The Full Wiki

Camellia (cipher): Wikis


Note: Many of our articles have direct quotes from sources you can cite, within the Wikipedia article! This article doesn't yet, but we're working on it! See more info or our list of citable articles.


From Wikipedia, the free encyclopedia

Designers Mitsubishi, NTT
First published 2000
Derived from E2, MISTY1
Certification CRYPTREC, NESSIE
Cipher detail
Key sizes 128, 192 or 256 bits
Block sizes 128 bits
Structure Feistel network
Rounds 18 or 24

In cryptography, Camellia is a block cipher that has been evaluated favorably by several organisations, including the European Union's NESSIE project (a selected algorithm), and the Japanese CRYPTREC project (a recommended algorithm). The cipher was developed jointly by Mitsubishi and NTT in 2000, and has similar design elements to earlier block ciphers (MISTY1 and E2) from these companies.

Camellia has a block size of 128 bits, and can use 128-bit, 192-bit or 256-bit keys — the same interface as the Advanced Encryption Standard. It is a Feistel cipher with either 18 rounds (if the key is 128 bits) or 24 rounds (if the key is 192 or 256 bits). Every six rounds, a logical transformation layer is applied: the so-called "FL-function" or its inverse. Camellia uses four 8 x 8-bit S-boxes with input and output affine transformations and logical operations. The cipher also uses input and output key whitening. The diffusion layer uses a linear transformation based on an MDS matrix with a branch number of 5.


Security analysis

Camellia is one of the ciphers that can be completely defined by minimal systems of multivariate polynomials [1]. The Camellia (as well as AES) S-boxes can be described by a system of 23 quadratic equations in 80 terms [2]. The key schedule can be described by 1120 equations in 768 variables using 3328 linear and quadratic terms [1]. The entire block cipher can be described by 5104 equations in 2816 variables using 14592 linear and quadratic terms [1]. In total, 6224 equations in 3584 variables using 17920 linear and quadratic terms are required [1]. The number of free terms is 11696, which is approximately the same number as for AES. Theoretically, such properties might make it possible to break Camellia (and AES) using an algebraic attack, such as Extended Sparse Linearisation, in the future (provided that the attack becomes feasible).

Patent status

Although patented, Camellia is available under a royalty-free license.[3] This has allowed the Camellia cipher to become part of the OpenSSL Project, under an Open Source license, as of November 8, 2006,[4] as well as Mozilla's NSS (Network Security Services) module.[5]


On June, 18 2008, support for the adopted Camellia cipher was added to the final release of Mozilla Firefox 3.[5]

Yoshisato Yanagisawa had added support for the Camellia cipher to the disk encryption storage class geli (software) in FreeBSD 7.0. On November 11, 2008, The FreeBSD Release Engineering Team announced that the cipher had also been included in the FreeBSD 6.4-RELEASE.

GNU Privacy Guard added support for Camellia in version 1.4.10 released on September 2, 2009.[6]

Notes and references

  1. ^ a b c d Biryukov, De Cannière (2003), Block ciphers and systems of quadratic equations, Springer-Verlag  
  2. ^ N. T. Courtois, J. Pieprzyk (2002), Cryptanalysis of block ciphers with overdefined systems of equations, Springer-Verlag  
  3. ^ NTT (2001-04-17). "Announcement of Royalty-free Licenses for Essential Patents of NTT Encryption and Digital Signature Algorithms". Press release. Retrieved 2006-11-08.  
  4. ^ NTT (2006-11-08). "The Open Source Community OpenSSL Project Adopts the Next Generation International Standard Cipher "Camellia" Developed in Japan". Press release. Retrieved 2008-02-29.  
  5. ^ a b "Camellia cipher added to Firefox". Mozilla in Asia. Mozilla. July 30, 2009.  
  6. ^ "GnuPG 1.4.10 released". September 2, 2009.  
 7  ZHAO Xin-jie and WANG Tao and ZHENG Yuan-yuan (PDF). Cache Timing Attacks on Camellia Block Cipher. Retrieved 2009-9-14.
 8  ZHAO Xin-jie and WANG Tao(PDF). An Improved Differential Fault Attack on Camellia. Retrieved 2009-12-02.

External links



Got something to say? Make a comment.
Your name
Your email address