Abstract

. Large classes of weak keys have been found for the block cipher algorithm IDEA, previously known as IPES [?]. IDEA has a 128bit key and encrypts blocks of 64 bits. For a class of 2 23 keys IDEA exhibits a linear factor. For a certain class of 2 35 keys the cipher has a global characteristic with probability 1. For another class of 2 51 keys only two encryptions and solving a set of 16 nonlinear boolean equations with 12 variables is sufficient to test if the used key belongs to this class. If it does, its particular value can be calculated efficiently. It is shown that the problem of weak keys can be eliminated by slightly modifying the key schedule of IDEA. 1 Introduction At Eurocrypt '90 the block cipher proposal PES (Proposed Encryption Standard) was presented [?]. At Eurocrypt '91 the same authors presented a modification of PES, called IPES (Improved PES) [?]. The reason for this modification were new insights based on differential cryptanalysis [?]. IPES has become comme...

Citations