PRESENT

An ultra-lightweight block cipher.

This file implements the PRESENT block cipher and the corresponding key schedule as described in [BKLPPRSV2007]. PRESENT is an example of an SP-network and consists of 31 rounds. The block length is 64 bits and two key lengths of 80 and 128 bits are supported.

This implementation is meant for experimental and educational usage only, do not use it in production code!

EXAMPLES:

Encrypt a message:

sage: from sage.crypto.block_cipher.present import PRESENT
sage: present = PRESENT()
sage: present.encrypt(plaintext=0, key=0).hex()
'2844b365c06992a3'

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT
>>> present = PRESENT()
>>> present.encrypt(plaintext=Integer(0), key=Integer(0)).hex()
'2844b365c06992a3'

from sage.crypto.block_cipher.present import PRESENT
present = PRESENT()
present.encrypt(plaintext=0, key=0).hex()

And decrypt it again:

sage: present.decrypt(ciphertext=0x2844b365c06992a3, key=0)
0

>>> from sage.all import *
>>> present.decrypt(ciphertext=Integer(0x2844b365c06992a3), key=Integer(0))
0

present.decrypt(ciphertext=0x2844b365c06992a3, key=0)

Have a look at the used round keys:

sage: from sage.crypto.block_cipher.present import PRESENT_KS
sage: ks = PRESENT_KS()
sage: [k.hex() for k in ks(0)]
['0',
 'c000000000000000',
  ...
 '6dab31744f41d700']

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT_KS
>>> ks = PRESENT_KS()
>>> [k.hex() for k in ks(Integer(0))]
['0',
 'c000000000000000',
  ...
 '6dab31744f41d700']

from sage.crypto.block_cipher.present import PRESENT_KS
ks = PRESENT_KS()
[k.hex() for k in ks(0)]

Tweak around with the cipher:

sage: from sage.crypto.sbox import SBox
sage: cipher = PRESENT(rounds=1, doFinalRound=False)
sage: cipher.sbox = SBox(range(16))
sage: cipher.keySchedule = lambda x: [0, 0]  # return the 0 keys as round keys
sage: cipher.encrypt(plaintext=0x1234, key=0x0).hex()
'1234'

>>> from sage.all import *
>>> from sage.crypto.sbox import SBox
>>> cipher = PRESENT(rounds=Integer(1), doFinalRound=False)
>>> cipher.sbox = SBox(range(Integer(16)))
>>> cipher.keySchedule = lambda x: [Integer(0), Integer(0)]  # return the 0 keys as round keys
>>> cipher.encrypt(plaintext=Integer(0x1234), key=Integer(0x0)).hex()
'1234'

from sage.crypto.sbox import SBox
cipher = PRESENT(rounds=1, doFinalRound=False)
cipher.sbox = SBox(range(16))
cipher.keySchedule = lambda x: [0, 0]  # return the 0 keys as round keys
cipher.encrypt(plaintext=0x1234, key=0x0).hex()

AUTHORS:

  • Lukas Stennes (2019-02-01): initial version

class sage.crypto.block_cipher.present.PRESENT(keySchedule=80, rounds=None, doFinalRound=False)[source]

Bases: SageObject

This class implements PRESENT described in [BKLPPRSV2007].

EXAMPLES:

You can invoke PRESENT encryption/decryption either by calling PRESENT with an appropriate flag:

sage: from sage.crypto.block_cipher.present import PRESENT
sage: present = PRESENT()
sage: P = 0xFFFFFFFFFFFFFFFF
sage: K = 0x0
sage: present(present(P, K, 'encrypt'), K, 'decrypt') == P
True

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT
>>> present = PRESENT()
>>> P = Integer(0xFFFFFFFFFFFFFFFF)
>>> K = Integer(0x0)
>>> present(present(P, K, 'encrypt'), K, 'decrypt') == P
True

from sage.crypto.block_cipher.present import PRESENT
present = PRESENT()
P = 0xFFFFFFFFFFFFFFFF
K = 0x0
present(present(P, K, 'encrypt'), K, 'decrypt') == P

Or by calling encryption/decryption methods directly:

sage: C = present.encrypt(P, K)
sage: P == present.decrypt(C, K)
True

>>> from sage.all import *
>>> C = present.encrypt(P, K)
>>> P == present.decrypt(C, K)
True

C = present.encrypt(P, K)
P == present.decrypt(C, K)

The number of rounds can be reduced easily:

sage: present = PRESENT(rounds=15)
sage: present(present(P, K, 'encrypt'), K, 'decrypt') == P
True

>>> from sage.all import *
>>> present = PRESENT(rounds=Integer(15))
>>> present(present(P, K, 'encrypt'), K, 'decrypt') == P
True

present = PRESENT(rounds=15)
present(present(P, K, 'encrypt'), K, 'decrypt') == P

You can use integers or a list-like bit representation for the inputs. If the input is an integer the output will be too. If it is list-like the output will be a bit vector:

sage: P = ZZ(0).digits(2,padto=64)
sage: K = ZZ(0).digits(2,padto=80)
sage: list(present(present(P, K, 'encrypt'), K, 'decrypt')) == P
True
sage: P = ZZ(0).digits(2,padto=64)
sage: K = 0x0
sage: list(present(present(P, K, 'encrypt'), K, 'decrypt')) == P
True

>>> from sage.all import *
>>> P = ZZ(Integer(0)).digits(Integer(2),padto=Integer(64))
>>> K = ZZ(Integer(0)).digits(Integer(2),padto=Integer(80))
>>> list(present(present(P, K, 'encrypt'), K, 'decrypt')) == P
True
>>> P = ZZ(Integer(0)).digits(Integer(2),padto=Integer(64))
>>> K = Integer(0x0)
>>> list(present(present(P, K, 'encrypt'), K, 'decrypt')) == P
True

P = ZZ(0).digits(2,padto=64)
K = ZZ(0).digits(2,padto=80)
list(present(present(P, K, 'encrypt'), K, 'decrypt')) == P
P = ZZ(0).digits(2,padto=64)
K = 0x0
list(present(present(P, K, 'encrypt'), K, 'decrypt')) == P

The 80-bit version of PRESENT is used by default but the 128-bit version is also implemented:

sage: present = PRESENT(128)
sage: P = 0x0123456789abcdef
sage: K = 0x00112233445566778899aabbccddeeff
sage: present(present(P, K, 'encrypt'), K, 'decrypt') == P
True

>>> from sage.all import *
>>> present = PRESENT(Integer(128))
>>> P = Integer(0x0123456789abcdef)
>>> K = Integer(0x00112233445566778899aabbccddeeff)
>>> present(present(P, K, 'encrypt'), K, 'decrypt') == P
True

present = PRESENT(128)
P = 0x0123456789abcdef
K = 0x00112233445566778899aabbccddeeff
present(present(P, K, 'encrypt'), K, 'decrypt') == P

See also

PRESENT_KS sage.crypto.sboxes

__init__(keySchedule=80, rounds=None, doFinalRound=False)[source]

Construct an instance of PRESENT.

INPUT:

  • keySchedule – (default: 80) the key schedule that will be used for encryption and decryption. Use 80 or 128 as a shortcut for the original key schedules from [BKLPPRSV2007].

  • rounds – integer (default: None); the number of rounds. If None the number of rounds of the key schedule is used.

  • doFinalRound – boolean (default: False); flag to control whether the linear layer in the last round should take place or not. Since the last linear layer does not add any security, it usually does not take place in real world implementations for performance reasons.

EXAMPLES:

By default a 80-bit version with 31 rounds is created:

sage: from sage.crypto.block_cipher.present import PRESENT
sage: PRESENT() # indirect doctest
PRESENT block cipher with 31 rounds, deactivated linear layer in
last round and the following key schedule:
Original PRESENT key schedule with 80-bit keys and 31 rounds

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT
>>> PRESENT() # indirect doctest
PRESENT block cipher with 31 rounds, deactivated linear layer in
last round and the following key schedule:
Original PRESENT key schedule with 80-bit keys and 31 rounds

from sage.crypto.block_cipher.present import PRESENT
PRESENT() # indirect doctest

The 128-bit version is also implemented:

sage: PRESENT(128) # indirect doctest
PRESENT block cipher with 31 rounds, deactivated linear layer in
last round and the following key schedule:
Original PRESENT key schedule with 128-bit keys and 31 rounds

>>> from sage.all import *
>>> PRESENT(Integer(128)) # indirect doctest
PRESENT block cipher with 31 rounds, deactivated linear layer in
last round and the following key schedule:
Original PRESENT key schedule with 128-bit keys and 31 rounds

PRESENT(128) # indirect doctest

Reducing the number of rounds is simple. But increasing it is not possible:

sage: PRESENT(keySchedule=80, rounds=23) # indirect doctest
PRESENT block cipher with 23 rounds, deactivated linear layer in
last round and the following key schedule:
Original PRESENT key schedule with 80-bit keys and 31 rounds
sage: PRESENT(80, 32) # indirect doctest
Traceback (most recent call last):
...
ValueError: number of rounds must be less or equal to the number
of rounds of the key schedule

>>> from sage.all import *
>>> PRESENT(keySchedule=Integer(80), rounds=Integer(23)) # indirect doctest
PRESENT block cipher with 23 rounds, deactivated linear layer in
last round and the following key schedule:
Original PRESENT key schedule with 80-bit keys and 31 rounds
>>> PRESENT(Integer(80), Integer(32)) # indirect doctest
Traceback (most recent call last):
...
ValueError: number of rounds must be less or equal to the number
of rounds of the key schedule

PRESENT(keySchedule=80, rounds=23) # indirect doctest
PRESENT(80, 32) # indirect doctest

By default the linear layer operation in the last round is omitted but of course you can enable it:

sage: PRESENT(doFinalRound=True) # indirect doctest
PRESENT block cipher with 31 rounds, activated linear layer in
last round and the following key schedule:
Original PRESENT key schedule with 80-bit keys and 31 rounds

>>> from sage.all import *
>>> PRESENT(doFinalRound=True) # indirect doctest
PRESENT block cipher with 31 rounds, activated linear layer in
last round and the following key schedule:
Original PRESENT key schedule with 80-bit keys and 31 rounds

PRESENT(doFinalRound=True) # indirect doctest

You can use arbitrary key schedules. Since it is the only one implemented here the original key schedule is used for demonstration:

sage: from sage.crypto.block_cipher.present import PRESENT_KS
sage: PRESENT(keySchedule=PRESENT_KS(80, 15)) # indirect doctest
PRESENT block cipher with 15 rounds, deactivated linear layer in
last round and the following key schedule:
Original PRESENT key schedule with 80-bit keys and 15 rounds

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT_KS
>>> PRESENT(keySchedule=PRESENT_KS(Integer(80), Integer(15))) # indirect doctest
PRESENT block cipher with 15 rounds, deactivated linear layer in
last round and the following key schedule:
Original PRESENT key schedule with 80-bit keys and 15 rounds

from sage.crypto.block_cipher.present import PRESENT_KS
PRESENT(keySchedule=PRESENT_KS(80, 15)) # indirect doctest

See also

PRESENT_KS

__call__(block, key, algorithm='encrypt')[source]

Apply PRESENT encryption or decryption on block using key. The flag algorithm controls what action is to be performed on block.

INPUT:

  • block – integer or bit list-like; the plaintext or ciphertext

  • K – integer or bit list-like; the key

  • algorithm – string (default: 'encrypt'); a flag to signify whether encryption or decryption is to be applied to B. The encryption flag is 'encrypt' and the decryption flag is 'decrypt'

OUTPUT:

  • The plaintext or ciphertext corresponding to block, obtained using the key. If block is an integer the output will be too. If block is list-like the output will be a bit vector.

EXAMPLES:

sage: from sage.crypto.block_cipher.present import PRESENT
sage: present = PRESENT(doFinalRound=True)
sage: P = 0xFFFFFFFFFFFFFFFF
sage: K = 0x0
sage: present(P, K, 'encrypt').hex()
'a112ffc72f68417b'

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT
>>> present = PRESENT(doFinalRound=True)
>>> P = Integer(0xFFFFFFFFFFFFFFFF)
>>> K = Integer(0x0)
>>> present(P, K, 'encrypt').hex()
'a112ffc72f68417b'

from sage.crypto.block_cipher.present import PRESENT
present = PRESENT(doFinalRound=True)
P = 0xFFFFFFFFFFFFFFFF
K = 0x0
present(P, K, 'encrypt').hex()
decrypt(ciphertext, key)[source]

Return the plaintext corresponding to the ciphertext, using PRESENT decryption with key.

INPUT:

  • ciphertext – integer or bit list-like; the ciphertext that will be decrypted

  • key – integer or bit list-like; the key

OUTPUT:

  • The plaintext corresponding to ciphertext, obtained using the key. If ciphertext is an integer the output will be too. If ciphertext is list-like the output will be a bit vector.

EXAMPLES:

The test vectors from [BKLPPRSV2007] are checked here:

sage: from sage.crypto.block_cipher.present import PRESENT
sage: present = PRESENT(doFinalRound=True)
sage: p1 = 0x0
sage: k1 = 0x0
sage: c1 = 0x5579C1387B228445
sage: present.decrypt(c1, k1) == p1
True
sage: p2 = 0x0
sage: k2 = 0xFFFFFFFFFFFFFFFFFFFF
sage: c2 = 0xE72C46C0F5945049
sage: present.decrypt(c2, k2) == p2
True
sage: p3 = 0xFFFFFFFFFFFFFFFF
sage: k3 = 0x0
sage: c3 = 0xA112FFC72F68417B
sage: present.decrypt(c3, k3) == p3
True
sage: p4 = 0xFFFFFFFFFFFFFFFF
sage: k4 = 0xFFFFFFFFFFFFFFFFFFFF
sage: c4 = 0x3333DCD3213210D2
sage: present.decrypt(c4, k4) == p4
True

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT
>>> present = PRESENT(doFinalRound=True)
>>> p1 = Integer(0x0)
>>> k1 = Integer(0x0)
>>> c1 = Integer(0x5579C1387B228445)
>>> present.decrypt(c1, k1) == p1
True
>>> p2 = Integer(0x0)
>>> k2 = Integer(0xFFFFFFFFFFFFFFFFFFFF)
>>> c2 = Integer(0xE72C46C0F5945049)
>>> present.decrypt(c2, k2) == p2
True
>>> p3 = Integer(0xFFFFFFFFFFFFFFFF)
>>> k3 = Integer(0x0)
>>> c3 = Integer(0xA112FFC72F68417B)
>>> present.decrypt(c3, k3) == p3
True
>>> p4 = Integer(0xFFFFFFFFFFFFFFFF)
>>> k4 = Integer(0xFFFFFFFFFFFFFFFFFFFF)
>>> c4 = Integer(0x3333DCD3213210D2)
>>> present.decrypt(c4, k4) == p4
True

from sage.crypto.block_cipher.present import PRESENT
present = PRESENT(doFinalRound=True)
p1 = 0x0
k1 = 0x0
c1 = 0x5579C1387B228445
present.decrypt(c1, k1) == p1
p2 = 0x0
k2 = 0xFFFFFFFFFFFFFFFFFFFF
c2 = 0xE72C46C0F5945049
present.decrypt(c2, k2) == p2
p3 = 0xFFFFFFFFFFFFFFFF
k3 = 0x0
c3 = 0xA112FFC72F68417B
present.decrypt(c3, k3) == p3
p4 = 0xFFFFFFFFFFFFFFFF
k4 = 0xFFFFFFFFFFFFFFFFFFFF
c4 = 0x3333DCD3213210D2
present.decrypt(c4, k4) == p4
encrypt(plaintext, key)[source]

Return the ciphertext corresponding to plaintext, using PRESENT encryption with key.

INPUT:

  • plaintext – integer or bit list-like; the plaintext that will be encrypted

  • key – integer or bit list-like; the key

OUTPUT:

  • The ciphertext corresponding to plaintext, obtained using the key. If plaintext is an integer the output will be too. If plaintext is list-like the output will be a bit vector.

EXAMPLES:

The test vectors from [BKLPPRSV2007] are checked here:

sage: from sage.crypto.block_cipher.present import PRESENT
sage: present = PRESENT(doFinalRound=True)
sage: p1 = 0x0
sage: k1 = 0x0
sage: c1 = 0x5579C1387B228445
sage: present.encrypt(p1, k1) == c1
True
sage: p2 = 0x0
sage: k2 = 0xFFFFFFFFFFFFFFFFFFFF
sage: c2 = 0xE72C46C0F5945049
sage: present.encrypt(p2, k2) == c2
True
sage: p3 = 0xFFFFFFFFFFFFFFFF
sage: k3 = 0x0
sage: c3 = 0xA112FFC72F68417B
sage: present.encrypt(p3, k3) == c3
True
sage: p4 = 0xFFFFFFFFFFFFFFFF
sage: k4 = 0xFFFFFFFFFFFFFFFFFFFF
sage: c4 = 0x3333DCD3213210D2
sage: present.encrypt(p4, k4) == c4
True

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT
>>> present = PRESENT(doFinalRound=True)
>>> p1 = Integer(0x0)
>>> k1 = Integer(0x0)
>>> c1 = Integer(0x5579C1387B228445)
>>> present.encrypt(p1, k1) == c1
True
>>> p2 = Integer(0x0)
>>> k2 = Integer(0xFFFFFFFFFFFFFFFFFFFF)
>>> c2 = Integer(0xE72C46C0F5945049)
>>> present.encrypt(p2, k2) == c2
True
>>> p3 = Integer(0xFFFFFFFFFFFFFFFF)
>>> k3 = Integer(0x0)
>>> c3 = Integer(0xA112FFC72F68417B)
>>> present.encrypt(p3, k3) == c3
True
>>> p4 = Integer(0xFFFFFFFFFFFFFFFF)
>>> k4 = Integer(0xFFFFFFFFFFFFFFFFFFFF)
>>> c4 = Integer(0x3333DCD3213210D2)
>>> present.encrypt(p4, k4) == c4
True

from sage.crypto.block_cipher.present import PRESENT
present = PRESENT(doFinalRound=True)
p1 = 0x0
k1 = 0x0
c1 = 0x5579C1387B228445
present.encrypt(p1, k1) == c1
p2 = 0x0
k2 = 0xFFFFFFFFFFFFFFFFFFFF
c2 = 0xE72C46C0F5945049
present.encrypt(p2, k2) == c2
p3 = 0xFFFFFFFFFFFFFFFF
k3 = 0x0
c3 = 0xA112FFC72F68417B
present.encrypt(p3, k3) == c3
p4 = 0xFFFFFFFFFFFFFFFF
k4 = 0xFFFFFFFFFFFFFFFFFFFF
c4 = 0x3333DCD3213210D2
present.encrypt(p4, k4) == c4

ALGORITHM:

Description of the encryption function based on [BKLPPRSV2007]:

A top-level algorithmic description of PRESENT encryption:

generateRoundKeys()
for i = 1 to 31 do
    addRoundkey(STATE, K_i)
    sBoxLayer(STATE)
    pLayer(STATE)
end for
addRoundkey(STATE, K_{32})

Each of the 31 rounds consists of an XOR operation to introduce a round key \(K_i\) for \(1 \leq i \leq 32\), where \(K_{32}\) is used for post-whitening, a linear bitwise permutation and a non-linear substitution layer. The non-linear layer uses a single 4-bit S-box which is applied 16 times in parallel in each round. Each stage but addRoundkey is specified in its corresponding function.

addRoundkey: Given round key \(K_i = \kappa^i_{63} \dots \kappa^i_0\) for \(1 \leq i \leq 32\) and current STATE \(b_{63} \dots b_0\), addRoundkey consists of the operation for \(0 \leq j \leq 63\), \(b_j = b_j \oplus \kappa^i_j\).

linear_layer(state, inverse=False)[source]

Apply the pLayer of PRESENT to the bit vector state and return the result.

The bit permutation used in PRESENT is given by the following table. Bit \(i\) of STATE is moved to bit position \(P(i)\).

i

0

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

P(i)

0

16

32

48

1

17

33

49

2

18

34

50

3

19

35

51

i

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

P(i)

4

20

36

52

5

21

37

53

6

22

38

54

7

23

39

55

i

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

P(i)

8

24

40

56

9

25

41

57

10

26

42

58

11

27

43

59

i

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

P(i)

12

28

44

60

13

29

45

61

14

30

46

62

15

31

47

63

EXAMPLES:

sage: from sage.crypto.block_cipher.present import PRESENT
sage: present = PRESENT()
sage: state = vector(GF(2), 64, [0, 1]+[0]*62)
sage: present.linear_layer(state)
(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0)

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT
>>> present = PRESENT()
>>> state = vector(GF(Integer(2)), Integer(64), [Integer(0), Integer(1)]+[Integer(0)]*Integer(62))
>>> present.linear_layer(state)
(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0)

from sage.crypto.block_cipher.present import PRESENT
present = PRESENT()
state = vector(GF(2), 64, [0, 1]+[0]*62)
present.linear_layer(state)
round(state, round_counter, round_key, inverse=False)[source]

Apply one round of PRESENT to state and return the result.

EXAMPLES:

sage: from sage.crypto.block_cipher.present import PRESENT
sage: from sage.crypto.block_cipher.present import convert_to_vector
sage: present = PRESENT(128)
sage: k = convert_to_vector(0x0011223344556677, 64)
sage: p = convert_to_vector(0x0123456789abcdef, 64)
sage: ZZ(list(present.round(p, 0, k)), 2).hex()
'ad0ed4ca386b6559'

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT
>>> from sage.crypto.block_cipher.present import convert_to_vector
>>> present = PRESENT(Integer(128))
>>> k = convert_to_vector(Integer(0x0011223344556677), Integer(64))
>>> p = convert_to_vector(Integer(0x0123456789abcdef), Integer(64))
>>> ZZ(list(present.round(p, Integer(0), k)), Integer(2)).hex()
'ad0ed4ca386b6559'

from sage.crypto.block_cipher.present import PRESENT
from sage.crypto.block_cipher.present import convert_to_vector
present = PRESENT(128)
k = convert_to_vector(0x0011223344556677, 64)
p = convert_to_vector(0x0123456789abcdef, 64)
ZZ(list(present.round(p, 0, k)), 2).hex()
sbox_layer(state, inverse=False)[source]

Apply the sBoxLayer of PRESENT to the bit vector state and return the result.

The S-box used in PRESENT is a 4-bit to 4-bit S-box. The action of this box in hexadecimal notation is given by the following table.

x

0

1

2

3

4

5

6

7

8

9

A

B

C

D

E

F

S[x]

C

5

6

B

9

0

A

D

3

E

F

8

4

7

1

2

For sBoxLayer the current STATE \(b_{63} \dots b_0\) is considered as sixteen 4-bit words \(w_{15} \dots w_0\) where \(w_i = b_{4i+3}||b_{4i+2}||b_{4i+1}||b_{4i}\) for \(0 \leq i \leq 15\) and the output nibble S[\(w_i\)] provides the updated state values in the obvious way.

EXAMPLES:

sage: from sage.crypto.block_cipher.present import PRESENT
sage: present = PRESENT()
sage: state = vector(GF(2), 64, [0]*64)
sage: present.sbox_layer(state)
(0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0,
1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1,
0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1)
sage: state = vector(GF(2), 64, [1]+[0]*63)
sage: present.sbox_layer(state)
(1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0,
1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1,
0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1)

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT
>>> present = PRESENT()
>>> state = vector(GF(Integer(2)), Integer(64), [Integer(0)]*Integer(64))
>>> present.sbox_layer(state)
(0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0,
1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1,
0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1)
>>> state = vector(GF(Integer(2)), Integer(64), [Integer(1)]+[Integer(0)]*Integer(63))
>>> present.sbox_layer(state)
(1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0,
1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1,
0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1)

from sage.crypto.block_cipher.present import PRESENT
present = PRESENT()
state = vector(GF(2), 64, [0]*64)
present.sbox_layer(state)
state = vector(GF(2), 64, [1]+[0]*63)
present.sbox_layer(state)

Note

sage.crypto.sbox uses big endian by default whereas most of Sage uses little endian. So to use the big endian PRESENT Sbox from sage.crypto.sboxes sbox_layer() has to do some endian conversion (i.e. reverse input and ouput of the Sbox). Keep this in mind if you change the Sbox or sbox_layer().

class sage.crypto.block_cipher.present.PRESENT_KS(keysize=80, rounds=31, master_key=None)[source]

Bases: SageObject

This class implements the PRESENT key schedules for both 80-bit and 128-bit keys as described in [BKLPPRSV2007].

EXAMPLES:

Initialise the key schedule with a \(master\_key\) to use it as an iterable:

sage: from sage.crypto.block_cipher.present import PRESENT_KS
sage: ks = PRESENT_KS(master_key=0)
sage: ks[0] == 0x0
True
sage: ks[31] == 0x6dab31744f41d700
True

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT_KS
>>> ks = PRESENT_KS(master_key=Integer(0))
>>> ks[Integer(0)] == Integer(0x0)
True
>>> ks[Integer(31)] == Integer(0x6dab31744f41d700)
True

from sage.crypto.block_cipher.present import PRESENT_KS
ks = PRESENT_KS(master_key=0)
ks[0] == 0x0
ks[31] == 0x6dab31744f41d700

Or omit the \(master\_key\) and pass a key when calling the key schedule:

sage: ks = PRESENT_KS(keysize=128)
sage: K = ks(0x00112233445566778899aabbccddeeff)
sage: K[0] == 0x0011223344556677
True
sage: K[31] == 0x091989a5ae8eab21
True

>>> from sage.all import *
>>> ks = PRESENT_KS(keysize=Integer(128))
>>> K = ks(Integer(0x00112233445566778899aabbccddeeff))
>>> K[Integer(0)] == Integer(0x0011223344556677)
True
>>> K[Integer(31)] == Integer(0x091989a5ae8eab21)
True

ks = PRESENT_KS(keysize=128)
K = ks(0x00112233445566778899aabbccddeeff)
K[0] == 0x0011223344556677
K[31] == 0x091989a5ae8eab21

ALGORITHM:

Description of the key schedule for 64-bit and 128-bit keys from [BKLPPRSV2007]:

The key schedule for 64-bit keys works as follows:

At round \(i\) the 64-bit round key \(K_i = \kappa_{63}\kappa_{62} \dots \kappa_0\) consists of the 64 leftmost bits of the current contents of register \(K\). Thus at round \(i\) we have that:

\[K_i = \kappa_{63}\kappa_{62}\dots \kappa_0 = k_{79}k_{78}\dots k_{16}.\]

After extracting the round key \(K_i\), the key register \(K = k_{79}k_{78} \dots k_0\) is updated as follows:

\[\begin{split}\begin{aligned} \ [k_{79}k_{78}\dots k_{1}k_{0}] &= [k_{18}k_{17}\dots k_{20}k_{19}] \\ [k_{79}k_{78}k_{77}k_{76}] &= S[k_{79}k_{78}k_{77}k_{76}] \\ [k_{19}k_{18}k_{17}k_{16}k_{15}] &= [k_{19}k_{18}k_{17}k_{16}k_{15}] \oplus round\_counter \end{aligned}\end{split}\]

Thus, the key register is rotated by 61 bit positions to the left, the left-most four bits are passed through the PRESENT S-box, and the round_counter value \(i\) is exclusive-ored with bits \(k_{19}k_{18}k_{17} k_{16}k_{15}\) of \(K\) with the least significant bit of round_counter on the right.

The key schedule for 128-bit keys works as follows:

At round \(i\) the 64-bit round key \(K_i = \kappa_{63}\kappa_{62} \dots \kappa_0\) consists of the 64 leftmost bits fo the current contents of register \(K\). Thus at round \(i\) we have that:

\[K_i = \kappa_{63}\kappa_{62}\dots \kappa_0 = k_{127}k_{126}\dots k_{64}\]

After extracting the round key \(K_i\), the key register \(K = k_{127}k_{126} \dots k_0\) is updated as follows:

\[\begin{split}\begin{aligned} \ [k_{127}k_{126}\dots k_{1}k_{0}] &= [k_{66}k_{65}\dots k_{68}k_{67}] \\ [k_{127}k_{126}k_{125}k_{124}] &= S[k_{127}k_{126}k_{125}k_{124}]\\ [k_{123}k_{122}k_{121}k_{120}] &= S[k_{123}k_{122}k_{121}k_{120}]\\ [k_{66}k_{65}k_{64}k_{63}k_{62}] &= [k_{66}k_{65}k_{64}k_{63}k_{62}] \oplus round\_counter \end{aligned}\end{split}\]

Thus, the key register is rotated by 61 bit positions to the left, the left-most eight bits are passed through two PRESENT S-boxes, and the round_counter value \(i\) is exclusive-ored with bits \(k_{66}k_{65}k_{64} k_{63}k_{62}\) of \(K\) with the least significant bit of round_counter on the right.

See also

PRESENT sage.crypto.sboxes

Note

sage.crypto.sbox uses big endian by default whereas most of Sage uses little endian. So to use the big endian PRESENT Sbox from sage.crypto.sboxes PRESENT_KS has to do some endian conversion (i.e. reverse input and ouput of the Sbox). Keep this in mind if you change the Sbox or __call__().

__init__(keysize=80, rounds=31, master_key=None)[source]

Construct an instance of PRESENT_KS.

INPUT:

  • keysize – integer (default: 80); the size of the keys that will be used in bits. It must be either 80 or 128.

  • rounds – integer (default: 31); the number of rounds self can create keys for

  • master_key – integer or bit list-like (default: None); the key that will be used

EXAMPLES:

sage: from sage.crypto.block_cipher.present import PRESENT_KS
sage: PRESENT_KS()
Original PRESENT key schedule with 80-bit keys and 31 rounds

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT_KS
>>> PRESENT_KS()
Original PRESENT key schedule with 80-bit keys and 31 rounds

from sage.crypto.block_cipher.present import PRESENT_KS
PRESENT_KS()

Note

If you want to use a PRESENT_KS object as an iterable you have to pass a master_key value on initialisation. Otherwise you can omit master_key and pass a key when you call the object.

__call__(K)[source]

Return all round keys in a list.

INPUT:

  • K – integer or bit list-like; the key

OUTPUT:

  • A list containing rounds + 1 round keys. Since addRoundkey takes place in every round and after the last round there must be rounds + 1 round keys. If K is an integer the elements of the output list will be too. If K is list-like the element of the output list will be bit vectors.

EXAMPLES:

sage: from sage.crypto.block_cipher.present import PRESENT_KS
sage: ks = PRESENT_KS()
sage: ks(0)[31] == 0x6dab31744f41d700
True

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import PRESENT_KS
>>> ks = PRESENT_KS()
>>> ks(Integer(0))[Integer(31)] == Integer(0x6dab31744f41d700)
True

from sage.crypto.block_cipher.present import PRESENT_KS
ks = PRESENT_KS()
ks(0)[31] == 0x6dab31744f41d700

Note

If you want to use a PRESENT_KS object as an iterable you have to pass a master_key value on initialisation. Otherwise you can omit master_key and pass a key when you call the object.

sage.crypto.block_cipher.present.convert_to_vector(I, L)[source]

Convert I to a bit vector of length L.

INPUT:

  • I – integer or bit list-like

  • L – integer; the desired bit length of the ouput

OUTPUT: the L-bit vector representation of I

EXAMPLES:

sage: from sage.crypto.block_cipher.present import convert_to_vector
sage: convert_to_vector(0x1F, 8)
(1, 1, 1, 1, 1, 0, 0, 0)
sage: v = vector(GF(2), 4, [1,0,1,0])
sage: convert_to_vector(v, 4)
(1, 0, 1, 0)

>>> from sage.all import *
>>> from sage.crypto.block_cipher.present import convert_to_vector
>>> convert_to_vector(Integer(0x1F), Integer(8))
(1, 1, 1, 1, 1, 0, 0, 0)
>>> v = vector(GF(Integer(2)), Integer(4), [Integer(1),Integer(0),Integer(1),Integer(0)])
>>> convert_to_vector(v, Integer(4))
(1, 0, 1, 0)

from sage.crypto.block_cipher.present import convert_to_vector
convert_to_vector(0x1F, 8)
v = vector(GF(2), 4, [1,0,1,0])
convert_to_vector(v, 4)