The creation of the prekeys for Serpent works by XORing some previous values with a counter and a fixed value. Every word is 32 bits big and 4 words form a round key (after applying a S-Box, but this shall not be part of this question).

The original raw key of 256 bit is $w_{-8}$ to $w_{-1}$, $\phi$ is a constant term with the value hex $0x9e3779b9$. $\lll$ equals the left rotation and $\oplus$ is XORing every individual bit. The equation for the value $i$ is: $$ w_i = (w_{i-8} \oplus w_{i-5} \oplus w_{i-3} \oplus w_{i-1} \oplus \phi \oplus i) \lll 11 $$ The creators of Serpent mention that this bases on the primitive polynomial $x^8 + x^7 + x^5 + x^3 + 1$

…to ensure an even distribution of key bits throughout the rounds, and to eliminate weak keys and related keys.

(Source: http://asmaes.sourceforge.net/serpent/serpentSpecification.pdf)

My question: Does this equation form a cycle across all possible values? I am asking, because a linear feedback shift register with a primitive polynomial has the feature that every possible value (excluding all bits set to 0) will be reached and then it starts again at the first value.

  • If the answer is “yes”, will this "feature" hold with other constant terms than the given $\phi$?
  • If the answer is ”no”, would it be enough to remove the constant term $\phi$ and/or the applied round counter $i$ from the equation?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.