Republic of Korea national standard block cipher
LEA LEA encryption round function
Designers Deukjo Hong, Jung-Keun Lee, Dong-Chan Kim, Daesung Kwon, Kwon Ho Ryu, Dong-Geon Lee First published 2013 Key sizes 128, 192, or 256 bits Block sizes 128 bits Structure ARX (modular Addition, bitwise Rotation, and bitwise XOR) Rounds 24, 28, or 32 (depending on key size) As of 2019, no successful attack on full-round LEA is known.
The Lightweight Encryption Algorithm (also known as LEA ) is a 128-bit block cipher developed by South Korea in 2013 to provide confidentiality in high-speed environments such as big data and cloud computing , as well as lightweight environments such as IoT devices and mobile devices .[ 1] AES , the most widely used block cipher in various software environments.
LEA is one of the cryptographic algorithms approved by the Korean Cryptographic Module Validation Program (KCMVP) and is the national standard of Republic of Korea (KS X 3246). LEA is included in the ISO/IEC 29192-2:2019 standard (Information security - Lightweight cryptography - Part 2: Block ciphers).
The block cipher LEA consisting of ARX operations (modular Addition:
⊞
{\displaystyle \boxplus }
⋘
{\displaystyle \lll }
⋙
{\displaystyle \ggg }
⊕
{\displaystyle \oplus }
Let
P
=
P
[
0
]
‖
P
[
1
]
‖
P
[
2
]
‖
P
[
3
]
{\displaystyle P=P[0]\|P[1]\|P[2]\|P[3]}
C
=
C
[
0
]
‖
C
[
1
]
‖
C
[
2
]
‖
C
[
3
]
{\displaystyle C=C[0]\|C[1]\|C[2]\|C[3]}
P
[
i
]
{\displaystyle P[i]}
C
[
i
]
{\displaystyle C[i]}
0
≤
i
<
4
{\displaystyle 0\leq i<4}
K
i
=
K
i
[
0
]
‖
K
i
[
1
]
‖
K
i
[
2
]
‖
K
i
[
3
]
‖
K
i
[
4
]
‖
K
i
[
5
]
{\displaystyle K_{i}=K_{i}[0]\|K_{i}[1]\|K_{i}[2]\|K_{i}[3]\|K_{i}[4]\|K_{i}[5]}
0
≤
i
<
N
r
{\displaystyle 0\leq i<Nr}
K
i
[
j
]
{\displaystyle K_{i}[j]}
0
≤
j
<
6
{\displaystyle 0\leq j<6}
N
r
{\displaystyle Nr}
X
0
[
0
]
‖
X
0
[
1
]
‖
X
0
[
2
]
‖
X
0
[
3
]
←
P
[
0
]
‖
P
[
1
]
‖
P
[
2
]
‖
P
[
3
]
{\displaystyle X_{0}[0]\|X_{0}[1]\|X_{0}[2]\|X_{0}[3]\leftarrow P[0]\|P[1]\|P[2]\|P[3]}
for
i
=
0
{\displaystyle i=0}
N
r
−
1
{\displaystyle Nr-1}
X
i
+
1
[
0
]
←
(
(
X
i
[
0
]
⊕
K
i
[
0
]
)
⊞
(
X
i
[
1
]
⊕
K
i
[
1
]
)
)
⋘
9
{\displaystyle X_{i+1}[0]\leftarrow \left(\left(X_{i}[0]\oplus K_{i}[0]\right)\boxplus \left(X_{i}[1]\oplus K_{i}[1]\right)\right)\lll 9}
X
i
+
1
[
1
]
←
(
(
X
i
[
1
]
⊕
K
i
[
2
]
)
⊞
(
X
i
[
2
]
⊕
K
i
[
3
]
)
)
⋙
5
{\displaystyle X_{i+1}[1]\leftarrow \left(\left(X_{i}[1]\oplus K_{i}[2]\right)\boxplus \left(X_{i}[2]\oplus K_{i}[3]\right)\right)\ggg 5}
X
i
+
1
[
2
]
←
(
(
X
i
[
2
]
⊕
K
i
[
4
]
)
⊞
(
X
i
[
3
]
⊕
K
i
[
5
]
)
)
⋙
3
{\displaystyle X_{i+1}[2]\leftarrow \left(\left(X_{i}[2]\oplus K_{i}[4]\right)\boxplus \left(X_{i}[3]\oplus K_{i}[5]\right)\right)\ggg 3}
X
i
+
1
[
3
]
←
X
i
[
0
]
{\displaystyle X_{i+1}[3]\leftarrow X_{i}[0]}
C
[
0
]
‖
C
[
1
]
‖
C
[
2
]
‖
C
[
3
]
←
X
N
r
[
0
]
‖
X
N
r
[
1
]
‖
X
N
r
[
2
]
‖
X
N
r
[
3
]
{\displaystyle C[0]\|C[1]\|C[2]\|C[3]\leftarrow X_{Nr}[0]\|X_{Nr}[1]\|X_{Nr}[2]\|X_{Nr}[3]}
The decryption operation is as follows:
X
N
r
[
0
]
‖
X
N
r
[
1
]
‖
X
N
r
[
2
]
‖
X
N
r
[
3
]
←
C
[
0
]
‖
C
[
1
]
‖
C
[
2
]
‖
C
[
3
]
{\displaystyle X_{Nr}[0]\|X_{Nr}[1]\|X_{Nr}[2]\|X_{Nr}[3]\leftarrow C[0]\|C[1]\|C[2]\|C[3]}
for
i
=
(
N
r
−
1
)
{\displaystyle i=(Nr-1)}
0
{\displaystyle 0}
X
i
[
0
]
←
X
i
+
1
[
3
]
{\displaystyle X_{i}[0]\leftarrow X_{i+1}[3]}
X
i
[
1
]
←
(
(
X
i
+
1
[
0
]
⋙
9
)
⊟
(
X
i
[
0
]
⊕
K
i
[
0
]
)
)
⊕
K
i
[
1
]
{\displaystyle X_{i}[1]\leftarrow \left(\left(X_{i+1}[0]\ggg 9\right)\boxminus \left(X_{i}[0]\oplus K_{i}[0]\right)\right)\oplus K_{i}[1]}
X
i
[
2
]
←
(
(
X
i
+
1
[
1
]
⋘
5
)
⊟
(
X
i
[
1
]
⊕
K
i
[
2
]
)
)
⊕
K
i
[
3
]
{\displaystyle X_{i}[2]\leftarrow \left(\left(X_{i+1}[1]\lll 5\right)\boxminus \left(X_{i}[1]\oplus K_{i}[2]\right)\right)\oplus K_{i}[3]}
X
i
[
3
]
←
(
(
X
i
+
1
[
2
]
⋘
3
)
⊟
(
X
i
[
2
]
⊕
K
i
[
4
]
)
)
⊕
K
i
[
5
]
{\displaystyle X_{i}[3]\leftarrow \left(\left(X_{i+1}[2]\lll 3\right)\boxminus \left(X_{i}[2]\oplus K_{i}[4]\right)\right)\oplus K_{i}[5]}
P
[
0
]
‖
P
[
1
]
‖
P
[
2
]
‖
P
[
3
]
←
X
0
[
0
]
‖
X
0
[
1
]
‖
X
0
[
2
]
‖
X
0
[
3
]
{\displaystyle P[0]\|P[1]\|P[2]\|P[3]\leftarrow X_{0}[0]\|X_{0}[1]\|X_{0}[2]\|X_{0}[3]}
The key schedule of LEA supports 128, 192, and 256-bit keys and outputs 192-bit round keys
K
i
{\displaystyle K_{i}}
0
≤
i
<
N
r
{\displaystyle 0\leq i<Nr}
Key schedule for LEA-128 [ edit ] Let
K
=
K
[
0
]
‖
K
[
1
]
‖
K
[
2
]
‖
K
[
3
]
{\displaystyle K=K[0]\|K[1]\|K[2]\|K[3]}
K
[
i
]
{\displaystyle K[i]}
0
≤
i
<
4
{\displaystyle 0\leq i<4}
K
{\displaystyle K}
δ
[
i
]
{\displaystyle \delta [i]}
0
≤
i
<
4
{\displaystyle 0\leq i<4}
K
i
{\displaystyle K_{i}}
0
≤
i
<
24
{\displaystyle 0\leq i<24}
T
[
0
]
‖
T
[
1
]
‖
T
[
2
]
‖
T
[
3
]
←
K
[
0
]
‖
K
[
1
]
‖
K
[
2
]
‖
K
[
3
]
{\displaystyle T[0]\|T[1]\|T[2]\|T[3]\leftarrow K[0]\|K[1]\|K[2]\|K[3]}
for
i
=
0
{\displaystyle i=0}
23
{\displaystyle 23}
T
[
0
]
←
(
T
[
0
]
⊞
(
δ
[
i
mod
4
]
⋘
i
)
)
⋘
1
{\displaystyle T[0]\leftarrow \left(T[0]\boxplus \left(\delta [i\mod 4]\lll i\right)\right)\lll 1}
T
[
1
]
←
(
T
[
1
]
⊞
(
δ
[
i
mod
4
]
⋘
(
i
+
1
)
)
)
⋘
3
{\displaystyle T[1]\leftarrow \left(T[1]\boxplus \left(\delta [i\mod 4]\lll \left(i+1\right)\right)\right)\lll 3}
T
[
2
]
←
(
T
[
2
]
⊞
(
δ
[
i
mod
4
]
⋘
(
i
+
2
)
)
)
⋘
6
{\displaystyle T[2]\leftarrow \left(T[2]\boxplus \left(\delta [i\mod 4]\lll \left(i+2\right)\right)\right)\lll 6}
T
[
3
]
←
(
T
[
3
]
⊞
(
δ
[
i
mod
4
]
⋘
(
i
+
3
)
)
)
⋘
11
{\displaystyle T[3]\leftarrow \left(T[3]\boxplus \left(\delta [i\mod 4]\lll \left(i+3\right)\right)\right)\lll 11}
K
i
←
T
[
0
]
‖
T
[
1
]
‖
T
[
2
]
‖
T
[
1
]
‖
T
[
3
]
‖
T
[
1
]
{\displaystyle K_{i}\leftarrow T[0]\|T[1]\|T[2]\|T[1]\|T[3]\|T[1]}
Key schedule for LEA-192 [ edit ] Let
K
=
K
[
0
]
‖
K
[
1
]
‖
K
[
2
]
‖
K
[
3
]
‖
K
[
4
]
‖
K
[
5
]
{\displaystyle K=K[0]\|K[1]\|K[2]\|K[3]\|K[4]\|K[5]}
K
[
i
]
{\displaystyle K[i]}
0
≤
i
<
6
{\displaystyle 0\leq i<6}
K
{\displaystyle K}
δ
[
i
]
{\displaystyle \delta [i]}
0
≤
i
<
6
{\displaystyle 0\leq i<6}
K
i
{\displaystyle K_{i}}
0
≤
i
<
28
{\displaystyle 0\leq i<28}
T
[
0
]
‖
T
[
1
]
‖
T
[
2
]
‖
T
[
3
]
‖
T
[
4
]
‖
T
[
5
]
←
K
[
0
]
‖
K
[
1
]
‖
K
[
2
]
‖
K
[
3
]
‖
K
[
4
]
‖
K
[
5
]
{\displaystyle T[0]\|T[1]\|T[2]\|T[3]\|T[4]\|T[5]\leftarrow K[0]\|K[1]\|K[2]\|K[3]\|K[4]\|K[5]}
for
i
=
0
{\displaystyle i=0}
27
{\displaystyle 27}
T
[
0
]
←
(
T
[
0
]
⊞
(
δ
[
i
mod
6
]
⋘
i
)
)
⋘
1
{\displaystyle T[0]\leftarrow \left(T[0]\boxplus \left(\delta [i\mod 6]\lll i\right)\right)\lll 1}
T
[
1
]
←
(
T
[
1
]
⊞
(
δ
[
i
mod
6
]
⋘
(
i
+
1
)
)
)
⋘
3
{\displaystyle T[1]\leftarrow \left(T[1]\boxplus \left(\delta [i\mod 6]\lll \left(i+1\right)\right)\right)\lll 3}
T
[
2
]
←
(
T
[
2
]
⊞
(
δ
[
i
mod
6
]
⋘
(
i
+
2
)
)
)
⋘
6
{\displaystyle T[2]\leftarrow \left(T[2]\boxplus \left(\delta [i\mod 6]\lll \left(i+2\right)\right)\right)\lll 6}
T
[
3
]
←
(
T
[
3
]
⊞
(
δ
[
i
mod
6
]
⋘
(
i
+
3
)
)
)
⋘
11
{\displaystyle T[3]\leftarrow \left(T[3]\boxplus \left(\delta [i\mod 6]\lll \left(i+3\right)\right)\right)\lll 11}
T
[
4
]
←
(
T
[
4
]
⊞
(
δ
[
i
mod
6
]
⋘
(
i
+
4
)
)
)
⋘
13
{\displaystyle T[4]\leftarrow \left(T[4]\boxplus \left(\delta [i\mod 6]\lll \left(i+4\right)\right)\right)\lll 13}
T
[
5
]
←
(
T
[
5
]
⊞
(
δ
[
i
mod
6
]
⋘
(
i
+
5
)
)
)
⋘
17
{\displaystyle T[5]\leftarrow \left(T[5]\boxplus \left(\delta [i\mod 6]\lll \left(i+5\right)\right)\right)\lll 17}
K
i
←
T
[
0
]
‖
T
[
1
]
‖
T
[
2
]
‖
T
[
3
]
‖
T
[
4
]
‖
T
[
5
]
{\displaystyle K_{i}\leftarrow T[0]\|T[1]\|T[2]\|T[3]\|T[4]\|T[5]}
Key schedule for LEA-256 [ edit ] Let
K
=
K
[
0
]
‖
K
[
1
]
‖
K
[
2
]
‖
K
[
3
]
‖
K
[
4
]
‖
K
[
5
]
‖
K
[
6
]
‖
K
[
7
]
{\displaystyle K=K[0]\|K[1]\|K[2]\|K[3]\|K[4]\|K[5]\|K[6]\|K[7]}
K
[
i
]
{\displaystyle K[i]}
0
≤
i
<
8
{\displaystyle 0\leq i<8}
K
{\displaystyle K}
δ
[
i
]
{\displaystyle \delta [i]}
0
≤
i
<
8
{\displaystyle 0\leq i<8}
K
i
{\displaystyle K_{i}}
0
≤
i
<
32
{\displaystyle 0\leq i<32}
T
[
0
]
‖
T
[
1
]
‖
T
[
2
]
‖
T
[
3
]
‖
T
[
4
]
‖
T
[
5
]
‖
T
[
6
]
‖
T
[
7
]
←
K
[
0
]
‖
K
[
1
]
‖
K
[
2
]
‖
K
[
3
]
‖
K
[
4
]
‖
K
[
5
]
‖
K
[
6
]
‖
K
[
7
]
{\displaystyle T[0]\|T[1]\|T[2]\|T[3]\|T[4]\|T[5]\|T[6]\|T[7]\leftarrow K[0]\|K[1]\|K[2]\|K[3]\|K[4]\|K[5]\|K[6]\|K[7]}
for
i
=
0
{\displaystyle i=0}
31
{\displaystyle 31}
T
[
6
i
mod
8
]
←
(
T
[
6
i
mod
8
]
⊞
(
δ
[
i
mod
8
]
⋘
i
)
)
⋘
1
{\displaystyle T[6i\mod 8]\leftarrow \left(T[6i\mod 8]\boxplus \left(\delta [i\mod 8]\lll i\right)\right)\lll 1}
T
[
6
i
+
1
mod
8
]
←
(
T
[
6
i
+
1
mod
8
]
⊞
(
δ
[
i
mod
8
]
⋘
(
i
+
1
)
)
)
⋘
3
{\displaystyle T[6i+1\mod 8]\leftarrow \left(T[6i+1\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+1\right)\right)\right)\lll 3}
T
[
6
i
+
2
mod
8
]
←
(
T
[
6
i
+
2
mod
8
]
⊞
(
δ
[
i
mod
8
]
⋘
(
i
+
2
)
)
)
⋘
6
{\displaystyle T[6i+2\mod 8]\leftarrow \left(T[6i+2\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+2\right)\right)\right)\lll 6}
T
[
6
i
+
3
mod
8
]
←
(
T
[
6
i
+
3
mod
8
]
⊞
(
δ
[
i
mod
8
]
⋘
(
i
+
3
)
)
)
⋘
11
{\displaystyle T[6i+3\mod 8]\leftarrow \left(T[6i+3\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+3\right)\right)\right)\lll 11}
T
[
6
i
+
4
mod
8
]
←
(
T
[
6
i
+
4
mod
8
]
⊞
(
δ
[
i
mod
8
]
⋘
(
i
+
4
)
)
)
⋘
13
{\displaystyle T[6i+4\mod 8]\leftarrow \left(T[6i+4\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+4\right)\right)\right)\lll 13}
T
[
6
i
+
5
mod
8
]
←
(
T
[
6
i
+
5
mod
8
]
⊞
(
δ
[
i
mod
8
]
⋘
(
i
+
5
)
)
)
⋘
17
{\displaystyle T[6i+5\mod 8]\leftarrow \left(T[6i+5\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+5\right)\right)\right)\lll 17}
K
i
←
T
[
6
i
mod
8
]
‖
T
[
6
i
+
1
mod
8
]
‖
T
[
6
i
+
2
mod
8
]
‖
T
[
6
i
+
3
mod
8
]
‖
T
[
6
i
+
4
mod
8
]
‖
T
[
6
i
+
5
mod
8
]
{\displaystyle K_{i}\leftarrow T[6i\mod 8]\|T[6i+1\mod 8]\|T[6i+2\mod 8]\|T[6i+3\mod 8]\|T[6i+4\mod 8]\|T[6i+5\mod 8]}
The eight 32-bit constant values
δ
[
i
]
{\displaystyle \delta [i]}
0
≤
i
<
8
{\displaystyle 0\leq i<8}
Constant values used in the key schedule
i
{\displaystyle i}
0
1
2
3
4
5
6
7
δ
[
i
]
{\displaystyle \delta [i]}
0xc3efe9db
0x44626b02
0x79e27c8a
0x78df30ec
0x715ea49e
0xc785da0a
0xe04ef22a
0xe5c40957
As of 2019, no successful attack on full-round LEA is known.
As is typical for iterated block ciphers, reduced-round variants have been attacked.
The best published attacks on LEA in the standard attack model (CPA/CCA with unknown key) are boomerang attacks and differential linear attacks.
The security margin to the whole rounds ratio is greater than 37% against various existing cryptanalytic techniques for block ciphers.
Security of LEA-128 (24 rounds)
Attack type
Attacked rounds
Differential[ 2]
14
Truncated differential[ 2]
14
Linear[ 1]
13
Zero correlation[ 1]
10
Boomerang[ 1]
15
Impossible differential[ 1]
12
Integral[ 1]
9
Differential linear[ 1]
15
Related-key differential[ 1]
13
Security margins of LEA
Block ciphers
Rounds (Attacked / Total)
Security margins
LEA-128
15 / 24
37.50%
LEA-192
16 / 28
42.85%
LEA-256
18 / 32
43.75%
LEA has very good performance in a general-purpose software environment.
In particular, it is possible to encrypt at a rate of about 1.5 to 2 times on average, compared to AES, the most widely used block cipher in various software environments.
The tables below compare the performance of LEA and AES using FELICS (Fair Evaluation of Lightweight Cryptographic Systems),[ 3]
FELICS scenario 1 – Enc. + Dec. + KeySetup / 128-byte CBC-Encryption[ 4]
Platform
LEA-128
LEA-192
LEA-256
AES-128
AVR
Code
1,684
2,010
2,150
3,010
RAM
631
943
1,055
408
Time
61,020
80,954
92,194
58,248
MSP
Code
1,130
1,384
1,468
2,684
RAM
626
942
1,046
408
Time
47,339
56,540
64,001
86,506
ARM
Code
472
536
674
3,050
RAM
684
968
1,080
452
Time
17,417
20,640
24,293
83,868
FELICS scenario 2 – Enc. / 128-bit CTR-Encryption[ 4]
Platform
LEA-128
LEA-192
LEA-256
AES-128
AVR
Code
906
1,210
1,306
1,246
RAM
80
80
80
81
Time
4,023
4,630
5,214
3,408
MSP
Code
722
1,014
1,110
1,170
RAM
78
78
78
80
Time
2,814
3,242
3,622
4,497
ARM
Code
628
916
1,012
1,348
RAM
92
100
100
124
Time
906
1,108
1,210
4,044
Test vectors for LEA for each key length are as follows.[ 5]
LEA-128
Key: 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0
Plaintext: 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
Ciphertext: 9f c8 4e 35 28 c6 c6 18 55 32 c7 a7 04 64 8b fd
LEA-192
Key: 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0 f0 e1 d2 c3 b4 a5 96 87
Plaintext: 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f
Ciphertext: 6f b9 5e 32 5a ad 1b 87 8c dc f5 35 76 74 c6 f2
LEA-256
Key: 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0 f0 e1 d2 c3 b4 a5 96 87 78 69 5a 4b 3c 2d 1e 0f
Plaintext: 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f
Ciphertext: d6 51 af f6 47 b1 89 c1 3a 89 00 ca 27 f9 e1 97 LEA is free for any use: public or private, commercial or non-commercial.
The source code for distribution of LEA implemented in C , Java , and Python can be downloaded from KISA's website.[ 6] C++ class library of cryptographic schemes.[ 7]
LEA is one of the cryptographic algorithms approved by the Korean Cryptographic Module Validation Program (KCMVP).[ 8]
LEA is included in the following standards.
KS X 3246, 128-bit block cipher LEA (in Korean)[ 5] ISO/IEC 29192-2:2019, Information security - Lightweight cryptography - Part 2: Block ciphers [ 9]
^ a b c d e f g h Hong, Deukjo; Lee, Jung-Keun; Kim, Dong-Chan; Kwon, Daesung; Ryu, Kwon Ho; Lee, Dong-Geon (2014). "LEA: A 128-Bit Block Cipher for Fast Encryption on Common Processors" . Information Security Applications . Lecture Notes in Computer Science. Vol. 8267. Springer International Publishing. pp. 3–27. doi :10.1007/978-3-319-05149-9_1 . ISBN 978-3-319-05149-9 ^ a b Song, Ling; Huang, Zhangjie; Yang, Qianqian (2016). "Automatic Differential Analysis of ARX Block Ciphers with Application to SPECK and LEA" . Information Security and Privacy . Lecture Notes in Computer Science. Vol. 9723. Springer International Publishing. pp. 379–394. doi :10.1007/978-3-319-40367-0_24 . ISBN 978-3-319-40367-0 ^ Dinu, Daniel; Corre, Yann Le; Khovratovich, Dmitry; Perrin, Léo; Großschädl, Johann; Biryukov, Alex (14 July 2018). "Triathlon of lightweight block ciphers for the Internet of things" (PDF) . Journal of Cryptographic Engineering . 9 (3): 283–302. doi :10.1007/s13389-018-0193-x . S2CID 1578215 . ^ a b "CryptoLUX > FELICS" . cryptolux.org .^ a b "KS X 3246, 128-bit block cipher LEA (in Korean)" .^ "KISA 암호이용활성화 - 암호알고리즘 소스코드" . seed.kisa.or.kr .^ "Crypto++ Library 8.2 | Free C++ Class Library of Cryptographic Schemes" . www.cryptopp.com .^ "KISA 암호이용활성화 - 개요" . seed.kisa.or.kr .^ "ISO/IEC 29192-2:2019, Information security - Lightweight cryptography - Part 2: Block ciphers " .
Common Less common Other Design Attackcryptanalysis ) Standardization Utilization
![{\displaystyle P=P[0]\|P[1]\|P[2]\|P[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/962d913080a55a105606ed205eb30a3f81622e81)
![{\displaystyle C=C[0]\|C[1]\|C[2]\|C[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/98a03ff58b706a4b94ad5055efd774e241695338)
![{\displaystyle P[i]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/995a8820a0bc8c667f15471fd6e37865064629c3)
![{\displaystyle C[i]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/d9e670bd48c5b92b5228727d2a35097581cc85a6)
![{\displaystyle K_{i}=K_{i}[0]\|K_{i}[1]\|K_{i}[2]\|K_{i}[3]\|K_{i}[4]\|K_{i}[5]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/91e90555ae2fdcf6b34ba6163e022ffcd859cbff)
![{\displaystyle K_{i}[j]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/f99b4f427964139a7a670d561d69ab4a23b69b82)
![{\displaystyle X_{0}[0]\|X_{0}[1]\|X_{0}[2]\|X_{0}[3]\leftarrow P[0]\|P[1]\|P[2]\|P[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/db8397289cf3e8a3410f2561861fcab23b69d3d2)
![{\displaystyle X_{i+1}[0]\leftarrow \left(\left(X_{i}[0]\oplus K_{i}[0]\right)\boxplus \left(X_{i}[1]\oplus K_{i}[1]\right)\right)\lll 9}](https://wikimedia.org/api/rest_v1/media/math/render/svg/1a30fa2c3a5b90e6a9f5de66a326180d46b8cf8a)
![{\displaystyle X_{i+1}[1]\leftarrow \left(\left(X_{i}[1]\oplus K_{i}[2]\right)\boxplus \left(X_{i}[2]\oplus K_{i}[3]\right)\right)\ggg 5}](https://wikimedia.org/api/rest_v1/media/math/render/svg/13bd46cce21115b84deaf7566371792f60b07d4b)
![{\displaystyle X_{i+1}[2]\leftarrow \left(\left(X_{i}[2]\oplus K_{i}[4]\right)\boxplus \left(X_{i}[3]\oplus K_{i}[5]\right)\right)\ggg 3}](https://wikimedia.org/api/rest_v1/media/math/render/svg/6136a6ee98ab3a117e74192b655b216b32182691)
![{\displaystyle X_{i+1}[3]\leftarrow X_{i}[0]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/ee7a937028a7ebca9ef68238adabeb0225f4acc9)
![{\displaystyle C[0]\|C[1]\|C[2]\|C[3]\leftarrow X_{Nr}[0]\|X_{Nr}[1]\|X_{Nr}[2]\|X_{Nr}[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/29027759399d200a8b2081a0f34e06d2953c41ad)
![{\displaystyle X_{Nr}[0]\|X_{Nr}[1]\|X_{Nr}[2]\|X_{Nr}[3]\leftarrow C[0]\|C[1]\|C[2]\|C[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/4e41f952bedf4a8bb64390ef66f6aa6749f0144e)
![{\displaystyle X_{i}[0]\leftarrow X_{i+1}[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/e3ddf7a7944e3fd6dc4684cba6de40c442536974)
![{\displaystyle X_{i}[1]\leftarrow \left(\left(X_{i+1}[0]\ggg 9\right)\boxminus \left(X_{i}[0]\oplus K_{i}[0]\right)\right)\oplus K_{i}[1]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/4a7ef531ee4f999fd0fbe8c451dd83a83849e6fa)
![{\displaystyle X_{i}[2]\leftarrow \left(\left(X_{i+1}[1]\lll 5\right)\boxminus \left(X_{i}[1]\oplus K_{i}[2]\right)\right)\oplus K_{i}[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/f31bad05059975314772a2cf1f3c63851903b874)
![{\displaystyle X_{i}[3]\leftarrow \left(\left(X_{i+1}[2]\lll 3\right)\boxminus \left(X_{i}[2]\oplus K_{i}[4]\right)\right)\oplus K_{i}[5]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/afc983ae2a5278c9eb223f23401eac53d54055fa)
![{\displaystyle P[0]\|P[1]\|P[2]\|P[3]\leftarrow X_{0}[0]\|X_{0}[1]\|X_{0}[2]\|X_{0}[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/e97059fe8b8a6eee0570ec5ffa4ddfd29ee14385)
![{\displaystyle K=K[0]\|K[1]\|K[2]\|K[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/91a8e1869cd8f75060e9f6ff3abb2c394ffd4c47)
![{\displaystyle K[i]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/595547aad84350ad59d41b9c27f8bfd3e8386819)
![{\displaystyle \delta [i]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/163badcb327ed4921313cb74c16e6d12fc63b430)
![{\displaystyle T[0]\|T[1]\|T[2]\|T[3]\leftarrow K[0]\|K[1]\|K[2]\|K[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/a2d8cd6b71cdc250c51db6d845bd63c1a96e6f0c)
![{\displaystyle T[0]\leftarrow \left(T[0]\boxplus \left(\delta [i\mod 4]\lll i\right)\right)\lll 1}](https://wikimedia.org/api/rest_v1/media/math/render/svg/0dd5c3a166aa4a4d03b772217ac1ef543d884768)
![{\displaystyle T[1]\leftarrow \left(T[1]\boxplus \left(\delta [i\mod 4]\lll \left(i+1\right)\right)\right)\lll 3}](https://wikimedia.org/api/rest_v1/media/math/render/svg/5b5cc3ec4c92fef2ecdedd91b8501173131bd72e)
![{\displaystyle T[2]\leftarrow \left(T[2]\boxplus \left(\delta [i\mod 4]\lll \left(i+2\right)\right)\right)\lll 6}](https://wikimedia.org/api/rest_v1/media/math/render/svg/3e159390a974011425f47ae8ad3cc243fbc7c54e)
![{\displaystyle T[3]\leftarrow \left(T[3]\boxplus \left(\delta [i\mod 4]\lll \left(i+3\right)\right)\right)\lll 11}](https://wikimedia.org/api/rest_v1/media/math/render/svg/8a490799a9d410dca3ba1e885ba4ad84ed64bb64)
![{\displaystyle K_{i}\leftarrow T[0]\|T[1]\|T[2]\|T[1]\|T[3]\|T[1]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/ccad72928edb7dc6c061826ae39a1d6ab7208001)
![{\displaystyle K=K[0]\|K[1]\|K[2]\|K[3]\|K[4]\|K[5]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/05ab5d243c7c22d820fa6c00c9aea275ba932d1a)
![{\displaystyle T[0]\|T[1]\|T[2]\|T[3]\|T[4]\|T[5]\leftarrow K[0]\|K[1]\|K[2]\|K[3]\|K[4]\|K[5]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/9f509ff7be4a0f619aca4800db4f9d6dbd9546da)
![{\displaystyle T[0]\leftarrow \left(T[0]\boxplus \left(\delta [i\mod 6]\lll i\right)\right)\lll 1}](https://wikimedia.org/api/rest_v1/media/math/render/svg/32d9dea5ba51b39719a5ea982dafb3dd7b4b1d7a)
![{\displaystyle T[1]\leftarrow \left(T[1]\boxplus \left(\delta [i\mod 6]\lll \left(i+1\right)\right)\right)\lll 3}](https://wikimedia.org/api/rest_v1/media/math/render/svg/1f77859db5a7e4d2c0e7c302eae3aab39b17f13b)
![{\displaystyle T[2]\leftarrow \left(T[2]\boxplus \left(\delta [i\mod 6]\lll \left(i+2\right)\right)\right)\lll 6}](https://wikimedia.org/api/rest_v1/media/math/render/svg/3181dae3448c81f4bc9a0b5ba43d8b950301ea73)
![{\displaystyle T[3]\leftarrow \left(T[3]\boxplus \left(\delta [i\mod 6]\lll \left(i+3\right)\right)\right)\lll 11}](https://wikimedia.org/api/rest_v1/media/math/render/svg/ca357c5f2e3f40c84720e53049d26a4e49f1924a)
![{\displaystyle T[4]\leftarrow \left(T[4]\boxplus \left(\delta [i\mod 6]\lll \left(i+4\right)\right)\right)\lll 13}](https://wikimedia.org/api/rest_v1/media/math/render/svg/8767b046667b5834723b7955513e7458bd5fbc2a)
![{\displaystyle T[5]\leftarrow \left(T[5]\boxplus \left(\delta [i\mod 6]\lll \left(i+5\right)\right)\right)\lll 17}](https://wikimedia.org/api/rest_v1/media/math/render/svg/eaa5c76294b9d8393ff1c15da06805dbb8ed06ec)
![{\displaystyle K_{i}\leftarrow T[0]\|T[1]\|T[2]\|T[3]\|T[4]\|T[5]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/11d1ce09a17e54f97b8857080c6a5de8a257ac76)
![{\displaystyle K=K[0]\|K[1]\|K[2]\|K[3]\|K[4]\|K[5]\|K[6]\|K[7]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/29b44142e94864911adccd66be94e6ad1f7046f9)
![{\displaystyle T[0]\|T[1]\|T[2]\|T[3]\|T[4]\|T[5]\|T[6]\|T[7]\leftarrow K[0]\|K[1]\|K[2]\|K[3]\|K[4]\|K[5]\|K[6]\|K[7]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/de06760bf199d3354231574731671b430207754d)
![{\displaystyle T[6i\mod 8]\leftarrow \left(T[6i\mod 8]\boxplus \left(\delta [i\mod 8]\lll i\right)\right)\lll 1}](https://wikimedia.org/api/rest_v1/media/math/render/svg/d4272d6d13b8645d9be5f1816025ef27106f8083)
![{\displaystyle T[6i+1\mod 8]\leftarrow \left(T[6i+1\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+1\right)\right)\right)\lll 3}](https://wikimedia.org/api/rest_v1/media/math/render/svg/3d6ee511dee9143f4d2cd3554f66800ab53ed6cd)
![{\displaystyle T[6i+2\mod 8]\leftarrow \left(T[6i+2\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+2\right)\right)\right)\lll 6}](https://wikimedia.org/api/rest_v1/media/math/render/svg/061b5afe7b1d09a45af6799f1bd9778ab3efeab1)
![{\displaystyle T[6i+3\mod 8]\leftarrow \left(T[6i+3\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+3\right)\right)\right)\lll 11}](https://wikimedia.org/api/rest_v1/media/math/render/svg/b23231464b09726a8358ca47bccbd2f36e713a67)
![{\displaystyle T[6i+4\mod 8]\leftarrow \left(T[6i+4\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+4\right)\right)\right)\lll 13}](https://wikimedia.org/api/rest_v1/media/math/render/svg/1369f96c7fa2018a4f0067143e4541b6636549cc)
![{\displaystyle T[6i+5\mod 8]\leftarrow \left(T[6i+5\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+5\right)\right)\right)\lll 17}](https://wikimedia.org/api/rest_v1/media/math/render/svg/d999349648589297936f2496d471be8d2738be3e)
![{\displaystyle K_{i}\leftarrow T[6i\mod 8]\|T[6i+1\mod 8]\|T[6i+2\mod 8]\|T[6i+3\mod 8]\|T[6i+4\mod 8]\|T[6i+5\mod 8]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/cdfb6beb04a3ba11f22054f6fe62cb76b3f56002)
