Xmx

Infobox block cipher
name = xmx
designers = David M'Raïhi, David Naccache, Jacques Stern, Serge Vaudenay
publish date = January 1997
derived from =
derived to =
related to =
key size = variable, equal to block size
block size = variable
structure =
rounds = variable, even
cryptanalysis = differential cryptanalysis, complementation property, weak keysIn cryptography, xmx is a block cipher designed in 1997 by DavidM'Raïhi, David Naccache, Jacques Stern, and Serge Vaudenay. According to thedesigners it "uses public-key-like operations as confusion and diffusion means." Thecipher was designed for efficiency, and the only operations it uses are XORsand modular multiplications.

The main parameters of xmx are variable, including the
block size and key size, which are equal, as wellas the number of rounds. In addition to the key, it also makesuse of an odd modulus "n" which is small enough to fit in a single block.

The round function is f(m)=(moa)·b mod n, where a and b aresubkeys and b is coprime to n. Here moa represents an operation thatequals m XOR a if that is less than n, and otherwise equals m. This is a simpleinvertible operation: moaoa = m. The xmx cipher consistsof an even number of iterations of the round function, followed by a final owith an additional subkey.

The key schedule is very simple, using the same key for all the multipliers, andthree different subkeys for the others: the key itself for the first half of thecipher, its multiplicative inverse mod n for the last half, and the XOR of these twofor the middle subkey.

The designers defined four specific variants of xmx:
* "Standard": 512-bit block size, 8 rounds, n=2⁵¹²-1
* "High security": 768-bit block size, 12 rounds, n=2⁷⁶⁸-1
* "Very-high security": 1024-bit block size, 16 rounds, n=2¹⁰²⁴-1
* "Challenge": 256-bit block size, 8 rounds, n=(2⁸⁰-1)·2¹⁷⁶+157

Borisov, et al, using a multiplicative form of differential cryptanalysis, found acomplementation property for any variant of xmx, like the first three above, such thatn=2^k-1, where k is the block size. They also found large weak key classesfor the Challenge variant, and for many other moduli.

References

* cite conference
author = David M'Raïhi, David Naccache, Jacques Stern, Serge Vaudenay
title = xmx: A Firmware-Oriented Block Cipher Based on Modular Multiplications
booktitle = 4th International Workshop on Fast Software Encryption (FSE '97)
pages = pp.166–171
publisher = Springer-Verlag
date = January 1997
location = Haifa
url = http://citeseer.ist.psu.edu/19207.html
format = PDF/PostScript
accessdate = 2007-01-03
* cite conference
author = Nikita Borisov, Monica Chew, Rob Johnson, David Wagner
title = Multiplicative Differentials
booktitle = 9th International Workshop on Fast Software Encryption (FSE '02)
pages = pp.17–33
publisher = Springer-Verlag
date = February 2002
location = Leuven
url = http://citeseer.ist.psu.edu/672650.html
format = PDF/PostScript
accessdate = 2007-01-03