# Why is PRESENT 31 rounds?

I tried a number of different inputs and keys and checked their respective hamming distances after each round. It seems PRESENT has an ideal or near ideal hamming distance (31 to 33) after only a few rounds. Indeed, some of the later rounds have worse hamming distances, e.g. 38 to 41. So why is it necessary to have so many rounds?

• what do you mean by hamming distances ? between what and what ?
– Biv
Jul 4 '17 at 11:28
• Are you sure your findings about hamming distance getting worse(I assume you mean average moving away from n/2 with that?) with increasing rounds are statistically significant? Jul 4 '17 at 12:03
• I observed hamming distances between an input M and each of the corresponding 32 outputs. I repeated this with several distinct inputs M. I also tried the same idea but with different keys K. In all cases the hamming distance were in the range 31 to 33 after only a few rounds, even just one or two rounds in some cases. Jul 5 '17 at 5:16
• Not all later rounds were worse, but many were. For example, some hamming distances were in the range 29 to 34 by the end of the eighth round, but 36 to 41 several rounds later. Jul 5 '17 at 5:23

I think that the reason for 31 rounds is in their paper, Section 5.1. Bogdanov et al. have approximated a small $2^{−43}$ bias that occurs after 28 rounds of linear analysis. Therefore they added another 3 rounds to arrive at a slightly unusual odd number of rounds.
• I am guessing that due to the "lightweight" cipher class of PRESENT; they also made 31 rounds because you can get the load state for free, not to mention the cryptographic safety margin. I used a $2^5$ counter and then ended up with the loading state as the zero reset, and then the completion was the overflow I do not know if that was their intention, but it was much nicer than the craziness on AES with only 14 rounds from a counter perspective. Jul 4 '17 at 12:52