LEA (cipher)

The block cipher LEA consisting of ARX operations (modular Addition: $\backslash boxplus$, bitwise Rotation: $\backslash lll$, $\backslash ggg$, and bitwise XOR $\backslash oplus$) for 32-bit words processes data blocks of 128 bits and has three different key lengths: 128, 192, and 256 bits.

LEA with a 128-bit key, LEA with a 192-bit key, and LEA with a 256-bit key are referred to as “LEA-128”, “LEA-192”, and “LEA-256”, respectively.

The number of rounds is 24 for LEA-128, 28 for LEA-192, and 32 for LEA-256.

Let $P\; =\; P[0]\; \backslash |\; P[1]\; \backslash |\; P[2]\; \backslash |\; P[3]$ be a 128-bit block of plaintext and $C\; =\; C[0]\; \backslash |\; C[1]\; \backslash |\; C[2]\; \backslash |\; C[3]$ be a 128-bit block of ciphertext, where $P[i]$ and $C[i]$ () are 32-bit blocks.

Let $K\_\{i\}\; =\; K\_\{i\}[0]\; \backslash |\; K\_\{i\}[1]\; \backslash |\; K\_\{i\}[2]\; \backslash |\; K\_\{i\}[3]\; \backslash |\; K\_\{i\}[4]\; \backslash |\; K\_\{i\}[5]$ () be 192-bit round keys, where $K\_\{i\}[j]$ () are 32-bit blocks.

Here $Nr$ is the number of rounds for the LEA algorithm.

The encryption operation is described as follows:

1. $X\_\{0\}[0]\; \backslash |\; X\_\{0\}[1]\; \backslash |\; X\_\{0\}[2]\; \backslash |\; X\_\{0\}[3]\; \backslash leftarrow\; P[0]\; \backslash |\; P[1]\; \backslash |\; P[2]\; \backslash |\; P[3]$
2. for $i=0$ to $Nr\; -\; 1$
3. $X\_\{i+1\}[0]\; \backslash leftarrow\; \backslash left(\; \backslash left(\; X\_\{i\}[0]\; \backslash oplus\; K\_\{i\}[0]\; \backslash right)\; \backslash boxplus\; \backslash left(\; X\_\{i\}[1]\; \backslash oplus\; K\_\{i\}[1]\; \backslash right)\; \backslash right)\; \backslash lll\; 9$
4. $X\_\{i+1\}[1]\; \backslash leftarrow\; \backslash left(\; \backslash left(\; X\_\{i\}[1]\; \backslash oplus\; K\_\{i\}[2]\; \backslash right)\; \backslash boxplus\; \backslash left(\; X\_\{i\}[2]\; \backslash oplus\; K\_\{i\}[3]\; \backslash right)\; \backslash right)\; \backslash ggg\; 5$
5. $X\_\{i+1\}[2]\; \backslash leftarrow\; \backslash left(\; \backslash left(\; X\_\{i\}[2]\; \backslash oplus\; K\_\{i\}[4]\; \backslash right)\; \backslash boxplus\; \backslash left(\; X\_\{i\}[3]\; \backslash oplus\; K\_\{i\}[5]\; \backslash right)\; \backslash right)\; \backslash ggg\; 3$
6. $X\_\{i+1\}[3]\; \backslash leftarrow\; X\_\{i\}[0]$
7. $C[0]\; \backslash |\; C[1]\; \backslash |\; C[2]\; \backslash |\; C[3]\; \backslash leftarrow\; X\_\{Nr\}[0]\; \backslash |\; X\_\{Nr\}[1]\; \backslash |\; X\_\{Nr\}[2]\; \backslash |\; X\_\{Nr\}[3]$

The decryption operation is as follows:

1. $X\_\{Nr\}[0]\; \backslash |\; X\_\{Nr\}[1]\; \backslash |\; X\_\{Nr\}[2]\; \backslash |\; X\_\{Nr\}[3]\; \backslash leftarrow\; C[0]\; \backslash |\; C[1]\; \backslash |\; C[2]\; \backslash |\; C[3]$
2. for $i=(Nr-1)$ down to $0$
3. $X\_\{i\}[0]\; \backslash leftarrow\; X\_\{i+1\}[3]$
4. $X\_\{i\}[1]\; \backslash leftarrow\; \backslash left(\; \backslash left(\; X\_\{i+1\}[0]\; \backslash ggg\; 9\; \backslash right)\; \backslash boxminus\; \backslash left(\; X\_\{i\}[0]\; \backslash oplus\; K\_\{i\}[0]\; \backslash right)\; \backslash right)\; \backslash oplus\; K\_\{i\}[1]$
5. $X\_\{i\}[2]\; \backslash leftarrow\; \backslash left(\; \backslash left(\; X\_\{i+1\}[1]\; \backslash lll\; 5\; \backslash right)\; \backslash boxminus\; \backslash left(\; X\_\{i\}[1]\; \backslash oplus\; K\_\{i\}[2]\; \backslash right)\; \backslash right)\; \backslash oplus\; K\_\{i\}[3]$
6. $X\_\{i\}[3]\; \backslash leftarrow\; \backslash left(\; \backslash left(\; X\_\{i+1\}[2]\; \backslash lll\; 3\; \backslash right)\; \backslash boxminus\; \backslash left(\; X\_\{i\}[2]\; \backslash oplus\; K\_\{i\}[4]\; \backslash right)\; \backslash right)\; \backslash oplus\; K\_\{i\}[5]$
7. $P[0]\; \backslash |\; P[1]\; \backslash |\; P[2]\; \backslash |\; P[3]\; \backslash leftarrow\; X\_\{0\}[0]\; \backslash |\; X\_\{0\}[1]\; \backslash |\; X\_\{0\}[2]\; \backslash |\; X\_\{0\}[3]$

The key schedule of LEA supports 128, 192, and 256-bit keys and outputs 192-bit round keys $K\_\{i\}$ () for the data processing part.

Let $K\; =\; K[0]\; \backslash |\; K[1]\; \backslash |\; K[2]\; \backslash |\; K[3]$ be a 128-bit key, where $K[i]$ () are 32-bit blocks.

The key schedule for LEA-128 takes $K$ and four 32-bit constants $\backslash delta[i]$ () as inputs and outputs twenty-four 192-bit round keys $K\_\{i\}$ ().

The key schedule operation for LEA-128 is as follows:

1. $T[0]\; \backslash |\; T[1]\; \backslash |\; T[2]\; \backslash |\; T[3]\; \backslash leftarrow\; K[0]\; \backslash |\; K[1]\; \backslash |\; K[2]\; \backslash |\; K[3]$
2. for $i=0$ to $23$
3. $T[0]\; \backslash leftarrow\; \backslash left(\; T[0]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 4]\; \backslash lll\; i\; \backslash right)\; \backslash right)\; \backslash lll\; 1$
4. $T[1]\; \backslash leftarrow\; \backslash left(\; T[1]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 4]\; \backslash lll\; \backslash left(\; i\; +\; 1\; \backslash right)\; \backslash right)\; \backslash right)\; \backslash lll\; 3$
5. $T[2]\; \backslash leftarrow\; \backslash left(\; T[2]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 4]\; \backslash lll\; \backslash left(\; i\; +\; 2\; \backslash right)\; \backslash right)\; \backslash right)\; \backslash lll\; 6$
6. $T[3]\; \backslash leftarrow\; \backslash left(\; T[3]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 4]\; \backslash lll\; \backslash left(\; i\; +\; 3\; \backslash right)\; \backslash right)\; \backslash right)\; \backslash lll\; 11$
7. $K\_\{i\}\; \backslash leftarrow\; T[0]\; \backslash |\; T[1]\; \backslash |\; T[2]\; \backslash |\; T[1]\; \backslash |\; T[3]\; \backslash |\; T[1]$

Let $K\; =\; K[0]\; \backslash |\; K[1]\; \backslash |\; K[2]\; \backslash |\; K[3]\; \backslash |\; K[4]\; \backslash |\; K[5]$ be a 192-bit key, where $K[i]$ () are 32-bit blocks.

The key schedule for LEA-192 takes $K$ and six 32-bit constants $\backslash delta[i]$ () as inputs and outputs twenty-eight 192-bit round keys $K\_\{i\}$ ().

The key schedule operation for LEA-192 is as follows:

1. $T[0]\; \backslash |\; T[1]\; \backslash |\; T[2]\; \backslash |\; T[3]\; \backslash |\; T[4]\; \backslash |\; T[5]\; \backslash leftarrow\; K[0]\; \backslash |\; K[1]\; \backslash |\; K[2]\; \backslash |\; K[3]\; \backslash |\; K[4]\; \backslash |\; K[5]$
2. for $i=0$ to $27$
3. $T[0]\; \backslash leftarrow\; \backslash left(\; T[0]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 6]\; \backslash lll\; i\; \backslash right)\; \backslash right)\; \backslash lll\; 1$
4. $T[1]\; \backslash leftarrow\; \backslash left(\; T[1]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 6]\; \backslash lll\; \backslash left(\; i\; +\; 1\; \backslash right)\; \backslash right)\; \backslash right)\; \backslash lll\; 3$
5. $T[2]\; \backslash leftarrow\; \backslash left(\; T[2]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 6]\; \backslash lll\; \backslash left(\; i\; +\; 2\; \backslash right)\; \backslash right)\; \backslash right)\; \backslash lll\; 6$
6. $T[3]\; \backslash leftarrow\; \backslash left(\; T[3]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 6]\; \backslash lll\; \backslash left(\; i\; +\; 3\; \backslash right)\; \backslash right)\; \backslash right)\; \backslash lll\; 11$
7. $T[4]\; \backslash leftarrow\; \backslash left(\; T[4]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 6]\; \backslash lll\; \backslash left(\; i\; +\; 4\; \backslash right)\; \backslash right)\; \backslash right)\; \backslash lll\; 13$
8. $T[5]\; \backslash leftarrow\; \backslash left(\; T[5]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 6]\; \backslash lll\; \backslash left(\; i\; +\; 5\; \backslash right)\; \backslash right)\; \backslash right)\; \backslash lll\; 17$
9. $K\_\{i\}\; \backslash leftarrow\; T[0]\; \backslash |\; T[1]\; \backslash |\; T[2]\; \backslash |\; T[3]\; \backslash |\; T[4]\; \backslash |\; T[5]$

Let $K\; =\; K[0]\; \backslash |\; K[1]\; \backslash |\; K[2]\; \backslash |\; K[3]\; \backslash |\; K[4]\; \backslash |\; K[5]\; \backslash |\; K[6]\; \backslash |\; K[7]$ be a 256-bit key, where $K[i]$ () are 32-bit blocks.

The key schedule for LEA-192 takes $K$ and eight 32-bit constants $\backslash delta[i]$ () as inputs and outputs thirty-two 192-bit round keys $K\_\{i\}$ ().

The key schedule operation for LEA-256 is as follows:

1. $T[0]\; \backslash |\; T[1]\; \backslash |\; T[2]\; \backslash |\; T[3]\; \backslash |\; T[4]\; \backslash |\; T[5]\; \backslash |\; T[6]\; \backslash |\; T[7]\; \backslash leftarrow\; K[0]\; \backslash |\; K[1]\; \backslash |\; K[2]\; \backslash |\; K[3]\; \backslash |\; K[4]\; \backslash |\; K[5]\; \backslash |\; K[6]\; \backslash |\; K[7]$
2. for $i=0$ to $31$
3. $T[6i\; \backslash mod\; 8]\; \backslash leftarrow\; \backslash left(\; T[6i\; \backslash mod\; 8]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 8]\; \backslash lll\; i\; \backslash right)\; \backslash right)\; \backslash lll\; 1$
4. $T[6i\; +\; 1\; \backslash mod\; 8]\; \backslash leftarrow\; \backslash left(\; T[6i\; +\; 1\; \backslash mod\; 8]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 8]\; \backslash lll\; \backslash left(\; i\; +\; 1\; \backslash right)\; \backslash right)\; \backslash right)\; \backslash lll\; 3$
5. $T[6i\; +\; 2\; \backslash mod\; 8]\; \backslash leftarrow\; \backslash left(\; T[6i\; +\; 2\; \backslash mod\; 8]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 8]\; \backslash lll\; \backslash left(\; i\; +\; 2\; \backslash right)\; \backslash right)\; \backslash right)\; \backslash lll\; 6$
6. $T[6i\; +\; 3\; \backslash mod\; 8]\; \backslash leftarrow\; \backslash left(\; T[6i\; +\; 3\; \backslash mod\; 8]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 8]\; \backslash lll\; \backslash left(\; i\; +\; 3\; \backslash right)\; \backslash right)\; \backslash right)\; \backslash lll\; 11$
7. $T[6i\; +\; 4\; \backslash mod\; 8]\; \backslash leftarrow\; \backslash left(\; T[6i\; +\; 4\; \backslash mod\; 8]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 8]\; \backslash lll\; \backslash left(\; i\; +\; 4\; \backslash right)\; \backslash right)\; \backslash right)\; \backslash lll\; 13$
8. $T[6i\; +\; 5\; \backslash mod\; 8]\; \backslash leftarrow\; \backslash left(\; T[6i\; +\; 5\; \backslash mod\; 8]\; \backslash boxplus\; \backslash left(\; \backslash delta[i\; \backslash mod\; 8]\; \backslash lll\; \backslash left(\; i\; +\; 5\; \backslash right)\; \backslash right)\; \backslash right)\; \backslash lll\; 17$
9. $K\_\{i\}\; \backslash leftarrow\; T[6i\; \backslash mod\; 8]\; \backslash |\; T[6i\; +\; 1\; \backslash mod\; 8]\; \backslash |\; T[6i\; +\; 2\; \backslash mod\; 8]\; \backslash |\; T[6i\; +\; 3\; \backslash mod\; 8]\; \backslash |\; T[6i\; +\; 4\; \backslash mod\; 8]\; \backslash |\; T[6i\; +\; 5\; \backslash mod\; 8]$

The eight 32-bit constant values $\backslash delta[i]$ () used in the key schedule are given in the following table.

As of 2019, no successful attack on full-round LEA is known.

As is typical for iterated block ciphers, reduced-round variants have been attacked.

The best published attacks on LEA in the standard attack model (CPA/CCA with unknown key) are boomerang attacks and differential linear attacks.

The security margin to the whole rounds ratio is greater than 37% against various existing cryptanalytic techniques for block ciphers.

LEA has very good performance in a general-purpose software environment.

In particular, it is possible to encrypt at a rate of about 1.5 to 2 times on average, compared to AES, the most widely used block cipher in various software environments.

The tables below compare the performance of LEA and AES using FELICS (Fair Evaluation of Lightweight Cryptographic Systems),{{cite journal |last1=Dinu |first1=Daniel |last2=Corre |first2=Yann Le |last3=Khovratovich |first3=Dmitry |last4=Perrin |first4=Léo |last5=Großschädl |first5=Johann |last6=Biryukov |first6=Alex |title=Triathlon of lightweight block ciphers for the Internet of things |journal=Journal of Cryptographic Engineering |date=14 July 2018 |volume=9 |issue=3 |pages=283–302 |doi=10.1007/s13389-018-0193-x |s2cid=1578215 |url=https://eprint.iacr.org/2015/209.pdf}} a benchmarking framework for evaluation of software implementations of lightweight cryptographic primitives.

Test vectors for LEA for each key length are as follows.

All values are expressed in hexadecimal form.

• LEA-128
• Key: 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0
• Plaintext: 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
• Ciphertext: 9f c8 4e 35 28 c6 c6 18 55 32 c7 a7 04 64 8b fd
• LEA-192
• Key: 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0 f0 e1 d2 c3 b4 a5 96 87
• Plaintext: 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f
• Ciphertext: 6f b9 5e 32 5a ad 1b 87 8c dc f5 35 76 74 c6 f2
• LEA-256
• Key: 0f 1e 2d 3c 4b 5a 69 78 87 96 a5 b4 c3 d2 e1 f0 f0 e1 d2 c3 b4 a5 96 87 78 69 5a 4b 3c 2d 1e 0f
• Plaintext: 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f
• Ciphertext: d6 51 af f6 47 b1 89 c1 3a 89 00 ca 27 f9 e1 97

LEA is free for any use: public or private, commercial or non-commercial.

The source code for distribution of LEA implemented in C, Java, and Python can be downloaded from KISA's website.{{Cite web|url=https://seed.kisa.or.kr/kisa/Board/20/detailView.do|title=KISA 암호이용활성화 - 암호알고리즘 소스코드|website=seed.kisa.or.kr}}

In addition, LEA is contained in Crypto++ library, a free C++ class library of cryptographic schemes.{{Cite web|url=https://www.cryptopp.com/|title=Crypto++ Library 8.2 | Free C++ Class Library of Cryptographic Schemes|website=www.cryptopp.com}}

LEA is one of the cryptographic algorithms approved by the Korean Cryptographic Module Validation Program (KCMVP).{{Cite web|url=https://seed.kisa.or.kr/kisa/kcmvp/EgovSummary.do|title=KISA 암호이용활성화 - 개요|website=seed.kisa.or.kr}}

LEA is included in the following standards.

• KS X 3246, 128-bit block cipher LEA (in Korean){{cite web

|url = https://rra.go.kr/ko/reference/kcsList_view.do?nb_seq=1923&cpage=4&nb_type=6&searchCon=&searchTxt=&sortOrder=

|title = KS X 3246, 128-bit block cipher LEA (in Korean)

|url-status =

|archiveurl =

|archivedate =

}}

• ISO/IEC 29192-2:2019, Information security - Lightweight cryptography - Part 2: Block ciphers{{cite web

|url = https://www.iso.org/standard/78477.html

|title = ISO/IEC 29192-2:2019, Information security - Lightweight cryptography - Part 2: Block ciphers

|url-status =

|archiveurl =

|archivedate =

}}

{{Reflist}}

{{cryptography navbox|block}}

Category:Block ciphers