How to calculate initial RC5 encryption parameters?

Question

I learn from a minithesis to understand RC5. As we can see at the formula, the round 0 must be using A=A+S[0], because the loop is starting at r(round) 1.

I tried addition and OR(bitwise) to get the answer DA679BFB but keep missing, Here is my result of calculating.

A = A + S[0]

  = 4B726970 + BF0A8B1D

  = 10A7CF48D


A = A OR S[0]

  = 4B726970 OR BF0A8B1D

  = FF7AEB7D

The S Data is the result of 3rd phase key expanding on RC5. I really need help because I have been stuck here for 2 days and thank you in advance.

Plaintext : 4B726970 746F2053 74656761 6E6F
key       : 4B726970 746F6772 616669 
w(blocksize) = 32, r(round) = 12, b(key lenght) = 16

score 3 · Accepted Answer · edited Jul 24 '18 at 19:39

First: you should use addition, not XOR. Next, if you're doing this calculation with a computer, make sure you're processing the bytes as little-endian, and that you pad your key to the 16 bytes you mentioned:

4B726970 746F6772 61666900 00000000

Now, you have basically answered the question yourself of why you aren't getting the correct value:

The S Data is the result of 3rd phase key expanding on RC5.

The formula A = A + S[0] is correct, but as you note there are multiple phases of mixing the $L$ and $S$ arrays. During the first phase, $A$ and $B$ look like:

i=1 A= **0xbf0a8b1d** B= **0x5ee7fad**
i=2 A= 0xd88eaf30 B= 0x2a1c93ca
i=3 A= 0xb7dc3e7f B= 0xc47155c4
...

These are the values on the right-hand side of the image you posted. The value 0xbf0a8b1d in particular is the one you've been trying to add. What you should be using are values from the 3rd phase:

i=1 A= **0x8ef5328b** B= **0x600e18b6**
i=2 A= 0x64aa69d0 B= 0x384a0d6
i=3 A= 0x7a471ae8 B= 0xd5a140fa
...

So now, take your plaintext word 0x4b726970 and add it to 0x8ef5328b, and you get the desired value of 0xda679b7b:

i=1 A= **0xda679bfb** B= 0xd9198a23 # before the loop even starts
i=2 A= 0x9637a9a8 B= 0x7e949194
i=3 A= 0x4ec0dda1 B= 0x299ed426
...

I followed Rivest's paper on RC5 and double-checked my values against a Python implementation. We don't do implementation details here, but that should answer why you haven't been able to match up to that example.

How to calculate initial RC5 encryption parameters?

1 Answers1