Draft:Ballet (cipher)
From Wikipedia, the free encyclopedia
Ballet[3] is a block cipher selected by the Chinese Association for Cryptologic Research (CACR) as winner of the 2018-2020 cinese National Cryptographic Algorithm Design Competition[1][4]. The cipher is an add–rotate–xor (ARX) with a Lai–Massey scheme structure.
 | Draft article not currently submitted for review.
This is a draft Articles for creation (AfC) submission. It is not currently pending review. While there are no deadlines, abandoned drafts may be deleted after six months. To edit or make changes to this draft, simply click on the "Edit" tab at the top of the window. To be accepted, a draft should:
It is strongly discouraged to write about either yourself or your business or employer. If you do so, you must declare it. Where to get help
How to improve a draft
You can also browse Wikipedia:Featured articles and Wikipedia:Good articles to find examples of Wikipedia's best writing on topics similar to your proposed article. Improving your odds of a speedy review To improve your odds of a faster review, tag your draft with relevant WikiProject tags using the button below. This will let reviewers know a new draft has been submitted in their area of interest. For instance, if you wrote about a female astronomer, you would want to add the Biography, Astronomy, and Women scientists tags. Editor resources
Last edited by ~2026-27501-97 (talk | contribs) 51 days ago. (Update) |
 | |
| General | |
|---|---|
| Designers | Ting-Ting Cui, Mei-Qin Wang, Yan-Hong Fan, Kai Hu, Yong Fu, Lu-Ning Huang |
| First published | 2019 |
| Certification | Cinese National Cryptographic Algorithm Design Competition[1] |
| Cipher detail | |
| Key sizes | 128 or 256 bits |
| Block sizes | 128 or 256 bits |
| Structure | ARX Lai–Massey scheme |
| Rounds | 46–74 (depending on block and key size) |
| Best public cryptanalysis | |
| No attacks are known on the full ciphers, but reduced-round versions have been attacked. Differential-linear attack can break up to 22 round of the 256 block version with a time complexity of 2242.06;[2] see #Cryptanalysis. | |
Cipher description
Ballet is defined in thee version to operate with different block and key size.
| Block size | Key size | Number of rounds |
|---|---|---|
| 128 | 128 | 46 |
| 256 | 48 | |
| 256 | 256 | 74 |
Round function
INPUT:
X0, X1, X2, X3
sk[0 ... r-1][...]
r
FUNCTION ROTL(value, n):
return (value << n) OR (value >> (WORD_SIZE - n))
FOR i = 0 TO r-2 DO:
(X0, X1, X2, X3) =
(
X1 XOR sk[i][0],
ROTL(X0, 6) + ROTL(X1 XOR X2, 9),
ROTL(X3, 15) + ROTL(X1 XOR X2, 14),
X2 XOR sk[i][1]
)
END FOR
// Final round (corrected)
(X0, X1, X2, X3) =
(
ROTL(X0, 6) + ROTL(X1 XOR X2, 9), // FIXED
X1 XOR sk[r-1][1],
X2 XOR sk[r-1][2],
ROTL(X3, 15) + ROTL(X1 XOR X2, 14)
)
OUTPUT:
X0, X1, X2, X3
Key generation algorithms
The following algorithms describe the round key generation procedures for the BALLET block cipher in the n/n and n/2n configurations.
Key generation for BALLET n/n
INPUT: k0, k1 // initial key parts
R // number of rounds
OUTPUT: subkeys[0..R-1]
FUNCTION ROTL(x, n):
RETURN (x << n) OR (x >> (WORD_SIZE - n))
FOR i FROM 0 TO R-1:
// --- 1. Form the round subkey ---
left_half = LEFT_HALF(k0)
right_half = RIGHT_HALF(k0)
subkeys[i] = CONCAT(left_half, right_half)
// --- 2. Save current value of k1 ---
old_k1 = k1
// --- 3. Update k1 ---
k1 = k0 XOR ROTL(old_k1, 3) XOR ROTL(old_k1, 5) XOR i
// --- 4. Swap values ---
k0 = old_k1
END FOR
Key generation for BALLET n/2n
INPUT: k0, k1, k2, k3 // initial key parts
R // number of rounds
OUTPUT: subkeys[0..R-1]
FUNCTION ROTL(x, n):
RETURN (x << n) OR (x >> (WORD_SIZE - n))
FOR i FROM 0 TO R-1:
// --- 1. Form the round subkey ---
left_half = LEFT_HALF(k0)
right_half = RIGHT_HALF(k0)
subkeys[i] = CONCAT(left_half, right_half)
// --- 2. Save current values ---
old_k1 = k1
old_k3 = k3
// --- 3. Update k3 ---
k3 = k2 XOR ROTL(old_k3, 7) XOR ROTL(old_k3, 17)
// --- 4. Update k1 ---
k1 = k0 XOR ROTL(old_k1, 3) XOR ROTL(old_k1, 5)
// --- 5. Shift values ---
k2 = old_k3
k0 = old_k1
// --- 6. Add round-dependent variation ---
k1 = k1 XOR k3 XOR i
END FOR