From 4bfd864f10b68b71482b35c818559068ef8d5797 Mon Sep 17 00:00:00 2001 From: Thomas Voss Date: Wed, 27 Nov 2024 20:54:24 +0100 Subject: doc: Add RFC documents --- doc/rfc/rfc8891.txt | 565 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 565 insertions(+) create mode 100644 doc/rfc/rfc8891.txt (limited to 'doc/rfc/rfc8891.txt') diff --git a/doc/rfc/rfc8891.txt b/doc/rfc/rfc8891.txt new file mode 100644 index 0000000..90e719f --- /dev/null +++ b/doc/rfc/rfc8891.txt @@ -0,0 +1,565 @@ + + + + +Independent Submission V. Dolmatov, Ed. +Request for Comments: 8891 JSC "NPK Kryptonite" +Updates: 5830 D. Baryshkov +Category: Informational Auriga, Inc. +ISSN: 2070-1721 September 2020 + + + GOST R 34.12-2015: Block Cipher "Magma" + +Abstract + + In addition to a new cipher with a block length of n=128 bits + (referred to as "Kuznyechik" and described in RFC 7801), Russian + Federal standard GOST R 34.12-2015 includes an updated version of the + block cipher with a block length of n=64 bits and key length of k=256 + bits, which is also referred to as "Magma". The algorithm is an + updated version of an older block cipher with a block length of n=64 + bits described in GOST 28147-89 (RFC 5830). This document is + intended to be a source of information about the updated version of + the 64-bit cipher. It may facilitate the use of the block cipher in + Internet applications by providing information for developers and + users of the GOST 64-bit cipher with the revised version of the + cipher for encryption and decryption. + +Status of This Memo + + This document is not an Internet Standards Track specification; it is + published for informational purposes. + + This is a contribution to the RFC Series, independently of any other + RFC stream. The RFC Editor has chosen to publish this document at + its discretion and makes no statement about its value for + implementation or deployment. Documents approved for publication by + the RFC Editor are not candidates for any level of Internet Standard; + see Section 2 of RFC 7841. + + Information about the current status of this document, any errata, + and how to provide feedback on it may be obtained at + https://www.rfc-editor.org/info/rfc8891. + +Copyright Notice + + Copyright (c) 2020 IETF Trust and the persons identified as the + document authors. All rights reserved. + + This document is subject to BCP 78 and the IETF Trust's Legal + Provisions Relating to IETF Documents + (https://trustee.ietf.org/license-info) in effect on the date of + publication of this document. Please review these documents + carefully, as they describe your rights and restrictions with respect + to this document. + +Table of Contents + + 1. Introduction + 2. General Information + 3. Definitions and Notation + 3.1. Definitions + 3.2. Notation + 4. Parameter Values + 4.1. Nonlinear Bijection + 4.2. Transformations + 4.3. Key Schedule + 5. Basic Encryption Algorithm + 5.1. Encryption + 5.2. Decryption + 6. IANA Considerations + 7. Security Considerations + 8. References + 8.1. Normative References + 8.2. Informative References + Appendix A. Test Examples + A.1. Transformation t + A.2. Transformation g + A.3. Key Schedule + A.4. Test Encryption + A.5. Test Decryption + Appendix B. Background + Authors' Addresses + +1. Introduction + + The Russian Federal standard [GOSTR3412-2015] specifies basic block + ciphers used as cryptographic techniques for information processing + and information protection, including the provision of + confidentiality, authenticity, and integrity of information during + information transmission, processing, and storage in computer-aided + systems. + + The cryptographic algorithms defined in this specification are + designed both for hardware and software implementation. They comply + with modern cryptographic requirements and put no restrictions on the + confidentiality level of the protected information. + + This document is intended to be a source of information about the + updated version of the 64-bit cipher. It may facilitate the use of + the block cipher in Internet applications by providing information + for developers and users of a GOST 64-bit cipher with the revised + version of the cipher for encryption and decryption. + +2. General Information + + The Russian Federal standard [GOSTR3412-2015] was developed by the + Center for Information Protection and Special Communications of the + Federal Security Service of the Russian Federation, with + participation of the open joint-stock company "Information + Technologies and Communication Systems" (InfoTeCS JSC). GOST R + 34.12-2015 was approved and introduced by Decree #749 of the Federal + Agency on Technical Regulating and Metrology on June 19, 2015. + + Terms and concepts in the specification comply with the following + international standards: + + * ISO/IEC 10116 [ISO-IEC10116] + + * series of standards ISO/IEC 18033 [ISO-IEC18033-1][ISO-IEC18033-3] + +3. Definitions and Notation + + The following terms and their corresponding definitions are used in + the specification. + +3.1. Definitions + + encryption algorithm: process that transforms plaintext into + ciphertext (Clause 2.19 of [ISO-IEC18033-1]) + + decryption algorithm: process that transforms ciphertext into + plaintext (Clause 2.14 of [ISO-IEC18033-1]) + + basic block cipher: block cipher that, for a given key, provides a + single invertible mapping of the set of fixed-length plaintext + blocks into ciphertext blocks of the same length + + block: string of bits of a defined length (Clause 2.6 of + [ISO-IEC18033-1]) + + block cipher: symmetric encipherment system with the property that + the encryption algorithm operates on a block of plaintext -- i.e., + a string of bits of a defined length -- to yield a block of + ciphertext (Clause 2.7 of [ISO-IEC18033-1]) + + Note: In GOST R 34.12-2015, it is established that the terms + "block cipher" and "block encryption algorithm" are synonyms. + + encryption: reversible transformation of data by a cryptographic + algorithm to produce ciphertext -- i.e., to hide the information + content of the data (Clause 2.18 of [ISO-IEC18033-1]) + + round key: sequence of symbols that is calculated from the key and + controls a transformation for one round of a block cipher + + key: sequence of symbols that controls the operation of a + cryptographic transformation (e.g., encipherment, decipherment) + (Clause 2.21 of [ISO-IEC18033-1]) + + Note: In GOST R 34.12-2015, the key must be a binary sequence. + + plaintext: unencrypted information (Clause 3.11 of [ISO-IEC10116]) + + key schedule: calculation of round keys from the key, + + decryption: reversal of a corresponding encipherment (Clause 2.13 of + [ISO-IEC18033-1]) + + symmetric cryptographic technique: cryptographic technique that uses + the same secret key for both the originator's and the recipient's + transformation (Clause 2.32 of [ISO-IEC18033-1]) + + cipher: alternative term for encipherment system (Clause 2.20 of + [ISO-IEC18033-1]) + + ciphertext: data that has been transformed to hide its information + content (Clause 3.3 of [ISO-IEC10116]) + +3.2. Notation + + The following notation is used in the specification: + + V* the set of all binary vector strings of a finite length + (hereinafter referred to as the strings), including the empty + string + + V_s the set of all binary strings of length s, where s is a + nonnegative integer; substrings and string components are + enumerated from right to left, starting from zero + + U[*]W direct (Cartesian) product of two sets U and W + + |A| the number of components (the length) of a string A belonging to + V* (if A is an empty string, then |A| = 0) + + A||B concatenation of strings A and B both belonging to V* -- i.e., + a string from V_(|A|+|B|), where the left substring from V_|A| is + equal to A and the right substring from V_|B| is equal to B + + A<<<_11 cyclic rotation of string A belonging to V_32 by 11 + components in the direction of components having greater indices + + Z_(2^n) ring of residues modulo 2^n + + (xor) exclusive-or of two binary strings of the same length + + [+] addition in the ring Z_(2^32) + + Vec_s: Z_(2^s) -> V_s bijective mapping that maps an element from + ring Z_(2^s) into its binary representation; i.e., for an element + z of the ring Z_(2^s), represented by the residue z_0 + (2*z_1) + + ... + (2^(s-1)*z_(s-1)), where z_i in {0, 1}, i = 0, ..., n-1, the + equality Vec_s(z) = z_(s-1)||...||z_1||z_0 holds + + Int_s: V_s -> Z_(2^s) the mapping inverse to the mapping Vec_s, + i.e., Int_s = Vec_s^(-1) + + PS composition of mappings, where the mapping S applies first + + P^s composition of mappings P^(s-1) and P, where P^1=P + +4. Parameter Values + +4.1. Nonlinear Bijection + + The bijective nonlinear mapping is a set of substitutions: + + Pi_i = Vec_4 Pi'_i Int_4: V_4 -> V_4, + + where + + Pi'_i: Z_(2^4) -> Z_(2^4), i = 0, 1, ..., 7. + + The values of the substitution Pi' are specified below as arrays. + + Pi'_i = (Pi'_i(0), Pi'_i(1), ... , Pi'_i(15)), i = 0, 1, ..., 7: + + Pi'_0 = (12, 4, 6, 2, 10, 5, 11, 9, 14, 8, 13, 7, 0, 3, 15, 1); + Pi'_1 = (6, 8, 2, 3, 9, 10, 5, 12, 1, 14, 4, 7, 11, 13, 0, 15); + Pi'_2 = (11, 3, 5, 8, 2, 15, 10, 13, 14, 1, 7, 4, 12, 9, 6, 0); + Pi'_3 = (12, 8, 2, 1, 13, 4, 15, 6, 7, 0, 10, 5, 3, 14, 9, 11); + Pi'_4 = (7, 15, 5, 10, 8, 1, 6, 13, 0, 9, 3, 14, 11, 4, 2, 12); + Pi'_5 = (5, 13, 15, 6, 9, 2, 12, 10, 11, 7, 8, 1, 4, 3, 14, 0); + Pi'_6 = (8, 14, 2, 5, 6, 9, 1, 12, 15, 4, 11, 0, 13, 10, 3, 7); + Pi'_7 = (1, 7, 14, 13, 0, 5, 8, 3, 4, 15, 10, 6, 9, 12, 11, 2); + +4.2. Transformations + + The following transformations are applicable for encryption and + decryption algorithms: + + t: V_32 -> V_32 + t(a) = t(a_7||...||a_0) = Pi_7(a_7)||...||Pi_0(a_0), where + a=a_7||...||a_0 belongs to V_32, a_i belongs to V_4, i=0, 1, ..., + 7. + + g[k]: V_32 -> V_32 + g[k](a) = (t(Vec_32(Int_32(a) [+] Int_32(k)))) <<<_11, where k, a + belong to V_32 + + G[k]: V_32[*]V_32 -> V_32[*]V_32 + G[k](a_1, a_0) = (a_0, g[k](a_0) (xor) a_1), where k, a_0, a_1 + belong to V_32 + + G^*[k]: V_32[*]V_32 -> V_64 + G^*[k](a_1, a_0) = (g[k](a_0) (xor) a_1) || a_0, where k, a_0, a_1 + belong to V_32. + +4.3. Key Schedule + + Round keys K_i belonging to V_32, i=1, 2, ..., 32 are derived from + key K = k_255||...||k_0 belonging to V_256, k_i belongs to V_1, i=0, + 1, ..., 255, as follows: + + K_1 = k_255||...||k_224; + K_2 = k_223||...||k_192; + K_3 = k_191||...||k_160; + K_4 = k_159||...||k_128; + K_5 = k_127||...||k_96; + K_6 = k_95||...||k_64; + K_7 = k_63||...||k_32; + K_8 = k_31||...||k_0; + K_(i+8) = K_i, i = 1, 2, ..., 8; + K_(i+16) = K_i, i = 1, 2, ..., 8; + K_(i+24) = K_(9-i), i = 1, 2, ..., 8. + +5. Basic Encryption Algorithm + +5.1. Encryption + + Depending on the values of round keys K_1,...,K_32, the encryption + algorithm is a substitution E_(K_1,...,K_32) defined as follows: + + E_(K_1,...,K_32)(a)=G^*[K_32]G[K_31]...G[K_2]G[K_1](a_1, a_0), + + where a=(a_1, a_0) belongs to V_64, and a_0, a_1 belong to V_32. + +5.2. Decryption + + Depending on the values of round keys K_1,...,K_32, the decryption + algorithm is a substitution D_(K_1,...,K_32) defined as follows: + + D_(K_1,...,K_32)(a)=G^*[K_1]G[K_2]...G[K_31]G[K_32](a_1, a_0), + + where a=(a_1, a_0) belongs to V_64, and a_0, a_1 belong to V_32. + +6. IANA Considerations + + This document has no IANA actions. + +7. Security Considerations + + This entire document is about security considerations. + + Unlike [RFC5830] (GOST 28147-89), but like [RFC7801], this + specification does not define exact block modes that should be used + together with the updated Magma cipher. One is free to select block + modes depending on the protocol and necessity. + +8. References + +8.1. Normative References + + [GOSTR3412-2015] + Federal Agency on Technical Regulating and Metrology, + "Information technology. Cryptographic data security. + Block ciphers.", GOST R 34.12-2015, 2015. + + [RFC5830] Dolmatov, V., Ed., "GOST 28147-89: Encryption, Decryption, + and Message Authentication Code (MAC) Algorithms", + RFC 5830, DOI 10.17487/RFC5830, March 2010, + . + + [RFC7801] Dolmatov, V., Ed., "GOST R 34.12-2015: Block Cipher + "Kuznyechik"", RFC 7801, DOI 10.17487/RFC7801, March 2016, + . + +8.2. Informative References + + [GOST28147-89] + Government Committee of the USSR for Standards, + "Cryptographic Protection for Data Processing System, GOST + 28147-89, Gosudarstvennyi Standard of USSR", 1989. + + [ISO-IEC10116] + ISO/IEC, "Information technology -- Security techniques -- + Modes of operation for an n-bit block cipher", ISO/ + IEC 10116, 2017. + + [ISO-IEC18033-1] + ISO/IEC, "Information technology -- Security techniques -- + Encryption algorithms -- Part 1: General", ISO/ + IEC 18033-1:2015, 2015. + + [ISO-IEC18033-3] + ISO/IEC, "Information technology -- Security techniques -- + Encryption algorithms -- Part 3: Block ciphers", ISO/ + IEC 18033-3:2010, 2010. + + [RFC7836] Smyshlyaev, S., Ed., Alekseev, E., Oshkin, I., Popov, V., + Leontiev, S., Podobaev, V., and D. Belyavsky, "Guidelines + on the Cryptographic Algorithms to Accompany the Usage of + Standards GOST R 34.10-2012 and GOST R 34.11-2012", + RFC 7836, DOI 10.17487/RFC7836, March 2016, + . + +Appendix A. Test Examples + + This section is for information only and is not a normative part of + the specification. + +A.1. Transformation t + + t(fdb97531) = 2a196f34, + t(2a196f34) = ebd9f03a, + t(ebd9f03a) = b039bb3d, + t(b039bb3d) = 68695433. + +A.2. Transformation g + + g[87654321](fedcba98) = fdcbc20c, + g[fdcbc20c](87654321) = 7e791a4b, + g[7e791a4b](fdcbc20c) = c76549ec, + g[c76549ec](7e791a4b) = 9791c849. + +A.3. Key Schedule + + With key set to + + K = ffeeddccbbaa99887766554433221100f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff, + + the following round keys are generated: + + K_1 = ffeeddcc, + K_2 = bbaa9988, + K_3 = 77665544, + K_4 = 33221100, + K_5 = f0f1f2f3, + K_6 = f4f5f6f7, + K_7 = f8f9fafb, + K_8 = fcfdfeff, + + K_9 = ffeeddcc, + K_10 = bbaa9988, + K_11 = 77665544, + K_12 = 33221100, + K_13 = f0f1f2f3, + K_14 = f4f5f6f7, + K_15 = f8f9fafb, + K_16 = fcfdfeff, + + K_17 = ffeeddcc, + K_18 = bbaa9988, + K_19 = 77665544, + K_20 = 33221100, + K_21 = f0f1f2f3, + K_22 = f4f5f6f7, + K_23 = f8f9fafb, + K_24 = fcfdfeff, + + K_25 = fcfdfeff, + K_26 = f8f9fafb, + K_27 = f4f5f6f7, + K_28 = f0f1f2f3, + K_29 = 33221100, + K_30 = 77665544, + K_31 = bbaa9988, + K_32 = ffeeddcc. + +A.4. Test Encryption + + In this test example, encryption is performed on the round keys + specified in Appendix A.3. Let the plaintext be + + a = fedcba9876543210, + + then + + (a_1, a_0) = (fedcba98, 76543210), + G[K_1](a_1, a_0) = (76543210, 28da3b14), + G[K_2]G[K_1](a_1, a_0) = (28da3b14, b14337a5), + G[K_3]...G[K_1](a_1, a_0) = (b14337a5, 633a7c68), + G[K_4]...G[K_1](a_1, a_0) = (633a7c68, ea89c02c), + G[K_5]...G[K_1](a_1, a_0) = (ea89c02c, 11fe726d), + G[K_6]...G[K_1](a_1, a_0) = (11fe726d, ad0310a4), + G[K_7]...G[K_1](a_1, a_0) = (ad0310a4, 37d97f25), + G[K_8]...G[K_1](a_1, a_0) = (37d97f25, 46324615), + G[K_9]...G[K_1](a_1, a_0) = (46324615, ce995f2a), + G[K_10]...G[K_1](a_1, a_0) = (ce995f2a, 93c1f449), + G[K_11]...G[K_1](a_1, a_0) = (93c1f449, 4811c7ad), + G[K_12]...G[K_1](a_1, a_0) = (4811c7ad, c4b3edca), + G[K_13]...G[K_1](a_1, a_0) = (c4b3edca, 44ca5ce1), + G[K_14]...G[K_1](a_1, a_0) = (44ca5ce1, fef51b68), + G[K_15]...G[K_1](a_1, a_0) = (fef51b68, 2098cd86) + G[K_16]...G[K_1](a_1, a_0) = (2098cd86, 4f15b0bb), + G[K_17]...G[K_1](a_1, a_0) = (4f15b0bb, e32805bc), + G[K_18]...G[K_1](a_1, a_0) = (e32805bc, e7116722), + G[K_19]...G[K_1](a_1, a_0) = (e7116722, 89cadf21), + G[K_20]...G[K_1](a_1, a_0) = (89cadf21, bac8444d), + G[K_21]...G[K_1](a_1, a_0) = (bac8444d, 11263a21), + G[K_22]...G[K_1](a_1, a_0) = (11263a21, 625434c3), + G[K_23]...G[K_1](a_1, a_0) = (625434c3, 8025c0a5), + G[K_24]...G[K_1](a_1, a_0) = (8025c0a5, b0d66514), + G[K_25]...G[K_1](a_1, a_0) = (b0d66514, 47b1d5f4), + G[K_26]...G[K_1](a_1, a_0) = (47b1d5f4, c78e6d50), + G[K_27]...G[K_1](a_1, a_0) = (c78e6d50, 80251e99), + G[K_28]...G[K_1](a_1, a_0) = (80251e99, 2b96eca6), + G[K_29]...G[K_1](a_1, a_0) = (2b96eca6, 05ef4401), + G[K_30]...G[K_1](a_1, a_0) = (05ef4401, 239a4577), + G[K_31]...G[K_1](a_1, a_0) = (239a4577, c2d8ca3d). + + Then the ciphertext is + + b = G^*[K_32]G[K_31]...G[K_1](a_1, a_0) = 4ee901e5c2d8ca3d. + +A.5. Test Decryption + + In this test example, decryption is performed on the round keys + specified in Appendix A.3. Let the ciphertext be + + b = 4ee901e5c2d8ca3d, + + then + + (b_1, b_0) = (4ee901e5, c2d8ca3d), + G[K_32](b_1, b_0) = (c2d8ca3d, 239a4577), + G[K_31]G[K_32](b_1, b_0) = (239a4577, 05ef4401), + G[K_30]...G[K_32](b_1, b_0) = (05ef4401, 2b96eca6), + G[K_29]...G[K_32](b_1, b_0) = (2b96eca6, 80251e99), + G[K_28]...G[K_32](b_1, b_0) = (80251e99, c78e6d50), + G[K_27]...G[K_32](b_1, b_0) = (c78e6d50, 47b1d5f4), + G[K_26]...G[K_32](b_1, b_0) = (47b1d5f4, b0d66514), + G[K_25]...G[K_32](b_1, b_0) = (b0d66514, 8025c0a5), + G[K_24]...G[K_32](b_1, b_0) = (8025c0a5, 625434c3), + G[K_23]...G[K_32](b_1, b_0) = (625434c3, 11263a21), + G[K_22]...G[K_32](b_1, b_0) = (11263a21, bac8444d), + G[K_21]...G[K_32](b_1, b_0) = (bac8444d, 89cadf21), + G[K_20]...G[K_32](b_1, b_0) = (89cadf21, e7116722), + G[K_19]...G[K_32](b_1, b_0) = (e7116722, e32805bc), + G[K_18]...G[K_32](b_1, b_0) = (e32805bc, 4f15b0bb), + G[K_17]...G[K_32](b_1, b_0) = (4f15b0bb, 2098cd86), + G[K_16]...G[K_32](b_1, b_0) = (2098cd86, fef51b68), + G[K_15]...G[K_32](b_1, b_0) = (fef51b68, 44ca5ce1), + G[K_14]...G[K_32](b_1, b_0) = (44ca5ce1, c4b3edca), + G[K_13]...G[K_32](b_1, b_0) = (c4b3edca, 4811c7ad), + G[K_12]...G[K_32](b_1, b_0) = (4811c7ad, 93c1f449), + G[K_11]...G[K_32](b_1, b_0) = (93c1f449, ce995f2a), + G[K_10]...G[K_32](b_1, b_0) = (ce995f2a, 46324615), + G[K_9]...G[K_32](b_1, b_0) = (46324615, 37d97f25), + G[K_8]...G[K_32](b_1, b_0) = (37d97f25, ad0310a4), + G[K_7]...G[K_32](b_1, b_0) = (ad0310a4, 11fe726d), + G[K_6]...G[K_32](b_1, b_0) = (11fe726d, ea89c02c), + G[K_5]...G[K_32](b_1, b_0) = (ea89c02c, 633a7c68), + G[K_4]...G[K_32](b_1, b_0) = (633a7c68, b14337a5), + G[K_3]...G[K_32](b_1, b_0) = (b14337a5, 28da3b14), + G[K_2]...G[K_32](b_1, b_0) = (28da3b14, 76543210). + + Then the plaintext is + + a = G^*[K_1]G[K_2]...G[K_32](b_1, b_0) = fedcba9876543210. + +Appendix B. Background + + This specification is a translation of relevant parts of the + [GOSTR3412-2015] standard. The order of terms in both parts of + Section 3 comes from the original text. Combining [RFC7801] with + this document will create a complete translation of [GOSTR3412-2015] + into English. + + Algorithmically, Magma is a variation of the block cipher defined in + [RFC5830] ([GOST28147-89]) with the following clarifications and + minor modifications: + + 1. S-BOX set is fixed at id-tc26-gost-28147-param-Z (see Appendix C + of [RFC7836]); + + 2. key is parsed as a single big-endian integer (compared to the + little-endian approach used in [GOST28147-89]), which results in + different subkey values being used; + + 3. data bytes are also parsed as a single big-endian integer + (instead of being parsed as little-endian integer). + +Authors' Addresses + + Vasily Dolmatov (editor) + JSC "NPK Kryptonite" + Spartakovskaya sq., 14, bld 2, JSC "NPK Kryptonite" + Moscow + 105082 + Russian Federation + + Email: vdolmatov@gmail.com + + + Dmitry Baryshkov + Auriga, Inc. + office 1410 + Torfyanaya Doroga, 7F + Saint-Petersburg + 197374 + Russian Federation + + Email: dbaryshkov@gmail.com -- cgit v1.2.3