RFC 4269 The SEED Encryption Algorithm December 2005
- A mixing phase of two 32-bit subkey blocks (Ki0, Ki1)
- 3 layers of function G (see Section 2.2), with additions for
mixing two 32-bit blocks
Where R0 is the most significant 32 bits of R, and R1 is the least
significant 32 bits.
The outputs (R0', R1') of function F are as follows:
R0' = G[ G[ G[(R0 ^ Ki0) ^ (R1 ^ Ki1)] + (R0 ^ Ki0)] + G[(R0 ^ Ki0) ^
(R1 ^ Ki1)]] + G[ G[(R0 ^ Ki0) ^ (R1 ^ Ki1)] + (R0 ^ Ki0)]
R1' = G[ G[ G[(R0 ^ Ki0) ^ (R1 ^ Ki1)] + (R0 ^ Ki0)] + G[(R0 ^ Ki0) ^
(R1 ^ Ki1)]]
2.2. The Function G
The function G has two layers: a layer of two 8x8 S-boxes and a layer
of block permutation of sixteen 8-bit sub-blocks. The outputs Z (=
Z3 || Z2 || Z1 || Z0) of the function G with four 8-bit inputs X (=
X3 || X2 || X1 || X0) are as follows:
Z0 = {S0(X0) & m0} ^ {S1(X1) & m1} ^ {S0(X2) & m2} ^ {S1(X3) & m3}
Z1 = {S0(X0) & m1} ^ {S1(X1) & m2} ^ {S0(X2) & m3} ^ {S1(X3) & m0}
Z2 = {S0(X0) & m2} ^ {S1(X1) & m3} ^ {S0(X2) & m0} ^ {S1(X3) & m1}
Z3 = {S0(X0) & m3} ^ {S1(X1) & m0} ^ {S0(X2) & m1} ^ {S1(X3) & m2}
where m0 = 0xFC, m1 = 0xF3, m2 = 0xCF, and m3 = 0x3F.
To increase the efficiency of G function, four extended S-boxes
"SS-box" (see Appendix A.2) are defined as follows:
SS0(X0)= {S0(X0)& m3} || {S0(X0)& m2} || {S0(X0)& m1} || {S0(X0)& m0}
SS1(X1)= {S1(X1)& m0} || {S1(X1)& m3} || {S1(X1)& m2} || {S1(X1)& m1}
SS2(X2)= {S0(X2)& m1} || {S0(X2)& m0} || {S0(X2)& m3} || {S0(X2)& m2}
SS3(X3)= {S1(X3)& m2} || {S1(X3)& m1} || {S1(X3)& m0} || {S1(X3)& m3}
New G function, Z, can be defined as follows:
Z = SS0(X0) ^ SS1(X1) ^ SS2(X2) ^ SS3(X3)
This new G function is faster than the original G function but takes
more memory to store four SS-boxes.
Lee, et al. Informational [Page 4]
RFC 4269 The SEED Encryption Algorithm December 2005
2.3. Key Schedule
The key schedule generates each round's subkeys. It uses the
function G, addition in modular 2***** subtraction in modular 2*****
and (left/right) circular rotation. A 128-bit input key is divided
into four 32-bit blocks (Key0, Key1, Key2, Key3). The two 32-bit
subkeys of the ith round, Ki0 and Ki1, are generated as follows:
- Type 1 : Odd round
Ki0 = G(Key0 + Key2 - KCi)
Ki1 = G(Key1 - Key3 + KCi)
Key0 || Key1 = (Key0 || Key1) >> 8
- Type 2 : Even round
Ki0 = G(Key0 + Key2 - KCi)
Ki1 = G(Key1 - Key3 + KCi)
Key2 || Key3 = (Key2 || Key3) << 8
Where Ki0 is the most significant 32 bits of Ki, and Ki1 is the least
significant 32 bits of Ki (where i=0,...,3).
The following table shows constants used in KCi:
i | Value i | Value
============================================
KC1 | 0x9E3779B9 KC2 | 0x3C6EF373
KC3 | 0x78DDE6E6 KC4 | 0xF1BBCDCC
KC5 | 0xE3779B99 KC6 | 0xC6EF3733
KC7 | 0x8DDE6E67 KC8 | 0x1BBCDCCF
KC9 | 0x3779B99E KC10 | 0x6EF3733C
KC11 | 0xDDE6E678 KC12 | 0xBBCDCCF1
KC13 | 0x779B99E3 KC14 | 0xEF3733C6
KC15 | 0xDE6E678D KC16 | 0xBCDCCF1B
A pseudo code for the key schedule is as follows:
Input : (Key0, Key1, Key2, Key3)
for i = 1 to 16
Ki0 = G(Key0 + Key2 - KCi)
Ki1 = G(Key1 - Key3 + KCi)
if i is odd
Key0 || Key1 = (Key0 || Key1) >> 8
else
Key2 || Key3 = (Key2 || Key3) << 8
Output : (Keyi0, Keyi1), i=1 to 16
Lee, et al. Informational [Page 5]