IDEA (ECB)

create

create("idea")

family

Lai-Massey

options

--key

self-inverse

no

keyspace

2^128 keys

try it

ciphers idea "ATTACK AT DAWN" --key 00010002000300040005000600070008

Xuejia Lai and James Massey built it at ETH Zurich. The first version from 1990 was called PES. Then differential cryptanalysis went public, they hardened the rounds and called it IPES, and in 1992 it became IDEA. Phil Zimmermann put it into PGP 2.0 in place of BassOmatic, his own cipher from PGP 1.0, which didn't hold up. The patents ran out in 2011 and now anyone can use it.

What makes IDEA odd is that it has no tables at all. Every 64-bit block is four 16-bit words, and a round mixes them with three operations that don't get along with each other:

• ⊕ XOR,
• ⊞ addition modulo 2^16,
• ⊙ multiplication modulo 2^16 + 1, which is prime, so every word has an inverse. The word 0 stands for 2^16 there.

No two of them are distributive or associative with each other, and that's the whole trick. Eight rounds of that, then a half round that only multiplies and adds, so papers write 8.5 rounds. The 128-bit key gets cut into 52 subkeys of 16 bits: eight straight from the key, then the key rotates left by 25 bits and gets cut again. Decryption runs the same rounds with the inverted subkeys in reverse order.

The key is 32 hex digits. Case doesn't matter and spaces are ignored. Text goes in as UTF-8 with PKCS#7 padding, ciphertext comes out as lowercase hex, and decode wants hex back. The mode is ECB, the same as Blowfish.

const idea = create("idea");
const key = "0001 0002 0003 0004 0005 0006 0007 0008";
idea.encode("ATTACK AT DAWN", { key }).text; // "1e79aa86c8a1f33bd0182e2668bd0bf6"
idea.decode("1e79aa86c8a1f33bd0182e2668bd0bf6", { key }).text; // "ATTACK AT DAWN"

That key is the one from Lai's thesis example. OpenSSL still has IDEA, but only in the legacy provider:

printf %s "ATTACK AT DAWN" | openssl enc -idea-ecb -provider legacy -provider default -K 00010002000300040005000600070008 | xxd -p
# 1e79aa86c8a1f33bd0182e2668bd0bf6

The tests check eleven vectors from Botan 2, including the thesis example and the all-zero key, where every subkey is 0 and so every multiplication is by 2^16. Whole texts are checked against OpenSSL.

How strong is it

For a cipher from 1991, surprisingly. The best attack on all 8.5 rounds is the biclique one by Khovratovich, Leurent and Rechberger from 2012, about 2^126 work instead of 2^128. That's a paper result, not a way in.

The weak spot is the key schedule. It's plain rotation, so a key with long runs of zero bits gives subkeys of 0 or 1, and multiplying by 1 changes nothing. Whole classes of such weak keys are known. With a random key the chance of hitting one is negligible, but a key someone typed by hand is a different story.

The block is only 64 bits too. After about 2^32 blocks under one key, collisions start to show up, the same thing that took down Triple DES and Blowfish in Sweet32.

Why ECB leaks

Same as every ECB here. Sixteen As are two equal blocks, and they come out as two equal blocks:

idea.encode("A".repeat(16), { key }).text;
// 14e5708749b11c09 14e5708749b11c09 46e751f52a939266

Spaces added to show the blocks. The last one is only padding.

A key that isn't 32 hex digits is an InvalidOptionError, a missing one a MissingOptionError. On decode, ciphertext that isn't whole 8-byte blocks of hex is a CipherError. A wrong key almost always breaks the padding, and that's a CipherError too. So are decrypted bytes that aren't UTF-8. This one is plain TypeScript on 16-bit words, and the multiplication is not constant time. Puzzles and learning, not secrets.