# Algebraic Properties of the Block Cipher DESL

^{1}

^{2}

^{3}

^{*}

^{†}

## Abstract

**:**

## 1. Introduction

## 2. Preliminaries

#### 2.1. Description of DESL

- There are 16 rounds, each round i implementing a permutation ${\pi}_{i}\in {S}_{{2}^{64}}$ which depends on a round key ${K}_{i}\in {\{0,1\}}^{48}$. The latter is derived from the secret key $K\in {\{0,1\}}^{56}$ through a suitable key schedule.
- Each of the 16 rounds involves a round-key-dependent function ${F}_{{K}_{i}}^{\prime}\left({R}_{i}\right)=P\circ \u2a01\circ S\circ \u2a01\circ E$ where
- –
- $E:{\{0,1\}}^{32}\u27f6{\{0,1\}}^{48}$ is an injective map specified in [1].
- –
- $\u2a01:{\{0,1\}}^{48}\u27f6{\{0,1\}}^{48},x\u27fcx\oplus {K}_{i}$ adds (xor) the round key ${K}_{i}$ to the input.
- –
- $S:{\{0,1\}}^{48}\u27f6{\{0,1\}}^{32}$ splits the input $({a}_{1},\cdots ,{a}_{48})\in {\{0,1\}}^{48}$ into 6-bit blocks and for each $j=1,\cdots ,8$ substitutes $({a}_{6j-5},\cdots ,{a}_{6j})\in {\{0,1\}}^{6}$ with the corresponding 4-bit value obtained from Table 1.
- –
- $P\in {S}_{{2}^{32}}$ is a permutation on 32-bit strings as specified in [1].

- In each round, the 64-bit input is split into a left half ${L}_{i}\in {\{0,1\}}^{32}$ and a right half ${R}_{i}\in {\{0,1\}}^{32}$. Then the value ${L}_{i}^{\prime}:={F}_{{K}_{i}}^{\prime}\left({R}_{i}\right)\oplus {L}_{i}$ is computed, where ⊕ is addition in ${\{0,1\}}^{48}$. The output of round i for $i\in \{1,\cdots ,15\}$ is $({R}_{i},{L}_{i}^{\prime})$. In the last round there is no swap, that is, the value $({L}_{16}^{\prime},{R}_{16})$ is output.

#### 2.2. Multiple Right-Hand Sides (MRHS)

#### 2.2.1. Basic Terminology

#### 2.2.2. Solving a System of Symbols

#### Agreeing

#### Gluing

#### Extracting Equations

#### Guessing Variables

## 3. The Group Generated by DESL’s Round Functions

#### 3.1. Notation

#### 3.2. Establishing 3-Transitivity of G

**Lemma**

**1.**

**Proof.**

**Proposition**

**1.**

- (a)
- $\forall (K,{K}^{\prime})\in \mathbb{M}:{F}_{K,{K}^{\prime}}^{L}\in {G}_{0,d}$ and ${F}_{K,{K}^{\prime}}^{R}\in {G}_{0}$.
- (b)
- $\forall (K,{K}^{\prime})\in {\mathbb{M}}_{{d}^{\prime}}:{F}_{K,{K}^{\prime}}^{L}\in {G}_{0,d}$ and ${F}_{K,{K}^{\prime}}^{R}\in {G}_{0,d}$.
- (c)
- Let $n\in \mathbb{N}$. Then, for all $({K}_{1},{K}_{1}^{\prime}),\cdots ,({K}_{n},{K}_{n}^{\prime})\in \mathbb{M}$ and for all $(a,b)\in {\{0,1\}}^{32}\times {\{0,1\}}^{32}$, the following hold:${F}_{{K}_{1},{K}_{1}^{\prime}}^{R}\circ \cdots \circ {F}_{{K}_{n},{K}_{n}^{\prime}}^{R}(a,b)=$$$\begin{array}{ccc}\hfill (a,& {\left[b\right]}_{1}\oplus & \underset{i=1}{\overset{n}{\u2a01}}(S({\left[{K}_{i}\right]}_{1}\oplus {\left[EP\left(a\right)\right]}_{1})\oplus S({\left[{K}_{i}^{\prime}\right]}_{1}\oplus {\left[EP\left(a\right)\right]}_{1})),\cdots ,\hfill \\ & {\left[b\right]}_{8}\oplus & \underset{i=1}{\overset{n}{\u2a01}}(S({\left[{K}_{i}\right]}_{8}\oplus {\left[EP\left(a\right)\right]}_{8})\oplus S({\left[{K}_{i}^{\prime}\right]}_{8}\oplus {\left[EP\left(a\right)\right]}_{8})))\hfill \end{array}$$and, analogously,${F}_{{K}_{1},{K}_{1}^{\prime}}^{L}\circ \cdots \circ {F}_{{K}_{n},{K}_{n}^{\prime}}^{L}(a,b)=$$$\begin{array}{ccc}\hfill ({\left[a\right]}_{1}& \oplus & \underset{i=1}{\overset{n}{\u2a01}}(S({\left[{K}_{i}\right]}_{1}\oplus {\left[EP\left(b\right)\right]}_{1})\oplus S({\left[{K}_{i}^{\prime}\right]}_{1}\oplus {\left[EP\left(b\right)\right]}_{1})),\cdots ,\hfill \\ \hfill {\left[a\right]}_{8}& \oplus & \underset{i=1}{\overset{n}{\u2a01}}(S({\left[{K}_{i}\right]}_{8}\oplus {\left[EP\left(b\right)\right]}_{8})\oplus S({\left[{K}_{i}^{\prime}\right]}_{8}\oplus {\left[EP\left(b\right)\right]}_{8})),\phantom{\rule{1.em}{0ex}}\phantom{\rule{1.em}{0ex}}b).\hfill \end{array}$$

**Proof.**

**Lemma**

**2.**

- (a)
- $\forall \phantom{\rule{4pt}{0ex}}y\in {\{0,1\}}^{6}\backslash \{(0,0,0,0,0,0),(0,0,0,0,0,1)\}:U\left(y\right)={\{0,1\}}^{4}$.
- (b)
- $U(0,0,0,0,0,1)=\{0,2,4,6,8,10,12,14\}$.
- (c)
- $\forall \phantom{\rule{4pt}{0ex}}y\in \{2,6,17,18,21,22,41,45,49,53,58,62\}:{U}_{{d}^{\prime}}\left(y\right)={\{0,1\}}^{4}$.
- (d)
- $\forall \phantom{\rule{4pt}{0ex}}y\in {\{0,1\}}^{6}\backslash \left\{(0,0,0,1,0,0)\right\}:{U}_{{d}^{\prime}}\left(y\right)\ne \left\{0\right\}$.

**Proof.**

**Remark**

**1.**

- For $i=1,\cdots ,8$ let ${u}_{i}\in U\left({\left[EP\left(a\right)\right]}_{i}\right)$ be a bitstring. Then, there exist $({K}_{1},{K}_{1}^{\prime}),\cdots ,({K}_{n},{K}_{n}^{\prime})\in \mathbb{M}$ such that ${F}_{{K}_{1},{K}_{1}^{\prime}}^{R}\circ \cdots \circ {F}_{{K}_{n},{K}_{n}^{\prime}}^{R}(a,b)=(a,{\left[b\right]}_{1}\oplus {u}_{1},\cdots ,{\left[b\right]}_{8}\oplus {u}_{8})$ for all $(a,b)\in {\{0,1\}}^{32}\times {\{0,1\}}^{32}$.
- For $i=1,\cdots ,8$ let ${u}_{i}\in U\left({\left[EP\left(b\right)\right]}_{i}\right)$ be a bitstring. Then, there exist $({K}_{1},{K}_{1}^{\prime}),\cdots ,({K}_{n},{K}_{n}^{\prime})\in \mathbb{M}$ such that ${F}_{{K}_{1},{K}_{1}^{\prime}}^{L}\circ \cdots \circ {F}_{{K}_{n},{K}_{n}^{\prime}}^{L}(a,b)=({\left[a\right]}_{1}\oplus {u}_{1},\cdots ,{\left[a\right]}_{8}\oplus {u}_{8},b)$ for all $(a,b)\in {\{0,1\}}^{32}\times {\{0,1\}}^{32}$.
- For $i\in \{1,\cdots ,8\}\backslash \left\{4\right\}$ let ${u}_{i}\in U\left({\left[EP\left(a\right)\right]}_{i}\right)$ be a bitstring and let ${u}_{4}\in {U}_{{d}^{\prime}}\left({\left[EP\left(a\right)\right]}_{4}\right)$. Then, there exist $({K}_{1},{K}_{1}^{\prime}),\cdots ,({K}_{n},{K}_{n}^{\prime})\in {\mathbb{M}}_{{d}^{\prime}}$ such that ${F}_{{K}_{1},{K}_{1}^{\prime}}^{R}\circ \cdots \circ {F}_{{K}_{n},{K}_{n}^{\prime}}^{R}(a,b)=(a,{b}_{1}\oplus {u}_{1},\cdots ,{b}_{8}\oplus {u}_{8})$ for all $(a,b)\in {\{0,1\}}^{32}\times {\{0,1\}}^{32}$.
- For $i\in \{1,\cdots ,8\}\backslash \left\{4\right\}$ let ${u}_{i}\in U\left({\left[EP\left(b\right)\right]}_{i}\right)$ be a bitstring and let ${u}_{4}\in {U}_{{d}^{\prime}}\left({\left[EP\left(b\right)\right]}_{4}\right)$. Then there exist $({K}_{1},{K}_{1}^{\prime}),\cdots ,({K}_{n},{K}_{n}^{\prime})\in {\mathbb{M}}_{{d}^{\prime}}$ such that ${F}_{{K}_{1},{K}_{1}^{\prime}}^{L}\circ \cdots \circ {F}_{{K}_{n},{K}_{n}^{\prime}}^{L}(a,b)=({a}_{1}\oplus {u}_{1},\cdots ,{a}_{8}\oplus {u}_{8},b)$ for all $(a,b)\in {\{0,1\}}^{32}\times {\{0,1\}}^{32}$.

**Lemma**

**3.**

**Proof.**

**Lemma**

**4.**

**Proof.**

- If $\exists \phantom{\rule{4pt}{0ex}}i\in \{33,\cdots ,64\}:{a}_{i}=1$:Then $\exists \phantom{\rule{4pt}{0ex}}l\phantom{\rule{4pt}{0ex}}\in \{1,\cdots ,8\}$ such that ${\left[EP{\left(a\right)}_{i=33}^{64}\right]}_{l}\ne 0$:
- –
- If ${\left[EP{\left(a\right)}_{i=33}^{64}\right]}_{l}\ne 1$, then $U{\left(\left[EP{\left(a\right)}_{i=33}^{64}\right)\right]}_{l}{)=\{0,1\}}^{4}$. Therefore, because of Remark 1, we can show ${a}^{\prime}={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left(a\right)$ such that ${\left({\left[{a}^{\prime}\right]}_{L}\right)}_{j}=1$ for $j\in \{4l-3,\cdots ,4l\}$. Thus, $\exists \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{2,5,10,18,26,31\}:{a}_{i}^{\prime}\phantom{\rule{3.33333pt}{0ex}}=\phantom{\rule{3.33333pt}{0ex}}1$.
- –
- If ${\left[EP{\left(a\right)}_{i=33}^{64}\right]}_{l}=1$, then $U\left({\left[EP{\left(a\right)}_{i=33}^{64}\right]}_{l}\right)=\{0,2,4,6,8,10,12,14\}$. With an argument similar to the previous one, we can get an element ${a}^{\prime}={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left(a\right)$, such that ${\left({a}_{L}^{\prime}\right)}_{i}=1$ for $i\in \{4l-3,\cdots ,4l-1\}$. Therefore, $\exists \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{2,5,10,18,26,31\}:{a}_{i}^{\prime}\phantom{\rule{3.33333pt}{0ex}}=\phantom{\rule{3.33333pt}{0ex}}1$.

- If $\forall \phantom{\rule{4pt}{0ex}}i\in \{33,\cdots ,64\}:{a}_{i}=0$.Since $a\ne 0$, then $\exists \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}:{a}_{i}=1$. Therefore, $\exists \phantom{\rule{4pt}{0ex}}l\in \{1,\cdots ,8\}$ such that ${\left[EP{\left(a\right)}_{i=1}^{32}\right]}_{l}\ne 0$ and, like before (but using “right-functions”) we prove that we can get an element ${a}^{\prime}={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{R}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{R}\left(a\right)$, where $({K}^{i},{K}^{{i}^{\prime}})\in {\mathbb{M}}_{{d}^{\prime}}$, such that $\exists \phantom{\rule{4pt}{0ex}}i\in \{33,\cdots ,64\}:{a}_{i}^{\prime}=1$. Notice that in this case the pairs $({K}^{i},{K}^{{i}^{\prime}})$ must be not only in $\mathbb{M}$, but in ${\mathbb{M}}_{{d}^{\prime}}$, so that $a\sim {a}^{\prime}$ (Proposition 1(b)).
- –
- If $l\ne 4$
- ∗
- If ${\left(EP{\left(a\right)}_{i=1}^{32}\right)}_{l}\ne 1$, then $U{\left(\left[EP{\left(a\right)}_{i=1}^{32}\right)\right]}_{l}{)=\{0,1\}}^{4}$.Therefore, because of Remark 1, we can have ${a}^{\prime}={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{R}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{R}\left(a\right)$, where $({K}^{i},{K}^{{i}^{\prime}})\in {\mathbb{M}}_{{d}^{\prime}}$, with ${a}_{i}^{\prime}=1$ for some $i\in \{33,\cdots ,64\}$.
- ∗
- If ${\left[EP{\left(a\right)}_{i=1}^{32}\right]}_{l}=1$, then $U{\left(\left[EP{\left(a\right)}_{i=1}^{32}\right)\right]}_{l})=\{0,2,4,6,8,10,12,14\}$. With the same argument as before, we can get an element ${a}^{\prime}={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{R}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{R}\left(a\right)$, such that ${a}_{i}^{\prime}=1$ for $i=32+j$, where $j\in \{4l-3,\cdots ,4l-1\}$.

- –
- If $l=4$: Since $a\ne d$, according to Table 2, ${\left(EPa\right)}_{4}\ne (0,0,0,1,0,0)$. Therefore, we have ${U}_{{d}^{\prime}}\left({\left(EPa\right)}_{4}\right)\ne 0$ (Lemma 2(d)) and we can obtain, as in the previous cases, an element ${a}^{\prime}:={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{R}\left(a\right)\sim a$, with ${a}_{i}^{\prime}=1$ for some $i\in \{33,\cdots ,64\}$.

**Lemma**

**5.**

**Proof.**

- If ${\left[EP{\left({a}^{\prime}\right)}_{L}\right]}_{2}\ne 1$, then $U\left({\left[EP{\left({a}^{\prime}\right)}_{L}\right]}_{2}\right)={\{0,1\}}^{4}$. Hence, because of Remark 1, $\exists \phantom{\rule{4pt}{0ex}}({K}^{i},{K}^{{i}^{\prime}})\phantom{\rule{4pt}{0ex}}\in {\mathbb{M}}_{{d}^{\prime}}$ such that ${\left[{\left[{a}^{0}\right]}_{R}\right]}_{2}={[{F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ {F}_{{K}^{2},{K}^{{2}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left({a}^{\prime}\right)]}_{2}=(1,1,1,1)$. Therefore, ${\left({a}^{0}\right)}_{32+i}=1$ for all $i\in \{5,\cdots ,8\}$.
- If ${\left[EP{\left({a}^{\prime}\right)}_{L}\right]}_{2}=1$, then $U\left({\left[EP{\left({a}^{\prime}\right)}_{L}\right]}_{2}\right)=\{0,2,4,6,8,10,12,14\}$. With a similar argument, $\exists \phantom{\rule{4pt}{0ex}}({K}^{i},{K}^{{i}^{\prime}})\in \phantom{\rule{4pt}{0ex}}{\mathbb{M}}_{{d}^{\prime}}$ such that ${\left[{\left[{a}^{0}\right]}_{R}\right]}_{2}={[{F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ {F}_{{K}^{2},{K}^{{2}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left({a}^{\prime}\right)]}_{2}=(1,1,1,0)$. Therefore, ${\left({a}^{0}\right)}_{32+i}=1$ for all $i\in \{5,\cdots ,7\}$.

- If $j\in \{1,6,9,14,16,17,21,22,25,29,32\}$, the set $\left(\right\{1,\cdots ,32\}\backslash \{13,\cdots ,16\left\}\right)\backslash J\left(j\right)$ has only one element. Therefore, as ${\left({\left({a}^{1}\right)}_{L}\right)}_{i}={e}_{i}\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\in $ J(j),${\left[EP\left({a}_{L}^{1}\right)\right]}_{i}\notin \{0,1\}\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,8\}\backslash \left\{4\right\}$, so $U\left({\left[EP\left({a}_{L}^{1}\right)\right]}_{i}\right)={\{0,1\}}^{4}$. Therefore, choosing appropriate $({K}^{i},{K}^{{i}^{\prime}})\phantom{\rule{4pt}{0ex}}\in \phantom{\rule{4pt}{0ex}}{\mathbb{M}}_{{d}^{\prime}}$ we get ${a}^{2}:={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{R}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{R}\left({a}^{1}\right)$, such that ${\left({\left[{a}^{2}\right]}_{R}\right)}_{i}={e}_{i}\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{13,\cdots ,16\}$ (Remark 1).Therefore, we have ${\left[EP\left({a}_{R}^{2}\right)\right]}_{i}\notin \{0,1\}\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,8\}\backslash \left\{4\right\}$, so $U\left({\left[EP\left({a}_{L}^{2}\right)\right]}_{i}\right)={\{0,1\}}^{4}$. Now, choosing adequate $({K}^{i},{K}^{{i}^{\prime}})\phantom{\rule{4pt}{0ex}}\in \phantom{\rule{4pt}{0ex}}{\mathbb{M}}_{{d}^{\prime}}$, we can have ${a}^{3}:={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left({a}^{2}\right)$, such that ${\left({a}^{3}\right)}_{i}={e}_{i}\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{13,\cdots ,16\}$. Therefore, for ${a}^{\u2033}:={a}^{3}$ we have the desired result.Hence, we have seen that the lemma holds if ${a}_{j}^{\prime}=1$ for $j\in \{1,6,9,14,16,17,21,22,25,29,32\}$.
- For indices $j\in \{1,\cdots ,32\}\backslash \{2,5,10,18,26,31\}$, we have $J\left(j\right)\cap \{1,6,9,14,16,17,21,22,25,29,32\}\ne \varnothing $. Therefore, we are in the case where $\exists \phantom{\rule{4pt}{0ex}}j\in \{1,6,9,14,16,17,21,22,25,29,32\}$ such that ${\left({a}^{1}\right)}_{i}=1$, and carrying out the same procedure as the one to get ${a}^{3}$ from ${a}^{\prime}$, we get ${a}^{\u2033}$ satisfying ${\left({a}^{\u2033}\right)}_{i}={e}_{i}\phantom{\rule{4pt}{0ex}}\forall i\in \{1,\cdots ,32\}\backslash \{13,\cdots ,16\}$.

**Lemma**

**6.**

**Proof.**

**Corollary**

**1.**

**Proof.**

**Corollary**

**2.**

**Proof.**

**Corollary**

**3.**

**Proof.**

**Lemma**

**7.**

**Proof.**

**Theorem**

**1.**

**Proof.**

## 4. Applying MRHS to DESL and DES

#### 4.1. Symbol Creation for DESL

#### 4.2. Results

`0123456789ABCDEF`, and the key was the first 56 bits of the SHA-1 hash of “Katalina” (without quotes).

## 5. Conclusions

## Author Contributions

## Funding

## Conflicts of Interest

## References

- Daley, W.M.; Kammer, R.G. Data Encryption Standard (DES). In Federal Information Processing Standards Publication; National Institute of Standards and Technology: Gaithersburg, MD, USA, 1999. [Google Scholar]
- Leander, G.; Paar, C.; Poschmann, A.; Schramm, K. New Lightweight DES Variants. In Fast Software Encryption, 14th International Workshop, FSE 2007; Lecture Notes in Computer Science; Biryukov, A., Ed.; International Association for Cryptologic Research, Springer: New York, NY, USA, 2007; Volume 4593, pp. 196–210. [Google Scholar]
- Priyanka, A.A.; Saibal, K.P. A Survey of Cryptanalytic Attacks on Lightweight Block Ciphers. Int. J. Comput. Sci. Inf. Technol. Secur.
**2012**, 2, 472–481. [Google Scholar] - Sun, S.; Hu, L.; Qiao, K.; Ma, X.; Shan, J.; Song, L. Improvement on the Method for Automatic Differential Analysis and Its Application to Two Lightweight Block Ciphers DESL and LBlock-s. In Proceedings of the 2015 10th International Workshop on Security Advances in Information and Computer Security, IWSEC, Nara, Japan, 26–28 August 2015; pp. 97–111. [Google Scholar]
- Hatzivasilis, G.; Fysarakis, K.; Papaefstathiou, I.; Manifavas, C. A review of lightweight block ciphers. J. Cryptogr. Eng.
**2018**, 8, 141–184. [Google Scholar] [CrossRef] - Ji, F.; Zhang, W.; Ding, T. Improving Matsui’s Search Algorithm for the Best Differential/Linear Trails and its Applications for DES, DESL and GIFT. Cryptology ePrint Archive, Report 2019/1190. 2019. Available online: http://eprint.iacr.org/2019/1190 (accessed on 14 November 2019).
- Wernsdorf, R. The One-Round Functions of the DES Generate the Alternating Group. In Advances in Cryptology—EUROCRYPT ’92; Lecture Notes in Computer Science; Rueppel, R.A., Ed.; Springer: New York, NY, USA, 1993; Volume 658, pp. 99–112. [Google Scholar]
- Raddum, H.; Semaev, I. Solving Multiple Right Hand Sides linear equations. Des. Codes Cryptogr.
**2008**, 49, 147–160. [Google Scholar] [CrossRef] - Geiselmann, W.; Matheis, K.; Steinwandt, R. PET SNAKE: A Special Purpose Architecture to Implement an Algebraic Attack in Hardware. In Transactions on Computational Science X; Lecture Notes in Computer Science; Springer: New York, NY, USA, 2010; Volume 6340, pp. 298–328. [Google Scholar]
- Håvard, R.; Zajac, P. MRHS solver based on linear algebra and exhaustive search. J. Math. Cryptol.
**2018**, 12, 143–157. [Google Scholar] - Zajac, P. Upper bounds on the complexity of algebraic cryptanalysis of ciphers with a low multiplicative complexity. Des. Codes Cryptogr.
**2017**, 82, 43–56. [Google Scholar] [CrossRef] - Schoonen, A.C.C. Multiple Right-Hand Side Equations. Master’s Thesis, Department of Mathematics and Computer Science, Eindhoven University of Technology, Eindhoven, The Netherlands, 2008. Available online: http://alexandria.tue.nl/extra1/afstversl/wsk-i/schoonen2008.pdf (accessed on 14 November 2019).
- Davio, M.; Desmedt, Y.; Fosséprez, M.; Govaerts, R.; Hulsbosch, J.; Neutjens, P.; Piret, P.; Quisquater, J.J.; Vandewalle, J.; Wouters, P. Analytical Characteristics of the DES. In Advanves in Cryptology—CRYPTO ’83; Chaum, D., Ed.; Plenum Press: New York, NY, USA, 1984; pp. 171–202. [Google Scholar]
- Raddum, H. MRHS Equation Systems. In Selected Areas in Cryptography—SAC 2007; Lecture Notes in Computer Science; Carlisle Adams, A.M., Wiener, M., Eds.; Springer: New York, NY, USA, 2007; Volume 4876, pp. 232–245. [Google Scholar]
- Even, S.; Goldreich, O. DES-Like Functions Can Generate the Alternating Group. IEEE Trans. Inf. Theory
**1983**, 29, 863–865. [Google Scholar] [CrossRef] - Foundation, P.S. Python Programming Language—Offical Website. 2010. Available online: http://www.python.org (accessed on 14 November 2019).
- Wielandt, H. Finite Permutation Groups; Academic Press: Cambridge, MA, USA, 1964. [Google Scholar]

**Figure 2.**Equivalent description of DESL with the permutation P being applied before the expansion function E.

**Table 1.**The substitution function $S:{\{0,1\}}^{6}\u27f6{\{0,1\}}^{4}$ of DESL is given by this S-box from [2]; $({a}_{1},\cdots ,{a}_{6})\in {\{0,1\}}^{6}$ is mapped to the 4-bit binary representation of the table entry in row no. ${a}_{1}{a}_{6}$ and column no. ${a}_{2}{a}_{3}{a}_{4}{a}_{5}$ (both interpreted as binary representation of a number in $\{0,\cdots ,3\}$ resp. $\{0,\cdots ,15\}$).

14 | 5 | 7 | 2 | 11 | 8 | 1 | 15 | 0 | 10 | 9 | 4 | 6 | 13 | 12 | 3 |

5 | 0 | 8 | 15 | 14 | 3 | 2 | 12 | 11 | 7 | 6 | 9 | 13 | 4 | 1 | 10 |

4 | 9 | 2 | 14 | 8 | 7 | 13 | 0 | 10 | 12 | 15 | 1 | 5 | 11 | 3 | 6 |

9 | 6 | 15 | 5 | 3 | 8 | 4 | 11 | 7 | 1 | 12 | 2 | 0 | 14 | 10 | 13 |

**Table 2.**The function $EP:{\{0,1\}}^{32}\u27f6{\{0,1\}}^{48}$, mapping $({a}_{1},\cdots ,{a}_{32})$ to ${a}_{EP\left(1\right)},\cdots ,{a}_{EP\left(32\right)}$ where $EP\left(j\right)$ is the j-th entry in the table, reading from left to right, top to bottom (e.g., $EP\left(7\right)=21$).

25 | 16 | 7 | 20 | 21 | 29 |

21 | 29 | 12 | 28 | 17 | 1 |

17 | 1 | 15 | 23 | 26 | 5 |

26 | 5 | 18 | 31 | 10 | 2 |

10 | 2 | 8 | 24 | 14 | 32 |

14 | 32 | 27 | 3 | 9 | 19 |

9 | 19 | 13 | 30 | 6 | 22 |

6 | 22 | 11 | 4 | 25 | 16 |

Rounds of DESL | |||||||
---|---|---|---|---|---|---|---|

Threshold | 4 | 6 | 8 | 10 | 12 | 14 | 16 |

20 | 0 | 34 | 36 | 36 | 40 | 38 | 40 |

21 | 0 | 34 | 39 | 37 | 39 | 39 | 42 |

22 | 0 | 33 | 39 | 37 | 38 | 43 | 38 |

23 | 0 | 33 | 38 | 45 | 46 | 48 | 46 |

Rounds of DES | |||||||
---|---|---|---|---|---|---|---|

Threshold | 4 | 6 | 8 | 10 | 12 | 14 | 16 |

20 | 1 (+1) | 35 (+1) | 36 (+0) | 36 (+0) | 41 (+1) | 41 (+3) | 40 (+0) |

21 | 0 (+0) | 35 (+1) | 39 (+0) | 37 (+0) | 39 (+0) | 40 (+1) | 39 (−3) |

22 | 0 (+0) | 32 (−1) | 39 (+0) | 37 (+0) | 38 (+0) | 40 (−3) | 38 (+0) |

23 | 0 (+0) | 33 (+0) | 39 (+1) | 43 (−2) | 46 (+0) | 48 (+0) | 46 (+0) |

© 2019 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).

## Share and Cite

**MDPI and ACS Style**

Matheis, K.; Steinwandt, R.; Suárez Corona, A. Algebraic Properties of the Block Cipher DESL. *Symmetry* **2019**, *11*, 1411.
https://doi.org/10.3390/sym11111411

**AMA Style**

Matheis K, Steinwandt R, Suárez Corona A. Algebraic Properties of the Block Cipher DESL. *Symmetry*. 2019; 11(11):1411.
https://doi.org/10.3390/sym11111411

**Chicago/Turabian Style**

Matheis, Kenneth, Rainer Steinwandt, and Adriana Suárez Corona. 2019. "Algebraic Properties of the Block Cipher DESL" *Symmetry* 11, no. 11: 1411.
https://doi.org/10.3390/sym11111411