Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
The Symmetric-key algorithm article from Wikipedia states:
The keys may be identical or there may be a simple transformation to go between the two keys.
I am not aware of any symmetric-key cryptosystem that uses different keys for encryption and decryption. What are some examples of such algorithms? Is this correct to call them symmetric-key algorithms?
there may be a simple transformation to go between the (encryption and decryption) keys
This answer gives an example with AES, a Substitution/Permutation Cipher (but note that AES has a few other differences between encryption and decryption).
That also applies to Feistel ciphers in their common form where the final round does one less (or more) swap that the others. An example would be a slight variant of DES with a 16×48-bit key, consisting of a 48-bit subkey for each of the 16 rounds. Decryption is precisely the same as encryption with the order of the subkeys reversed. That's not merely theoretical: many implementation of DES in software do exactly that.
Another example is the Pohlig-Hellman exponentiation cipher¹. It is agreed on a public prime $p$ with $q=(p-1)/2$ prime, the encryption key is an odd $k\in[1,q)\,$, and encryption on the interval $[0,p)\,$ (or $[1,p)\,$ or better $[2,p-2]\,$) goes $m\mapsto c=m^k\bmod p$. The decryption key is $k'=k^{-1}\bmod(p-1)$ and decryption goes $c\mapsto m=c^{k'}\bmod p\,$. Proof that decryption always works follows from Fermat's Little Theorem. Again encryption and decryption are exactly identical, except for a relatively simple transformation of the key.
Is this correct to call them symmetric-key algorithms?
Yes. The critical point is that the encryption and decryption keys must both be secret for security to hold.
¹ Stephen C. Pohlig, Martin E. Hellman: An Improved Algorithm for Computing Logarithms over GP(p) and Its Cryptographic Significance, correspondence to the IEEE published in IEEE ToIT, 1978.
A relevant example where you usually don't use the same key for encryption and decryption is actually AES (and any SPN-based cipher for that matter).
The simplest point here would be that for AES you'd normally store your expanded key in order of usage in memory (to help with things like prefetching). However this would mean that the e.g. 11 round keys are stored in reverse order for encryption and decryption!
Furthermore for actual AES-NI based implementations you'd go one step further and pre-process your decryption round keys due to the way the hardware decryption instructions work (see e.g. this Intel guide (PDF) on how to do that). Due to this your actual key schedule usually looks completely different for the encryption and decryption direction (though you can somewhat easily transform one into the other). But no one would argue that AES is not a symmetric cipher...
As for the more general angle on this question: If the transformation is a simple operation as suggested on Wikipedia, it would usually be "hidden" from the user. That is one would usually specify the faster expansion for encryption and then add a pre-processing step for the key-usage during decryption.
