| Internet-Draft | Encryption algorithms - Block cipher MKV | July 2026 |
| Cuong & Truong | Expires 7 January 2027 | [Page] |
This document specifies the MKV block cipher for use in cryptographic mechanisms supporting information security. The algorithm may be used to provide confidentiality of information during transmission, processing, and storage in information systems.¶
This note is to be removed before publishing as an RFC.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 7 January 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
The MKV block cipher is specified with two block sizes: a 256-bit version, intended to provide a higher security margin in the context of post-quantum considerations, and a 128-bit version for use in transitional deployment scenarios. Each version supports three key lengths, allowing different security levels depending on application requirements. The MKV block cipher adopts a substitution - permutation network (SPN) structure based on the FLC scheme. The design is intended to achieve security properties consistent with the Luby-Rackoff model [3]. In addition, the FLC-SDS structure is designed to provide resistance against differential and linear cryptanalysis under commonly accepted assumptions [4]. The cipher employs 8-bit S-boxes to provide nonlinearity and an MDS matrix to achieve diffusion. These components are selected based on established cryptographic criteria and are optimized for both hardware and software implementations [4], [6], [7]. The key schedule is based on an iterative design approach described in [6] and is intended to provide resistance against structural and related-key attacks. The MKV block cipher is designed to provide resistance against known forms of cryptanalysis, including differential, linear, boomerang, integral, algebraic, related-key, and impossible differential attacks, within the claimed security margins. Evaluation of resistance against quantum adversaries, including Grover's and Simon's algorithms, remains an area of ongoing research. The algorithm is designed to achieve efficient performance across a range of hardware and software platforms suitable for information security applications.¶
The MKV block cipher shall operate on fixed-length data blocks of size
n?{128, 256} bits.
The cipher shall be denoted as MKV-l, where l represents the block size.
For each block size, the cipher shall support three key lengths k, with
the corresponding number of rounds R defined as follows:
For MKV-128: k?{128, 192, 256} with R=7, 8, 9, respectively
For MKV-256: k?{256, 384, 512} with R=7, 8, 9, respectively
The set of supported variants is summarized in Table 1.
Version l k R
MKV-128 128 128 7
192 8
256 9
MKV-256 256 256 7
384 8
512 9
¶
The encryption process shall transform a plaintext block P in {0,1}^n into a ciphertext block C in {0,1}^n using a master key K_master.¶
The internal state X shall be an n-bit string.
The state shall be partitioned into four sub-states:
X=(X_0, X_1, X_2,X_3)
where each sub-state X_i has size w=n/4 bits.
Each sub-state shall be represented as a sequence of bytes:
X_i=(x_(i,0), x_(i,1), ..., x_(i,t-1))
where:
x_(i,j) in {0,1}^8
t=w/8
Thus:
t=4 for MKV-128
t=8 for MKV-256
The state X may be represented as a matrix of size t×4, where each column
corresponds to one sub-state.
¶
For each round r=0, ..., R-1, the state shall be updated as follows: X <- X (+) K_r,0 X <- SubCells(X) X <- MixWords(X) X <- X (+) K_r,1 X <- SubCells(X) X <- XWords(X) X <- X (+) K_r¶
X <- X (+) K_post¶
The encryption process can be fully described as follows: (1) X <- P¶
(2) For r=0 to R-1 do (2.1) X <- X <- K_r^0 (2.2) X <- SubCells(X) (2.3) X <- MixWords(X) (2.4) X <- X (+) K_r^1 (2.5) X <- SubCells(X) (2.6) X <- XWords(X) (3) C <- X (+) K_post¶
The decryption process shall transform a ciphertext block C in {0,1}^n into a plaintext block P in {0,1}^n using the master key K_master.¶
X <- X(+)K_post where K_post is the post-whitening key defined in Clause 2.2.¶
Let: K_r denote the round keys, K_(r,0) and K_(r,1) denote the half round keys as defined in Clause 2.2. For r=R,-1 R-2,...,0, the state shall be updated as follows: X <- XWords(X) X <- invSubCells(X) X <- X (+) K_r,1 X <- invMixWords(X) X <- invSubCells(X) X <- X (+) K_r,0¶
The SubCells transformation shall apply a nonlinear substitution to
each byte of the state X.
Let the state be represented as:
X_i=(x_(i,j) ), 0<=i<4, 0<=j<t
where each x_(i,j) in {0,1}^8.
The SubCells transformation shall be defined as:
x_(i,j) <- S(x_(i,j))
for all i, j , where S is a fixed 8-bit substitution box (S-box).
The S-box S shall be specified as a lookup table mapping 8-bit input
values to 8-bit output values.
The lookup shall be performed as follows:
the input byte shall be interpreted as a hexadecimal value ab,
where:
a is the most significant 4 bits (high nibble),
b is the least significant 4 bits (low nibble);
the output value shall be obtained from the entry at row a and column
b of the S-box table.
The S-box values shall be specified in Table 1.
Table 1. The tabular representation of the substitution box S
¶
01, 11, 91, E1, D1, B1, 71, 61, F1, 21, C1, 51, A1, 41, 31, 81 00, 10, E3, 92, B5, D4, 77, 66, 89, 38, AB, 4A, CD, 5C, 2F, FE 08, 5F, 3E, B0, 1C, C2, 83, DD, E8, F6, 47, 79, 95, 2B, AA, 64 0F, 48, D0, 29, A3, 1A, F2, BB, 65, CC, E4, 3D, 57, 7E, 86, 9F 0C, 2A, F4, 1F, 5B, 90, EE, C5, 36, 6D, 73, 88, BC, A7, 49, D2 0A, 3C, 18, 85, E0, 4D, 99, A4, B3, 5E, DA, C7, 72, FF, 6B, 26 06, 76, CF, A8, 4E, 59, 60, 17, DC, 9B, 32, F5, 23, 84, ED, BA 07, 67, 2D, 3B, FA, 8C, 16, 70, 54, A2, 98, BE, EF, D9, C3, 45 0E, A9, 62, 5A, 27, BF, 34, 9C, FD, D5, 8E, E6, 1B, 43, 78, C0 03, B2, 87, C4, 9D, 6E, 4B, F8, 7A, E9, 2C, AF, D6, 15, 50, 33 0D, FB, 56, EC, 3F, 75, B8, 42, 1E, 24, C9, 93, 80, 6A, D7, AD 04, E5, B9, 7D, 82, A6, CA, 2E, 97, 13, 6F, DB, 44, 30, FC, 58 0B, 8D, 9A, 46, 74, 28, DF, 53, CB, B7, F0, 6C, AE, E2, 35, 19 05, 94, 7B, DE, C6, F3, AC, 39, 4F, 8A, 55, 20, 68, BD, 12, E7 02, D3, A5, F7, 69, EB, 5D, 8F, 22, 40, B6, 14, 3A, C8, 9E, 7C 09, CE, 4C, 63, D8, 37, 25, EA, A0, 7F, 1D, 52, F9, 96, B4, 8B¶
10, 00, E0, 90, B0, D0, 60, 70, 20, F0, 50, C0, 40, A0, 80, 30 11, 01, DE, B9, EB, 9D, 76, 67, 52, CF, 35, 8C, 24, FA, A8, 43 DB, 09, E8, 6C, A9, F6, 5F, 84, C5, 33, 41, 2D, 9A, 72, B7, 1E BD, 0E, 6A, 9F, 86, CE, 48, F5, 19, D7, EC, 73, 51, 3B, 22, A4 E9, 0D, A7, 8D, BC, 7F, C3, 2A, 31, 4E, 1B, 96, F2, 55, 64, D8 9E, 0B, FB, C7, 78, DA, A2, 3C, BF, 65, 83, 44, 1D, E6, 59, 21 66, 07, 82, F3, 2F, 38, 17, 71, DC, E4, AD, 5E, CB, 49, 95, BA 77, 06, 5C, 4A, C4, A5, 61, 16, 8E, 2B, 98, D2, EF, B3, 3D, F9 AC, 0F, B4, 26, 6D, 53, 3E, 92, 4B, 18, D9, FF, 75, C1, 8A, E7 45, 02, 13, AB, D1, 2C, FD, B8, 7A, 56, C2, 69, 87, 94, EE, 3F F8, 0C, 79, 34, 57, E2, B5, 4D, 63, 81, 2E, 1A, D6, AF, CC, 9B 23, 05, 91, 58, FE, 14, EA, C9, A6, B2, 6F, 37, 4C, DD, 7B, 85 8F, 0A, 25, 7E, 93, 47, D4, 5B, ED, AA, B6, C8, 39, 1C, F1, 62 32, 04, 4F, E1, 15, 89, 9C, AE, F4, 7D, 5A, BB, 68, 27, D3, C6 54, 03, CD, 12, 3A, B1, 8B, DF, 28, 99, F7, E5, A3, 6E, 46, 7C CA, 08, 36, D5, 42, 6B, 29, E3, 97, FC, 74, A1, BE, 88, 1F, 5D¶
The MixWords transformation shall be a linear transformation applied independently to each sub-state of the state X.¶
2.4.3.1 Rotation step¶
Let the input state be:
X=(X_0,X_1,X_2,X_3)
where each sub-state X_i in {0,1}^w.
Each sub-state shall first be rotated to the left by a sub-state-
dependent offset:
Z_i=RotL(X_i, i(.)w/4)
for i=0,1,2,3,
where:
RotL(x,r) denotes cyclic left rotation of the bit string x by r bits.
¶
2.4.3.2 Linear transformation over GF(2^8)¶
Each rotated sub-state Z_i ? shall be interpreted as a vector of bytes:
Z_i = (z_(i,0), z_(i,1), ..., z_(i,t-1))
where:
z_(i,j) in GF(2^8)
t=w/8
The output sub-state Y_i ? shall be computed as:
Y_i = M(.)Z_i
where:
M in GF(2^8)^(t×t) is a fixed matrix
multiplication is performed over GF(2^8)
2.4.3.3 Component-wise definition
The transformation shall be defined component-wise as:
y_(i,j) = Sum_(k=0)^(t-1) (m_(j,k)(.)z_(i,k))
for: 0<=i<4,0<=j<t
where:
m_(j,k) in GF(2^8)
addition and multiplication are performed in GF(2^8)
2.4.3.4 Matrix specification
For MKV-128, the matrix M shall be defined as:
M_4=(
0x01&0x02&0x01&0x03
0x03&0x07&0x01&0x04
0x04&0x0B&0x03&0x0C
0x0C&0x1E&0x06&0x14)
The result of the multiplication Y^i=M_4 Z^i (0<=i<4) is determined
as follows:
M_4=(
y_0^i=0x01?z_0^i?0x02?z_1^i?0x01?z_2^i?0x03?z_3^i
y_1^i=0x03?z_0^i?0x07?z_1^i?0x01?z_2^i?0x04?z_3^i
y_2^i=0x04?z_0^i?0x0B?z_1^i?0x03?z_2^i?0x0D?z_3^i
y_3^i=0x0D?z_0^i?0x1E?z_1^i?0x06?z_2^i?0x14?z_3^i )
For MKV-256, the matrix M shall be defined as:
M_8=(
"0x01" &"0x04" &"0xDB" &"0x0C" &"0x14" &"0x0C" &"0xDB" &"0x04"
"0x04" &"0x11" &"0x15" &"0xEB" &"0x5C" &"0x24" &"0x1D" &"0xCB"
"0xCB" &"0x55" &"0x38" &"0xE6" &"0xD5" &"0xAF" &"0x0D" &"0x4C"
"0x4C" &"0xD0" &"0x5D" &"0x15" &"0x91" &"0xF8" &"0xA7" &"0x16"
"0x16" &"0x14" &"0x18" &"0xB5" &"0x06" &"0x79" &"0x30" &"0xFF"
"0xFF" &"0x97" &"0xE0" &"0xB0" &"0x66" &"0xAE" &"0x8D" &"0xB1"
"0xB1" &"0x6D" &"0xF6" &"0x7D" &"0x3C" &"0xFB" &"0xCF" &"0x1F"
"0x1F" &"0xCD" &"0x5C" &"0x72" &"0xDA" &"0xB8" &"0xCA" &"0xB3" ))
The result of the multiplication Y^i=M_8 z^i (0?i<8) is determined as follows:
y_0^i=0x01?z_0^i?0x04?z_1^i?0xDB?z_2^i?0x0C?z_3^i?0x14?z_4^i?0x0C?
z_5^i?0xDB?z_6^i?0x04?z_7^i
y_1^i=0x04?z_0^i?0x11?z_1^i?0x15?z_2^i?0xEB?z_3^i?0x5C?z_4^i?0x24?
z_5^i?0x1D?z_6^i?0xCB?z_7^i
y_2^i=0xCB?z_0^i?0x55?z_1^i?0x38?z_2^i?0xE6?z_3^i?0xD5?z_4^i?0xAF?
z_5^i?0x0D?z_6^i?0x4C?z_7^i
y_3^i=0x4C?z_0^i?0xD0?z_1^i?0x5D?z_2^i?0x15?z_3^i?0x91?z_4^i?0xF8?
z_5^i?0xA7?z_6^i?0x16?z_7^i
y_4^i=0x16?z_0^i?0x14?z_1^i?0x18?z_2^i?0xB5?z_3^i?0x06?z_4^i?0x79?
z_5^i?0x30?z_6^i?0xFF?z_7^i
y_5^i=0xFF?z_0^i?0x97?z_1^i?0xE0?z_2^i?0xB0?z_3^i?0x66?z_4^i?0xAE?
z_5^i?0x8D?z_6^i?0xB1?z_7^i
y_6^i=0xB1?z_0^i?0x6D?z_1^i?0xF6?z_2^i?0x7D?z_3^i?0x3C?z_4^i?0xFB?
z_5^i?0xCF?z_6^i?0x1F?z_7^i
y_7^i=0x1F?z_0^i?0xCD?z_1^i?0x5C?z_2^i?0x72?z_3^i?0xDA?z_4^i?0xB8?
z_5^i?0xCA?z_6^i?0xB3?z_7^i )
¶
The invMixWords transformation shall be the inverse of the MixWords transformation defined in Clause 2.4.3. The transformation shall be applied independently to each sub-state of the state.¶
a) Inverse linear transformation¶
Let the input state be:
X=(X_0,X_1,X_2,X_3)
Each sub-state X_i shall be interpreted as a vector of bytes:
X_i=(x_(i,0),x_(i,1),...,x_(i,t-1))
The intermediate sub-state Z_i shall be computed as:
Z_i=M^(-1)(.)X_i
where:
M^(-1) in GF(2^8 )^(t×t) is the inverse of the matrix M defined
in Clause 2.4.3
all operations are performed in GF(2^8)
For MKV-128, the inverse matrix M^(-1) shall be defined as:
M^(-1)=(
0x14&0x06&0x18&0x0B
0x0B&0x02&0x0D&0x05
0x05&0x01&0x07&0x02
0x02&0x01&0x03&0x01))
The result of the multiplication z^i=M_4^(-1) x^i (0<=i<4) is
determined as follows:
z_0^i=0x14?x_0^i?0x06?x_1^i?0x18?x_2^i?0x0B?x_3^i
z_1^i=0x0B?x_0^i?0x02?x_1^i?0x0D?x_2^i?0x05?x_3^i
z_2^i=0x05?x_0^i?0x01?x_1^i?0x07?x_2^i?0x02?x_3^i
z_3^i=0x02?x_0^i?0x01?x_1^i?0x03?x_2^i?0x01?x_3^i )
For MKV-256, the inverse matrix M^(-1) shall be defined as:
M_8^(-1)=(
"0xB3" &"0xCA" &"0xB8" &"0xDA" &"0x72" &"0x5C" &"0xCD" &"0x1F"
"0x1F" &"0xCF" &"0xFB" &"0x3C" &"0x7D" &"0xF6" &"0x6D" &"0xB1"
"0xB1" &"0x8D" &"0xAE" &"0x66" &"0xB0" &"0xE0" &"0x97" &"0xFF"
"0xFF" &"0x30" &"0x79" &"0x06" &"0xB5" &"0x18" &"0x14" &"0x16"
"0x16" &"0xA7" &"0xF8" &"0x91" &"0x15" &"0x5D" &"0xD0" &"0x4C"
"0x4C" &"0x0D" &"0xAF" &"0xD5" &"0xE6" &"0x38" &"0x55" &"0xCB"
"0xCB" &"0x1D" &"0x24" &"0x5C" &"0xEB" &"0x15" &"0x11" &"0x04"
"0x04" &"0xDB" &"0x0C" &"0x14" &"0x0C" &"0xDB" &"0x04" &"0x01")
The result of the multiplication z^i=M_8^(-1) x^i (0<=i<8) is
determined as follows:
z_0^i=0xB3?x_0^i?0xCA?x_1^i?0xB8?x_2^i?0xDA?x_3^i?0x72?x_4^i?0x5C?
x_5^i?0xCD?x_6^i?0x1F?x_7^i
z_1^i=0x1F?x_0^i?0xCF?x_1^i?0xFB?x_2^i?0x3C?x_3^i?0x7D?x_4^i?0xF6?
x_5^i?0x6D?x_6^i?0xB1?x_7^i
z_2^i=0xB1?x_0^i?0x8D?x_1^i?0xAE?x_2^i?0x66?x_3^i?0xB0?x_4^i?0xE0?
x_5^i?0x97?x_6^i?0xFF?x_7^i
z_3^i=0xFF?x_0^i?0x30?x_1^i?0x79?x_2^i?0x06?x_3^i?0xB5?x_4^i?0x18?
x_5^i?0x14?x_6^i?0x16?x_7^i
z_4^i=0x16?x_0^i?0xA7?x_1^i?0xF8?x_2^i?0x91?x_3^i?0x15?x_4^i?0x5D?
x_5^i?0xD0?x_6^i?0x4C?x_7^i
z_5^i=0x4C?x_0^i?0x0D?x_1^i?0xAF?x_2^i?0xD5?x_3^i?0xE6?x_4^i?0x38?
x_5^i?0x55?x_6^i?0xCB?x_7^i
z_6^i=0xCB?x_0^i?0x1D?x_1^i?0x24?x_2^i?0x5C?x_3^i?0xEB?x_4^i?0x15?
x_5^i?0x11?x_6^i?0x04?x_7^i
z_7^i=0x04?x_0^i?0xDB?x_1^i?0x0C?x_2^i?0x14?x_3^i?0x0C?x_4^i?0xDB?
x_5^i?0x04?x_6^i?0x01?x_7^i )
b) Component-wise definition
z_(i,j) = Sum_(k=0)^(t-1) m_(j,k)^(-1)(.)x_(i,k)
for 0<=i<4,0<=j<t
c) Inverse rotation
¶
The output sub-state Y_i? shall be obtained by applying the inverse rotation:
Y_i=RotR(Z_i,i(.)w/4)
for i=0,1,2,3,
where:
RotR(x,r) denotes cyclic right rotation of x by r bits
¶
The XWords transformation shall be a linear transformation applied to
the state X?{0,1}^n, operating on its four sub-states.
Let the input state be:
X=(X_0,X_1,X_2,X_3)
where each sub-state X_i in {0,1}^w.
The output state:
Y=(Y_0,Y_1,Y_2,Y_3)
shall be computed as follows:
Y_0=X_1(+)X_2(+)X_3
Y_1=X_0(+)X_2(+)X_3
Y_2=X_0(+)X_1(+)X_3
Y_3=X_0(+)X_1(+)X_2
Note: The XWords transformation shall be self-invertible.
That is, the input state X shall be recovered from Y as:
X_0=Y_1(+)Y_2(+)Y_3
X_1=Y_0(+)Y_2(+)Y_3
X_2=Y_0(+)Y_1(+)Y_3
X_3=Y_0(+)Y_1(+)Y_2
¶
About key schedule¶
Key state representation¶
The key state shall be partitioned into eight words:
K = (K_0, K_1, K_2, K_3, K_4, K_5, K_6, K_7)
where each K_i in {0,1}^w, with w=n/4.
Each word shall be represented as:
K_i=(k_(i,0),k_(i,1),...,k_(i,T-1))
where:
k_(j,k) in {0,1}^8
t=w/8
The key state shall also be represented as:
K^0=(K_0, K_1, K_2, K_3)
K^1=(K_4, K_5, K_6, K_7)
such that:
K=K^0||K^1
c) Key schedule internal process
¶
The initial key state K shall be derived from K_master as follows:
K <- K_master
During the key schedule proces, round keys are derived from the 2n-bit
states, double the length of the states in the encryption and
decryption operations in Sections 2.2 and 2.3. Thus, the key schedule
state K will be processed into 8 w-bit words k^0,k^1,k^2,k^3,k^4,k^5,
k^6,k^7 as follows: K=k^0 ... k^7, where k^i are w-bit strings divided
into t byte of the form k_0^i ...k_(t-1)^i,k_j^i in V_8 for all
0<=i<8, 0<=j<t.
This state is represented as a t×8 table with elements having byte
values. Additionally, each state K will also be represented as two
sub-states of size n-bit
K^0=k^0||k^1||k^2||k^3 in V_n,
K^1=k^4||k^5||k^6||k^7 in V_n
such that K=K^0||K^1 in V_2n.
The MKV key schedule process updates the 2n-bit key state
K=K^0||K^1 in V_2n to retrieve round keys from master key K_master.
First, the initial key state with value K_int is initialized from the
master key K_master in the case of 2n-bit key, and the additional key
is added for the other case as follows:
K_int={
k^0||...||k^7
in case K_master=k^0||...||k^7 in V_2n
k^0||...||k^4||k^5||(k^2^neg)||(k^3^neg)
in case K_master=k^0||...||k^5 in V_(3n/2)
k^0||...||k^3||(k^0^neg)||...||(k^3^neg)
in case K_master=k^0||...||k^3 in V_n
this initialization step is denoted by K_int<-K_master.
Next, the round keys K_i, i=0, 1,...,R-1 and K_post are obtained from
2R+1) n-bit strings RK, which generated during the key states update
process including basic transformations SubCells, MixWords, XWords in
Clause 2.4 on the sub-states K^0, K^1 combined with XOR addition with
a round constant of n-bit value depending on Const_l^0, Const_l^1 and
round indices i and the transformation to swap the values ??of the two
sub-states denoted as SWAP(K^0,K^1).
By performing R updates to the keystate K, we obtain the values
RK_0,RK_1,...,RK_2R. Then, the round keys K_0,...,K_(R-1)in V_2n,
K_post in V_n that allow encryption and decryption in Clauses 2.2 and
2.3 will be determined through the n-bit strings RK_0,RK_1,...,RK_2R.
The key schedule process can be fully described as follows:
(1) K=K_int <- K_master
(2) RK_0=K^0
(3) For i=0 to R-1 do
(3.1) K^1=XWord(SubCells(MixWords(SubCells(K^1(+)Const_i^1(+)(2i+2)_n))))
(3.2) K^1=XWord(SubCells(MixWords(SubCells(K^1))))
(3.3) K^0=XWord(SubCells(MixWords(SubCells(K^0(+)Const_i^0(+)(2i+1)_n))))
(3.4) K^0=XWord(SubCells(MixWords(SubCells(K^0 ))))(+)K^1
(3.5) SWAP(K^0,K^1)
3.6) RK_(2i+1)=K^0
(3.7) RK_(2i+2)=K^1
(4) For i=0 to R-1 do
(4.1) K_i=(K_i^0||K_i^1)=(RK_2i||RK_(2i+1))
(5) K_post=RK_2R
¶
d) Round constants¶
A.1.1. Master Key of length 128 bits:¶
Plaintext: 11 22 33 44 55 66 77 88 99 AA BB CC DD EE FF 00 Masterkey: 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 11¶
Round keys obtained through key schedule:¶
K_0^0: 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 11 K_0^1: 0D 96 E3 D1 96 32 6A C6 83 15 EF 29 34 37 AB 0A K_1^0: 05 6F 4B 9A 95 33 CA 5B 6D DC 9B 6A 7E CE 62 A7 K_1^1: D6 26 AD 46 28 C7 1B B9 14 E5 A9 5B 4B 64 40 E1 K_2^0: BB BE 38 EF FA E9 03 80 B8 B8 9E B0 0A B5 93 42 K_2^1: 6C B1 7B 9E 1F 7C C4 AF 12 3B 73 D3 E4 36 13 CF K_3^0: AE BF 06 AC 43 F1 15 1E A1 F4 E5 27 DB 99 69 FD K_3^1: 1A 6D 25 63 A6 32 39 02 94 D0 C6 23 61 6B A9 CC K_4^0: B9 E5 40 FC F1 0F 0D E0 CF F7 D7 02 0D 64 DF 79 K_4^1: 3E 45 29 0E F0 47 E0 B7 C2 C0 6D 48 56 FB 76 74 K_5^0: BA 7F 68 9F 56 12 F6 C4 49 98 27 AB 9A 63 FE 29 K_5^1: 2B 4D FA 61 28 CC 1D 7E A8 BA 0C E2 FE DC F7 AE K_6^0: 5B 40 A6 BF 12 50 B1 E8 9A 89 4F 39 F4 F4 5B 9D K_6^1: 10 6C 25 67 A7 43 EE 1E 9E 32 0F BD BD EB 47 4E K_post: F5 83 77 1B 15 ED D4 76 67 B6 07 29 E4 81 32 C4 The 128-bit state updated round by round: Round 1 1.AddRKey K_0^0: 10 20 30 40 50 60 70 80 90 A0 B0 C0 D0 E0 F0 11 2.SubCells: 00 08 0F 0C 0A 06 07 0E 03 0D 04 0B 05 02 09 10 3.MixWords: 0B 07 15 22 13 33 5D FC 00 0E 00 05 38 48 C9 58 4.AddRKey K_0^1: 06 91 F6 F3 85 01 37 3A 83 1B EF 2C 0C 7F 62 52 5.SubCells: 71 B2 25 63 BF 11 BB E4 5A 4A 7C 95 A1 45 CF 18 6.XWords: 44 1E 08 69 8A BD 96 EE 6F E6 51 9F 94 E9 E2 12 Ciphertext: B3 31 22 83 34 C3 F8 1A 37 20 65 91 49 87 56 A1¶
A.1.2. Master Key of length 192 bits¶
Ciphertext: A1 34 C7 86 F6 E7 74 85 43 3B 2D 7C AA FD 7A 97¶
A.1.3. Master Key of length 256 bits¶
11 22 33 44 55 66 77 88 99 AA BB CC DD EE FF 00¶
Masterkey: 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 22 23¶
Ciphertext: 8A 6F 9B BC 74 5B FE E7 00 5F 04 05 4D D1 FF 8E¶
A.2.1. Master Key of length 256 bits¶
Plaintext: 112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF00 Masterkey: 0102030405060708090A0B0C0D0E0F1112131415161718191A1B1C1D1E1F2223¶
Ciphertext: 3E6359590DC566D8E79629607D5872A6A7C9ADF74BF0D2DF00EAF76FF7C129C3¶
A.2.2. Master Key of length 384 bits¶
Ciphertext: 515D487A2CC34D8A68BEFF4371BE4DF4AAF458B4AB540F394F72747BD9D9DFDB¶
A.2.3. Master Key of length 512 bits¶
Ciphertext: 5E6FD5F88B7924E0E24F070C8E3F3FBC264350BF06A169F55167C51521B7CFA4¶
[1] Tieu chuan quoc gia TCVN 11367-1:2016: Cong nghe thong tin - Cac ky thuat an toan - Thuat toan mat ma - Ma khoi MKV [2] Cuong Nguyen, Anh Nguyen, Phong Trieu, Long Nguyen, and Lai Tran. Analysis of a new practically secure SPN-based scheme in the Luby-Rackoff model. in The 9th International Conference on Future Data and Security Engineering. 2022. Springer. [3] Cuong Nguyen, Nam Tran, and Long Nguyen. FLC: A New Secure and Efficient SPN-Based Scheme for Block Ciphers. in 2022 9th NAFOSTED Conference on Information and Computer Science (NICS). 2022. IEEE. [4] Tran Sy Nam, Nguyen Van Long, and Nguyen Bui Cuong. An Optimized Bit-Slice Implementation of Secure 8-Bit Sbox Based on Butterfly Structure. 15th International Conference on Knowledge and Systems Engineering (KSE). 2023. IEEE. [5] Bui Cuong Nguyen and Tuan Anh Nguyen, Evaluating pseudorandomness and superpseudorandomness of the iterative scheme to build SPN block cipher. Journal of Science and Technology on Information security, 2017. 40(2): p. 40. [6] Tran Sy Nam, Nguyen Van Long and Nguyen Bui Cuong, Xay dung tang tuyen tinh co cai dat hieu qua cho ma khoi 128-bit co cau truc FLC, Hoi thao nghien cuu ung dung mat ma va an toan thong tin, Hoc vien Ky thuat mat ma, Ha noi 2002 [7] Tran Sy Nam, Nguyen Van Long and Nguyen Bui Cuong, De xuat tang tuyen tinh va danh gia kha nang cai dat trong xay dung ma khoi 256-bit co cau truc FLC. Tap chi Khoa hoc va Cong nghe trong linh vuc an toan thong tin, 2(16) 2023, 31-38. https://doi.org/10.54654/isj.v1i16.920.¶