Lawrence Brown, Josef Pieprzyk, Jennifer Seberry, LOKI - A Cryptographic Primitive for Authentication and Secrecy Applications, Lecture Notes in Computer Science, Advances in Cryptology, proceedings of AUSCRYPT'90, pp. 229--236, 1990. 13  Home/Search   Document Not in Database   Summary   Related Articles   Check

....64 56 baseline baseline Triple DES[22] 64 112 DES 1 3 DES DESX[25] 64 56 64 DES =DES RC2[24] 64 variable variable DES RC5[23] variable variable variable variable IDEA[15] 64 128 DES DES CA 1. 1[13] 384 64 1024 unknown CAST[1] 64 64 =DES unknown SAFER[18] 64 64 unknown DES LOKI[7] 64 64 =DES unknown 3 Way[10] 96 96 unknown DES Table 5.1: Crypto algorithms suitable for ATM Currently the ATM Forum is discussing which algorithm will become the standard. One problem holding the decision back is the US Government s restriction on exporting cryptography. The current law ....

L. Brown, J. Pieprzyk, and J. Seberry. LOKI: a cryptographic primitive for authentication and secrecy applications. In Advances in Cryptology -- AUSCRYPT '90 Proceedings, pages 229--236. Springer-Verlag, 1990. 113 BIBLIOGRAPHY 114

....involves a key dependent involution followed by an involutionary permutation, f j = f(x i ; k j ) P (I(x i ; k j ) 63 the resulting function B : Sigma Theta K Sigma B = f r ffi f r Gamma1 ffi Delta Delta Delta ffi f 1 forms an involution cryptosystem. DES [58] FEAL [73] and LOKI [10] are all involution cryptosystems. Group and Involution Systems If the round function, f , involves a group function followed by an involutionary permutation, f j = f(x i ; k j ) I(G(x i ; k A j ) k B j ) the resulting function B : Sigma Theta K Sigma B = f r ffi f r Gamma1 ffi ....

L. Brown, J. Pieprzyk, and J. Seberry. LOKI - a cryptographic primitive for authentication and secrecy applications. In Advances in Cryptography - AUSCRYPT'90. Springer-Verlag, 1990.

....DES when in the software or hardware implementation. FEAL has two types : FEAL 4 and FEAL 8 depending on the number of rounds. Moreover, Hitachi also proposed a symmetric cryptosystem called Multi2 [76] in 1989. Also, Brown et al. in Australia proposed one symmetric cryptosystem called LOKI [11] for banking securities in 1990. It could be considered that all the above mentioned symmetric cryptosystems are good practical design of the mixing transformation. We categorize these cryptosystems altogether as DES like cryptosystem . In DES like cryptosystems, a substitution box (abbreviated ....

L. Brown, J. Pieprzyk, and J. Seberry, "LOKI -- a Cryptographic Primitive for Authentication and Secrecy", Proc. of AUSCRYPT'90, 1990.

....points of view. We found that our designed DES like S boxes exhibit better cryptographical properties than those of DES S boxes. 1 Introduction Until now, DES [3] Data Encryption Standard) is known as one of the most famous block cipher algorithms. In some published block cipher algorithm [9][16][14] half of the input block is nonlinearly mapped into a new half of input block by one important cryptographic primitive called f function which is the core of the algorithm and determine their overall security. In DES f function is implemented by 8 nonlinear look up tables (each look up ....

L. Brown, J. Pieprzyk, and J. Seberry, "LOKI -- a Cryptographic Primitive for Authentication and Secrecy", Proc. of AUSCRYPT'90, 1990.

....an efficient and systematic means of generating arbitrary input size bijective S boxes satisfying the SAC by applying simple rules recursively given 3 bit input bijective S box(es) satisfying the SAC. 1 Introduction For the good S box design of DES [NBS] like cryptosystems (FEAL [MSS] LOKI [BPS],etc) in the open cryptologic society, Kam and Davida [KD] proposed the completeness condition that each output bit depends on all input bits of the substitution. Webster and Tavares [WT] introduced the strict avalanche criterion( SAC ) in order to combine the notions of the completeness and the ....

L. Brown, J.Pieprzyk and J. Seberry, "LOKI -- a cryptographic primitive for authentication and secrecy", Proc. of AUSCRYPT90, 1990.

....breaking s 3 DES by differential attack is less efficient than key exhaustive search. 1. Introduction In 1990, Biham and Shamir [4] proposed one of the remarkable breaking method differential cryptanalysis 1 to cryptanalyze any iterated block cipher algorithm (DES [1] FEAL [2] LOKI [3], etc: To break DES (Data Encryption Standard) they utilized the precomputed pairs XOR distribution of S boxes which is the most important cryptographic primitive in DES. Their method is now known as one of the most efficient method to break DES in the open literature. We assume that the ....

L. Brown, J. Pieprzyk, and J. Seberry, "LOKI -- a Cryptographic Primitive for Authentication and Secrecy", Proc. of Auscrypt'90, 1990.

....assuming that the bit isn t redirected by the keyed permutation. However, in the worst case, keyed permutation can result in up to three bits from an S box exclusively affecting the same S box in the next round. 4 The S boxes The S boxes in ICE are similar in structure to those used in LOKI [3] in their use of Galois Field exponentiation. Each S box takes a 10 bit input X . Bits X 9 and X 0 are concatenated to form the row selector R. Bits X 8 : X 1 are concatenated to form the 8 bit column selector C. For each row R, there is an XOR offset value OR , and a Galois Field prime ....

....used for key permutation. The key is first converted into four 16 bit blocks, KB[0 . 3] These blocks are used, along with the key rotations KR shown in table 4, to derive the subkeys in each round using the algorithm as follows. KB[0] K 63 : K 48 KB[1] K 47 : K 32 KB[2] K 31 : K 16 KB[3] = K 15 : K 0 for each round n = 1 . 16 for SK = SK1, SK2, SK3 in turn, 5 times each for i = 0 . 3 Set B to bit 0 of KB[ i KR[n] mod 4] Shift SK left one bit. Set bit 0 of SK to B. Shift KB[ i KR[n] mod 4] right one bit. Set bit 19 of KB[ i KR[n] mod 4] to the inverse of B. ....

[Article contains additional citation context not shown here]

L. Brown, J. Pieprzyk and J. Seberry, LOKI: A Cryptographic Primitive for Authentication and Secrecy Applications, Advances in Cryptology - AUSCRYPT '90 Proceedings, Springer-Verlag, pp. 229-236, 1990

....function (usually called the F function) into a permutation. It was invented by Horst Feistel [FNS75] in his design of Lucifer [Fei73] and popularized by DES [NBS77] It is the basis of most block ciphers published since then, including FEAL [SM88] GOST [GOST89] Khufu and Khafre [Mer91] LOKI [BPS90, BKPS93], CAST 128 [Ada97a] Blow sh [Sch94] and RC5 [Riv95] The fundamental building block of a Feistel network is the F function: a key dependent mapping of an input string onto an output string. An F function is always non linear and possibly non surjective 1 : F : f0; 1g n=2 f0; 1g N 7 ....

....the basis of performance [SW97] The early post DES cipher designs would often compete on the number of rounds in the cipher. The original FEAL paper [SM88] for example, discussed the bene ts of a stronger round function and fewer rounds. Other cipher designs of the period REDOC II [CW91] LOKI [BPS90] and LOKI 93 [BKPS93] IDEA [LM91, LMM91] only considered performance as an afterthought. Khufu Khafre [Mer91] was the rst published algorithm that explicitly used operations that were ecient on 32 bit microprocessors; SEAL [RC94, RC97] is a more recent example. RC2 [Riv97, KRRR98] was designed ....

L. Brown, J. Pieprzyk, and J. Seberry, \LOKI: A Cryptographic Primitive for Authentication and Secrecy Applications," Advances in Cryptology | AUSCRYPT '90 Proceedings, Springer-Verlag, 1990, pp. 229{ 236.

....function (usually called the F function) into a permutation. It was invented by Horst Feistel [FNS75] in his design of Lucifer [Fei73] and popularized by DES [NBS77] It is the basis of most block ciphers published since then, including FEAL [SM88] GOST [GOST89] Khufu and Khafre [Mer91] LOKI [BPS90, BKPS93], CAST 128 [Ada97a] Blowfish [Sch94] and RC5 [Riv95] The fundamental building block of a Feistel network is the F function: a key dependent mapping of an input string onto an output string. An F function is always non linear and possibly non surjective 1 : F : 0, 1 n 2 0, 1 N ## ....

....basis of performance [SW97] The early post DES cipher designs would often compete on the number of rounds in the cipher. The original FEAL paper [SM88] for example, discussed the benefits of a stronger round function and fewer rounds. Other cipher designs of the period REDOC II [CW91] LOKI [BPS90] and LOKI 93 [BKPS93] IDEA [LM91, LMM91] only considered performance as an afterthought. Khufu Khafre [Mer91] was the first published algorithm that explicitly used operations that were e#cient on 32 bit microprocessors; SEAL [RC94, RC97] is a more recent example. RC2 [Riv97, KRRR98] was ....

L. Brown, J. Pieprzyk, and J. Seberry, "LOKI: A Cryptographic Primitive for Authentication and Secrecy Applications," Advances in Cryptology --- AUSCRYPT '90 Proceedings, Springer-Verlag, 1990, pp. 229-- 236.

....Thus, we consider only current ciphers that are well tested and known to be reliable as the framework of E2 . Most ciphers can be classified into three framework structures as follows; Feistel cipher structure. This structure is used in DES [U77] FEAL [MSS88] CAST [A97a] LOKI89 [BPS90] LOKI91 [BKPS93] Blowfish [S94] MISTY [M97] etc. SPN (Substitution Permutation Network) structure. This is used in SAFER [M94a] SHARK [RDP 96] Square [DKR97] etc. Other cipher structures. They are used in RC5 [R95] IDEA [LMM91] etc. 5 Copyright NTT 1998 Why we decided to ....

....algorithm. Encryption In the case that a large amount of data is encrypted with 1 key, since the time taken by key scheduling can be regarded as 0, slow key scheduling is not a problem. 33 Copyright NTT 1998 name of cipher reference time construction of key scheduling DES [U77] 0 LOKI89 [BPS90] 0 LOKI91 [BKPS93] 0 IDEA [LMM91, LM91] 0 SAFER K 64 [M94a] 0 # ICE [K97b] 0 FEAL [MSS88, MKOM90] 1 # Multi2 [TSN89] 1 # SXAL8 [IKM93] 1 # MISTY [M97] 1 # Qcode [SS96] 1 # 2 # SPEED [Z97] 1 Square [DKR97] 1 # CAST 128 [A97a] 1 # 2 # RC5 32 12 16 [R95] 6 # SHARK ....

L. Brown, J. Pieprzyk, and J. Seberry. LOKI - A Cryptographic Primitive for Authentication and Secrecy Applications. In J. Seberry and J. Pieprzyk, editors, Advances in Cryptology --- AUSCRYPT'90, Volume 453 of Lecture Notes in Computer Science, pp. 229--236. Springer-Verlag, Berlin, Heidelberg, New York, 1990.

....function (usually called the F function) into a permutation. It was invented by Horst Feistel [FNS75] in his design of Lucifer [Fei73] and popularized by DES [NBS77] It is the basis of most block ciphers published since then, including FEAL [SM88] GOST [GOST89] Khufu and Khafre [Mer91] LOKI [BPS90, BKPS93], CAST 128 [Ada97a] Blowfish [Sch94] and RC5 [Riv95] The fundamental building block of a Feistel network is the F function: a key dependent mapping of an input string onto an output string. An F function is always non linear and possibly non surjective 1 : F : f0; 1g n=2 Theta f0; 1g N ....

....basis of performance [SW97] The early post DES cipher designs would often compete on the number of rounds in the cipher. The original FEAL paper [SM88] for example, discussed the benefits of a stronger round function and fewer rounds. Other cipher designs of the period REDOC II [CW91] LOKI [BPS90] and LOKI 93 [BKPS93] IDEA [LM91, LMM91] only considered performance as an afterthought. Khufu Khafre [Mer91] was the first published algorithm that explicitly used operations that were efficient on 32 bit microprocessors; SEAL [RC94, RC97] is a more recent example. RC2 [Riv97, KRRR98] was ....

L. Brown, J. Pieprzyk, and J. Seberry, "LOKI: A Cryptographic Primitive for Authentication and Secrecy Applications," Advances in Cryptology --- AUSCRYPT '90 Proceedings, Springer-Verlag, 1990, pp. 229-- 236.

....of at least 2 m encryptions. Three main classes of hash functions have been proposed: Hash functions with rate 1 and with an internal memory of 2m bits; most of these constructions have been broken (see for example [14] a notable exception being the LOKI DBH mode proposed at Auscrypt 90 [4]. In this paper it will be shown that a collision attack for this hash function requires only 2 3m=4 encryptions; the attack is more general and shows that there are no hash functions in this class for which finding a collision requires more than 2 3m=4 operations. MDC 2 (rate 1 2) and ....

....hash functions. In the following we provide the last piece of the puzzle by presenting attacks on all hash functions of hash rate 1 defined by (2) which are much faster than brute force attacks and which require only small memory. In particular these attacks break the LOKI DBH hash function [4]. We consider double block length hash functions for which H 1 i (or H 2 i ) can be written as H 1 i = EA (B) Phi C with 2 4 A B C 3 5 = L Delta 2 6 6 4 H 1 i Gamma1 H 2 i Gamma1 M 1 i M 2 i 3 7 7 5 (3) where L is a binary 3 Theta 4 matrix. This includes all double ....

[Article contains additional citation context not shown here]

L. Brown, J. Pieprzyk, J. Seberry, "LOKI -- a cryptographic primitive for authentication and secrecy applications," Advances in Cryptology, Proc. Auscrypt'90, LNCS 453, J. Seberry, J. Pieprzyk, Eds., Springer-Verlag, 1990, pp. 229--236.

....attacks. In [3,4] we described the application of differential cryptanalysis to Feal[12,11] and extended the method to known plaintext attacks. In this paper differential cryptanalysis methods are applied to the hash function Snefru[9] and to the cryptosystems Khafre[10] REDOC II[14,6] LOKI[5] and Lucifer[7] 1 Introduction The notion of differential cryptanalysis was introduced in [1,2,3,4] In this paper differential cryptanalytic methods are applied to Snefru[9] Khafre[10] REDOC II[14, 6] LOKI[5] and Lucifer[7] Snefru[9] is a one way hash function suggested by Merkle as the ....

.... the hash function Snefru[9] and to the cryptosystems Khafre[10] REDOC II[14,6] LOKI[5] and Lucifer[7] 1 Introduction The notion of differential cryptanalysis was introduced in [1,2,3,4] In this paper differential cryptanalytic methods are applied to Snefru[9] Khafre[10] REDOC II[14, 6] LOKI[5] and Lucifer[7] Snefru[9] is a one way hash function suggested by Merkle as the Xerox secure hash function. In March 1990 a 1000 reward was offered to the first person to break the two pass variant of Snefru by finding two messages which hash to the same value. A similar reward was later ....

[Article contains additional citation context not shown here]

Lawrence Brown, Josef Pieprzyk, Jennifer Seberry, LOKI - A Cryptographic Primitive for Authentication and Secrecy Applications, Lecture Notes in Computer Science, Advances in Cryptology, proceedings of AUSCRYPT'90, pp. 229--236, 1990.

....Cryptanalysis of LOKI Lars Ramkilde Knudsen Aarhus Universitet Datalogisk Afdeling Ny Munkegade DK 8000 Aarhus C. Abstract In [BPS90] Brown, Pieprzyk and Seberry proposed a new encryption primitive, which encrypts and decrypts a 64 bit block of data using a 64 bit key. Furthermore they propose a way to build private versions of LOKI. In this paper we show first that the keyspace of any LOKI version is only 2 60 , not 2 64 ....

....kind of attack, at least in principle. We show that we cannot find a characteristic with a probability high enough to break LOKI with 16 rounds. Finally we consider differentials, introduced in [LMM91] versus characteristics, introduced in [BS90] 1 LOKI a family of encryption primitives In [BPS90] Brown, Pieprzyk and Seberry proposed a new encryption primitive, which encrypts and decrypts a 64 bit block of data using a 64 bit key. LOKI is interface compatible with the DES (ISO DEA 1) and its structure is very much like the structure of DES. Therefore it is obvious to try to do a ....

[Article contains additional citation context not shown here]

Lawrence Brown, Josef Pieprzyk, Jennifer Seberry. LOKI - A Cryptographic Primitive for Authentication and Secrecy Applications. Advances in Cryptology - AUSCRYPT '90. Springer Verlag, Lecture Notes 453, pp. 229-236, 1990.

.... 10) is set, bit i of E1 and E3 will be swapped. The exor operation The 40 bit result from the keyed permutation is exored with a 40 bit subkey. The S boxes ICE uses four 10 to 8 bit S boxes to map the 40 bit value to a 32 bit value. These S boxes are similar in structure to those used in LOKI [4, 3] in their use of Galois Field exponentiation. From the 10 bit input X , we concatenate X 9 and X 0 to form the row selector R. Bits X 8 : X 1 form the column selector C. For each row there is a XOR offset value OR , and a Galois Field prime (irreducible polynomial) PR . The 8 bit output of an ....

L. Brown, J. Pieprzyk and J. Seberry, "LOKI: A Cryptographic Primitive for Authentication and Secrecy Applications," Advances in Cryptology -- AusCrypt '90 Proceedings, LNCS 453, J. Seberry and J. Pieprzyk, Eds., Springer-Verlag, 1990, pp. 229--236.

....[17] has had a quite revolutionary effect on the design of block ciphers. Differential cryptanalysis is a chosen plaintext attack on iterative block ciphers. It has been particularly successful when applied to more recent block ciphers such as Khafre [97] REDOC II [31] FEAL [139] and LOKI [24], but DES has, by contrast, fared much better. The reasons and implications of this success will be considered further in Section 4.4. There is considerable evidence to support the claim by Coppersmith [29] that the IBM team designing DES knew about differential cryptanalysis in the early 1970 s ....

....version can be attacked using known plaintext to obtain three bytes of internal and key dependent information [17] REDOC II is now rarely mentioned in the literature though Schneier [135] reports that a streamlined version of REDOC II, known as REDOC III, has also been proposed. 10.4 LOKI LOKI [24] was initially proposed in 1989 and is a DES like iterative cipher that operates on 64 bit blocks and uses a 64 bit key. Its security is based on the use of a large S box, taking 12 bits and outputting eight, which in turn is based on the use of irreducible polynomials. Further specifications ....

L. Brown, J. Pieprzyl, and J. Seberry. LOKI: A cryptographic primitive for authentication and secrecy applications. In J. Seberry and J. Pieprzyk, editors, Advances in Cryptology --- Auscrypt '90, volume 453 of Lecture Notes in Computer Science, pages 229--236, Berlin, 1990. Springer Verlag.

....found by the attacker. A scenario for an attack is the as follows. 6 On the Use of Encryption in Cryptographic Protocols 1. A secret key forms an exact number of message blocks. This is a typical situation for a block cipher where block lengths are normally 64 bits and keys are 64 or 128 bits [12, 13, 14, 15]. 2. A key is passed in a message where the nonce, designed to prevent replay, comes before the key. 3. The attacker is able to find the value of an old key that has been passed in some previous message. This is a normal assumption and has been used as the basis of previous well known protocol ....

L. Brown, J. Pieprzyk, and J. Seberry. LOKI - A cryptographic primitive for authentication and secrecy applications. In Advances in Cryptology - AusCrypt'90, Lecture Notes in Computer Science 453, 1990.

....abstract) Lars Ramkilde Knudsen Arhus University, Denmark Abstract. In this paper we present several new potentially weak (pairs of) keys for DES, LOKI89 and LOKI91. 1 Introduction In this paper we consider DES like iterative ciphers in particular the DES [5] and the LOKI ciphers, LOKI 89[2] and LOKI 91[3] In these ciphers the ciphertext is calculated by recursively applying a round function to the plaintext. We expect the reader to be familiar with the basic concepts of differential cryptanalysis and refer to [1, 7] for further details. In this paper we show how to use the ....

...., where KL = vwyzvwyz x and KR = V WY ZV WY Z x s.t. v Phi w Phi y = z and V Phi W Phi Y = Z and v Phi V = w Phi W = y Phi Y , satisfy the condition in Theorem 5. For LOKI 89 the key K = KL kKR is added (modulo 2) to the plaintext and the swapped key (KR kKL ) is added to the ciphertext [2]. The xor of the plaintext and the ciphertext for LOKI 89 (ffi in (2) is oe Phi ckoe Phi c, where c = KL Phi KR . Corollary 3 LOKI 91 has at least 16 weak hash keys. Proof: Let Roln (X) be X rotated (bitwise) n places to the left and let h be a hex digit, h 2 f0; 3; 5; 6; 9; A; C;Fg: From ....

L. Brown, J. Pieprzyk, J. Seberry. LOKI - A Cryptographic Primitive for Authentication and Secrecy Applications. Advances in Cryptology - AUSCRYPT '90. Springer Verlag, LNCS 453, pp. 229-236, 1990.

No context found.

Lawrence Brown, Josef Pieprzyk, Jennifer Seberry, LOKI - A Cryptographic Primitive for Authentication and Secrecy Applications, Lecture Notes in Computer Science, Advances in Cryptology, proceedings of AUSCRYPT'90, pp. 229--236, 1990. 13

No context found.

L. Brown, J. Pieprzyk, J. Seberry - "LOKI - a cryptographic primitive for authentication and secrecy applications" - AUSCRYPT 90 - LNCS 453 - p. 229-236

No context found.

L. Brown, J. Pieprzyk, and J. Seberry, "LOKI---a cryptographic primitive for authentication and secrecy applications, " in Advances in Cryptology --- AUSCRYPT '90 Proceedings (J. Seberry and J. Pieprzyk, eds.), vol. 453 of Lecture Notes in Computer Science, pp. 229--236, SpringerVerlag, 1990.

No context found.

L. Brown, J. Pieprzyk, and J. Seberry, \LOKI: A Cryptographic Primitive for Authentication and Secrecy Applications, " Advances in Cryptology | AUSCRYPT '90 Proceedings, SpringerVerlag, 1990, pp. 229-236.

No context found.

L. Brown, J. Pieprzyk, and J. Seberry, "LOKI---A cryptographic primitive for authentication and secrecy applications, " Advances in Cryptology---AUSCRYPT '90 Proceedings, eds. J. Seberry and J. Pieprzyk, vol.453 of Lecture Notes in Computer Science, pp.229--236, Springer-Verlag, 1990.

No context found.

L. Brown, J. Pieprzyk, J. Seberry - "LOKI - a cryptographic primitive for authentication and secrecy applications" - AUSCRYPT 90 - LNCS 453 - p. 229-236

No context found.

L. Brown, J. Pieprzyk, and J. Seberry, "LOKI: A Cryptographic Primitive for Authentication and Secrecy Applications, " Advances in Cryptology --- AUSCRYPT '90 Proceedings, SpringerVerlag, 1990, pp. 229--236.

First 50 documents

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC