Machine Translated by Google

128-bit block cipher LEA

specification
Machine Translated by Google
Machine Translated by Google

index

1. Overview... ·······················································································. ············································One

2. Composition and scope... ·······················································································. ······························One

3. Definitions and abbreviations ··························································································································· ·······················································································. ·····················One

4. Symbols and notations······························································· ·······················································································. ······················································································3

4.1. sign ················································· ·······················································································. ·······························································································3

4.2. Mark ················································· ·······················································································. ·························································5

5. Block cipher LEA... ·······················································································. ·······································7

5.1. standard ················································· ·······················································································. ·············································7

5.2. encryption ················································· ·······················································································. ·······································7

5.3. Decryption··························································· ·······················································································. ······················································12

Appendix ÿ. Reference implementation value... ·······················································································. ·················································16

Machine Translated by Google
Machine Translated by Google

128-bit block cipher LEA

1. Overview

Block cipher LEA (Lightweight Encryption Algorithm) is an algorithm that encrypts 128-bit data blocks. It can use 128-, 192-,

and 256-bit secret keys, and its use can be classified according to the required safety standards. The round function of LEA

(Lightweight Encryption Algorithm) consists only of ARX (Addition, Rotation, XOR) operations in 32-bit units, so these

operations

It operates at high speed on a general-purpose 32-bit software platform that supports . Also the round function

The internal ARX (Addition, Rotation, XOR) operation arrangement ensures sufficient safety and at the same time

A lightweight implementation is possible by excluding the use of S-box.

2. Composition and scope

This specification describes the overall structure and internal round functions of the 128-bit block cipher LEA, and the

Also, in the process of generating a round key that acts as a secret element of the round function during the encryption and decryption process,

Describe about it.

3. Definitions and abbreviations

3.1. Term Definition

3.1.1. internal state

Median value seen during encryption, decryption, or key scheduling

3.1.2. round key

A value created through key schedule. Applies to encryption and decryption functions

3.1.3. round function

Function repeatedly performed in encryption or decryption function

3.1.4. Decryption (process)

A series of conversions that change ciphertext into plaintext using a secret key.

Consists of a secret key schedule

- One -
Machine Translated by Google

3.1.5. decryption function

A function that takes input of round keys and ciphertext and outputs plaintext.

3.1.6. block

fixed length bit string

3.1.7. block cipher

An algorithm that encrypts or decrypts fixed-length blocks of data using a secret key.

Rhythm

3.1.8. secret key

Secret information used for encryption or decryption. Enter key schedule

3.1.9. cryptogram

Information encrypted from plaintext

3.1.10. Encryption (Course)

A series of conversions that change plaintext into ciphertext using a secret key, using an encryption function and

Consists of an encryption key schedule

3.1.11. encryption function

A function that takes input of round keys and plaintext and outputs ciphertext.

3.1.12. key schedule

The process of receiving a secret key and generating round keys

3.1.13. Plain text

Original, unencrypted information

-2-
Machine Translated by Google

3.1.14. Type

Type of variable. bit, byte, or word

3.2. abbreviation

ARX Addition, Rotation, XOR

LEAs Lightweight Encryption Algorithm

4. Symbols and notations

4.1. sign

a mod n For an integer a and an integer n (> 0), the remainder of dividing a by n

BitToInt(x) 32-bit string x = x31 ÿ x30 ÿ … ÿ For x0 input + … + x31•2

0
Integer n = x0•2 + x1•2 Function that outputs 31
One

C cryptogram. Byte array C = (C[0], C[1], … , Notated as C[15])

Decrypt Decryption function. Rounds generated from secret keys by key schedule
Decrypt the ciphertext into plaintext using the key.

ÿ Constants used in key schedules. Expressed as word array ÿ = (ÿ[0], ÿ[1], … ,

ÿ[7])

Encrypt Encryption function. Rounds generated from secret keys by key schedule
Encrypt plaintext into ciphertext using a key

K Secret key. Byte array K = (K[0], K[1], … , Notated as K[Nk - 1])

k The number of bits that make up the secret key. For LEAs, k = 128, 192, or 256
is used.

Nb The number of bytes that make up plaintext or ciphertext. Fixed at Nb = 16 for

LEA

Nk Number of bytes that make up the secret key. For LEA, Nk = 16, 24, or 32 is
used.

Nr Number of rounds. Determined by Nk. For LEA Nr = 24, 28, and

is used as 32

-3-
Machine Translated by Google

32 0 +
IntToBit(n) 0 to 2 – For integers n up to 1, n = x0•2 + x1•2 One

… + x31•2 32 -bit string x that satisfies 31 = x31 ÿ x30 ÿ … ÿ Function that

outputs x0
enc
KeySchedulei Round key RKienc (0 ÿ
A function that produces i ÿ (Nr – 1))
dec dec
KeySchedulei Round key RKi required for decryption from k-bit secret key K (0 ÿ
A function that produces i ÿ (Nr – 1))

P Plain text. Byte array P = (P[0], P[1], … , Notated as P[15])

ROLi(x) Left circular shift of i bit of 32-bit bit string x

RORi(x) Right circular shift of i bit of 32-bit bit string x

Roundenc Crypto round function

Rounddec Decryption round function

enc
RKi 192-bit round used in the ith round function of the encryption process
Deki. Word array RKienc = (RKienc[0], RKienc[1], … , denoted as
RKienc[5])
dec
RKi 192-bit round used in the ith round function of the decryption process
dec
Deki. Word array RKi = (RKi dec[0], RKi dec[1], … , RKi dec[5])
marked
T Internal state variable used to generate the round key of the key schedule. secret
It has the same length as the key and is a word array T = (T[0], T[1], … ,
Notated as T[Nk/4 – 1])

Xi 128-bit internal state change input to the ith round function of the encryption
or decryption function or output from the (i – 1)th round function
number. It has the same length as the plaintext and is a word array Xi = (Xi[0], Xi[1],
Notated as Xi[2], Xi[3])
xÿy Concatenation of two bit strings x and y

xÿy XOR (eXclusive OR) of two bit strings x and y with the same length

xÿy The operation defined as IntToBit(BitToInt(x) + BitToInt(y) mod 2 32) on two

32-bit strings x and y.

xÿy The operation defined as IntToBit(BitToInt(x) - BitToInt(y) mod 2 32) on two

32-bit strings x and y.

YÿX Operation that substitutes the bit string of X into Y

-4-
Machine Translated by Google

4.2. Mark

4.2.1. Algorithm variable notation

The plaintext and ciphertext of the block cipher LEA are each a 128-bit long bit string, and the secret keys are 128 and 19.

2, or a bit string of 256 bits in length. LEA's secret key, plaintext, and ciphertext are expressed as a byte array.

The internal state variables and round keys used in the encryption, decryption, and key schedule processes are
expressed as a word array.

4.2.2. Byte array conversion of input bit string

In this specification, byte refers to a bit string of 8 bits in length. Input bit string inp of length 8n

… , from input8n-1, byte arrays A[0], A[1], A[2], … ut0, input1, input2, , A[n – 1] is
It is given as follows, and the order is as shown in <Table 4-1>.

A[i] := input8i ÿ input8i+1 ÿ … ÿ input8i+7 (0 ÿ i ÿ (n - 1)).

<Table 4-1> Relationship between input bit sequence and byte array

Input bit string 0 One … 7 8 9 … 15 … 8n-8 8n-7 … 8n-1

byte array 0 One

… n-1

4.2.3. Converting between byte array and word array

In this specification, word x is a 32-bit long bit string x31 ÿ x30 ÿ … ÿ means x0 , which means
The number BitToInt corresponds to any integer between 0 and (232 - 1). Conversely, 0 and (232 - 1)
Its integer n corresponds to some word by the function IntToBit. In this specification, byte or

Word values are expressed using hexadecimal notation, which divides the bits of a byte or word into 4 ratios.
Each bit is grouped and the 4 bits are expressed by corresponding to a single character as shown in <Table 4-2>.

<Table 4-2> Hexadecimal representation of bit pattern

bit pattern character bit pattern character bit pattern character bit pattern character

0000 0 0100 4 1000 8 1100 c

0001 One 0101 5 1001 9 1101 d

0010 2 0110 6 1010 a 1110 e

0011 3 0111 7 1011 b 1111 f

-5-
Machine Translated by Google

The operation B ÿ A introduced in Section 4.1 is specifically defined as follows.

ÿ If A and B are bits, bytes, or words of the same type: B has the same bit string as A

ÿ If A is a byte array and B is a word: B contains the bit strings A = (A[0], A[1], A[2], A[3])

B = A[3] ÿ A[2] ÿ A[1] ÿ A[0]

Substituted as

ÿ If A and B are arrays of the same type: B = (B[0], B[1], … , B[n - 1]) to A = (A[0], A[1],
… , A[n - 1]) bit strings

B[i] = A[i] (0 ÿ i ÿ (n - 1))

Substituted to satisfy

ÿ If A is a byte array and B is a word array: B = (B[0], B[1], … , A = (A in B[n - 1])

[0], A[1], … , A[4n - 1]) bit strings

B[i] = A[4i + 3] ÿ A[4i + 2] ÿ A[4i + 1] ÿ A[4i] (0 ÿ i ÿ (n - 1))

Substituted to satisfy

ÿ If A is a word array and B is a byte array: B = (B[0], B[1], … , A = B[4n - 1])

(A[0], A[1], … , A[n - 1]) bit strings

A[i] = B[4i + 3] ÿ B[4i + 2] ÿ B[4i + 1] ÿ B[4i] (0 ÿ i ÿ (n - 1))

Substituted to satisfy

The relationship between byte array, word array, and bit index within a word is summarized in <Table 4-3>.

<Table 4-3> Relationship between byte array, word array, and bit index within word

byte array 3 2 One 0 7 6 5 4 … 4n-1 4n-2 4n-3 4n-4

word arrangement 0 One

… n-1

Bit index within word 31 … 0 31 … 0 … 31 … 0

-6-
Machine Translated by Google

5. Block cipher LEA

5.1. standard

In this specification, LEA is divided into LEA-128, LEA-192, and LEA-256 according to each key length.

all. The specifications of block cipher LEA can be summarized as <Table 5-1>. The block length is expressed as Nb bytes, the

secret key length as Nk bytes, and the number of rounds as Nr.

<Table 5-1> LEA specifications

division Nb Nk Nr

LEA-128 16 16 24

LEA-192 16 24 28

LEA-256 16 32 32

The overall operation process of LEA is shown in (Figure 5-1).

(Figure 5-1) Encryption and decryption process

5.2. encryption

The encryption process of LEA starts with a k-bit key K and generates Nr 192-bit encryption round keys RKienc (0

ÿ i ÿ (Nr - 1)), a key schedule function KeySchedulekenc, a round key RKienc , and a round

-7-
Machine Translated by Google

An encryption function that converts 128-bit plaintext P into 128-bit ciphertext C using the function Roundenc.
It consists of Encrypt.

5.2.1. encryption function

LEA's encryption function Encrypt uses the key schedule function KeySchedulekenc for the k-bit key K.
Nr 192-bit round keys generated by performing

RKienc = (RKienc[0], RKienc[1], …

, RKienc[5]) (0 ÿ i ÿ (Nr - 1))

and 128-bit plaintext P = (P[0], P[1], … , P[15]) is input and algorithm 1 is performed to obtain 128 ratio.
ciphertext C = (C[0], C[1], … , C[15]) is output.

e nc
Algorithm 1 encryption function: C ÿ Encrypt(P, RK0 enc, RK1 enc, … , R.K.N. - One)
r
e nc
Input: 128-bit plaintext P, Nr 192-bit round keys RK0 enc, RK1 enc, … , R.K.N. -
r One

Output: 128-bit ciphertext C

1:_
2: for i = 0 to (Nr - 1) do
3:
Xi+1 ÿ Roundenc(Xi, RKi enc)
4: end for
5: C ÿ

In Algorithm 1, the round function Roundenc of the i (0 ÿ i ÿ (Nr - 1))th round is within 128 bits.
State variable

Xi = (Xi[0], Xi[1], Xi[2], Xi[3])

and 192-bit round key

RKienc = (RKienc[0], RKienc[1], …

, RKienc[5])

Perform Algorithm 2 from to create a new 128-bit internal state variable.

Xi+1 = (Xi+1[0], Xi+1[1], Xi+1[2], Xi+1[3])

creates .

-8-
Machine Translated by Google

Algorithm 2 The ith round function of the encryption process: Xi+1 ÿ Roundenc(Xi, RKi enc)
enc
Input: 128-bit internal state variable Xi, 192-bit round key RKi Output:
128-bit internal state variable Xi+1

1: Xi+1[0] ÿ ROL9((Xi[0] ÿ RKi enc[0]) ÿ (Xi[1] ÿ RKi enc[1]))

2: Xi+1[1] ÿ ROR5((Xi[1] ÿ RKi enc[2]) ÿ (Xi[2] ÿ RKi enc[3]))

3: Xi+1[2] ÿ ROR3((Xi[2] ÿ RKi enc[4]) ÿ (Xi[3] ÿ RKi enc[5]))

4: Xi+1[3] ÿ Xi[0]

(Figure 5-2) is a diagrammatic representation of the ith round function of the encryption process.

(Figure 5-2) i-th round function of the encryption process (0 ÿ i ÿ (Nr - 1))

5.2.2. Encryption key schedule

enc
Nr 192-bit encryption round keys RKi required for the encryption process from key K (0 ÿ i ÿ (N
Describes the key schedule process for generating r-1)).
The 32-bit constants ÿ[i] (0 ÿ i ÿ 7) used in the key schedule function are as follows.

-9-
Machine Translated by Google

ÿ[0] = c3efe9db, ÿ[1] = 44626b02;

ÿ[2] = 79e27c8a, ÿ[3] = 78df30ec;

ÿ[4] = 715ea49e; ÿ[5] = c785da0a,

ÿ[6] = e04ef22a, ÿ[7] = e5c40957.

128-bit key K = (K[0], K[1], … , For K[15]), c used for encryption of LEA-128 is 24 192-bit

Key schedule function KeySchedule1 e2n8encryption round keys

RKienc = (RKienc[0], RKienc[1], … , RKienc[5]) (0 ÿ i ÿ 23)

is generated as in Algorithm 3, and in this process, the 128-bit internal state variable T = (T[0], T[1], T
[2], T[3]) are used.

e en
Algorithm 3 LEA-128 encryption key schedule function: (RK0 enc, … , RK23nc) ÿ KeySchedule1 c(K)
28

Input: 128-bit secret key K

enc
Output: 24 192-bit encrypted roundkey RKi (0 ÿ i ÿ 23)
1: T ÿ K

2: for i = 0 to 23 do

3: T[0] ÿ ROL1(T[0] ÿ ROLi(ÿ[i mod 4]))

4: T[1] ÿ ROL3(T[1] ÿ ROLi+1(ÿ[i mod 4]))
5: T[2] ÿ ROL6(T[2] ÿ ROLi+2(ÿ[i mod 4]))
6: T[3] ÿ ROL11(T[3] ÿ ROLi+3(ÿ[i mod 4]))
enc
7: RKi ÿ (T[0], T[1], T[2], T[1], T[3], T[1])
8:end for

192-bit key K = (K[0], K[1], … , Key schedule function used for encryption of LEA-192 for K[23])

KeySchedule1 e9n 2 c is 28 192-bit encryption round keys

…
RKienc = (RKienc[0], RKienc[1] , , RKienc[5]) (0 ÿ i ÿ 27)

is generated as in Algorithm 4, and in this process, the 192-bit internal state variable T = (T[0], T[1], …
, T[5]) is used.

- 10 -
Machine Translated by Google

e en
Algorithm 4 LEA-192 encryption key schedule function: (RK0 enc, … , RK27nc) ÿ KeySchedule1 c(K)
92

Input: 192-bit secret key K

enc
Output: 28 192-bit encrypted roundkey RKi (0 ÿ i ÿ 27)

1: T ÿ K

2: for i = 0 to 27 do

3: T[0] ÿ ROL1(T[0] ÿ ROLi(ÿ[i mod 6]))

4: T[1] ÿ ROL3(T[1] ÿ ROLi+1(ÿ[i mod 6]))
5: T[2] ÿ ROL6(T[2] ÿ ROLi+2(ÿ[i mod 6]))
6: T[3] ÿ ROL11(T[3] ÿ ROLi+3(ÿ[i mod 6]))
7: T[4] ÿ ROL13(T[4] ÿ ROLi+4(ÿ[i mod 6]))
8: T[5] ÿ ROL17(T[5] ÿ ROLi+5(ÿ[i mod 6]))
enc
9: RKi ÿ (T[0], T[1], T[2], T[3], T[4], T[5])
10:end for

256-bit key K = (K[0], K[1], … , Key schedule function KeySchedule2 e5n 6 used for encryption of LEA-256 for K[31])

c is 32 192-bit encryption round keys

RKienc = (RKienc[0], RKienc[1], … , RKienc[5]) (0 ÿ i ÿ 31)

is generated as in Algorithm 5, and in this process, the 256-bit internal state variable T = (T[0], T[1], …
, T[7]) is used.

e en
Algorithm 5 LEA-256 encryption key schedule function: (RK0 enc, … nc) ÿ KeySchedule2
, RK3 One
c(K)
56

Input: 256-bit secret key K

enc
Output: 32 192-bit encrypted roundkey RKi (0 ÿ i ÿ 31)

1: T ÿ K

2: for i = 0 to 31 do

3: T[6i mod 8] ÿ ROL1(T[6i mod 8] ÿ ROLi(ÿ[i mod 8]))

4: T[(6i + 1) mod 8] ÿ ROL3(T[(6i + 1) mod 8] ÿ ROLi+1(ÿ[i mod 8]))
5: T[(6i + 2) mod 8] ÿ ROL6(T[(6i + 2) mod 8] ÿ ROLi+2(ÿ[i mod 8]))
6: T[(6i + 3) mod 8] ÿ ROL11(T[(6i + 3) mod 8] ÿ ROLi+3(ÿ[i mod 8]))
7: T[(6i + 4) mod 8] ÿ ROL13(T[(6i + 4) mod 8] ÿ ROLi+4(ÿ[i mod 8]))
8: T[(6i + 5) mod 8] ÿ ROL17(T[(6i + 5) mod 8] ÿ ROLi+5(ÿ[i mod 8]))
enc
9: ÿ (T[6i mod 8], T[(6i + 1) mod 8], T[(6i + 2) mod 8], T[(6i + 3) mod 8],
RKi
T[(6i + 4) mod 8], T[(6i + 5) mod 8])
10:end for

- 11 -
Machine Translated by Google

5.3. decryption

dec
The decryption process of LEA consists of Nr 192-bit decryption round keys RKi from k-bit key K. (0
dec
Decryption is performed by converting 128-bit ciphertext C into 128-bit plaintext P using key schedule function
KeySchedulek dec, which generates ÿ i ÿ (Nr - 1)), round key RKi , and round function Rounddec.

It consists of number Decrypt.

5.3.1. decryption function

LEA's decryption function Decrypt uses the key schedule function KeySchedulek dec for the k-bit key K.
Nr 192-bit round keys generated by performing

dec
RKi = (RKi dec[0], RKi dec[1], … , RKi dec[5]) (0 ÿ i ÿ (Nr - 1))

and 128-bit ciphertext C = (C[0], C[1], … bit , C[15]) is input and algorithm 6 is performed to obtain 128
plaintext P = (P[0], P[1], … , P[15]) is output.

dec
Algorithm 6 Decryption function: P ÿ Decrypt(C, RK0 dec, RK1 dec, … , r- One)

d ec
RKN input: 128-bit ciphertext C, Nr 192-bit round keys RK0 dec, RK1 dec, … , r- One

RKN output: 128-bit plaintext P

1: X0 ÿ C 2:
for i = 0 to (Nr - 1) do

3: Xi+1 ÿ Rounddec(Xi, RKi dec)

4:end for
5: P ÿ

In Algorithm 6, the round function Rounddec of the i (0 ÿ i ÿ (Nr - 1))th round is within 128 bits.
State variable

Xi = (Xi[0], Xi[1], Xi[2], Xi[3])

and 192-bit round key

dec
RKi = (RKi dec[0], RKi dec[1], … , RKi dec[5])

Perform Algorithm 7 from to create a new 128-bit internal state variable.

Xi+1 = (Xi+1[0], Xi+1[1], Xi+1[2], Xi+1[3])

creates .

- 12 -
Machine Translated by Google

Algorithm 7 ith round function of decoding process: Xi+1 ÿ Rounddec(Xi, RKi dec)
dec
Input: 128-bit internal state variable Xi, 192-bit round key RKi Output:
128-bit internal state variable Xi+1

1: Xi+1[0] ÿ Xi[3]

2: Xi+1[1] ÿ (ROR9(Xi[0]) ÿ (Xi+1[0]ÿRKi dec[0])) ÿ RKi dec[1]

3: Xi+1[2] ÿ (ROL5(Xi[1]) ÿ (Xi+1[1]ÿRKi dec[2])) ÿ RKi dec[3]
4: Xi+1[3] ÿ (ROL3(Xi[2]) ÿ (Xi+1[2]ÿRKi dec[4])) ÿ RKi dec[5]

(Figure 5-3) is a diagrammatic representation of the ith round function of the decoding process.

(Figure 5-3) i-th round function of the decoding process (0 ÿ i ÿ (Nr - 1))

5.3.2. Decryption key schedule

dec
Nr decryption round keys RKi required for the decryption process from key K (0 ÿ i ÿ (Nr - 1))
The key schedule process for generating is explained. Encryption round key and decryption round key

dec
RKi = RKNe rn-c i-1 (0 ÿ i ÿ (Nr - 1))

Except for the relationship, it is created in the same way and the same constants are used.

- 13 -
Machine Translated by Google

128-bit key K = (K[0], K[1], … , 2 e8 c used for decryption of LEA-128 for K[15]) is 24 192-bit
d
Key schedule function KeySchedule1decryption round keys

dec
RKi = (RKi dec[0], RKi dec[1], … , RKi dec[5]) (0 ÿ i ÿ 23)

is generated as in Algorithm 8, and in this process, the 128-bit internal state variable T = (T[0], T[1], T
[2], T[3]) are used.

d de
Algorithm 8 LEA-128 decryption key schedule function: (RK0 dec, … , RK23ec) ÿ KeySchedule1 28
c(K)
Input: 128-bit secret key K
dec
Output: 24 192-bit decryption roundkey RKi (0 ÿ i ÿ 23)
1: T ÿ K
2: for i = 0 to 23 do
3: T[0] ÿ ROL1(T[0] ÿ ROLi(ÿ[i mod 4]))
4: T[1] ÿ ROL3(T[1] ÿ ROLi+1(ÿ[i mod 4]))
5: T[2] ÿ ROL6(T[2] ÿ ROLi+2(ÿ[i mod 4]))
6: T[3] ÿ ROL11(T[3] ÿ ROLi+3(ÿ[i mod 4]))
dec
7: RK23- i
ÿ (T[0], T[1], T[2], T[1], T[3], T[1])
8:end for

192-bit key K = (K[0], K[1], … , e2 c , used for decryption of LEA-192 for K[23]), is 28 192-bit
d
Key schedule function KeySchedule19decryption round keys

dec
RKi = (RKi dec[0], RKi dec[1], … , RKi dec[5]) (0 ÿ i ÿ 27)

is generated as in Algorithm 9, and in this process, the 192-bit internal state variable T = (T[0], T[1],
… , T[5]) is used.

d de
Algorithm 9 LEA-192 decryption key schedule function: (RK0 dec, … , RK27ec) ÿ KeySchedule1 92
c(K)
Input: 192-bit secret key K
dec
Output: 28 192-bit decryption roundkey RKi (0 ÿ i ÿ 27)
1: T ÿ K
2: for i = 0 to 27 do
3: T[0] ÿ ROL1(T[0] ÿ ROLi(ÿ[i mod 6]))
4: T[1] ÿ ROL3(T[1] ÿ ROLi+1(ÿ[i mod 6]))
5: T[2] ÿ ROL6(T[2] ÿ ROLi+2(ÿ[i mod 6]))
6: T[3] ÿ ROL11(T[3] ÿ ROLi+3(ÿ[i mod 6]))
7: T[4] ÿ ROL13(T[4] ÿ ROLi+4(ÿ[i mod 6]))
8: T[5] ÿ ROL17(T[5] ÿ ROLi+5(ÿ[i mod 6]))
de c
9: RK27- i
ÿ (T[0], T[1], T[2], T[3], T[4], T[5])

- 14 -
Machine Translated by Google

10:end for

256-bit key K = (K[0], K[1], … , used for decoding LEA-256 for K[31])
d
Key schedule function KeySchedule25 e6 c is 32 192-bit decryption round keys

dec
RKi = (RKi dec[0], RKi dec[1], … , RKi dec[5]) (0 ÿ i ÿ 31)

is generated as in Algorithm 10, and in this process, the 256-bit internal state variable T = (T[0], T[1],
… , T[7]) is used.

d de
Algorithm 10 LEA-256 decryption key schedule function: (RK0 dec, … ec) ÿ KeySchedule2
, RK3 One
56
c(K)
Input: 256-bit secret key K
dec
Output: 32 192-bit decryption roundkeys RKi (0 ÿ i ÿ 31)
1: T ÿ K

2: for i = 0 to 31 do

3: T[6i mod 8] ÿ ROL1(T[6i mod 8] ÿ ROLi(ÿ[i mod 8]))

4: T[(6i + 1) mod 8] ÿ ROL3(T[(6i + 1) mod 8] ÿ ROLi+1(ÿ[i mod 8]))
5: T[(6i + 2) mod 8] ÿ ROL6(T[(6i + 2) mod 8] ÿ ROLi+2(ÿ[i mod 8]))
6: T[(6i + 3) mod 8] ÿ ROL11(T[(6i + 3) mod 8] ÿ ROLi+3(ÿ[i mod 8]))
7: T[(6i + 4) mod 8] ÿ ROL13(T[(6i + 4) mod 8] ÿ ROLi+4(ÿ[i mod 8]))
8: T[(6i + 5) mod 8] ÿ ROL17(T[(6i + 5) mod 8] ÿ ROLi+5(ÿ[i mod 8]))
de c
RK3 -
i
ÿ (T[6i mod 8], T[(6i + 1) mod 8], T[(6i + 2) mod 8], T[(6i + 3) mod 8],
9: One

T[(6i + 4) mod 8], T[(6i + 5) mod 8])

10:end for

- 15 -
Machine Translated by Google

Appendix ÿ

Reference implementation value

ÿ.1. code

All reference implementation values follow the following conventions.

ÿ All values are expressed in hexadecimal.

ÿ When byte array A is given as follows, the array indices from the left are 0, 1,… corresponds to

0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0

That is, A[0] = 0f, A[1] = 1e, … , A[15] = f0

ÿ When word array A is given as follows, the array indices from the left are 0, 1,… corresponds to

003a0fd4 02497010 194f7db1 02497010 090d0883 02497010

That is, A[0] = 003a0fd4, A[1] = 02497010, … , A[5] = 02497010

ÿ Secret key K, plaintext P, and ciphertext C are expressed as a byte array.

ÿ Round key RKienc (0 ÿ i ÿ (Nr - 1)), internal state variable Xi (0 ÿ i ÿ Nr) expressed as a word array

ÿ Byte array and word array follow the conversion convention (Section 4.2.3)

The internal state variables and decryption round key of the decryption process are the internal state variables of the encryption process and

This can be confirmed using the relationship of the reverse order of the encryption round key.

- 16 -
Machine Translated by Google

ÿ.2. LEA-128 encryption

ÿ.2.1. encryption function

K 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0

P 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f

X0 13121110 17161514 1b1a1918 1f1e1d1c

X1 0f079051 693d668d e5edcfd4 13121110
X2 3fc44a2d f767ea2a a0b67cf0 0f079051
X3 99e912cd 906fd05d 4d293e55 3fc44a2d
X4 43048c71 5faa8d15 dfc687fb 99e912cd
X5 862a337d 419f623d 4b97dd8a 43048c71
X6 055b3a34 a2eb0f67 af9873ba 862a337d
X7 38875cb8 19f1c052 02e13d1c 055b3a34
X8 f1ddbcca 2c031302 8a5f86d6 38875cb8
X9 f770a17e c47d9365 2df8cda7 f1ddbcca
X10 58a898f4 db57aa1e 20d820a4 f770a17e
X11 11c9f487 bf079d6e 28c10b82 58a898f4
X12 a7e4a0e4 e8e97f62 47727e5f 11c9f487
X13 d1ea924a 2298587f f2afc1d0 a7e4a0e4
X14 7e91cf8c fcca259f 86ab69cf d1ea924a
X15 809fd3e9 ef492067 536df05e 7e91cf8c
X16 2b54eee2 98b175f9 d9c14ac4 809fd3e9
X17 63eb48a2 7ad2716d 783a355e 2b54eee2
X18 4b34e264 101d5f00 7fee2017 63eb48a2
X19 ba42cf9e d156295c b88c1f9d 4b34e264
X20 970433ea a0d420cb 4b96b2c1 ba42cf9e
X21 49facf18 6f1fe3c2 3744e7b8 970433ea
X22 d1527e90 6ce66afe 1d55c7f1 49facf18
X23 fd8b6404 8675df3b e4b9d73f d1527e90
X24 354ec89f 18c6c628 a7c73255 fd8b6404

C 9f c8 4e 35 28 c6 c6 18 55 32 c7 a7 04 64 8b fd

- 17 -
Machine Translated by Google

ÿ.2.2. Encryption key schedule

K 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0
enc
RK0 003a0fd4 02497010 194f7db1 02497010 090d0883 02497010
enc
RK1 11fdcbb1 9e98e0c8 18b570cf 9e98e0c8 9dc53a79 9e98e0c8
enc
RK2 f30f7bb5 6d6628db b74e5dad 6d6628db a65e46d0 6d6628db
enc
RK3 74120631 dac9bd17 cd1ecf34 dac9bd17 540f76f1 dac9bd17
enc
RK4 662147db c637c47a 46518932 c637c47a 23269260 c637c47a
enc
RK5 e4dd5047 f694285e e1c2951d f694285e 8ca5242c f694285e
enc
RK6 baf8e5ca 3e936cd7 0fc7e5b1 3e936cd7 f1c8fa8c 3e936cd7
enc
RK7 5522b80c ee22ca78 8a6fa8b3 ee22ca78 65637b74 ee22ca78
enc
RK8 8a19279e 6fb40ffe 85c5f092 6fb40ffe 92cc9f25 6fb40ffe
enc
RK9 9dde584c cb00c87f 4780ad66 cb00c87f e61b5dcb cb00c87f
e nc
RK10 4fa10466 f728e276 d255411b f728e276 656839ad f728e276
e nc
RK1 9250d058 51bd501f 1cb40dae 51bd501f 1abf218d 51bd501f
One

e nc
RK12 21dd192d 77c644e2 cabfaa45 77c644e2 681c207d 77c644e2
e nc
RK13 de7ac372 9436afd0 10331d80 9436afd0 f326fe98 9436afd0
e nc
RK14 fb3ac3d4 93df660e 2f65d8a3 93df660e df92e761 93df660e
e nc
RK15 27620087 265ef76e 4fb29864 265ef76e 2656ed1a 265ef76e
e nc
RK16 227b88ec d0b3fa6f c86a08fd d0b3fa6f a864cba9 d0b3fa6f
e nc
RK17 f1002361 e5e85fc3 1f0b0408 e5e85fc3 488e7ac4 e5e85fc3
e nc
RK18 c65415d5 51e176b6 eca88bf9 51e176b6 edb89ece 51e176b6
e nc
RK19 9b6fb99c 0548254b 8de9f7c2 0548254b b6b4d146 0548254b
e nc
RK20 7257f134 06051a42 36bcef01 06051a42 b649d524 06051a42
e nc
RK2 a540fb03 34b196e6 f7c80dad 34b196e6 71bc7dc4 34b196e6
One

e nc
RK22 8fbee745 cf744123 907c0a60 cf744123 8215ec35 cf744123
e nc
RK23 0bf6adba df69029d 5b72305a df69029d cb47c19f df69029d

- 18 -
Machine Translated by Google

ÿ.3. LEA-192 encryption

ÿ.3.1. encryption function

K 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0 f0 e1 d2 c3 b4 a5 96 87

P 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f

X0 23222120 27262524 2b2a2928 2f2e2d2c

X1 0f085091 030483d2 be4ab9ef 23222120
X2 23fc7579 99fa0bb5 92d65065 0f085091
X3 1e64758b 6b19e366 3edbb998 23fc7579
X4 8da45638 d886dfdd 2da2b83c 1e64758b
X5 a29dfd15 d8687adf b89c47b4 8da45638
X6 34e43c2e b6268ba7 584086d7 a29dfd15
X7 df6e285b 88f26855 198fbb0c 34e43c2e
X8 e62dde25 dd1cdf46 b8049544 df6e285b
X9 d715e465 0e4d136e 35bc93a5 e62dde25
X10 1ab97de4 a5c19c64 cfd627b0 d715e465
X11 1a155930 4ccf6ee2 8c5136f7 1ab97de4
X12 0eef4d0d 9f3065e1 405fc8b9 1a155930
X13 a0dd5c61 fcefa1a4 48e2adc3 0eef4d0d
X14 dcf21fcc f9ca084f 0b02cdd8 a0dd5c61
X15 dfd53021 2eee92c5 eedfe48b dcf21fcc
X16 81dce833 4e0af1c2 3abac76b dfd53021
X17 9646ef75 607a7771 9fbc48ec 81dce833
X18 7f40d072 ac609c27 5de1c810 9646ef75
X19 fd0bae5f 35429a83 11f5e49f 7f40d072
X20 2feb9af2 0799218a e5374a5f fd0bae5f
X21 fd86cfee a7d97a82 7c97ed23 2feb9af2
X22 add0adf1 e09057e1 ccd95f65 fd86cfee
X23 06c45cfe 392aaa1d ae9fd56c add0adf1
X24 f3032315 b1df9d75 1627928d 06c45cfe
X25 f4eec840 6a15d699 2392c666 f3032315
X26 b353eb6a ad286c22 5a9d146d f4eec840
X27 f2c67476 44333e44 6d5a1045 b353eb6a
X28 325eb96f 871bad5a 35f5dc8c f2c67476

C 6f b9 5e 32 5a ad 1b 87 8c dc f5 35 76 74 c6 f2

- 19 -
Machine Translated by Google

ÿ.3.2. Encryption key schedule

K 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0 f0 e1 d2 c3 b4 a5 96 87
enc
RK0 003a0fd4 02497010 194f7db1 090d0883 2ff5805a c2580b27
enc
RK1 11fdcbb1 9e98e0c8 18b570cf 9dc53a79 5c145788 9771b5e5
enc
RK2 f30f7bb5 6d6628db b74e5dad a65e46d0 6f44da96 f643115f
enc
RK3 74120631 dac9bd17 cd1ecf34 540f76f1 aa1a5bdb fbafaae7
enc
RK4 13f8a031 34f28728 31fdb409 0e31481b df498117 cf9371f1
enc
RK5 0967c312 b3484ec8 3aae5b3d 5a9714a0 b2d4dd5f 3a1fcdf7
enc
RK6 0ac47404 59e9e54d a60dc00a 566139d3 898dce4f 582d72dd
enc
RK7 77f3ea4c e2a73c8d b8f1249a 6a172700 bc0e539c 2e46fdbb
enc
RK8 b4e0e98a 3d028c05 b8d3a050 dbd67bef df675c7a 99eefbb0
enc
RK9 e68584f6 ce31ef45 96c105ac 2a1be677 9d72b8b0 33cecc54
e nc
RK10 c22ffd76 1ab7167e 42bb3060 7da517f5 4aa0e8d3 0a070c3c
e nc
RK1 e200a765 c2be17b3 7f22543f 3e4eb7a1 c992a6f4 a783c823
One

e nc
RK12 c13cc747 ffcc8185 66514e9e e4ccc199 cd5c766d a004f676
e nc
RK13 1d3a1fa6 d46894ec f49c33e6 782fda7e 1fe6346c 0ffe981c
e nc
RK14 78b97c3d 956e8ee8 49ab721c 2672138a 037ea242 ce5fe8a4
e nc
RK15 225f7158 32d83e3e e118f6aa 1fb83751 4d27715c ed2fba4e
e nc
RK16 8dfbc56d e0a907db e4af091c 5e123225 d0e8d2e1 cc4501fb
e nc
RK17 8422a8f0 46a12f92 415152ad f55417f5 38738248 c6e29ded
e nc
RK18 5723715e abfa788c c3646af7 64af9186 8fc855ec 2bc36989
e nc
RK19 5e6b28e3 e0f5f592 eb3dd108 0551012a 50e4221d 97e85c0f
e nc
RK20 4e258e14 92298f0b 771269c3 6f934254 c0933b6b 421159b8
e nc
RK2 d76953f4 6a3e36be 53b656fb 610c22e0 9f399330 acf7e7e9
One

e nc
RK22 fe0b573b cbb73085 89ed67fc 77014cef e1b8431f ba1b4105
e nc
RK23 06de3450 b3f5b2fe df1cec27 fb22bd10 8e3de6fe 3d4acd27
e nc
RK24 c5444873 5bec968b 8b2af393 11e2f6ca 9cb3694f 94c56b91
e nc
RK25 939a1a93 27f101bb 5381bae7 48ebd1b1 f6d5fca7 0ca24bbc
e nc
RK26 7b03490b de00acfb c7f8abfe 410a14c1 d37932a9 14029327
e nc
RK27 bd948525 2c75004d c52486d5 0f07e2fa 1963e1fd 882719c3

- 20 -
Machine Translated by Google

ÿ.4. LEA-256 encryption

ÿ.4.1. encryption function

0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0
K
f0 e1 d2 c3 b4 a5 96 87 78 69 5a 4b 3c 2d 1e 0f
P 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f

X0 33323130 37363534 3b3a3938 3f3e3d3c

X1 0f0810d1 030583d2 a246bdef 33323130
X2 e370475a 379d1cd0 7b627f7b 0f0810d1
X3 a212c114 c5be3591 435bb556 e370475a
X4 90bcb059 94df55a0 d8e15ef6 a212c114
X5 4e5cc849 f484b5d8 ef0fc663 90bcb059
X6 a520787d ae3db194 fa2feb17 4e5cc849
X7 231a5d45 f338ad75 9d4b9850 a520787d
X8 dd744e80 0a6568a0 3f9c93a9 231a5d45
X9 d141f34e 311ba7ed b34c9f6f dd744e80
X10 f5a76166 3e00a130 b1f9a58d d141f34e
X11 af52973c c4befd35 aae4a642 f5a76166
X12 3df5e119 b8937ebb b4a7a6ab af52973c
X13 ede0ddb3 2c84bd26 2c86c203 3df5e119
X14 960f7157 477a5b5a 29659f76 ede0ddb3
X15 2c8d1d71 e0b54ae6 fbdd003c 960f7157
X16 720a9b5f 18bf274a 0a1af597 2c8d1d71
X17 1aa88202 c3867edc c49ce291 720a9b5f
X18 e16c34f7 69defa8b 15b2990f 1aa88202
X19 c7837b0b cf85d76f 17203201 e16c34f7
X20 a3061bb3 bbe1ce55 00a3f8e9 c7837b0b
X21 54f6bcfa c195ea5b b8280ef0 a3061bb3
X22 662f351e 49995ddc 4ef48970 54f6bcfa
X23 09db178e 4748e08a 30ba1411 662f351e
X24 751113cb 9a425ee2 200fee63 09db178e
X25 47d21a23 08561dff 86131859 751113cb
X26 f7aaf6ac 4f5eac5b f4247a5b 47d21a23
X27 8e952768 3de52e9b 367ed97c f7aaf6ac
X28 cb641a2d 8d161a90 dbd4a137 8e952768
X29 b6e87380 93b8b779 c9530e82 cb641a2d
X30 48bd3559 5ad96ae7 2e0feb8b b6e87380
X31 97e1f927 853a0309 487c41fc 48bd3559
X32 f6af51d6 c189b147 ca00893a 97e1f927

C d6 51 af f6 47 b1 89 c1 3a 89 00 ca 27 f9 e1 97

- 21 -
Machine Translated by Google

ÿ.4.2. Encryption key schedule

0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0
K
f0 e1 d2 c3 b4 a5 96 87 78 69 5a 4b 3c 2d 1e 0f
enc
RK0 003a0fd4 02497010 194f7db1 090d0883 2ff5805a c2580b27
enc
RK1 a83e7ef9 053eca29 d359f988 8101a243 9bbf34b3 9228434f
enc
RK2 2efee506 8b5f7bd4 9991e811 72dbc20c 2384c97f cefee47f
enc
RK3 c571782c 00da90b1 b940a552 5db79619 4bc9a125 5d08a419
enc
RK4 72de26cc d69bc26f 46a7f207 66ff4d81 a87862fc a5f63601
enc
RK5 7909c4fa f3f93651 72cb0bcd ae69b2e3 80f2ca4b f13efcce
enc
RK6 7869db69 6b7a5b8e fefbf6b1 ec608c8e 76e9d5d2 13ca4bf6
enc
RK7 c5eeec7a aa42a59d 1f22cd00 fdd92bdc d6bbe3e8 15d459ec
enc
RK8 cda7632a 9cf01bef 6596e261 8c1de14c 1127c3b8 48b3f629
enc
RK9 3723d0e1 fc0317ec 3fdd5378 0201ae1d e55db65e e4c84dbc
e nc
RK10 3633db3f e4c24fc2 bb1e1fd7 a339425c fe3e1bdf d61c808d
e nc
RK1 bdca3449 beb8aa4e 145a9687 eb6fcd87 8b88ca72 7677a84b
One

e nc
RK12 d11005e9 558275c5 bc742819 3f17e888 20fcb71f 60886959
e nc
RK13 8d9446c4 67d2d167 855a6aef 69ea517c 36e48e11 0d3f4e86
e nc
RK14 bb0ede65 cceecc06 efc9c49f 44902261 bd8549c0 a7e7f682
e nc
RK15 772101e6 b4b9a250 6faa7b73 7318b792 1e57e751 fd43b41c
e nc
RK16 4ec21b5f dcfbf30b a4046947 be0e781c d74e21ac 6b1f5d22
e nc
RK17 e8b8e02b 4a662d2d b50f9ca9 01c98c69 9eb28089 216cfd3f
e nc
RK18 92f0126b 7b9961aa 581f94ac ab4be6dd c2a91af5 fb4e8e0c
e nc
RK19 4c2c8f04 81a45991 1fcb946c bccbb5b5 808899cb 8c1b2f89
e nc
RK20 192061be 78e5cf04 f239ab5c e8471e86 9e6217c7 e5fdf35c
e nc
RK2 83c3150d 766887f8 a1092ac7 6aa6f41d 16e200f9 6bdc26ca
One

e nc
RK22 52345706 db70d6af a8d8ffeb 492ee661 4cd1e991 d75d8352
e nc
RK23 85a9c5fb 1e0f569e 7ff7c600 3f36a1d8 e406ad00 4ded8f16
e nc
RK24 512bb2f4 772b192c 2e6168bd 76af67e1 d893a786 3e276f69
e nc
RK25 d11ee3ad b7f8c612 d3b19318 89fee4db b6c3aedd 05420f90
e nc
RK26 04f662f0 8fb41a6c 2f42dd5e a8ad1839 46474e45 46418de0
e nc
RK27 351550c8 668014f6 04924365 5f353d6f 4eba8d76 924a4318
e nc
RK28 5aba711c a36b1398 5b3e7bf4 7b3a2cf9 1d006ebe 0d5683e5
e nc
RK29 4f56916f 215dccd2 9f57886f 876d1357 46013d49 2a4932a3
e nc
RK30 aa285691 ebefe7d3 e960e64b dd893f0f 6a234412 495d13c9
e nc
RK3 71c683e8 8069dfd0 6c1a501d 00699418 262142f0 a91a7393
One

- 22 -