ου γαρ εστιν κρυπτον ο ου φανερον γενησεται ουδε αποκρυφον ο ου γνωσθησεται και εις φανερον ελθη
Wersja PL ENG Version

RC2

  • Description
  • Algorithm
  • Block diagrams
  • Mathematical functions
  • Implementation
RC2 is a block symmetric cipher which was popular in the first half of the 90s of the last century. It was greatly promoted by the US government agencies.
Block cipher with symmetric secret key
Key length = from one byte up to 128 bytes
Block length = 8 bytes
RC2 was designed by Ron Rivest of RSA Security in 1987, who created also a few other ciphers. RC2 algorithm had been kept secret until 1996, when it was anonymously posted on sci.crypt group.

RC2 is also known as ARC2. The acronym RC is understood as "Rivest Cipher" or "Ron's Code".

RC2 is a block cipher, and the block size is 8 bytes (64 bits). This means that the input data is first divided into blocks of 8 bytes and then each of them is processed separately.

Each data block is treated as four words, each word has 16 bits (2 bytes). The array of four words is presented as R[0] R[1] R[2] R[3]. Both encryption and decryption take this array as input and modify the four words. The output is returned in the same array.

Key Expansion

Apart from the data, the RC2 cipher takes as input a secret user key. The key provided by the user may be of size from one byte up to 128 bytes. Let us denote the key size (in bytes) as Keysize. The first operation which RC2 then performs is to expand the key, to receive new 128 key bytes which will be used for encryption of decryption of all data bytes.

The user provides also a second value, denoted Keybit-limit, which determine the maximum effective key size, provided in bits. This means, that no matter how many bytes of the secret key has been provided by the user, the cipher will operate on the key which effective size is Keybyte-limit, where:
    Keybyte-limit = (Keybit-limit + 7) / 8

Of course, the real strenght of the key will be even smaller, if the user provided less key bytes than Keybyte-limit.

In order to assure that only that many bites will be used to secure the data, the following bit mask is defined:
    Keymask = 255 mod 2^(8 + Keybit-limit - 8·Keybyte-limit)

The 8 - (8·Keybyte-limit - Keybit-limit) least significant bits of Keymask are set, the rest are zeros.

Key Words and Bytes

The mathematical operations that are performed on the key operate on both single bytes and whole words. So, for convenience, the numbers in the key may be presented as either 64 words:
    K[0], K[1], ..., K[63]

or 128 separate bytes:
    L[0], L[1], ..., L[127].

Note, that each part of the key array may be addressed by using either bytes or words. The following equation can be defined:
    K[i] = L[2·i] + 256·L[2·i+1]

The low-order eight bits of each word is located before the high-order byte.

Key Expansion Algorithm

The first step of the key expansion algorithm is to fill the first Keysize bytes of key array with the bytes received from the user:
    L[0], L[1], ..., L[Keysize-1].

Then, the following steps are performed on the key data. TPI mentioned below is a fixed array of size 256, filled randomly with values from 0 to 255:

  1. For i = Keysize, Keysize+1, and up until 127:
        L[i] = TPI[(L[i-1] + L[i-Keysize]) mod 256]
  2. L[128-Keybyte-limit] = TPI[L[128-Keybyte-limit] & Keymask]
  3. For i = 127-Keybyte-limit, down until 0:
        L[i] = TPI[L[i+1] XOR L[i+Keybyte-limit]]

The effective encryption key is determined by the bytes:
    L[128-Keybyte-limit], L[128-Keybyte-limit+1]..., L[127]

The operation & performed in the second step above limits the effective size of the key down to just Keybit-limit bits.

Encryption

The encryption procedure takes as input four words: R[0] R[1] R[2] R[3], which form one block of data. Every block of data will be encrypted by using the same 64 words of expanded secret key: K[0] K[1] ... K[63].

The following encryption steps are performed on every data block:

  1. Initialize the counter j to 0.
  2. Perform five Mixing Rounds.
  3. Perform one Mashing Round.
  4. Perform six Mixing Rounds.
  5. Perform one Mashing Round.
  6. Perform five Mixing Rounds.

Because every Mixing Round uses 4 key bytes, all 128 key bytes are used during encryption of one data block. The Mashing Rounds use key bytes in a more unpredicted manner.

Each Mixing Round consists of four Mixing operations, performed on four words of the data block:

  1. Mixing R[0]
  2. Mixing R[1]
  3. Mixing R[2]
  4. Mixing R[3]

Each Mashing Round consists of four Mashing operations, performed on four words of the data block:

  1. Mashing R[0]
  2. Mashing R[1]
  3. Mashing R[2]
  4. Mashing R[3]

Decryption

The decryption procedure takes as input four ciphertext words: R[0] R[1] R[2] R[3], which form one block of encrypted data. Every block of data will be decrypted by using the same 64 words of expanded secret key: K[0] K[1] ... K[63].

The following decryption steps are performed on every ciphertext block:

  1. Initialize the counter j to 63.
  2. Perform five R-Mixing Rounds.
  3. Perform one R-Mashing Round.
  4. Perform six R-Mixing Rounds.
  5. Perform one R-Mashing Round.
  6. Perform five R-Mixing Rounds.

Each R-Mixing Round consists of four R-Mixing operations, performed on four words of the encrypted data block:

  1. R-Mixing R[3]
  2. R-Mixing R[2]
  3. R-Mixing R[1]
  4. R-Mixing R[0]

Each R-Mashing Round consists of four R-Mashing operations, performed on four words of the encrypted data block:

  1. R-Mashing R[3]
  2. R-Mashing R[2]
  3. R-Mashing R[1]
  4. R-Mashing R[0]
The operations for RC2 algorithm are presented in the order from the low-level functions, to the more complex operations, that use the functions described above them.
Table PI (TPI)
Table PI is a fixed array that contains 256 elements, using during key expansion operations.

Table PI is filled with numbers, which are a random permutations of all possible byte values from 0 to 255. The order of numbers is based on the digits of PI: 3.1415...

Table PI in hexadecimal notation
d978f9c419ddb5ed28e9fd794aa0d89d
c67e37832b76538e624c6488448bfba2
179a59f587b34f1361456d8d09817d32
bd8f40eb86b77b0bf09521225c6b4e82
54d66593ce60b21c7356c014a78cf1dc
1275ca1f3bbee4d1423dd430a33cb626
6fbf0eda4669075727f21d9bbc944303
f811c7f690ef3ee706c3d52fc8661ed7
08e8eade8052eef784aa72ac354d6a2a
961ad2715a1549744b9fd05e0418a4ec
c2e0416e0f51cbcc2491af50a1f47039
997c3a8523b8b47afc02365b25559731
2d5dfa98e38a92ae05df2910676cbac9
d300e6cfe19ea82c6316013f58e289a9
0d38341bab33ffb0bb480c5fb9b1cd2e
c5f3db47e5a59c770aa62068fe7fc1ad
Binary Left Rotation: <<<
The a-bit left rotation of a 2-byte word w is denoted in the algorithm as w <<< a.
The leftmost a bits move to the rightmost positions.
Binary Right Rotation: >>>
The a-bit right rotation of a 2-byte word w is denoted in the algorithm as w >>> a.
The rightmost a bits move to the leftmost positions.
Mixing Operation
Mixing Operation modifies one data word and increments the counter j during encryption process.

The following three operations are performed during Mixing:
    R[i] = R[i] + K[j] +
         + (R[(i+4-1) mod 4] & R[(i+4-2) mod 4])
         + ((~R[(i+4-1) mod 4]) & R[(i+4-3) mod 4])

    j = j + 1
    R[i] = R[i] <<< s[i]

where j is the counter variable and the vector s contains the following values: s[0] = 1, s[1] = 2, s[2] = 3, s[3] = 5.

Mashing Operation
Mashing Operation modifies one data word during encryption process.

The following operation is performed during Mashing:
    R[i] = R[i] + K[R[(i+4-1) mod 4] & 63]

R-Mixing Operation
R-Mixing Operation modifies one ciphertext word and decrements the counter j during decryption process.

The following three operations are performed during R-Mixing:
    R[i] = R[i] >>> s[i]
    R[i] = R[i] - K[j]
         - (R[(i+4-1) mod 4] & R[(i+4-2) mod 4])
         - ((~R[(i+4-1) mod 4]) & R[(i+4-3) mod 4])

    j = j - 1

where j is the counter variable and the vector s contains the following values: s[0] = 1, s[1] = 2, s[2] = 3, s[3] = 5.

R-Mashing Operation
R-Mashing Operation modifies one data word during decryption process.

The following operation is performed during R-Mashing:
    R[i] = R[i] - K[R[(i+4-1) mod 4] & 63]

Site under development.