indicates an inverse transformation) QARMA is an
Even–Mansour cipher using three stages, with
whitening keys
w0 and
w1 XORed in between: • permutation F is using
core key
k0 and parameterized by a tweak
T. It has
r rounds inside (r = 7 for QARMA-64, r = 11 for QARMA-128); • "central" permutation C is using key
k1 and is designed to be reversible via a simple key transformation (contains two
central rounds); • the third permutation is an inverse of the first (
r more rounds). All keys are derived from the
master encryption key K using
specialisation: • K is partitioned into halves as w0
Concatenation k0, each will have
halfsize bits; • for encryption w1 = (w0
>>> 1) + (w0
>> (halfsize-1)); • for encryption k1 = k0; • for decryption, the same design can be used as long as k0+α is used as a core key, k1 = Q•k0, w1 and w0 are swapped. α here is a special constant and Q a special
involutary matrix. This construct is similar to the
alpha reflection in PRINCE. s. |thumb|500px The data is split into 16
cells (4-bit
nibbles for QARMA-64, 8-bit
bytes for QARMA-128). Internal state also contains 16 cells, arranged in a 4x4 matrix, and is initialized by plaintext (XORed with w0). In each round of \digamma, the state is transformed via operations \tau, M, S: • \tau is
ShuffleCells, a
MIDORI permutation of cells ([ 0, 11, 6, 13, 10, 1, 12, 7, 5, 14, 3, 8, 15, 4, 9, 2]); • M is
MixColumns: each column is multiplied by a fixed matrix M; • S is
SubCells: each cell is transformed using an
S-box. The tweak for each round is updated using h, \omega: • h is a cell permutation from MANTIS ([ 6, 5, 14, 15, 0, 1, 2, 3, 7, 12, 13, 4, 8, 9, 10, 11]); • \omega is an
LFSR applied to each of the cells with numbers [0, 1, 3, 4, 8, 11, 13]. For QARMA-64, the LFSR is (b3, b2, b1, b0) ⇒ (b0 + b1, b3, b2, b1), for QARMA-128, (b7, b6, ..., b0) ⇒ (b0 + b2, b7, b6, ..., b1), The rounds of \overline \digamma consist of inverse operations \overline \tau, \overline M, \overline S, \overline h, \overline \omega. Central rounds, in addition to two rounds (\tau, M, S and \overline \tau, \overline M, \overline S), include multiplication of the state by an involutary matrix
Q. == References ==