Source-linked AI summary
BelT Block Cipher
Sergey Agievich, Victor Galinskij, Nikolai Mikulich, Yuriy Kharin
TL;DR
BelT is described as a block cipher built around 32-bit registers and eight rounds. The paper presents its design rationale and performance characteristics, including reported encryption speeds on two Pentium processors.
Problem
The paper situates BelT among block ciphers whose weaknesses and security are studied by cryptographic researchers.
Source: §1 · p. 1Method
BelT uses register-based encryption and decryption rounds, with similar round structures that support simpler software and hardware implementations.
Source: §2.2 · p. 2, §3 · p. 4Results
BelT’s encryption speed is reported as approximately 18.73 Mbit/s on a Pentium-200 CPU and 187.7 Mbit/s on a Pentium III-1000 CPU.
Source: §4 · p. 7Takeaways & Limitations
The round-key method requires no calculations in practical implementations, which is advantageous where keys change frequently.
Source: §4 · p. 8
Abstract
from arXiv · showhide
BelT is a block cipher with a 128-bit block size and a 256-bit key, developed in Belarus and adopted as part of the Belarusian national standard STB 34.101.31 for encryption and integrity control. Its specification was issued as a preliminary standard in 2007, becoming a final standard in 2011. BelT employs an eight-round structure combining elements of a Feistel network and the Lai-Massey scheme. This paper presents a complete description of the cipher and explains the principles underlying its design. Software performance and possible optimizations of BelT are discussed in comparison with those of candidates in the Advanced Encryption Standard (AES) competition.
1 Introduction
BelT is presented as a block cipher whose design principles and performance are described. The paper places it among established ciphers that have drawn cryptanalytic study.
1 Introduction
- DES, GOST 28147-89, IDEA, and Rijndael are among the proposed and standardized ciphers noted in the background.Cryptographic researchers study such ciphers for weaknesses and assess their security.Source: §1 · p. 1
- The paper describes BelT and presents its design principles and performance characteristics.BelT has a 128-bit block size and a 256-bit key.Source: §1 · p. 1
- The cited original Russian paper on BelT appeared in 2002.Its listed authors are Agievich, Galinsky, Mikulich, and Kharin.Source: §1 · p. 1
2 Specification
The specification defines notation and a register-based block cipher with encryption and decryption rounds. It also gives a test vector and points to register values across encryption rounds.
2.1 Notation
- The notation defines concatenation, bitwise XOR, 32-bit modular addition and subtraction, and register swapping.It also maps 8-bit strings and concatenated 32-bit words to integers.Source: §2.1 · p. 2
2.2 Encryption and decryption
- The key schedule generates 56 32-bit round keys from eight 32-bit key words, with the key words repeated for encryption and reversed for decryption.The supplied passages also include a plaintext test-vector input and its ciphertext.Source: §2.2 · p. 2, §2.3 · p. 3
- Encryption and decryption operate on four 32-bit registers initialized from the 128-bit input block, with an additional 32-bit auxiliary register.Encryption runs rounds 1–8 and outputs b ∥ d ∥ a ∥ c; decryption runs rounds 8–1 and outputs c ∥ a ∥ d ∥ b.Source: §2.2 · p. 2
- Each encryption round includes a keyed transformation of b ⊞ c and updates b and c using the resulting value.The round also swaps registers; decryption replaces step (12), and Gr and the S-box are specified as cipher transformations.Source: §2.2 · p. 3
2.3 Test Vectors
- Table 2 records the contents of registers a, b, c, and d during encryption rounds.Figure 1 is identified as an encryption round.Source: §2.3 · p. 3, Figure 1 · p. 4
3 Design Principles
BelT’s design combines a customized S-box and alternating operations from different algebraic groups, with eight rounds chosen for protection against common cryptanalytic methods and a security margin. Its design also seeks simpler implementations through similar encryption and decryption structures.
1. Structural similarity of the encryption and decryption transformations
- The encryption round differs only slightly from the decryption round, enabling simpler software and hardware implementations.Source: §3 · p. 4
2. Customization of the S-box S
- A custom S-box can serve as an additional long-term key when a personalized cipher is required.Source: §3 · p. 4
3. Construction and properties of the S-box S
- The S-box coordinate truth tables use distinct length-255 segments of linear recurrence sequences, with a zero inserted at a fixed position in each segment.Source: §3 · pp. 4–5
- The S-box has nonlinearity 102, with high nonlinearity cited as resistance to linear cryptanalysis, and differential quantities 8, 7, 6, and 3 cited as sufficiently small for resistance to differential cryptanalysis.The respective measures are R⊕⊕(S), R⊞⊞(S), R⊕⊞(S), and R⊞⊕(S).Source: §3 · p. 5
- Each S-box coordinate Boolean function has maximum algebraic degree 7, which hinders higher-order differential attacks; the S-box also has no quadratic input-output relations, whose existence simplifies algebraic attacks.Source: §3 · p. 6
4. Alternation of operations
- XOR is interleaved with addition or subtraction modulo 2^32 during register updates, making certain cryptanalytic methods more difficult to apply.Source: §3 · p. 6
5. Round distinction
- Adding the round number makes each round a distinct permutation even with repeated round keys, reducing chances of weaknesses such as low-order permutations or equivalent keys.Source: §3 · p. 6
6. The number of rounds
- Eight rounds were chosen to protect against common cryptanalytic methods and provide a security margin, although preliminary analysis found no significant plaintext, ciphertext, and key regularities after two rounds.Source: §3 · p. 6
4 Performance
The section describes BelT’s software implementation choices and reports encryption throughput on two Pentium-family processors. It also compares BelT’s implementation and key schedule with AES-competition ciphers.
4 Performance
- BelT’s design uses a 32-bit architecture, with byte substitution through the S-box as the sole non-32-bit operation.Source: §4 · p. 6
- Precomputed expanded tables for r = 5, 13, 21, 29 require 4 KB in total.Source: §4 · p. 7
- Table 3 gives operation counts for encryption and decryption of a 16-byte block.Source: §4 · p. 7, Table 3 · p. 7
- Using matched C implementations, the authors compared BelT with seven AES-competition ciphers; VTune measured Pentium-family cycles per 16-byte encryption.Source: §4 · p. 7, Table 4 · p. 8
- 18.73 Mbit/s on a Pentium-200 CPU and 187.7 Mbit/s on a Pentium III-1000 CPU were reported for BelT.Source: §4 · p. 7
- BelT’s round keys require no calculations in practical implementations; the paper contrasts this with Twofish’s key schedule, whose complexity is about five times one 16-byte block encryption.Source: §4 · p. 8