9
$\begingroup$

In the hierocrypt-L3 description, the cipher takes 6, 7, or 8 rounds. Example source code also seems to follow this same specification of 8 rounds for 256-bit keys. Wikipedia shows 8.5 rounds for 256-bits. I found it some other literature as well.

Where does this 1/2 round come from?

|improve this question
$\endgroup$
7
$\begingroup$

The following appears in the linked wikipedia article (emphasis mine):

The Hierocrypt ciphers use a nested substitution-permutation network (SPN) structure. Each round consists of parallel applications of a transformation called the XS-box, followed by a linear diffusion operation. The final half-round replaces the diffusion with a simple post-whitening. The XS-box, which is shared by the two algorithms, is itself an SPN, consisting of a subkey XOR, an S-box lookup, a linear diffusion, another subkey XOR, and another S-box lookup. The diffusion operations use two MDS matrices, and there is a single 8×8-bit S-box.

So the final round operates differently, opting to replace the diffusion step with an add-key step.

It is not uncommon for block ciphers to skip the final linear diffusion operation, because it does not appear to improve security to include it. For example, AES skips the final diffusion step also. But they don't refer to it as a half round.

Salsa20

Salsa20 (and ChaCha) both use a double-round, which is counted as 1 round. So half-rounds appear again here in this context (scroll to FAQ), due to how the rounds are structured and counted.

|improve this answer
$\endgroup$
  • $\begingroup$ As a follow up, any ideas why they rounded up to 8.5? AES you could say was 11.5. $\endgroup$ – b degnan Dec 31 '18 at 16:22
  • $\begingroup$ @bdegnan It uses 8 full rounds, plus 1 half round $\endgroup$ – Ella Rose♦ Dec 31 '18 at 17:19
  • $\begingroup$ why not say 11.5 for AES then? i’m just trying to get down to nuance of nomenclature. cryptography is infuriating $\endgroup$ – b degnan Dec 31 '18 at 17:36
  • 2
    $\begingroup$ It's just the convention that the designers chose. There is no universal standard on how to count these things. $\endgroup$ – Ella Rose♦ Dec 31 '18 at 17:40
  • $\begingroup$ And each "double round" consists of four parallel applications of a "quarter round" (though confusingly, four quarter rounds don't make two double rounds, but one). $\endgroup$ – forest Apr 29 '19 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.