1. Cryptography Team Presentation 1
“Implementation of a RC5 block cipher algorithm and implementing an attack on it”
Agarwal, Kshitij
Rao, Prashant
Project Mentor – Prof. Alan Kaminsky

2. About RC5 Fast symmetric block cipher
Same key for encryption and decryption
Plaintext and ciphertext are fixed-length bit sequences (blocks)

3. Parameters of RC5 RC5 – w/r/b E.g. RC5 – 32/16/10 w = 32 bits
r = 16 rounds
b = 10-byte (80-bit) secret key variable
t = 2 (r + 1) = 2 (16 + 1) = 34 rounds

4. Important parameters in details
“w”(bits) – variable word size
Allowable choice for “w” in RC5– 16,32 and 64
Suggested 32
“Two” word input (plaintext) block size – 64-bit plaintext
“Two” word output (ciphertext) block size – 64-bit ciphertext
Design accepts all w > 0
Variable word size can exploit longer word length of processors like 64 – bit processors.

5. Important parameters in details
“r” – variable number of rounds
Tradeoff between high speed and high security.
Allowed values 0-255
Suggested – 12
Higher the number of rounds provides increased level of security.
“S” – Expanded key table – derived from user’s secret key.
“t” – The size of table “S” (depends on “r”)
t = 2 ( r + 1 ) words.

6. Important parameters in details
“b” – variable length secret cryptographic key
The number of bytes in the secret key K.
16 bytes suggested with allowed values from 0 – 255
“K” – The b-byte secret key : K[0], K[1], ..., K[b-1].

7. Discussion on parameters
RC5 cannot be secure for all possible values
r = 0
No rounds of security will provide no encryption
r = 1
One round will provide very less security
As a matter of fact, it can be easily broken
b = 0
No key, no security
Maximum allowable parameter values will be overkill.
Nominal Choice Proposed
RC5 – 32/12/16

8. Notation and RC5 Primitive Ops
Three Primitive operations(and their inverses)
Two’s complement addition of words, modulo 2w
‘+’
Inverse op , subtraction, ‘-’
Bit-wise exclusive OR of words, denoted by ⊕
A left-rotation of words
x <<< y , cyclic rotation of word x left by y bits
One word of the intermediate results is cyclically rotated by an amount determined bits of another intermediate results.
The inverse operation is right-rotation, x>>>y

9. Note
We see that rotations are ‘rotations by variable amount’ that is plaintext dependent
We know that on modern microprocessors, a variable rotation takes constant-time
Time is independent of the rotation amount y
No other non-linear operations in RC5
Strength,therefore, relies on data-dependent rotations

10. RC5 Algorithm Three parts:- Key Expansion Encryption Algorithm
Decryption Algorithm

11. RC5 Algorithm – Key Expansion
Requirements of key expansion
Filling the expanded key table array S[0…t – 1] with random binary words
“t” – Size of table “S” => 2 ( r+1 )
S table is not an “S-box” like DES.
Entries in S sequentially, one at a time.
Random binary words are derived from the K.

12. RC5 Algorithm – Key Expansion
Starting with two magic constants
Two word-sized binary constants
Pw = Odd((e - 2) 2w )
Qw = Odd((φ – 1) 2w )
e = … (base of natural logarithms)
Φ = … (golden ratio),
Where, Odd(x) is the odd integer nearest to x
For w = 16 and 32 in hexadecimal form
P16 = b7e1
Q16 = 9e37
P32 = b7e15163
Q32 = 9e3779b9

13. RC5 Algorithm – Key Expansion
Converting the Secret Key from Bytes to Words
c = ceiling(b/u) words
Pseudo code for conversion:-
Image Source:

14. RC5 Algorithm – Key Expansion
Initializing the S Array
Initialization to a particular fixed(key- independent)
Image Source:

15. RC5 Algorithm – Key Expansion
Mixing in the Secret Key
Pseudo code:-
Image Source:

16. RC5 Algorithm Encryption Algorithm
Two w-bit words are denoted as A and B
A = A + S[0];
B = B + S[1];
for i = 1 to r do
A = (( A ⊕ B ) <<< B ) + S[ 2 * i ];
B = (( B ⊕ A) <<< A ) + S[ 2 * i + 1];
The output is in the registers A and B.
Work is done on both A and B, unlike DES
where only half input is updated.
Image Source:

17. RC5 Algorithm Decryption Algorithm (easily derived from encryption)
Two w-bit words are denoted as A and B
for i = r downto 1 do
B = (( B – S[ 2 * i + 1 ]) >>> A) ⊕ A;
A = (( A – S[ 2 * i ] >>> B) ⊕ B;
B = B - S[1];
A = A - S[0];
The output is in the registers A and B.

18. Important Notes
Data dependent rotations – amount of rotation is not pre-determined.
The behavior of each round is different as the rotation amount is different.
Each round ends by adding expanded key from S
It was experimentally[1] determined that after eight rounds in RC5-32, each message bit affected some rotation amount.
[1]: Rivest, R. L. (1994). "The RC5 Encryption Algorithm" (pdf). Proceedings of the Second International Workshop on Fast Software Encryption (FSE) 1994e. pp. 86–96.

19. Next Presentation Differential Attack will be performed.
Difficult because bits are rotated to “random” positions in each round.
Analysis of the requirements of the attack.
Analysis of the results of the attack.

20. References
Rivest, R. L. (1994). "The RC5 Encryption Algorithm" (pdf). Proceedings of the Second International Workshop on Fast Software Encryption (FSE) 1994e. pp. 86–96.
RC5 Encryption Diagram

21. THANK YOU
Questions, if any.