Draft:Ballet (cipher)

Ballet
Round Function of the Ballet Cipher
General
DesignersTing-Ting Cui, Mei-Qin Wang, Yan-Hong Fan, Kai Hu, Yong Fu, Lu-Ning Huang
First published2019
CertificationCinese National Cryptographic Algorithm Design Competition[1]
Cipher detail
Key sizes128 or 256 bits
Block sizes128 or 256 bits
StructureARX Lai–Massey scheme
Rounds46–74 (depending on block and key size)
Best public cryptanalysis
No attacks are known on the full ciphers, but reduced-round versions have been attacked. Differential-linear attack can break up to 22 round of the 256 block version with a time complexity of 2242.06;[2] see #Cryptanalysis.

Ballet[3] is a block cipher selected by the Chinese Association for Cryptologic Research (CACR) as winner of the 2018-2020 cinese National Cryptographic Algorithm Design Competition[1][4]. The cipher is an add–rotate–xor (ARX) with a Lai–Massey scheme structure.

Cipher description

Ballet is defined in thee version to operate with different block and key size.

Block size Key size Number of rounds
128 128 46
256 48
256 256 74

Round function

INPUT:
    X0, X1, X2, X3
    sk[0 ... r-1][...]
    r

FUNCTION ROTL(value, n):
    return (value << n) OR (value >> (WORD_SIZE - n))

FOR i = 0 TO r-2 DO:
    (X0, X1, X2, X3) =
    (
        X1 XOR sk[i][0],

        ROTL(X0, 6) + ROTL(X1 XOR X2, 9),

        ROTL(X3, 15) + ROTL(X1 XOR X2, 14),

        X2 XOR sk[i][1]
    )
END FOR

// Final round (corrected)
(X0, X1, X2, X3) =
(
    ROTL(X0, 6) + ROTL(X1 XOR X2, 9),   // FIXED

    X1 XOR sk[r-1][1],

    X2 XOR sk[r-1][2],

    ROTL(X3, 15) + ROTL(X1 XOR X2, 14)
)

OUTPUT:
    X0, X1, X2, X3

Key generation algorithms

The following algorithms describe the round key generation procedures for the BALLET block cipher in the n/n and n/2n configurations.

Key generation for BALLET n/n 

INPUT: k0, k1        // initial key parts
       R             // number of rounds

OUTPUT: subkeys[0..R-1]

FUNCTION ROTL(x, n):
    RETURN (x << n) OR (x >> (WORD_SIZE - n))

FOR i FROM 0 TO R-1:

    // --- 1. Form the round subkey ---
    left_half  = LEFT_HALF(k0)
    right_half = RIGHT_HALF(k0)
    subkeys[i] = CONCAT(left_half, right_half)

    // --- 2. Save current value of k1 ---
    old_k1 = k1

    // --- 3. Update k1 ---
    k1 = k0 XOR ROTL(old_k1, 3) XOR ROTL(old_k1, 5) XOR i

    // --- 4. Swap values ---
    k0 = old_k1

END FOR

Key generation for BALLET n/2n 

INPUT: k0, k1, k2, k3   // initial key parts
       R                // number of rounds

OUTPUT: subkeys[0..R-1]

FUNCTION ROTL(x, n):
    RETURN (x << n) OR (x >> (WORD_SIZE - n))

FOR i FROM 0 TO R-1:
    // --- 1. Form the round subkey ---
    left_half  = LEFT_HALF(k0)
    right_half = RIGHT_HALF(k0)
    subkeys[i] = CONCAT(left_half, right_half)

    // --- 2. Save current values ---
    old_k1 = k1
    old_k3 = k3

    // --- 3. Update k3 ---
    k3 = k2 XOR ROTL(old_k3, 7) XOR ROTL(old_k3, 17)

    // --- 4. Update k1 ---
    k1 = k0 XOR ROTL(old_k1, 3) XOR ROTL(old_k1, 5)

    // --- 5. Shift values ---
    k2 = old_k3
    k0 = old_k1

    // --- 6. Add round-dependent variation ---
    k1 = k1 XOR k3 XOR i

END FOR


Cryptanalysis

References

  1. ^ a b https://web.archive.org/web/20251030125127/https://sfjs.cacrnet.org.cn/site/content/309.html
  2. ^ Bellini, Emanuele; Bellini, Gabriele; De Piccoli, Alessandro; Gallone, Michela; Gerault, David; Huang, Yun Ju; Onger, Matteo; Pelizzola, Simone; Visconti, Andrea (2026-03-11). "More Brisés in Ballet: Extending Differential and Linear Cryptanalysis" (PDF). Retrieved 2026-04-29.
  3. ^ CUI (崔), Ting-Ting (婷婷); WANG (王), Mei-Qin (美琴); FAN (樊), Yan-Hong (燕红); HU (胡), Kai (凯); FU (付), Yong (勇); HUANG (黄), Lu-Ning (鲁宁) (2019). "Ballet: 一个软件实现友好的分组密码算法. (Ballet: A Software-friendly Block Cipher)". doi:10.13868/j.cnki.jcr.000335. Retrieved 2026-05-06.
  4. ^ https://www.cacrnet.org.cn/site/content/854.html

Content Disclaimer

Informasi ini disarikan dari Wikipedia dan disajikan kembali untuk tujuan edukasi. Konten tersedia di bawah lisensi CC BY-SA 3.0. Kami tidak bertanggung jawab atas ketidakakuratan data yang bersumber dari kontribusi publik tersebut.

  1. The information displayed on this website is sourced in part or in whole from Wikipedia and has been adapted for the purpose of restating it. We strive to provide accurate and relevant information, however:
  2. There is no guarantee of absolute accuracy. Wikipedia is an open, collaborative project that can be edited by anyone, so information is subject to change.
  3. It is not intended to constitute professional advice. The content displayed is for informational and educational purposes only. For important decisions (e.g., medical, legal, or financial), please consult a professional.
  4. Content copyright. Wikipedia is licensed under the Creative Commons Attribution-ShareAlike License (CC BY-SA). This means that content may be reused with appropriate attribution and shared under a similar license.
  5. Responsible use. Any risk arising from the use of information from this website is entirely the responsibility of the user.