Safer
Designer:
James Massey
Published:
September 1995.
Description:
This algorithm refers to the version of SAFER with a strengthened key schedule, designed in 1995 (see SAFER_SK.TXT, cited below).
Alias:
"OpenPGP.Cipher.6" is an alias to "SAFER-SK(13)".
References:
- [Def (excluding key schedule)] Massey, J. L.,
- "SAFER K-64: A Byte-Oriented Block Ciphering Algorithm",
- Fast Software Encryption (R. Anderson, ed.), Proceedings of the Cambridge Security Workshop, Cambridge, U.K., December 9-11, 1993, pp. 1-17.
- Volume 809 of Lecture Notes in Computer Science, Springer, 1994.
- [] Massey, J. L.,
- "Announcement of a Strengthened Key Schedule for the Cipher SAFER",
- September 9, 1995, (see file 'SAFER_SK.TXT' included in the SAFER toolkit, below).
- [Inf, Test, Impl] Richard De Moliner,
- "A Generalization of Linear Cryptanalysis Applied to SAFER,"
- March 9, 1995.
- "Truncated differentials of SAFER,"
- Fast Software Encryption, Volume 1039 of Lecture Notes in Computer Science (D. Gollmann, ed.), pp. 15-26. Springer-Verlag, 1996.
- "Key-Schedule Cryptanalysis of 3-WAY, IDEA, G-DES, RC4, SAFER, and Triple-DES",
- Advances in Cryptology - Crypto '96 Proceedings, pp. 237-251. Springer-Verlag, August 1996.
- Parameters:
- Integer rounds [creation/read, default null (indicating key-length-dependent)] - the number of rounds to be performed (minimum 8). When the value of this property is null, 8 rounds are used for a 64-bit key, and 10 rounds for a 128-bit key.
- Key length: 64 or 128 bits; default 128 bits.
- Block size: 8 bytes.
Comments:
- Conventionally, the key length for SAFER with strengthened key schedule is included in the algorithm name, e.g. "SAFER SK-64", "SAFER SK-128", etc. Because a SCAN algorithm may have variable-length keys, all of these are referred to as "SAFER-SK".
- SAFER_SK.TXT suggests a maximum of 10 rounds for a 64-bit key, and 12 rounds for a 128-bit key; however here we do not specify any limit on the number of rounds. Also note that because the number of rounds can be given in the algorithm name before the key length is known, it is possible to use a 128-bit key with 8 or 9 rounds (i.e. less than the default), but this is definitely not recommended.
- A 40-bit key schedule has also been specified for SAFER-SK; this is not required to be implemented, and application designers should not assume that a SAFER-SK implementation will support 40-bit keys.
|
