![]() |
The Twofish Encryption Algorithm: A 128-Bit Block Cipher
by Bruce Schneier ; John Kelsey ; Doug Whiting ; David Wagner ; Chris Hall ; Niels Ferguson Wiley Computer Publishing, John Wiley & Sons, Inc. ISBN: 0471353817 Pub Date: 03/01/99 |
Previous | Table of Contents | Next |
This appendix gives an overview of the symbols used in the definition of Twofish. For data elements, lowercase symbols usually refer to byte values and uppercase symbols usually refer to 32-bit word values.
A | The list of Ai words used in the key schedule. [Page 67] |
A0, . . . , A19 | Intermediate values in the key schedule. [Page 16] |
a0, . . . , a4 | Intermediate 4-bit values used in the definition of the q mappings. [Page 16] |
B | The list of Bi words used in the key schedule. [Page 67] |
B0, . . . , B19 | Intermediate values in the key schedule. [Page 16] |
b0, . . . , b4 | Intermediate 4-bit values used in the definition of the q mappings. [Page 16] |
C0, . . . , C3 | The four 32-bit words of the ciphertext. [Page 11] |
c0, . . . , c15 | The bytes of the ciphertext. [Page 11] |
DPmax(f) | The probability of the best differential characteristic of f. [Page 48] |
F (X, Y, r) | The Feistel round function. This function takes the round number r and two data words X and Y as input. It produces two words of output. The round number is used to select the correct words from the expanded key. Note that the definition of F depends on the key. [Page 11] |
F(X, Y) | This is the F function without the final addition of two key words. It is thus independent of the round number, but still depends on the key. [Page 11] |
Fr,0, Fr,1 | The two output words from the F function in round r. [Page 11] |
g(X) | This function maps a 32-bit word to a 32-bit word. It consists of four S-boxes, and the MDS matrix. It is defined as g(X) → h(X, S). Note that S depends on the key, so this function depends also on the key. [Page 11] |
h(X, L) | A function that maps the 32-bit word X to a 32-bit result under control of a list of words L that is derived from the key. This function is used both in the key schedule, and in the round function. [Page 14] |
K0, . . . , K39 | The expanded key, consisting of 40 words of 32 bits each. The words K0, . . . , K3 are used for the pre-whitening, K4, . . . , K7 for the post-whitening, and K8, . . . , K39 for the 16 rounds. [Page 16] |
k | The length of the key divided by 64. [Page 12] |
L | The list of key-derived words used in h. [Page 14] |
L0, . . . , Lk-1 | The k words of L. [Page 14] |
li, 0, . . . , li, 3 | The four bytes of Li. [Page 15] |
LPmax(f) | The significance-probability of the best linear characteristic of f. [Page 48] |
M0, . . . , M2k-1 | The 2k 32-bit words of the key. [Page 12] |
Me, Mo | Two lists of 32-bit words. The first one consists of the even key words and the second one of the odd key words. [Page 13] |
m0, . . . , m8k-1 | The 8k bytes of the key. [Page 12] |
N | The length of the key, in bits. [Page 12] |
P0, . . . , P3 | The four 32-bit words of the plaintext. [Page 9] |
p0, . . . , p15 | The bytes of the plaintext. [Page 9] |
q0, q1 | Two distinct fixed bijective functions that map byte values into byte values. [Page 16] |
Rr,0, . . . , Rr,3 | The 32-bit words of the data just before round r. The rounds are numbered 0, . . . , 15. For r = 0 these words are the data just before the first round (but after the whitening). For r = 16 they are the data just after the last round (but before the whitening). [Page 9] |
r | The round number. The rounds are numbered 0 to 15 when encrypting. [Page 11] |
ROL(X, n) | A function that rotates a 32-bit value X left by n bits. [Page 11] |
ROR(X, n) | A function that rotates a 32-bit value X right by n bits. [Page 11] |
S | A list of k 32-bit words that is derived from the key using the RS matrix. [Page 13] |
S0, . . . , Sk-1 | The words that make up S. Note that these are put in reverse order to create S. [Page 13] |
s0, . . . , s3 | The key-dependent S-boxes. Each S-box consists of a sequence of table lookups in a q-table, and XORs with key bytes. [Page 16] |
si,0, . . ., si,3 | The four bytes of Si. [Page 13] |
T0,T1 | Two intermediate values used in the computation of F. These are the results of the two g functions, just before the PHT. [Page 11] |
t0, . . . , t3 | Four permutations on 4-bit values. One set of four t permutations is used to define q0, a second set is used to define q1. [Page 17] |
v | The polynomial used to define GF(28) for the MDS matrix multiply. [Page 12] |
w | The polynomial used to define GF(28) for the RS matrix multiply. [Page 13] |
x | The input to one of the q mappings. [Page 16] |
x0, . . . , x3 | The four input bytes to g or h. [Page 12] |
y | The output of one of the q mappings. [Page 16] |
y0, . . . , y3 | Four intermediate bytes in g or h [Page 12]. |
yi,j | The intermediate values used in the computation of yi from xi. [Page 15] |
z0, . . . , z3 | The four output bytes from g or h. [Page 15] |
Z | The 32-bit output word from g or h. [Page 12] |
ρ | A constant used for notational convenience. [Page 16] |
Previous | Table of Contents | Next |