RFC 4503

A Description of the Rabbit Stream Cipher Algorithm

📅 published May 2006, from ietf

A Description of the Rabbit Stream Cipher Algorithm 🐰✨

okay bestie, here's the tea 🫶 this doc is from the Network Working Group, it's Request for Comments: 4503, and it came out in May 2006.

  • Authors: M. Boesgaard, M. Vesterager, and E. Zenner, all from Cryptico A/S
  • Category: Informational 🎀 so it's info vibes, not an Internet standard
  • Obsoletes / Updates: the title block doesn't list any, so it doesn't replace or change anything else

Status of This Memo 🌸

This memo gives information to the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.

Copyright (C) The Internet Society (2006).

Abstract 🔥

this doc describes the encryption algorithm Rabbit 🐇 it's a stream cipher with a 128-bit key and a 64-bit initialization vector (IV). it was published in 2003 and has been through public security and performance review. its high performance makes it super suited for internet protocols that have to process huge amounts of data. literally the main character of bulk encryption 👑

Table of Contents 📚

   1. Introduction ....................................................2
   2. Algorithm Description ...........................................2
      2.1. Notation ...................................................2
      2.2. Inner State ................................................3
      2.3. Key Setup Scheme ...........................................3
      2.4. IV Setup Scheme ............................................3
      2.5. Counter System .............................................4
      2.6. Next-State Function ........................................4
      2.7. Extraction Scheme ..........................................5
      2.8. Encryption/Decryption Scheme ...............................5
   3. Security Considerations .........................................6
      3.1. Message Length .............................................6
      3.2. Initialization Vector ......................................6
   4. Informative References ..........................................7
   Appendix A: Test Vectors ...........................................8
      A.1. Testing without IV Setup ...................................8
      A.2. Testing with IV Setup ......................................8
   Appendix B: Debugging Vectors ......................................9

      B.1. Testing Round Function and Key Setup .......................9
      B.2. Testing the IV setup ......................................10

1. Introduction 💖

Rabbit is a stream cipher that was designed to be fast in software 🚀 both key setup and encryption are very quick, so it's especially good for anything with lots of data or lots of data packets to encrypt. some examples are server-side encryption, multimedia encryption, hard-disk encryption, and encryption on limited-resource devices. the list goes on 🧚

the cipher is based on ideas from the behavior of certain chaotic maps. those maps were carefully discretized, which gives you a compact stream cipher. Rabbit was openly published in 2003 [1] and hasn't shown any weaknesses as of this writing 🙈 to keep the security checking going, it was also submitted to the ECRYPT eSTREAM project[2].

technically, Rabbit is a pseudorandom bitstream generator. it takes a 128-bit key and a 64-bit initialization vector (IV) as input, and it outputs a stream of 128-bit blocks. encryption works by combining that output with the message using exclusive-OR. decryption is done in exactly the same way as encryption ✨

more info about Rabbit, including the reference implementation, test vectors, performance figures, and security white papers, is at http://www.cryptico.com/ 🍓

2. Algorithm Description 🎀

2.1. Notation 🧮

this doc uses these elementary operators:

    +     integer addition.
    *     integer multiplication.
   div    integer division.
   mod    integer modulus.
    ^     bitwise exclusive-OR operation.
   <<<    left rotation operator.
    ||    concatenation operator.

when we label the bits of a variable A, the least significant bit is A[0]. the notation A[h..g] means bits h through g of variable A, where h is more significant than g. similar variables are labeled A0, A1, ..., and the notation A(0), A(1), ... can be used for those same variables if it's easier to read 👀

given a 64-bit word, the function MSW grabs the most significant 32 bits, and the function LSW grabs the least significant 32 bits.

constants with a 0x prefix are in hexadecimal notation. the constant WORDSIZE is defined to be 0x100000000 🔢

2.2. Inner State 🌈

the internal state of the stream cipher is 513 bits total 🫧 512 of those bits are split between eight 32-bit state variables, X0, ..., X7, and eight 32-bit counter variables, C0, ..., C7. on top of that there's one counter carry bit, b.

2.3. Key Setup Scheme 🔑

first, the counter carry bit b is set to zero. then the state and counter words are derived from the key K[127..0] 💅

the key is split into subkeys: K0 = K[15..0], K1 = K[31..16], ... K7 = K[127..112]. the initial state gets set up like this:

     for j=0 to 7:
       if j is even:
         Xj = K(j+1 mod 8) || Kj
         Cj = K(j+4 mod 8) || K(j+5 mod 8)
       else:
         Xj = K(j+5 mod 8) || K(j+4 mod 8)
         Cj = Kj || K(j+1 mod 8)

then the system gets iterated four times. each iteration does a counter update (Section 2.5) and then the next-state function (Section 2.6) 🔁 after that, the counter variables are reinitialized like so:

     for j=0 to 7:
       Cj = Cj ^ X(j+4 mod 8)

2.4. IV Setup Scheme 🦋

if an IV is used for encryption, the counter variables get modified after the key setup. with the IV bits written as IV[63..0], the setup goes like this:

     C0 = C0 ^ IV[31..0]        C1 = C1 ^ (IV[63..48] || IV[31..16])
     C2 = C2 ^ IV[63..32]       C3 = C3 ^ (IV[47..32] || IV[15..0])
     C4 = C4 ^ IV[31..0]        C5 = C5 ^ (IV[63..48] || IV[31..16])
     C6 = C6 ^ IV[63..32]       C7 = C7 ^ (IV[47..32] || IV[15..0])

then the system is iterated another 4 times, with each iteration doing a counter update (Section 2.5) and the next-state function (Section 2.6) 🌸

here's how key setup and IV setup relate:

  • once the key setup is done, the resulting inner state gets saved as a master state 💜 then the IV setup runs to get the first encryption starting state.
  • whenever you need to re-initialize under a new IV, the IV setup runs on the master state again to derive the next encryption starting state 🍰

4. Informative References ✨

Okay bestie, here's the reading list 📚 these authors used to build Rabbit. Every single source is listed below, complete, so you can go check them yourself 🧐

  • [1] M. Boesgaard, M. Vesterager, T. Pedersen, J. Christiansen, O. Scavenius. "Rabbit: A New High-Performance Stream Cipher". Proc. Fast Software Encryption 2003, Lecture Notes in Computer Science 2887, p. 307-329. Springer, 2003.
  • [2] ECRYPT eSTREAM project, available from http://www.ecrypt.eu.org/stream/
  • [3] M. Boesgaard, T. Pedersen, M. Vesterager, E. Zenner. "The Rabbit Stream Cipher - Design and Security Analysis". Proc. SASC Workshop 2004, available from http://www.isg.rhul.ac.uk/research/projects/ecrypt/stvl/sasc.html.
  • [4] H. Wu. "The Misuse of RC4 in Microsoft Word and Excel". IACR eprint archive 2005/007, available from http://eprint.iacr.org/2005/007.pdf.
  • [5] Jonsson, J. and B. Kaliski, "Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1", RFC 3447, February 2003.

Appendix A: Test Vectors 🎀

Okay, this is the official set of test vectors for conformance testing 💅 They're written in octets. To use them with Rabbit, you have to convert them into integers using the OS2IP and I2OSP conversion primitives, which are described in [5].

A.1. Testing without IV Setup 🌸

key  = [00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00]
S[0] = [B1 57 54 F0 36 A5 D6 EC F5 6B 45 26 1C 4A F7 02]
S[1] = [88 E8 D8 15 C5 9C 0C 39 7B 69 6C 47 89 C6 8A A7]
S[2] = [F4 16 A1 C3 70 0C D4 51 DA 68 D1 88 16 73 D6 96]

key  = [91 28 13 29 2E 3D 36 FE 3B FC 62 F1 DC 51 C3 AC]
S[0] = [3D 2D F3 C8 3E F6 27 A1 E9 7F C3 84 87 E2 51 9C]
S[1] = [F5 76 CD 61 F4 40 5B 88 96 BF 53 AA 85 54 FC 19]
S[2] = [E5 54 74 73 FB DB 43 50 8A E5 3B 20 20 4D 4C 5E]

key  = [83 95 74 15 87 E0 C7 33 E9 E9 AB 01 C0 9B 00 43]
S[0] = [0C B1 0D CD A0 41 CD AC 32 EB 5C FD 02 D0 60 9B]
S[1] = [95 FC 9F CA 0F 17 01 5A 7B 70 92 11 4C FF 3E AD]
S[2] = [96 49 E5 DE 8B FC 7F 3F 92 41 47 AD 3A 94 74 28]

A.2. Testing with IV Setup 🦋

mkey = [00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00]
iv   = [00 00 00 00 00 00 00 00]
S[0] = [C6 A7 27 5E F8 54 95 D8 7C CD 5D 37 67 05 B7 ED]
S[1] = [5F 29 A6 AC 04 F5 EF D4 7B 8F 29 32 70 DC 4A 8D]
S[2] = [2A DE 82 2B 29 DE 6C 1E E5 2B DB 8A 47 BF 8F 66]

iv   = [C3 73 F5 75 C1 26 7E 59]
S[0] = [1F CD 4E B9 58 00 12 E2 E0 DC CC 92 22 01 7D 6D]
S[1] = [A7 5F 4E 10 D1 21 25 01 7B 24 99 FF ED 93 6F 2E]
S[2] = [EB C1 12 C3 93 E7 38 39 23 56 BD D0 12 02 9B A7]

iv   = [A6 EB 56 1A D2 F4 17 27]
S[0] = [44 5A D8 C8 05 85 8D BF 70 B6 AF 23 A1 51 10 4D]
S[1] = [96 C8 F2 79 47 F4 2C 5B AE AE 67 C6 AC C3 5B 03]
S[2] = [9F CB FC 89 5F A7 1C 17 31 3D F0 34 F0 15 51 CB]

Appendix B: Debugging Vectors 🔍

These vectors show Rabbit's inner state during key and IV setup. They're mainly there for debugging, so if something's going sideways in your build, this is where you look 🫶 Octet strings are written using I2OSP conventions.

B.1. Testing Round Function and Key Setup 💜

key  = [91 28 13 29 2E ED 36 FE 3B FC 62 F1 DC 51 C3 AC]

Inner state after key expansion:
b  = 0
X0 = 0xDC51C3AC, X1 = 0x13292E3D, X2 = 0x3BFC62F1, X3 = 0xC3AC9128,
X4 = 0x2E3D36FE, X5 = 0x62F1DC51, X6 = 0x91281329, X7 = 0x36FE3BFC,
C0 = 0x36FE2E3D, C1 = 0xDC5162F1, C2 = 0x13299128, C3 = 0x3BFC36FE,
C4 = 0xC3ACDC51, C5 = 0x2E3D1329, C6 = 0x62F13BFC, C7 = 0x9128C3AC

Inner state after first key setup iteration:
b  = 1
X0 = 0xF2E8C8B1, X1 = 0x38E06FA7, X2 = 0x9A0D72C0, X3 = 0xF21F5334,
X4 = 0xCACDCCC3, X5 = 0x4B239CBE, X6 = 0x0565DCCC, X7 = 0xB1587C8D,
C0 = 0x8433018A, C1 = 0xAF9E97C4, C2 = 0x47FCDE5D, C3 = 0x89310A4B,
C4 = 0x96FA1124, C5 = 0x6310605E, C6 = 0xB0260F49, C7 = 0x6475F87F

Inner state after fourth key setup iteration:
b  = 0
X0 = 0x1D059312, X1 = 0xBDDC3E45, X2 = 0xF440927D, X3 = 0x50CBB553,
X4 = 0x36709423, X5 = 0x0B6F0711, X6 = 0x3ADA3A7B, X7 = 0xEB9800C8,
C0 = 0x6BD17B74, C1 = 0x2986363E, C2 = 0xE676C5FC, C3 = 0x70CF8432,
C4 = 0x10E1AF9E, C5 = 0x018A47FD, C6 = 0x97C48931, C7 = 0xDE5D96F9

Inner state after final key setup xor:
b  = 0
X0 = 0x1D059312, X1 = 0xBDDC3E45, X2 = 0xF440927D, X3 = 0x50CBB553,
X4 = 0x36709423, X5 = 0x0B6F0711, X6 = 0x3ADA3A7B, X7 = 0xEB9800C8,
C0 = 0x5DA1EF57, C1 = 0x22E9312F, C2 = 0xDCACFF87, C3 = 0x9B5784FA,
C4 = 0x0DE43C8C, C5 = 0xBC5679B8, C6 = 0x63841B4C, C7 = 0x8E9623AA

Inner state after generation of 48 bytes of output:
b  = 1
X0 = 0xB5428566, X1 = 0xA2593617, X2 = 0xFF5578DE, X3 = 0x7293950F,
X4 = 0x145CE109, X5 = 0xC93875B0, X6 = 0xD34306E0, X7 = 0x43FEEF87,
C0 = 0x45406940, C1 = 0x9CD0CFA9, C2 = 0x7B26E725, C3 = 0x82F5FEE2,
C4 = 0x87CBDB06, C5 = 0x5AD06156, C6 = 0x4B229534, C7 = 0x087DC224
The 48 output bytes:
S[0] = [3D 2D F3 C8 3E F6 27 A1 E9 7F C3 84 87 E2 51 9C]
S[1] = [F5 76 CD 61 F4 40 5B 88 96 BF 53 AA 85 54 FC 19]
S[2] = [E5 54 74 73 FB DB 43 50 8A E5 3B 20 20 4D 4C 5E]

B.2. Testing the IV Setup ✨

key  = [91 28 13 29 2E ED 36 FE 3B FC 62 F1 DC 51 C3 AC]
iv   = [C3 73 F5 75 C1 26 7E 59]

Inner state during key setup:
as above

Inner state after IV expansion:
b  = 0
X0 = 0x1D059312, X1 = 0xBDDC3E45, X2 = 0xF440927D, X3 = 0x50CBB553,
X4 = 0x36709423, X5 = 0x0B6F0711, X6 = 0x3ADA3A7B, X7 = 0xEB9800C8,
C0 = 0x9C87910E, C1 = 0xE19AF009, C2 = 0x1FDF0AF2, C3 = 0x6E22FAA3,
C4 = 0xCCC242D5, C5 = 0x7F25B89E, C6 = 0xA0F7EE39, C7 = 0x7BE35DF3

Inner state after first IV setup iteration:
b  = 1
X0 = 0xC4FF831A, X1 = 0xEF5CD094, X2 = 0xC5933855, X3 = 0xC05A5C03,
X4 = 0x4A50522F, X5 = 0xDF487BE4, X6 = 0xA45FA013, X7 = 0x05531179,
C0 = 0xE9BC645B, C1 = 0xB4E824DC, C2 = 0x54B25827, C3 = 0xBB57CDF0,
C4 = 0xA00F77A8, C5 = 0xB3F905D3, C6 = 0xEE2CC186, C7 = 0x4F3092C6

Inner state after fourth IV setup iteration:
b  = 1
X0 = 0x6274E424, X1 = 0xE14CE120, X2 = 0xDA8739D9, X3 = 0x65E0402D,
X4 = 0xD1281D10, X5 = 0xBD435BAA, X6 = 0x4E9E7A02, X7 = 0x9B467ABD,
C0 = 0xD15ADE44, C1 = 0x2ECFC356, C2 = 0xF32C3FC6, C3 = 0xA2F647D7,
C4 = 0x19F71622, C5 = 0x5272ED72, C6 = 0xD5CB3B6E, C7 = 0xC9183140

Authors' Addresses 🧑‍💻

Here's who built this, and where to find them 💌

Martin Boesgaard
Cryptico A/S
Fruebjergvej 3
2100 Copenhagen
Denmark

Phone: +45 39 17 96 06
EMail: mab@cryptico.com
URL:   http://www.cryptico.com


Mette Vesterager
Cryptico A/S
Fruebjergvej 3
2100 Copenhagen
Denmark

Phone: +45 39 17 96 06
EMail: mvp@cryptico.com
URL:   http://www.cryptico.com


Erik Zenner
Cryptico A/S
Fruebjergvej 3
2100 Copenhagen
Denmark

Phone: +45 39 17 96 06
EMail: ez@cryptico.com
URL:   http://www.cryptico.com

Legal time, but make it cute 🎀 Here's the official copyright notice:

Copyright (C) The Internet Society (2006).

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 💜

The IETF doesn't take a position on whether any Intellectual Property Rights or other rights might apply to implementing or using the technology in this document, or whether any license under those rights is available. It also doesn't claim to have independently searched for any such rights. You can find the procedures for rights in RFC documents in BCP 78 and BCP 79.

Copies of IPR disclosures sent to the IETF Secretariat, along with any assurances of licenses that will be made available, or the result of any attempt to get a general license or permission for implementers or users to use such proprietary rights, can be found in the IETF's online IPR repository at http://www.ietf.org/ipr.

The IETF invites anyone to let it know about any copyrights, patents or patent applications, or other proprietary rights that might cover technology needed to implement this standard. Send that information to the IETF at ietf-ipr@ietf.org.

Acknowledgement 🌈

Funding for the RFC Editor function comes from the IETF Administrative Support Activity (IASA). Thank you, IASA, for keeping the lights on 💖

📦 where this page comes from