Misplaced Pages

QARMA

Article snapshot taken from Wikipedia with creative commons attribution-sharealike license. Give it a read and then ask your questions in the chat. We can research this topic together.

QARMA (from Qualcomm ARM Authenticator) is a lightweight tweakable block cipher primarily known for its use in the ARMv8 architecture for protection of software as a cryptographic hash for the Pointer Authentication Code. The cipher was proposed by Roberto Avanzi in 2016. Two versions of QARMA are defined: QARMA-64 (64-bit block size with a 128-bit encryption key) and QARMA-128 (128-bit block size with a 256-bit key). The design of the QARMA was influenced by PRINCE and MANTIS. The cipher is intended for fully-unrolled hardware implementations with low latency (like memory encryption). Unlike the XTS mode, the address can be directly used as a tweak and does not need to be whitened with the block encryption first.

Architecture

QARMA overview (an overbar indicates an inverse transformation)

QARMA is an Even–Mansour cipher using three stages, with whitening keys w and w XORed in between:

  1. permutation F is using core key k and parameterized by a tweak T. It has r rounds inside (r = 7 for QARMA-64, r = 11 for QARMA-128);
  2. "central" permutation C is using key k and is designed to be reversible via a simple key transformation (contains two central rounds);
  3. the third permutation is an inverse of the first (r more rounds).

All keys are derived from the master encryption key K using specialisation:

  • K is partitioned into halves as w Concatenation k, each will have halfsize bits;
  • for encryption w = (w >>> 1) + (w >> (halfsize-1));
  • for encryption k = k;
  • for decryption, the same design can be used as long as k+α is used as a core key, k = Q•k, w and w are swapped. α here is a special constant and Q a special involutary matrix. This construct is similar to the alpha reflection in PRINCE.
QARMA details. Rounds of ϝ {\displaystyle \digamma } are at the top, rounds of ϝ ¯ {\displaystyle {\overline {\digamma }}} are at the bottom, C {\displaystyle C} is on the right. Inner path describes the transformation of the internal state, outer path corresponds to the tweak update. ci are round constants.

The data is split into 16 cells (4-bit nibbles for QARMA-64, 8-bit bytes for QARMA-128). Internal state also contains 16 cells, arranged in a 4x4 matrix, and is initialized by plaintext (XORed with w). In each round of ϝ {\displaystyle \digamma } , the state is transformed via operations τ , M , S {\displaystyle \tau ,M,S} :

  • τ {\displaystyle \tau } is ShuffleCells, a MIDORI permutation of cells ();
  • M {\displaystyle M} is MixColumns: each column is multiplied by a fixed matrix M;
  • S {\displaystyle S} is SubCells: each cell is transformed using an S-box.

The tweak for each round is updated using h , ω {\displaystyle h,\omega } :

  • h {\displaystyle h} is a cell permutation from MANTIS ();
  • ω {\displaystyle \omega } is an LFSR applied to each of the cells with numbers . For QARMA-64, the LFSR is (b3, b2, b1, b0) ⇒ (b0 + b1, b3, b2, b1), for QARMA-128, (b7, b6, ..., b0) ⇒ (b0 + b2, b7, b6, ..., b1),

The rounds of ϝ ¯ {\displaystyle {\overline {\digamma }}} consist of inverse operations τ ¯ , M ¯ , S ¯ , h ¯ , ω ¯ {\displaystyle {\overline {\tau }},{\overline {M}},{\overline {S}},{\overline {h}},{\overline {\omega }}} . Central rounds, in addition to two rounds ( τ , M , S {\displaystyle \tau ,M,S} and τ ¯ , M ¯ , S ¯ {\displaystyle {\overline {\tau }},{\overline {M}},{\overline {S}}} ), include multiplication of the state by an involutary matrix Q.

References

  1. Qameleon v. 1.0: A Submission to the NIST Lightweight Cryptography Standardization Process
  2. ^ Zong & Dong 2016.
  3. ^ Avanzi 2016.

Sources

External links

Category: