EPCBC - A Block Cipher Suitable for Electronic Product Code ...

3.1 EPCBC(48,96) - EPCBC with 48-bit block size and 96-bit key size
The main cipher of EPCBC(48,96) iterates the PR-48 structure for 32 rounds, i.e. it uses the PRESENT
description of Section 4.1 with n = 48 and r = 32. Due to n = 48, EPCBC(48,96) will be suited for
applications with the key being changed frequently. The choice of r = 32 ensures security of the cipher
against differential and linear cryptanalysis as explained in Section 5.1.
However, the key schedule of EPCBC(48,96) is different from that of PRESENT. The EPCBC(48,96)
key schedule takes in the 96-bit secret key as a 96-bit keystate. The left half of the keystate is taken as
the first subkey. Then a variant-Feistel structure is applied to the keystate for 8 rounds. Each nonlinear
function F of the Feistel variant consists of 4 rounds of the PR-48 main cipher structure where a subkey
is output after each round, giving 8 × 4 + 1 = 33 subkeys in total. The following is a description of
the EPCBC(48,96) key schedule where 1Round denotes one round of PR-48 without subkey addition.
Subkey[i] represents the subkey for round i of the main cipher.
(LKeystate,RKeystate) = 96-bit key
Subkey[0] ← LKeystate
for i = 0 to 7 do
temp ← LKeystate ⊕ RKeystate
for j = 0 to 3 do
RKeystate ← 1Round(RKeystate) ⊕ (4i+j)
Subkey[4i+j +1] ← RKeystate
end for
LKeystate ← RKeystate
RKeystate ← temp
end for
3.2 EPCBC(96,96) - EPCBC with 96-bit block size and 96-bit key size
The main cipher of EPCBC(96,96) iterates the PR-96 structure for 32 rounds, i.e. it uses the PRESENT
description of Section 4.1 with n = 96 and r = 32. The choice of r = 32 ensures security of the
cipher against differential and linear cryptanalysis as explained in Section 5.1. The key schedule of
EPCBC(96,96) is also different from the PRESENT key schedule. It takes in the 96-bit secret key as a
96-bit keystate, outputs this keystate as the first subkey and applies the PR-96 main cipher structure 1
to it for 32 rounds where a subkey is output after each round. Let 1Round denote one round of PR-96
without subkey addition. Subkey[i] represents the subkey for round i of the main cipher.
Keystate = 96-bit key
Subkey[0] ← Keystate
for i = 0 to 31 do
Keystate ← 1Round(Keystate) ⊕ i
Subkey[i+1] ← Keystate
end for
4 Improved Differential and Linear Cryptanalyis of PR-n
As we are using the structure of PRESENT for the main cipher of EPCBC, we did a security analysis of
n-bit block size PRESENT (PR-n) against differential and linear cryptanalysis, and, we obtained new
results. We first give a brief description of PR-n.
1 Note that the hash function WHIRLPOOL[3] and the block cipher SMS4[19] also use an identical function for
both their main cipher and key schedule.