The ANUBIS Block Cipher

Welcome!

ANUBIS is a block cipher designed by Vincent Rijmen and Paulo S. L. M. Barreto that operates on data blocks of length 128 bits, and uses keys of length 128 to 320 bits in steps of 32 bits. It has been submitted as a candidate algorithm for the NESSIE cryptographic primitive evaluation effort.



---

The cipher

ANUBIS is an iterated 128-bit block cipher with variable-length keys (128 bits to 320 bits, in steps of 32 bits).

The number of rounds depends on the key size: at least 12 (for 128-bit keys), plus one extra round for each additional 32 key bits. Each round consists of sixteen 8-bit to 8-bit S-box parallel lookups, a linear transformation (matrix transposition followed by multiplication by a constant MDS diffusion matrix) and the round key addition.

The S-box and the diffusion matrix were chosen in a way which guarantees that encryption and decryption are the same operation except in the round subkeys.

ANUBIS belongs to the same family of block ciphers as the AES winner algorithm, RIJNDAEL, the main differences being sketched in the following table:

---

The documentation

The original definition of ANUBIS as submitted to NESSIE can be found here, or locally here.



---

The "tweak"

We suggested this "tweak" to make ANUBIS more efficiently implementable in hardware. It does not change the basic structure of ANUBIS; rather, it replaces the S-box, which in the original submission is generated entirely at random (i.e. lacks any internal structure), by a recursive structure: the new 8x8 substitution box is composed of smaller pseudo-randomly generated 4x4 "mini-boxes" (the P-box and the Q-box).

The recursive structure of the "tweaked" S-box:


The P mini-box:

u	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
P(u)	3	F	E	0	5	4	B	C	D	A	9	6	7	8	2	1




The Q mini-box:

u	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
Q(u)	9	E	5	6	A	2	3	C	F	0	4	D	7	B	1	8






---

The security statement

This section is an excerpt from the documentation submitted to NESSIE.

ANUBIS is expected, for all key lengths defined, to behave as good as can be expected from a block cipher with the given block and key lengths (in the sense of being K-secure and hermetic).

This implies among other things, the following.



The most efficient key-recovery attack for ANUBIS is exhaustive key search. Obtaining information from given plaintext-ciphertext pairs about other plaintext-ciphertext pairs cannot be done more efficiently than by determining the key by exhaustive key search. The expected effort of exhaustive key search depends on the bit length of the cipher key and is 2m-1 applications of ANUBIS for m-bit keys.

The rationale for this is that a considerable safety margin is taken with respect to all known attacks. We do however realise that it is impossible to make non-speculative statements on things unknown.

In spite of any analysis, doubts might remain regarding the presence of trapdoors deliberately introduced in the algorithm. That is why the NESSIE effort asked for the designers' declaration on the contrary. Therefore we, the designers of ANUBIS, do hereby declare that there are no hidden weaknesses inserted by us in the ANUBIS primitive.



---

The availability

ANUBIS is not (and will never be) patented. It may be used free of charge for any purpose.



---

The reference implementation and test vectors

Original version	"Tweaked" version
Test vectors	Test vectors
C reference implementation	C reference implementation
Java reference implementation	Java reference implementation


These implementations are in the public domain. But before you go and use it, please read the following disclaimer:


THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.



---

The name

ANUBIS, or , was the Egyptian god of embalming and entombment -- hence, by extension, the god of "encryption". The name seems therefore suitable for a cipher; besides, this choice makes ANUBIS the only cipher with an associated curse against information privacy invaders .


The Ancient Egyptian God Anubis in silicon.
Image courtesy of Michael W. Davidson on behalf of the "Molecular Expressions" web site.


---

The links

The Pairing-Based Crypto Lounge The Hashing Function Lounge

The KHAZAD Block Cipher The WHIRLPOOL Hashing Function

Paulo's page Vincent's page

---

Visits between 2001.09.23 and 2008.11.19:

Visits since 2008.11.19:

Last update: 2008.11.19
Copyright © 2001, 2008 by Paulo S. L. M. Barreto.  All rights reserved.