=Paper=
{{Paper
|id=Vol-2104/paper_220
|storemode=property
|title=High-Performance Reliable Block Encryption Algorithms Secured against Linear and
Differential Cryptanalytic Attacks
|pdfUrl=https://ceur-ws.org/Vol-2104/paper_220.pdf
|volume=Vol-2104
|authors=Sergiy Gnatyuk,Vasyl Kinzeryavyy,Maksim Iavich,Dmytro Prysiazhnyi,Khalicha Yubuzova
|dblpUrl=https://dblp.org/rec/conf/icteri/GnatyukKIPY18
}}
==High-Performance Reliable Block Encryption Algorithms Secured against Linear and
Differential Cryptanalytic Attacks==
https://ceur-ws.org/Vol-2104/paper_220.pdf
High-Performance Reliable Block Encryption Algorithms Secured
against Linear and Differential Cryptanalytic Attacks
Sergiy Gnatyuk1, Vasyl Kinzeryavyy1, Maksim Iavich2, Dmytro Prysiazhnyi3,
Khalicha Yubuzova4
1
National Aviation University, Kyiv, Ukraine
2
Scientific Cyber Security Association, Tbilisi, Georgia
3
Vinnytsia National Technical University, Vinnytsia, Ukraine
4
Satbayev University, Almaty, Kazakhstan
s.gnatyuk@nau.edu.ua v.kinzeryavyy@nau.edu.ua m.iavich@scsa.ge
dimpris@gmail.com hali4a@mail.ru
Abstract. To be secure, modern information and communication technology
(ICT) needs reliable encryption. Symmetric cryptography combines encryption
algorithms that use the same cryptographic keys for both encryption of plaintext
and decryption of ciphertext. These algorithms are used for confidentiality
ensuring in different spheres but most of them are worn out and outdated.
Modern encryption algorithms development is very actual task for ICT (up to
date and next generation). In this paper to improve the security effectiveness of
electronic information resources, two encryption algorithms have been
developed based on fixed lookup tables with extended-bit depth and dynamic
key-dependent lookup tables. The developed algorithms are at least two times
faster than the previous national encryption standard and virtually secure to
linear and differential cryptanalysis. Properties of random sequences formed
using the proposed algorithms’ encryption (in counter mode) were explored in
the environment of NIST STS statistical tests, according to which they passed
integrated control by mentioned tests with better results than other generators.
Keywords: IT security, confidentiality, cryptography, cipher, block encryption
algorithm, cryptographic security, reliable encryption, algebraic coding theory.
1. Introduction
As a result of modern global challenges in information security on the state level, the
requirements for state information resources security and other critical information
(transferred and stored in information and communication systems) are constantly
growing [1-2]. The cryptographic security of these resources is one of the most
significant security measures (especially in critical information infrastructure
protection [2-3]). Cryptographic security is one of the most reliable and effective
methods of information security; its principal and undeniable advantage is the data
protection without access to it. The principal criterion for choosing cryptosystems is
security, but for some applications (e.g., Big Data encryption, online banking
payment systems etc.) the key role played by cryptographic data processing is speed.
Despite the wide variety of modern encryption methods and algorithms, not all have
the necessary level of effectiveness (speed and security). In addition, the rapid
development of computational tools and their simultaneous cost reduction have led to
new requirements for both the security and the performance of cryptosystems–old
cryptographic algorithms disappear, and new ones must pass specific competitive
selection and prove their ability to provide security for a specific period of time in the
future [4-10]. Algorithm 28147:2009 was Ukrainian National Encryption Standard
until 2014. DSTU 7624:2014, the new Encryption Standard since 2015, has not been
well investigated [6, 9]. However, considering the significant progress in the field of
cryptanalysis methods and tools, Ukrainian National Encryption Standard 28147:2009
has become obsolete [9]. Thus, in accordance with the requirements of the New
European Schemes for Signatures, Integrity, and Encryption (NESSIE) project [5], the
algorithm of Ukrainian Encryption Standard 28147-2009 applies only to the third
(lowest) class of security [8]. In addition, previous Ukrainian National Encryption
Standard 28147-2009 does not satisfy the modern requirements for data encryption
speed [7] that is important for mentioned tasks.
Additional disadvantages include complexity of hardware implementation and use of
secret long-term key data, which are supplied in a prescribed manner [7]. Therefore,
the development of new algorithms to improve the efficiency of information security
is an important scientific task. The purpose of this work is to contribute to
improvement in the efficiency of electronic information resources security through
the development of modern secure high-performance reliable block ciphers.
2. Method for Speed of Block Ciphers Increasing
Consider a class of block ciphers with a set of open (encrypted) messages Vn {0,1}n ,
n 128 p , p N , a set of round keys K Vn , and a family of cryptographic
transformations Fk f r , kr ... f 1 ,k1 , k k1 ,..., kr K r , where r is the number of
encryption rounds.
The round transformation fi , k x for any x Vn , k K , and i 1, r is described as
x k , i r
fi , k , where is defined separately for each round operation of
sr x k , i r
addition modulo 2 or 232l , l N , l n 32 . Substitutions x and si x are
defined by the formulas x L s i x , x Vn , si x si xc 1 , ... , si x0 ,
where x xc 1 ,..., x0 , x j Vt , t 4 , c n / t , j 0, c 1 , si involves m lookup
tables on the set Vt , used in the i-th round ( m 1, c ), аnd L x is a linear
transformation used in a block cipher. si – one of m ( m N ) substitution tables on
set Vt , that is using in i -th round, L x – linear transformation using in block cipher.
For the above class of block ciphers there are fairly well known analytical upper
estimates of the parameters [11, 12], characterizing practical security against linear
[13, 15] and differential [13, 14] cryptanalysis attacks:
EDP r 1 BL / 2 1 (1)
ELP r 1 BL / 2 1 (2)
where max d , : , Vt \ 0 is the maximum probability difference of
s
the substitution table s [11], max l , : , V \ 0 is the maximum
s
t
probability of linear approximation of the substitution table s [11], BL is the
number of the revitalization branches of the following linear transformation L x
( BL min wt x wt xL1 ) [11], EDP is the average differential
characteristics probability of [11], аnd ELP is the average linear
characteristic probability of [11].
Variables d s ( , ) and l s ( , ) are defined by the following formulas (if the
operation “+” is addition modulo 2) [11, 12]:
d s ( , ) 2t ( s(k ) s(k ), ) , (3)
kVt
2
l s ( , ) 2t 2t (1) x s( x k ) (4)
k Vt xVt
0, u v
where is the Kronecker delta symbol, (u, v) .
1, u v
According to the standard methodology of constructing block ciphers [16], using
linear transformations with a large parameter BL and substitution tables with smaller
indices and reasonably decrease the number of encryption rounds of a block
cipher r , ensuring its practical security against of linear and differential
cryptanalysis. The minimum number of rounds (see Table 1) was determined on the
basis of formulas (1) and (2), yielding practical resistance to linear and differential
cryptanalysis of block ciphers (considered class), where the length of the secret key
and data block is 128 bits.
Table 1. Minimum number of rounds for ensuring practical security
against linear and differential cryptanalysis
MDS-codes, Substitution table on the set
covering bytes V8 ( 2 ) V16 ( 214 ) V32 ( 230 )
6
4 bytes ( BL 5 ) r 10 r 5 r 3
8 bytes ( BL 9 ) r 6 r 3 r2
16 bytes ( BL 17 r 4 r 2 r2
)
As a linear transformation of the considered maximum distance separable (MDS)
codes, covering w bytes ( w 4, 8, 16 ) allows the number of activation branches
BL w 1 . We investigated the substitution table on the set Vq , where q 8, 16, 32 ,
for which the theoretically achievable levels of and are equal to 2 q 2 .
According to Table 1, the performance of block ciphers (considered as a class) can be
improved by taking the following steps:
1) Expand the variety of permutations to use the substitution table on the set V16
(most modern cryptographic algorithms use lookup tables on multiples of V8 ). Using
such a table requires only 128 KB of memory, which is now acceptable. A
substitution table on the set V32 requires much more memory, resulting in it being
impractical for current use.
2) Replace some MDS codes to cover a larger number of bytes (this will increase the
number of operations per round, but not significantly).
3) Reduce the number of block cipher rounds to improve performance.
For example, this method can be applied to block cipher Kalyna encryption
algorithms ( , 25 , BL 9 , r 11 ) [11] and the Advanced Encryption Standard
(AES) ( 26 , BL 5 , r 11 ) [4], but in this case (with decreasing r ),
investigating their security in regard to other methods of cryptanalysis is a very
difficult task. However, the opportunity to enhance their performances deserves
attention.
3. New Block Encryption Algorithms Development
On the basis of the described method for increasing the speed of block ciphers, two
algorithms have been developed for encrypting the information using a fixed table lookup
with an extended bit depth (Luna) and with dynamic key-dependent lookup tables
(Neptune). The pseudocode for the algorithms is shown in Fig. 1a and 1b, respectively.
Luna Neptune
Input: 128-bit input data block state , Input: 128-bit input data block state ,
128-bit extended keys subkey i , i 0, r 2 . 128-bit extended keys subkey i , i 0, 2 r .
Output: 128-bit output data block. Output: 128-bit output data block.
1. AddKeyMod 2 state, subkey 1 ; 1. AddKeyMod 2 state, subkey 0 ;
2. For j 0, j r 1, j do 2. For j 0, j r 1, j do
2.1. SubBytesLuna state ;
2.1. SubBytesNeptun state, subkey 2 j 1 ;
2.2. ShiftRows state ; 2.2. ShiftRows state ;
2.3. MixColumns state ; 2.3. MixColumns state ;
2.4. AddKeyMod 2 state, subkey j 2 ;
2.4. AddKeyMod 2 state, subkey 2 j 2 ;
3. SubBytesLuna state ; 3. SubBytesNeptun state, subkey 2 r 1 ;
4. ShiftRows state ; 4. ShiftRows state ;
5. AddKeyMod 2 state, subkey r 1 ; 5. AddKeyMod 2 state, subkey 2 r ;
6. return state ; 6. return state ;
a b
Fig. 1. Pseudocode for encrypting the (a) Luna and (b) Neptune encryption algorithms
These algorithms use 128-bit data blocks (represented as 4 4 byte matrices) with
secret-key lengths of 128, 256, and 512 bits, formed from the required number of 128-
bit extended keys represented as matrices of size 4 4 bytes. The number r of
encryption rounds depends on the length of the secret key. With secret-key lengths of
128, 256, and 512 bits, r 7, 9, 13 in Luna and r 9, 13, 21 in Neptune,
respectively.
The operation AddKeyMod 2 state, subkey i is bitwise addition modulo 2 of the
corresponding bits of the extended subkey i key and a state data block.
The MixColumns state operation is a linear state sequence transformation. In this
operation, the state data block is split into two parts of eight bytes (the first two four-
byte columns form one eight-byte part, and the other eight – the second part), each of
which is considered as a polynomial over the field GF 28 with eight terms, which
are multiplied by x 1 modulo a fixed polynomial c x (see Fig. 2), thereby
8
ensuring that the number of activation branches is nine. The polynomial c x is
given by c x 3x7 7 x6 x5 3x4 7 x3 4x2 1Dx 1 , where the coefficients are
represented in base-16 forms. A not given polynomial chosen polynomial is
m x x8 x7 x5 x4 x 1 .
X1,1 X2,1
X3,1 X4,1 y1 y1
X1,2 X2,2
X3,2 X4,2
c(x) X ... = ...
X1,3 X2,3
X3,3 X4,3
X1,4 X2,4 X3,4 X4,4 y8 y8
Fig. 2 Scheme of the execution of the MixColumns state operation
In SubBytesLuna state and SubBytesNeptun state, subkey i , an operation table is
replaced according to each of the 16- and 8-bit data blocks with a specific table of
substitutions (see Figs. 3a and 3b, respectively). Luna uses one 16 16 substitution
table, while Neptune uses 16 tables, with the choice of a particular table in each round
depending on the expanded key (a dynamically changeable substitutions table
complicates the cryptanalysis and will dynamically manage the information
dispersion). The substitution table was constructed in such way that there were no
fixed points, as well as to satisfy the respective equalities for the parameters,
214 for the Luna substitution table and 26 for each Neptune
substitution table.
Sbox X Y Sbox X Y
X1,1 X2,1 X3,1 X4,1 X1,1 X2,1 X3,1 X4,1
X1,2 X2,2 X3,2 X4,2 X1,2 X2,2 X3,2 X4,2
X1,3 X2,3 X3,3 X4,3 X1,3 X2,3 X3,3 X4,3
X1,4 X2,4 X3,4 X4,4 X1,4 X2,4 X3,4 X4,4
A b
Fig. 3. Scheme of substitution table operation for (a) Luna and (b) Neptune
The proposed substitution tables are created by calculating the inverse field element
C X GF (2q ) and then performing affine transformations over the field GF (2) :
1
S ( X ) M C X V , where X , C ,V GF (2q ) , and M is not a singular square
1
matrix over the GF (2) field of q q size. For Luna, q 16 , and for Neptune, q 8 .
The C , V , and M settings for the Neptune and Luna table lookup algorithms are
shown in base-16 forms in Tables 2 and 3, respectively (each matrix row is shown in
the form of one base-16 number).
Table 2. C , V , and M settings for building the substitution table
of the Luna encryption algorithm
M C V
{0652, CA4, 1948, 3290,
6520, CA40, 9481, 2903,
1787 2544
5206, A40C, 4819, 9032,
2065, 40CA, 8194, 0329}
Table 3. C , V , and M settings for building the substitution table
of the Neptune encryption algorithm
Substitution
M C V
table index
1 { 91, 23, 46, 8C, 19, 95 E0
2 { 83, 7, 32, E, 64, 1C, C8 } 38, E1 E4
3 { AB, 57, 70, AE, E0, 5D, C1 }BA, 14 EA
4 { EA, D5, 75, AB,EA, 57, D5 }AE, 54 5
5 { 94, 29, 5D, 52, BA, A4, 75 } 49, B2 B0
6 { AB, 57, 92, AE, 25, 5D, 4A }BA, 50 7A
7 { 64, C8,75, 91, EA, 23, D5 } 46, DD F8
8 { C4, 89, 8C, 13, 19, 26, 32 } 4C, F9 97
9 { 2F, 5E, 98, BC,31, 79, 62 } F2, 1D B2
10 { FE, FD, E5, FB, CB, F7, 97 } EF, 95 8E
11 { D6, AD,DF, 5B, BF, B6, 7F } 6D, 13 43
12 { A4, 49, DA, 92, B5, 25, 6B } 4A, 22 35
13 { E9, D3, 94, A7, 29, 4F, 52 } 9E, D9 B9
14 { 7F, FE, 3D, FD,7A, FB, F4 } F7, EE 54
15 { 8A, 15, EF, 2A, DF, 54, BF } A8, 3B EA
16 { D3, A7, 51, 4F, A2, 9E, 45 } 3D, 91 E7
7A, F4, E9 }
In ShiftRows state operation executes byte matrix elements shift state : elements of
i ( i 2, 3 ) last string sequence state cyclically shifted right by 2 elements.
The procedures of Neptune and Luna decoding are similar to the encryption
procedure (see Figs. 1a and 1b), except that the extended keys are provided in reverse
order, with the reverse substitution tables and a reversed MixColumns state
operation being used (multiplication by a polynomial
d x 7 Ax7 A1x6 F 8x5 EEx4 20x3 89x2 EBx 51 ).
In the key expansion procedure, a 128n -bit secret key K ( n 1, 2, 4 ) is divided into
n parts of 128 bits ( al , l 1, n ) to formulate extended keys. Each of these is divided
into four k l i ( i 1, 4 ) parts that, together with the 32-bit variables A , B , C , D ,
E , F , and yi ( i 1, 4 ), are moved to the key expansion routine input, the
pseudocode of which is shown in Fig. 4.
The Sbox X operation for Neptune and Luna performs tabular substitution in
accordance with each 16 and 8 bits, respectively (Luna uses a substitution table based
on the parameters from Table 2, while Neptune uses bases of the parameters from the
first row of Table 3). Mix y1 , y2 , y3 , y4 is the operation of linear dispersion. In this
operation, variables yi are broken into two parts of eight bytes, each of which is
considered as a polynomial over the field GF 28 with eight terms that are
multiplied by x8 1 modulo a fixed c x polynomial of order seven, where
c x 3x7 7 x6 x5 3x4 7 x3 4x2 1Dx 1 . As a polynomial that is not chosen,
consider m x x8 x7 x5 x4 x 1 .
Input: al , KolSubKey
A, B, C, D, E, F , y1 , y2 , y3 , y4 .
Output: 128 -bit extended keys subkey i , i 0, KolSubKey 1
1. For k 0, k KolSubKey, k do
1.1. subkey k 0;
2. For l 0, l n, l do
2.1. For k 0, k KolSubKey, k do
2.1.1. For j 0, j 7, j do
2.1.1.1
A A k 2 D k l1 y3 ;
l
2.1.1.2.
k l1 Sbox A k l1 B ;
2.1.1.3. B Sbox B k 1 C k l 3 ;
l
2.1.1.4.
k l 2 Sbox B k l 2 k l 4 A ;
2.1.1.5. y1 Sbox Sbox y k k E y ;
1
l
2
l
1 4
2.1.1.6. C Sbox C F y1 D ;
2.1.1.7.
y2 Sbox y2 C k l 2 k l1 ;
2.1.1.8. Mix y1 , y2 , y3 , y4 ;
2.1.1.9.
D D k l 4 A k l 3 y1 ;
2.1.1.10.
l
k 3 Sbox D k 3 E ; l
2.1.1.11. E Sbox E k 3 F k l1 ;
l
2.1.1.12.
k l 4 Sbox E k l 4 k l 2 D ;
2.1.1.13. y3 Sbox Sbox y k k B y ;
3
l
4
l
3 2
2.1.1.14. F Sbox F C y3 A ;
2.1.1.15.
y4 Sbox y4 F k l 4 k l 3 ;
2.1.1.16. Mix y1 , y2 , y3 , y4 ;
2.1.2 temp l k y1 | y2 | y3 | y4 ;
2.1.3 subkey k subkey k temp l k .
Fig. 4. Pseudocode procedure for key expansion
Initial values of the variables A , B , C , D , E , F , yi are listed in base-16 in
Table 4.
Table 4. Initial values of variables A , B , C , D , E , F , yi
Variable Initial values
A 13C5E572
B BC6FF4AD
C 4C1371E1
D 89F8D170
E 01069DA9
F C5F52BD7
y1 3B106B7A
y2 7E15CEC1
y3 23B0C13E
y4 37A763D2
4. Software optimization of the Neptune and Luna cryptographic algorithms
Both Neptune and Luna utilize widely used algebraic operations in finite fields.
Immediate execution of these operations would lead to extremely inefficient
implementations. However, the byte-algorithm structure opens up opportunities for
optimization. Thus, two-byte substitution can be implemented during Luna
implementation, shifting and multiplying the result by the corresponding columns of
the matrix M as one of substitution 16 bits on 64 bits, and Neptune implementation
can be implemented as a bit-substitution shift, with a multiplication matrix state
element on the column of the matrix M being implemented as 8-bit on 64-bit
substitution. In that case, a complete round of Luna will consist of eight permutations
of 16 on 64 bits and eight-bit addition modulo 2. Similarly, performing a full round of
the Neptune algorithm requires only 16 substitutions of 8-bit on 64 bits and 16
additions modulo 2. Thus, by allocating a larger amount of RAM and performing
preliminary calculations, it is possible to reduce the number of operations in the round
and achieve a cryptographic processing speed boost.
5. Statistical Security Estimation using NIST STS
Properties of pseudorandom sequences formed with the help of Neptune and Luna (in
counter mode) have been studied in the environment of NIST STS statistical tests
(testing technique described in [17]). Statistical portraits of Neptune and Luna
software implementations are shown in Figs. 5-6, respectively.
Fig. 5 Statistical portrait of Luna encryption algorithm in counter mode
Fig. 6 Statistical portrait of Neptune encryption algorithm in counter mode
For comparison, Table 5 presents the results of testing sequences generated on the
basis of the Luna, Neptune, Ukrainian Encryption Standard 28147-2009, Blum Blum
Shub (BBS), and Kalyna algorithms. As can be seen from the results (Table 5), the
Luna- and Neptune-based generators passed comprehensive testing using the NIST
STS method and show better results than other algorithm-based generators.
Table 5. Results of sequence testing
Number of tests in which the test was conducted
Generator
99% sequence 96% sequence
BBS 133 (70,3%) 189 (100%)
DSTU 28147-2009 132 (69,8%) 188 (99,4%)
Kalyna 136 (72,0%) 189 (100%)
Luna 141 (74,6%) 189 (100%)
Neptune 140 (74,0%) 189 (100%)
6. Encryption Rate Estimation
Based on the described optimization software, the Luna, Neptune, AES, and Kalyna
encryption algorithms and Ukrainian Encryption Standard 28147-2009 were
implemented in the C++ programming language. During the Luna implementation,
two-byte substitution, shifting, and multiplying the result by the corresponding
columns of the matrix as a 16-bit to 64-bit substitution were presented. Similarly,
during the Neptune and Kalyna implementations, byte operation substitution, shift,
and multiplication of elements of the matrix by a column matrix as one eight-bit to
64-bit substitution were presented. During the DSTU 28147-2009 implementation,
every two four-by-four-bit substitution tables were combined as a table of eight by
eight bits, allowing reduction of the number of lookup operations from eight to four.
During AES implementation, the operations of byte substitution, shift, and
multiplication of elements of the matrix by a column matrix as one eight-bit to 32-bit
substitution were presented.
After software tools development, an experimental study was conducted to show that,
in identical conditions, the Neptune and Luna encryption algorithms are 1.09 to 2.93
times faster than the Ukrainian Encryption Standard 28147-2009, Kalyna, or AES
ciphers (see Table 6). The studies were conducted on an Intel(R) Core(TM)2 Duo
T7300 2.0 GHz.
Table 6. Comparison of encryption algorithm speed performance
Encryption algorithm Speed (MB/s)
AES -128 37.2
Kalyna -128 34.9
DSTU 28147-2009 18.1
Luna -128 53.1
Neptune -128 40.9
7. Security Estimation against Linear and Differential Cryptanalysis
During calculation of the analytical upper bounds of the parameters characterizing
practical security to linear and differential cryptanalysis using formulas (1) and (2),
and must be calculated depending on the parameters’ lookup table. For this
purpose, special software was developed and special tables were built using equations
(3) and (4). Then, we determined the maximum value in these tables (except for the
items in the zero-th row or column). As a result, it was determined that for Luna,
214 , and for each Neptune table, 26 .
Table 7 contains the analytical upper bounds of the parameters (using equations (1) -
(2)), characterizing the practical security of the Neptune and Luna encryption
algorithms to differential and linear cryptanalysis.
Table 7. Analytical upper bounds of the security against differential and linear cryptanalysis
Key Luna Neptune
length Differential Linear Differential Linear
(bit) cryptanalysis cryptanalysis cryptanalysis cryptanalysis
128 EDP() 2392 ELP() 2392 EDP() 2222 ELP() 2222
256 EDP() 2512 ELP() 2512 EDP() 2330 ELP() 2330
512 EDP() 2770 ELP() 2770 EDP() 2546 ELP() 2546
8. Conclusions
In this paper, two encryption algorithms were proposed to improve the efficiency of
electronic information resources security from viewpoint of reliability, speed and
security. As can be seen from the results of the experimental study, the proposed
algorithms, Luna and Neptune, are at least two times faster than the previous
Ukrainian National Encryption Standard 28147-2009 (in fact, this is the standard for
all post-Soviet states). In addition, designed algorithms passed comprehensive control
using the NIST STS technique and showed better results than other encryption
algorithm-based generators. It was also shown that the proposed algorithms are
practically secured against linear and differential cryptanalysis.
References
1. Gnatyuk, S., Zhmurko, T., Falat, P.: Efficiency increasing method for quantum secure
direct communication protocols. In: Proceedings of the 2015 IEEE 8th International Conference
on “Intelligent Data Acquisition and Advanced Computing Systems: Technology and
Applications” (IDAACS’2015), Warsaw, Poland, 468-472 (September 24-26, 2015).
2. Korchenko, O., Vasiliu, Ye., Gnatyuk, S.: Modern quantum technologies of information
security against cyber-terrorist attacks. Aviation 14 (2), 58-69 (2010).
3. Kovtun, M., Kovtun, V., Okrimenko, A., Gnatyuk, S.: Search method development of
birationally equivalent binary Edwards curves for binary Weierstrass curves from DSTU 4145-
2002. In: Proceedings of 2nd International Scientific-Practical Conf. on the Problems of Info-
communications. Science and Technology, Kharkiv, Ukraine, 135-139 (October 13-15, 2015).
4. Advanced Encryption Standard (AES): FIPS 197. Gaithersburg, Maryland, USA: NIST,
2001. http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf.
5. NESSIE contest (The New European Signature Algorithms, Integrity and Encryption)
Panasenko, S. http://old.cio-world.ru/bsolutions/e-safety/340556.
6. Position about carrying out of open competition of cryptographic algorithms, Institute
of Cybernetics named after V. Glushkov of NASU. http://www.dstszi.gov.ua/dstszi/control/ru/
publish/article;jsessionid=EE63A37FEF8F5B34030F1E38D7247DBC?art_id=48387&cat_id=92733.
7. Gorbenko, I., Lisitskaya I.: Encryption algorithms standardization. Project requirements
of national standard for block symmetric encryption on the modern stage of cryptography
development. Radio Engineering, 5-10 (2011).
8. Gorbenko, I., Dolgov, V., Oliynykov, R. et al: Principles of construction and properties
of IDEA-like block symmetric ciphers. Applied Radio Electronics 6 (2), 158-173 (2007).
9. DSTU 7624:2014. Ukrainian National Encryption Standard “Kalyna”, 86 p. (2014).
10. Panasenko, S.: The encryption algorithms. Special guide, St. Petersburg, BHV-
Petersburg. 576 (2009).
11. Alekseichuk, A., Kovalchuk, L., Skrynnik, E. et al: Rating of practical resistance of
Kalyna block cipher relative to the difference methods, linear cryptanalysis and algebraic
attacks based on homomorphisms. Applied Radio Electronics 7 (3), 203-209 (2008).
12. Alekseichuk, A., Kovalchuk, L., Skrynnik, E. et al: Rating of practical resistance of
“Kalyna” block cipher relative to the difference methods, linear cryptanalysis and algebraic
attacks based on cryptanalysis. In: Proceedings of the 4th intern. conf. on security and countering
terrorism. MSU, M. V. Lomonosov. 30-31 Oct. 2008, 2th ed, M.: MCCME, 15-20 (2009).
13. Alsalami Y., Yeun C. Y., Martin T.: Linear and differential cryptanalysis of small-sized
random (n, m)-S-boxes. In: Proceedings of 2016 11th International Conference for Internet
Technology and Secured Transactions, Barcelona, Spain. DOI: 10.1109/ICITST.2016.7856751
14. Lai, X., Massey, J., Murphy, S.: Markov ciphers and differential cryptanalysis.
Advances in Cryptology, EUROCRYPT’91, Proceedings, Springer Verlag, 17-38 (1991).
15. Matsui, M.: Linear cryptanalysis methods for DES cipher. EUROCRYPT, Springer
Verlag (1998).
16. Daemen, J.: Cipher and hash function design strategies based on linear and differential
cryptanalysis: Ph. D. Thesis, Katholieke Univ. Leuven (1995).
17. Narges, M., Khayyambashi, M. Performance Evaluation of Authentication Encryption
and Confidentiality Block Cipher Modes of Operation on Digital Image. International Journal
of Computer Network and Information Security (IJCNIS), Vol.9, No.9, pp.30-37, 2017. DOI:
10.5815/ijcnis.2017.09.04.