LEA (cipher)

The Lightweight Encryption Algorithm (also known as LEA) is a 128-bit block cipher developed by South Korea in 2013 to provide confidentiality in high-speed environments such as big data and cloud computing, as well as lightweight environments such as IoT devices and mobile devices. LEA has three different key lengths: 128, 192, and 256 bits. LEA encrypts data about 1.5 to 2 times faster than AES, the most widely used block cipher in various software environments. LEA is one of the cryptographic algorithms approved by the Korean Cryptographic Module Validation Program (KCMVP) and is the national standard of Republic of Korea (KS X 3246). LEA is included in the ISO/IEC 29192-2:2019 standard (Information security - Lightweight cryptography - Part 2: Block ciphers).

The Lightweight Encryption Algorithm (also known as LEA) is a 128-bit block cipher developed by South Korea in 2013 to provide confidentiality in high-speed environments such as big data and cloud computing, as well as lightweight environments such as IoT devices and mobile devices. LEA has three different key lengths: 128, 192, and 256 bits. LEA encrypts data about 1.5 to 2 times faster than AES, the most widely used block cipher in various software environments. LEA is one of the cryptographic algorithms approved by the Korean Cryptographic Module Validation Program (KCMVP) and is the national standard of Republic of Korea (KS X 3246). LEA is included in the ISO/IEC 29192-2:2019 standard (Information security - Lightweight cryptography - Part 2: Block ciphers).

Encryption

Let P = P[0] \| P[1] \| P[2] \| P[3] be a 128-bit block of plaintext and C = C[0] \| C[1] \| C[2] \| C[3] be a 128-bit block of ciphertext, where P[i] and C[i] ( 0 \le i ) are 32-bit blocks. Let K_{i} = K_{i}[0] \| K_{i}[1] \| K_{i}[2] \| K_{i}[3] \| K_{i}[4] \| K_{i}[5] ( 0 \le i ) be 192-bit round keys, where K_{i}[j] ( 0 \le j ) are 32-bit blocks. Here Nr is the number of rounds for the LEA algorithm. The encryption operation is described as follows: X_{0}[0] \| X_{0}[1] \| X_{0}[2] \| X_{0}[3] \leftarrow P[0] \| P[1] \| P[2] \| P[3] for i=0 to Nr - 1 X_{i+1}[0] \leftarrow \left( \left( X_{i}[0] \oplus K_{i}[0] \right) \boxplus \left( X_{i}[1] \oplus K_{i}[1] \right) \right) \lll 9 X_{i+1}[1] \leftarrow \left( \left( X_{i}[1] \oplus K_{i}[2] \right) \boxplus \left( X_{i}[2] \oplus K_{i}[3] \right) \right) \ggg 5 X_{i+1}[2] \leftarrow \left( \left( X_{i}[2] \oplus K_{i}[4] \right) \boxplus \left( X_{i}[3] \oplus K_{i}[5] \right) \right) \ggg 3 X_{i+1}[3] \leftarrow X_{i}[0] C[0] \| C[1] \| C[2] \| C[3] \leftarrow X_{Nr}[0] \| X_{Nr}[1] \| X_{Nr}[2] \| X_{Nr}[3]

Decryption

The decryption operation is as follows: X_{Nr}[0] \| X_{Nr}[1] \| X_{Nr}[2] \| X_{Nr}[3] \leftarrow C[0] \| C[1] \| C[2] \| C[3] for i=(Nr-1) down to 0 X_{i}[0] \leftarrow X_{i+1}[3] X_{i}[1] \leftarrow \left( \left( X_{i+1}[0] \ggg 9 \right) \boxminus \left( X_{i}[0] \oplus K_{i}[0] \right) \right) \oplus K_{i}[1] X_{i}[2] \leftarrow \left( \left( X_{i+1}[1] \lll 5 \right) \boxminus \left( X_{i}[1] \oplus K_{i}[2] \right) \right) \oplus K_{i}[3] X_{i}[3] \leftarrow \left( \left( X_{i+1}[2] \lll 3 \right) \boxminus \left( X_{i}[2] \oplus K_{i}[4] \right) \right) \oplus K_{i}[5] P[0] \| P[1] \| P[2] \| P[3] \leftarrow X_{0}[0] \| X_{0}[1] \| X_{0}[2] \| X_{0}[3] Let K = K[0] \| K[1] \| K[2] \| K[3] be a 128-bit key, where K[i] ( 0 \le i ) are 32-bit blocks. The key schedule for LEA-128 takes K and four 32-bit constants \delta[i] ( 0 \le i ) as inputs and outputs twenty-four 192-bit round keys K_{i} ( 0 \le i ). The key schedule operation for LEA-128 is as follows: T[0] \| T[1] \| T[2] \| T[3] \leftarrow K[0] \| K[1] \| K[2] \| K[3] for i=0 to 23 T[0] \leftarrow \left( T[0] \boxplus \left( \delta[i \mod 4] \lll i \right) \right) \lll 1 T[1] \leftarrow \left( T[1] \boxplus \left( \delta[i \mod 4] \lll \left( i + 1 \right) \right) \right) \lll 3 T[2] \leftarrow \left( T[2] \boxplus \left( \delta[i \mod 4] \lll \left( i + 2 \right) \right) \right) \lll 6 T[3] \leftarrow \left( T[3] \boxplus \left( \delta[i \mod 4] \lll \left( i + 3 \right) \right) \right) \lll 11 K_{i} \leftarrow T[0] \| T[1] \| T[2] \| T[1] \| T[3] \| T[1] Let K = K[0] \| K[1] \| K[2] \| K[3] \| K[4] \| K[5] be a 192-bit key, where K[i] ( 0 \le i ) are 32-bit blocks. The key schedule for LEA-192 takes K and six 32-bit constants \delta[i] ( 0 \le i ) as inputs and outputs twenty-eight 192-bit round keys K_{i} ( 0 \le i ). The key schedule operation for LEA-192 is as follows: T[0] \| T[1] \| T[2] \| T[3] \| T[4] \| T[5] \leftarrow K[0] \| K[1] \| K[2] \| K[3] \| K[4] \| K[5] for i=0 to 27 T[0] \leftarrow \left( T[0] \boxplus \left( \delta[i \mod 6] \lll i \right) \right) \lll 1 T[1] \leftarrow \left( T[1] \boxplus \left( \delta[i \mod 6] \lll \left( i + 1 \right) \right) \right) \lll 3 T[2] \leftarrow \left( T[2] \boxplus \left( \delta[i \mod 6] \lll \left( i + 2 \right) \right) \right) \lll 6 T[3] \leftarrow \left( T[3] \boxplus \left( \delta[i \mod 6] \lll \left( i + 3 \right) \right) \right) \lll 11 T[4] \leftarrow \left( T[4] \boxplus \left( \delta[i \mod 6] \lll \left( i + 4 \right) \right) \right) \lll 13 T[5] \leftarrow \left( T[5] \boxplus \left( \delta[i \mod 6] \lll \left( i + 5 \right) \right) \right) \lll 17 K_{i} \leftarrow T[0] \| T[1] \| T[2] \| T[3] \| T[4] \| T[5] Let K = K[0] \| K[1] \| K[2] \| K[3] \| K[4] \| K[5] \| K[6] \| K[7] be a 256-bit key, where K[i] ( 0 \le i ) are 32-bit blocks. The key schedule for LEA-192 takes K and eight 32-bit constants \delta[i] ( 0 \le i ) as inputs and outputs thirty-two 192-bit round keys K_{i} ( 0 \le i ). The key schedule operation for LEA-256 is as follows: T[0] \| T[1] \| T[2] \| T[3] \| T[4] \| T[5] \| T[6] \| T[7] \leftarrow K[0] \| K[1] \| K[2] \| K[3] \| K[4] \| K[5] \| K[6] \| K[7] for i=0 to 31 T[6i \mod 8] \leftarrow \left( T[6i \mod 8] \boxplus \left( \delta[i \mod 8] \lll i \right) \right) \lll 1 T[6i + 1 \mod 8] \leftarrow \left( T[6i + 1 \mod 8] \boxplus \left( \delta[i \mod 8] \lll \left( i + 1 \right) \right) \right) \lll 3 T[6i + 2 \mod 8] \leftarrow \left( T[6i + 2 \mod 8] \boxplus \left( \delta[i \mod 8] \lll \left( i + 2 \right) \right) \right) \lll 6 T[6i + 3 \mod 8] \leftarrow \left( T[6i + 3 \mod 8] \boxplus \left( \delta[i \mod 8] \lll \left( i + 3 \right) \right) \right) \lll 11 T[6i + 4 \mod 8] \leftarrow \left( T[6i + 4 \mod 8] \boxplus \left( \delta[i \mod 8] \lll \left( i + 4 \right) \right) \right) \lll 13 T[6i + 5 \mod 8] \leftarrow \left( T[6i + 5 \mod 8] \boxplus \left( \delta[i \mod 8] \lll \left( i + 5 \right) \right) \right) \lll 17 K_{i} \leftarrow T[6i \mod 8] \| T[6i + 1 \mod 8] \| T[6i + 2 \mod 8] \| T[6i + 3 \mod 8] \| T[6i + 4 \mod 8] \| T[6i + 5 \mod 8] Key: 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0 Plaintext: 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f Ciphertext: 9f c8 4e 35 28 c6 c6 18 55 32 c7 a7 04 64 8b fd LEA-192 Key: 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0 f0 e1 d2 c3 b4 a5 96 87 Plaintext: 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f Ciphertext: 6f b9 5e 32 5a ad 1b 87 8c dc f5 35 76 74 c6 f2 LEA-256 Key: 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0 f0 e1 d2 c3 b4 a5 96 87 78 69 5a 4b 3c 2d 1e 0f Plaintext: 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f Ciphertext: d6 51 af f6 47 b1 89 c1 3a 89 00 ca 27 f9 e1 97

Text derived from https://en.wikipedia.org/w/index.php?oldid=1199235259 under CC BY-SA 4.0; modifications have been made.