be needed.

× ISAAC-64-LE Stream Cipher
Designer:
Robert J. Jenkins Jr.
Published:
1996
References:
[see references for ISAAC-64-BE]
Key length:
?
Missing information:
[see ISAAC-BE]

? JEROBOAM Stream Cipher
Designers:
Hervé Chabanne, Emmanuel Michon
Published:
1998
Description:
This algorithm refers to JEROBOAM version 2.0.
Alias:
"JEROBOAM-2.0"
References:
Key length:
128 or 248 bits
Missing information:
I have not yet read either of the referenced papers, so I don't know whether byte-order is specified, status of test vectors, etc.

× LEVIATHAN-BE Stream Cipher
Designers:
David McGrew, Scott Fluhrer
Published:
October 2000
Description:
This is LEVIATHAN using big-endian byte order, when XORing the keystream with the plaintext for encryption.
References:
Key length:
128 or 256 bits
Security comment:
The output of LEVIATHAN can be distinguished from a random stream given about ??? MBytes of output.

× LEVIATHAN-LE Stream Cipher
Designers:
David McGrew, Scott Fluhrer
Published:
October 2000
Description:
This is LEVIATHAN using little-endian byte order, when XORing the keystream with the plaintext for encryption.
References:
[see references for LEVIATHAN-BE]
Key length:
128 or 256 bits
Security comment:
[see Security comment for LEVIATHAN-BE]

LOKI91 Block Cipher
Designers:
Laurence Brown, Matthew Kwan, Josef Pieprzyk, Jennifer Seberry
Published:
1991-92
References:
Key length:
64 bits.
Block size:
8 bytes.
Security comments:

LOKI97 Block Cipher
Designers:
Laurence Brown, Josef Pieprzyk, Jennifer Seberry
Published:
1997
References:
Key length:
128, 192 or 256 bits; default 128 bits.
Block size:
16 bytes.
Security comment:
The paper "Weaknesses in LOKI97" describes an attack using Differential Cryptanalysis, estimated as requiring at most 256 chosen plaintexts, and an attack using Linear Cryptanalysis, estimated as requiring at most 256 known plaintexts.

MAGENTA Block Cipher
Designers:
Michael Jacobson Jr., Klaus Huber
Published:
August 1998
References:
Key length:
128, 256, or 256 bits; default 128 bits.
Block size:
16 bytes.
Security comment:
The paper "Cryptanalysis of Magenta" describes a chosen plaintext attack using 264 chosen plaintexts, and 264 work. It also notes that "given a ciphertext, one can decrypt it by swapping its two halves, re-encrypting the result, and swapping again". This would be a fatal weakness for some applications, even though it does not allow obtaining the key.
Patent status:
MAGENTA may be patented (see references).

MARS Block Cipher
Designers:
Carolynn Burwick, Don Coppersmith, Edward D'Avignon, Rosario Gennaro, Shai Halevi, Charanjit Jutla, Stephen M. Matyas Jr., Luke O'Connor, Mohammad Peyravian, David Safford, Nevenko Zunicof
Published:
August? 1999
Description:
This is the "tweaked" version of MARS submitted as a second round AES candidate.
Alias:
"MARS-2"
References:
Key length:
Minimum 128, maximum 448, multiple of 32 bits; default 128 bits.
Block size:
16 bytes.
Patent status:
IBM has a patent pending on MARS. It has said that "... we are making MARS available on a royalty-free basis, worldwide, regardless of AES outcome." (See this press release.) However, it is not clear whether "royalty-free" excludes the possibility of up-front license fees.

? MDC Stream Cipher
Designer:
Peter Gutmann
Published:
October 1992
References:
Key length:
Minimum 64, maximum 640, multiple of 8 bits; default 128 bits.
Missing information:
Test vectors.
Comments:
Security comment:
A new random IV should be used for each message encrypted under a given key.

MISTY1[(rounds)] Block Cipher
Designer:
M. Matsui
Published:
January 1997
References:
Parameters:
Key length:
128 bits.
Block size:
8 bytes.

? MISTY2[(rounds)] Block Cipher
Designer:
M. Matsui
Published:
January 1997
References:
Parameters:
Key length:
128 bits.
Block size:
8 bytes.
Missing information:
Test vectors.

Noekeon[(rounds)] Block Cipher
Designers:
Joan Daemen, Michaël Peeters, Gilles van Assche, Vincent Rijmen
Published:
November 2000
References:
Parameters:
Key length:
128 bits.
Block size:
16 bytes.

Noekeon-Direct[(rounds)] Block Cipher
Designers:
Joan Daemen, Michaël Peeters, Gilles van Assche, Vincent Rijmen
Published:
November 2000
Description:
This is the "direct-key" variant of Noekeon, i.e. where the working key is provided directly. This key should be generated at random, or as the output of a hash or PRF.
References:
Parameters:
Key length:
128 bits.
Block size:
16 bytes.

? Panama Stream Cipher
Designers:
Joan Da