Camellia Key Schedule

Question

Camellia is widely used, an international standard now. Its key schedule seems to be too simple compared to other famous ciphers like Twofish and CAST-256. What are the prerequisites for the key schedule, and does Camellia's key schedule have them?

Answer 1

This question and answer covers the requirements of a key schedule.

I could not find a simpler description of Camellia then this rfc

The following excerpt outlines the key schedule. Addressing only the 128 bit cipher for simplicity:

128-bit key K:

KL = K;    KR = 0;
...

The 128-bit variables KA and KB are generated from KL and KR as follows. Note that KB is used only if the length of the secret key is 192 or 256 bits. D1 and D2 are 64-bit temporary variables. F- function is described in Section 2.4.

   D1 = (KL ^ KR) >> 64;

   D2 = (KL ^ KR) & MASK64;
   D2 = D2 ^ F(D1, Sigma1);
   D1 = D1 ^ F(D2, Sigma2);
   D1 = D1 ^ (KL >> 64);
   D2 = D2 ^ (KL & MASK64);
   D2 = D2 ^ F(D1, Sigma3);
   D1 = D1 ^ F(D2, Sigma4);
   KA = (D1 << 64) | D2;
   ...

The 64-bit constants Sigma1, Sigma2, ..., Sigma6 are used as "keys" in the F-function. These constant values are, in hexadecimal notation, as follows.

Sigma1 = 0xA09E667F3BCC908B;

Sigma2 = 0xB67AE8584CAA73B2;
Sigma3 = 0xC6EF372FE94F82BE;
Sigma4 = 0x54FF53A5F1D36F1C;
Sigma5 = 0x10E527FADE682D1D;
Sigma6 = 0xB05688C2B3E6C1FD;

64-bit subkeys are generated by rotating KL, KR, KA, and KB and taking the left- or right-half of them.

It appears the first part of the key schedule is a Feistel network as well: The right half is combine via XOR with F(left half, key), using a constant (SigmaN) for each of the keys. Then this process continues alternated, and some key additions are applied.

Actual round subkeys are generated via simple rotations of the result of the above. So recovery of one subkeys bits provides partial knowledge of the bits of other round subkeys.

This would appear to classify as a type "1B" key schedule, according to the classification system presented in this paper.

The strongest key schedule classification is "2B". For more details on the classification and what exactly it indicates, consult the paper linked at the top of this answer.

Answer 2

The aim of key schedule design is to prevent key-based attacks such as :

• related-key attack 1: the attack is not possible due to rotations in the key schedule . The best best related-key differential characteristic byte-Camellia is 20 active s-boxes on 8 rounds (out of ) 2.
• slide attack , rotational attack 1: they are not possible because of constants in the key schedule (6 sigmas).
• whitening (pre and post) 3: the aim of whitening is to strengthen against brute force attacks 4.

The Camellia algorithm uses $FL$ and $FL^{-1}$ to prevent connection of weak sub-keys between rounds in differential and linear cryptanalysis as shown in comparison of the number of active boxes with/without $FL$ and $FL^{-1}$. it is has also complementary property.

In general , I do not think Camellia key schedule is too simple,. it does the job along with other considerations such implementation on multiple platforms