# How to calculate initial RC5 encryption parameters?

I learn from a minithesis to understand RC5. As we can see at the formula, the round 0 must be using A=A+S[0], because the loop is starting at r(round) 1.

I tried addition and OR(bitwise) to get the answer DA679BFB but keep missing, Here is my result of calculating.

A = A + S[0]

= 4B726970 + BF0A8B1D

= 10A7CF48D

A = A OR S[0]

= 4B726970 OR BF0A8B1D

= FF7AEB7D


The S Data is the result of 3rd phase key expanding on RC5. I really need help because I have been stuck here for 2 days and thank you in advance.

Plaintext : 4B726970 746F2053 74656761 6E6F
key       : 4B726970 746F6772 616669
w(blocksize) = 32, r(round) = 12, b(key lenght) = 16

• Could you specify the RC5 input parameters used? I'm assuming the word size is 32, the number of rounds is 12, and the key is all zeroes? – user47922 May 21 '17 at 14:14
• The most important check you can do is in your endianness, since RC5 is little-endian. So your first word may be 70 69 72 4B. – user47922 May 21 '17 at 14:16
• Finally, how much trust are you placing in this "minithesis" being correct? – user47922 May 21 '17 at 14:17
• I put more information in the post, And i trust this minithesis sir – meh96 May 21 '17 at 15:07

First: you should use addition, not XOR. Next, if you're doing this calculation with a computer, make sure you're processing the bytes as little-endian, and that you pad your key to the 16 bytes you mentioned:

4B726970 746F6772 61666900 00000000

Now, you have basically answered the question yourself of why you aren't getting the correct value:

The S Data is the result of 3rd phase key expanding on RC5.

The formula A = A + S[0] is correct, but as you note there are multiple phases of mixing the $L$ and $S$ arrays. During the first phase, $A$ and $B$ look like:

i=1 A= **0xbf0a8b1d** B= **0x5ee7fad**
i=2 A= 0xd88eaf30 B= 0x2a1c93ca
i=3 A= 0xb7dc3e7f B= 0xc47155c4
...

These are the values on the right-hand side of the image you posted. The value 0xbf0a8b1d in particular is the one you've been trying to add. What you should be using are values from the 3rd phase:

i=1 A= **0x8ef5328b** B= **0x600e18b6**
i=2 A= 0x64aa69d0 B= 0x384a0d6
i=3 A= 0x7a471ae8 B= 0xd5a140fa
...

So now, take your plaintext word 0x4b726970 and add it to 0x8ef5328b, and you get the desired value of 0xda679b7b:

i=1 A= **0xda679bfb** B= 0xd9198a23 # before the loop even starts
i=2 A= 0x9637a9a8 B= 0x7e949194
i=3 A= 0x4ec0dda1 B= 0x299ed426
...

I followed Rivest's paper on RC5 and double-checked my values against a Python implementation. We don't do implementation details here, but that should answer why you haven't been able to match up to that example.

• So on the 2nd phase its using the new S and L from the 1st phase since A and B is back to zero, right? Thank you again sir. – meh96 May 21 '17 at 19:25
• S and L are continually updated on each phase, yes. A and B represent registers containing the plaintext. Once the algorithm starts, A and B are never reset to zero. – user47922 May 21 '17 at 19:48