In the hierocrypt-L3 description, the cipher takes 6, 7, or 8 rounds. Example source code also seems to follow this same specification of 8 rounds for 256-bit keys. Wikipedia shows 8.5 rounds for 256-bits. I found it some other literature as well.

Where does this 1/2 round come from?


1 Answer 1


The following appears in the linked wikipedia article (emphasis mine):

The Hierocrypt ciphers use a nested substitution-permutation network (SPN) structure. Each round consists of parallel applications of a transformation called the XS-box, followed by a linear diffusion operation. The final half-round replaces the diffusion with a simple post-whitening. The XS-box, which is shared by the two algorithms, is itself an SPN, consisting of a subkey XOR, an S-box lookup, a linear diffusion, another subkey XOR, and another S-box lookup. The diffusion operations use two MDS matrices, and there is a single 8×8-bit S-box.

So the final round operates differently, opting to replace the diffusion step with an add-key step.

It is not uncommon for block ciphers to skip the final linear diffusion operation, because it does not appear to improve security to include it. For example, AES skips the final diffusion step also. But they don't refer to it as a half round.


Salsa20 (and ChaCha) both use a double-round, which is counted as 1 round. So half-rounds appear again here in this context (scroll to FAQ), due to how the rounds are structured and counted.

  • $\begingroup$ As a follow up, any ideas why they rounded up to 8.5? AES you could say was 11.5. $\endgroup$
    – b degnan
    Dec 31, 2018 at 16:22
  • $\begingroup$ @bdegnan It uses 8 full rounds, plus 1 half round $\endgroup$
    – Ella Rose
    Dec 31, 2018 at 17:19
  • $\begingroup$ why not say 11.5 for AES then? i’m just trying to get down to nuance of nomenclature. cryptography is infuriating $\endgroup$
    – b degnan
    Dec 31, 2018 at 17:36
  • 2
    $\begingroup$ It's just the convention that the designers chose. There is no universal standard on how to count these things. $\endgroup$
    – Ella Rose
    Dec 31, 2018 at 17:40
  • $\begingroup$ And each "double round" consists of four parallel applications of a "quarter round" (though confusingly, four quarter rounds don't make two double rounds, but one). $\endgroup$
    – forest
    Apr 29, 2019 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.