Republic of Korea national standard block cipher
LEA![](https://upload.wikimedia.org/wikipedia/commons/thumb/3/3a/LEA_enc_round_function.png/220px-LEA_enc_round_function.png) LEA encryption round function |
|
Designers | Deukjo Hong, Jung-Keun Lee, Dong-Chan Kim, Daesung Kwon, Kwon Ho Ryu, Dong-Geon Lee |
---|
First published | 2013 |
---|
|
Key sizes | 128, 192, or 256 bits |
---|
Block sizes | 128 bits |
---|
Structure | ARX (modular Addition, bitwise Rotation, and bitwise XOR) |
---|
Rounds | 24, 28, or 32 (depending on key size) |
---|
|
As of 2019, no successful attack on full-round LEA is known. |
The Lightweight Encryption Algorithm (also known as LEA) is a 128-bit block cipher developed by South Korea in 2013 to provide confidentiality in high-speed environments such as big data and cloud computing, as well as lightweight environments such as IoT devices and mobile devices.[1] LEA has three different key lengths: 128, 192, and 256 bits. LEA encrypts data about 1.5 to 2 times faster than AES, the most widely used block cipher in various software environments.
LEA is one of the cryptographic algorithms approved by the Korean Cryptographic Module Validation Program (KCMVP) and is the national standard of Republic of Korea (KS X 3246). LEA is included in the ISO/IEC 29192-2:2019 standard (Information security - Lightweight cryptography - Part 2: Block ciphers).
Specification
The block cipher LEA consisting of ARX operations (modular Addition:
, bitwise Rotation:
,
, and bitwise XOR
) for 32-bit words processes data blocks of 128 bits and has three different key lengths: 128, 192, and 256 bits.
LEA with a 128-bit key, LEA with a 192-bit key, and LEA with a 256-bit key are referred to as “LEA-128”, “LEA-192”, and “LEA-256”, respectively.
The number of rounds is 24 for LEA-128, 28 for LEA-192, and 32 for LEA-256.
Encryption
Let
be a 128-bit block of plaintext and
be a 128-bit block of ciphertext, where
and
(
) are 32-bit blocks.
Let
(
) be 192-bit round keys, where
(
) are 32-bit blocks.
Here
is the number of rounds for the LEA algorithm.
The encryption operation is described as follows:
![{\displaystyle X_{0}[0]\|X_{0}[1]\|X_{0}[2]\|X_{0}[3]\leftarrow P[0]\|P[1]\|P[2]\|P[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/db8397289cf3e8a3410f2561861fcab23b69d3d2)
- for
to
![{\displaystyle X_{i+1}[0]\leftarrow \left(\left(X_{i}[0]\oplus K_{i}[0]\right)\boxplus \left(X_{i}[1]\oplus K_{i}[1]\right)\right)\lll 9}](https://wikimedia.org/api/rest_v1/media/math/render/svg/1a30fa2c3a5b90e6a9f5de66a326180d46b8cf8a)
![{\displaystyle X_{i+1}[1]\leftarrow \left(\left(X_{i}[1]\oplus K_{i}[2]\right)\boxplus \left(X_{i}[2]\oplus K_{i}[3]\right)\right)\ggg 5}](https://wikimedia.org/api/rest_v1/media/math/render/svg/13bd46cce21115b84deaf7566371792f60b07d4b)
![{\displaystyle X_{i+1}[2]\leftarrow \left(\left(X_{i}[2]\oplus K_{i}[4]\right)\boxplus \left(X_{i}[3]\oplus K_{i}[5]\right)\right)\ggg 3}](https://wikimedia.org/api/rest_v1/media/math/render/svg/6136a6ee98ab3a117e74192b655b216b32182691)
![{\displaystyle X_{i+1}[3]\leftarrow X_{i}[0]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/ee7a937028a7ebca9ef68238adabeb0225f4acc9)
![{\displaystyle C[0]\|C[1]\|C[2]\|C[3]\leftarrow X_{Nr}[0]\|X_{Nr}[1]\|X_{Nr}[2]\|X_{Nr}[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/29027759399d200a8b2081a0f34e06d2953c41ad)
Decryption
The decryption operation is as follows:
![{\displaystyle X_{Nr}[0]\|X_{Nr}[1]\|X_{Nr}[2]\|X_{Nr}[3]\leftarrow C[0]\|C[1]\|C[2]\|C[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/4e41f952bedf4a8bb64390ef66f6aa6749f0144e)
- for
down to
![{\displaystyle X_{i}[0]\leftarrow X_{i+1}[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/e3ddf7a7944e3fd6dc4684cba6de40c442536974)
![{\displaystyle X_{i}[1]\leftarrow \left(\left(X_{i+1}[0]\ggg 9\right)\boxminus \left(X_{i}[0]\oplus K_{i}[0]\right)\right)\oplus K_{i}[1]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/4a7ef531ee4f999fd0fbe8c451dd83a83849e6fa)
![{\displaystyle X_{i}[2]\leftarrow \left(\left(X_{i+1}[1]\lll 5\right)\boxminus \left(X_{i}[1]\oplus K_{i}[2]\right)\right)\oplus K_{i}[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/f31bad05059975314772a2cf1f3c63851903b874)
![{\displaystyle X_{i}[3]\leftarrow \left(\left(X_{i+1}[2]\lll 3\right)\boxminus \left(X_{i}[2]\oplus K_{i}[4]\right)\right)\oplus K_{i}[5]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/afc983ae2a5278c9eb223f23401eac53d54055fa)
![{\displaystyle P[0]\|P[1]\|P[2]\|P[3]\leftarrow X_{0}[0]\|X_{0}[1]\|X_{0}[2]\|X_{0}[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/e97059fe8b8a6eee0570ec5ffa4ddfd29ee14385)
Key schedule
The key schedule of LEA supports 128, 192, and 256-bit keys and outputs 192-bit round keys
(
) for the data processing part.
Key schedule for LEA-128
Let
be a 128-bit key, where
(
) are 32-bit blocks.
The key schedule for LEA-128 takes
and four 32-bit constants
(
) as inputs and outputs twenty-four 192-bit round keys
(
).
The key schedule operation for LEA-128 is as follows:
![{\displaystyle T[0]\|T[1]\|T[2]\|T[3]\leftarrow K[0]\|K[1]\|K[2]\|K[3]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/a2d8cd6b71cdc250c51db6d845bd63c1a96e6f0c)
- for
to
![{\displaystyle T[0]\leftarrow \left(T[0]\boxplus \left(\delta [i\mod 4]\lll i\right)\right)\lll 1}](https://wikimedia.org/api/rest_v1/media/math/render/svg/0dd5c3a166aa4a4d03b772217ac1ef543d884768)
![{\displaystyle T[1]\leftarrow \left(T[1]\boxplus \left(\delta [i\mod 4]\lll \left(i+1\right)\right)\right)\lll 3}](https://wikimedia.org/api/rest_v1/media/math/render/svg/5b5cc3ec4c92fef2ecdedd91b8501173131bd72e)
![{\displaystyle T[2]\leftarrow \left(T[2]\boxplus \left(\delta [i\mod 4]\lll \left(i+2\right)\right)\right)\lll 6}](https://wikimedia.org/api/rest_v1/media/math/render/svg/3e159390a974011425f47ae8ad3cc243fbc7c54e)
![{\displaystyle T[3]\leftarrow \left(T[3]\boxplus \left(\delta [i\mod 4]\lll \left(i+3\right)\right)\right)\lll 11}](https://wikimedia.org/api/rest_v1/media/math/render/svg/8a490799a9d410dca3ba1e885ba4ad84ed64bb64)
![{\displaystyle K_{i}\leftarrow T[0]\|T[1]\|T[2]\|T[1]\|T[3]\|T[1]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/ccad72928edb7dc6c061826ae39a1d6ab7208001)
Key schedule for LEA-192
Let
be a 192-bit key, where
(
) are 32-bit blocks.
The key schedule for LEA-192 takes
and six 32-bit constants
(
) as inputs and outputs twenty-eight 192-bit round keys
(
).
The key schedule operation for LEA-192 is as follows:
![{\displaystyle T[0]\|T[1]\|T[2]\|T[3]\|T[4]\|T[5]\leftarrow K[0]\|K[1]\|K[2]\|K[3]\|K[4]\|K[5]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/9f509ff7be4a0f619aca4800db4f9d6dbd9546da)
- for
to
![{\displaystyle T[0]\leftarrow \left(T[0]\boxplus \left(\delta [i\mod 6]\lll i\right)\right)\lll 1}](https://wikimedia.org/api/rest_v1/media/math/render/svg/32d9dea5ba51b39719a5ea982dafb3dd7b4b1d7a)
![{\displaystyle T[1]\leftarrow \left(T[1]\boxplus \left(\delta [i\mod 6]\lll \left(i+1\right)\right)\right)\lll 3}](https://wikimedia.org/api/rest_v1/media/math/render/svg/1f77859db5a7e4d2c0e7c302eae3aab39b17f13b)
![{\displaystyle T[2]\leftarrow \left(T[2]\boxplus \left(\delta [i\mod 6]\lll \left(i+2\right)\right)\right)\lll 6}](https://wikimedia.org/api/rest_v1/media/math/render/svg/3181dae3448c81f4bc9a0b5ba43d8b950301ea73)
![{\displaystyle T[3]\leftarrow \left(T[3]\boxplus \left(\delta [i\mod 6]\lll \left(i+3\right)\right)\right)\lll 11}](https://wikimedia.org/api/rest_v1/media/math/render/svg/ca357c5f2e3f40c84720e53049d26a4e49f1924a)
![{\displaystyle T[4]\leftarrow \left(T[4]\boxplus \left(\delta [i\mod 6]\lll \left(i+4\right)\right)\right)\lll 13}](https://wikimedia.org/api/rest_v1/media/math/render/svg/8767b046667b5834723b7955513e7458bd5fbc2a)
![{\displaystyle T[5]\leftarrow \left(T[5]\boxplus \left(\delta [i\mod 6]\lll \left(i+5\right)\right)\right)\lll 17}](https://wikimedia.org/api/rest_v1/media/math/render/svg/eaa5c76294b9d8393ff1c15da06805dbb8ed06ec)
![{\displaystyle K_{i}\leftarrow T[0]\|T[1]\|T[2]\|T[3]\|T[4]\|T[5]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/11d1ce09a17e54f97b8857080c6a5de8a257ac76)
Key schedule for LEA-256
Let
be a 256-bit key, where
(
) are 32-bit blocks.
The key schedule for LEA-192 takes
and eight 32-bit constants
(
) as inputs and outputs thirty-two 192-bit round keys
(
).
The key schedule operation for LEA-256 is as follows:
![{\displaystyle T[0]\|T[1]\|T[2]\|T[3]\|T[4]\|T[5]\|T[6]\|T[7]\leftarrow K[0]\|K[1]\|K[2]\|K[3]\|K[4]\|K[5]\|K[6]\|K[7]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/de06760bf199d3354231574731671b430207754d)
- for
to
![{\displaystyle T[6i\mod 8]\leftarrow \left(T[6i\mod 8]\boxplus \left(\delta [i\mod 8]\lll i\right)\right)\lll 1}](https://wikimedia.org/api/rest_v1/media/math/render/svg/d4272d6d13b8645d9be5f1816025ef27106f8083)
![{\displaystyle T[6i+1\mod 8]\leftarrow \left(T[6i+1\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+1\right)\right)\right)\lll 3}](https://wikimedia.org/api/rest_v1/media/math/render/svg/3d6ee511dee9143f4d2cd3554f66800ab53ed6cd)
![{\displaystyle T[6i+2\mod 8]\leftarrow \left(T[6i+2\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+2\right)\right)\right)\lll 6}](https://wikimedia.org/api/rest_v1/media/math/render/svg/061b5afe7b1d09a45af6799f1bd9778ab3efeab1)
![{\displaystyle T[6i+3\mod 8]\leftarrow \left(T[6i+3\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+3\right)\right)\right)\lll 11}](https://wikimedia.org/api/rest_v1/media/math/render/svg/b23231464b09726a8358ca47bccbd2f36e713a67)
![{\displaystyle T[6i+4\mod 8]\leftarrow \left(T[6i+4\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+4\right)\right)\right)\lll 13}](https://wikimedia.org/api/rest_v1/media/math/render/svg/1369f96c7fa2018a4f0067143e4541b6636549cc)
![{\displaystyle T[6i+5\mod 8]\leftarrow \left(T[6i+5\mod 8]\boxplus \left(\delta [i\mod 8]\lll \left(i+5\right)\right)\right)\lll 17}](https://wikimedia.org/api/rest_v1/media/math/render/svg/d999349648589297936f2496d471be8d2738be3e)
![{\displaystyle K_{i}\leftarrow T[6i\mod 8]\|T[6i+1\mod 8]\|T[6i+2\mod 8]\|T[6i+3\mod 8]\|T[6i+4\mod 8]\|T[6i+5\mod 8]}](https://wikimedia.org/api/rest_v1/media/math/render/svg/cdfb6beb04a3ba11f22054f6fe62cb76b3f56002)
Constant values
The eight 32-bit constant values
(
) used in the key schedule are given in the following table.
Constant values used in the key schedule
|
0
|
1
|
2
|
3
|
4
|
5
|
6
|
7
|
|
0xc3efe9db
|
0x44626b02
|
0x79e27c8a
|
0x78df30ec
|
0x715ea49e
|
0xc785da0a
|
0xe04ef22a
|
0xe5c40957
|
Security
As of 2019, no successful attack on full-round LEA is known.
As is typical for iterated block ciphers, reduced-round variants have been attacked.
The best published attacks on LEA in the standard attack model (CPA/CCA with unknown key) are boomerang attacks and differential linear attacks.
The security margin to the whole rounds ratio is greater than 37% against various existing cryptanalytic techniques for block ciphers.
Security of LEA-128 (24 rounds)
Attack type
|
Attacked rounds
|
Differential[2]
|
14
|
Truncated differential[2]
|
14
|
Linear[1]
|
13
|
Zero correlation[1]
|
10
|
Boomerang[1]
|
15
|
Impossible differential[1]
|
12
|
Integral[1]
|
9
|
Differential linear[1]
|
15
|
Related-key differential[1]
|
13
|
Security margins of LEA
Block ciphers
|
Rounds (Attacked / Total)
|
Security margins
|
LEA-128
|
15 / 24
|
37.50%
|
LEA-192
|
16 / 28
|
42.85%
|
LEA-256
|
18 / 32
|
43.75%
|
Test vectors
Test vectors for LEA for each key length are as follows.[5]
All values are expressed in hexadecimal form.
- LEA-128
- Key: 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0
- Plaintext: 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
- Ciphertext: 9f c8 4e 35 28 c6 c6 18 55 32 c7 a7 04 64 8b fd
- LEA-192
- Key: 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0 f0 e1 d2 c3 b4 a5 96 87
- Plaintext: 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f
- Ciphertext: 6f b9 5e 32 5a ad 1b 87 8c dc f5 35 76 74 c6 f2
- LEA-256
- Key: 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0 f0 e1 d2 c3 b4 a5 96 87 78 69 5a 4b 3c 2d 1e 0f
- Plaintext: 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f
- Ciphertext: d6 51 af f6 47 b1 89 c1 3a 89 00 ca 27 f9 e1 97
Implementations
LEA is free for any use: public or private, commercial or non-commercial.
The source code for distribution of LEA implemented in C, Java, and Python can be downloaded from KISA's website.[6]
In addition, LEA is contained in Crypto++ library, a free C++ class library of cryptographic schemes.[7]
KCMVP
LEA is one of the cryptographic algorithms approved by the Korean Cryptographic Module Validation Program (KCMVP).[8]
Standardization
LEA is included in the following standards.
- KS X 3246, 128-bit block cipher LEA (in Korean)[5]
- ISO/IEC 29192-2:2019, Information security - Lightweight cryptography - Part 2: Block ciphers[9]