Ballet (cipher)

Ballet

Round Function of the Ballet Cipher
General
Designers	Ting-Ting Cui, Mei-Qin Wang, Yan-Hong Fan, Kai Hu, Yong Fu, Lu-Ning Huang
First published	2019
Certification	Cinese National Cryptographic Algorithm Design Competition
Cipher detail
Key sizes	128 or 256 bits
Block sizes	128 or 256 bits
Structure	ARX Lai–Massey scheme
Rounds	46–74 (depending on block and key size)
Best public cryptanalysis
No attacks are known on the full ciphers, but reduced-round versions have been attacked. Differential-linear attack can break up to 22 round of the 256 block version with a time complexity of 2242.06; see #Cryptanalysis.

Ballet is a block cipher selected by the Chinese Association for Cryptologic Research (CACR) as winner of the 2018-2020 cinese National Cryptographic Algorithm Design Competition. The cipher is an add–rotate–xor (ARX) with a Lai–Massey scheme structure.

Cipher description

Ballet is defined in thee version to operate with different block and key size.

Block size	Key size	Number of rounds
128	128	46
	256	48
256	256	74

Round function

INPUT:
    X0, X1, X2, X3
    sk[0 ... r-1][...]
    r

FUNCTION ROTL(value, n):
    return (value << n) OR (value >> (WORD_SIZE - n))

FOR i = 0 TO r-2 DO:
    (X0, X1, X2, X3) =
    (
        X1 XOR sk[i][0],

        ROTL(X0, 6) + ROTL(X1 XOR X2, 9),

        ROTL(X3, 15) + ROTL(X1 XOR X2, 14),

        X2 XOR sk[i][1]
    )
END FOR

// Final round (corrected)
(X0, X1, X2, X3) =
(
    ROTL(X0, 6) + ROTL(X1 XOR X2, 9),   // FIXED

    X1 XOR sk[r-1][1],

    X2 XOR sk[r-1][2],

    ROTL(X3, 15) + ROTL(X1 XOR X2, 14)
)

OUTPUT:
    X0, X1, X2, X3

Key generation algorithms

The following algorithms describe the round key generation procedures for the BALLET block cipher in the n/n and n/2n configurations.

Key generation for BALLET n/n

INPUT: k0, k1        // initial key parts
       R             // number of rounds

OUTPUT: subkeys[0..R-1]

FUNCTION ROTL(x, n):
    RETURN (x << n) OR (x >> (WORD_SIZE - n))

FOR i FROM 0 TO R-1:

    // --- 1. Form the round subkey ---
    left_half  = LEFT_HALF(k0)
    right_half = RIGHT_HALF(k0)
    subkeys[i] = CONCAT(left_half, right_half)

    // --- 2. Save current value of k1 ---
    old_k1 = k1

    // --- 3. Update k1 ---
    k1 = k0 XOR ROTL(old_k1, 3) XOR ROTL(old_k1, 5) XOR i

    // --- 4. Swap values ---
    k0 = old_k1

END FOR

Key generation for BALLET n/2n

INPUT: k0, k1, k2, k3   // initial key parts
       R                // number of rounds

OUTPUT: subkeys[0..R-1]

FUNCTION ROTL(x, n):
    RETURN (x << n) OR (x >> (WORD_SIZE - n))

FOR i FROM 0 TO R-1:
    // --- 1. Form the round subkey ---
    left_half  = LEFT_HALF(k0)
    right_half = RIGHT_HALF(k0)
    subkeys[i] = CONCAT(left_half, right_half)

    // --- 2. Save current values ---
    old_k1 = k1
    old_k3 = k3

    // --- 3. Update k3 ---
    k3 = k2 XOR ROTL(old_k3, 7) XOR ROTL(old_k3, 17)

    // --- 4. Update k1 ---
    k1 = k0 XOR ROTL(old_k1, 3) XOR ROTL(old_k1, 5)

    // --- 5. Shift values ---
    k2 = old_k3
    k0 = old_k1

    // --- 6. Add round-dependent variation ---
    k1 = k1 XOR k3 XOR i

END FOR

References

This article "Ballet (cipher)" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Ballet (cipher). Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.

---