RFC 5830

GOST 28147-89: Encryption, Decryption, and Message Authentication Code (MAC) Algorithms

📅 published March 2010, from ietf

RFC 5830: GOST 28147-89 Encryption, Decryption, and MAC Algorithms ✨

Okay bestie, let's get into RFC 5830 🎀 It's an Independent Submission edited by V. Dolmatov, Ed., from Cryptocom, Ltd. It's Informational (so not a Standards Track spec), dated March 2010, and it has ISSN 2070-1721. The title block doesn't say it obsoletes or updates anything, so it stands on its own 🦋

Abstract 💜

So this doc is basically a info guide about the Russian federal standard for electronic encryption, decryption, and message authentication, which is GOST 28147-89 🔐 It's one of the Russian cryptographic standard algorithms that people call "GOST algorithms." Russian cryptography is showing up in Internet applications now, so this was written as info for devs and users of GOST 28147-89 who want to do encryption, decryption, and message authentication 💅

Status of This Memo 🌸

This one is not an Internet Standards Track spec. It's just published for info purposes 📚

It's a contribution to the RFC Series, independent of any other RFC stream. The RFC Editor picked to publish it at their discretion, and they make zero statement about whether it's valuable for implementing or deploying 🙈 Docs the RFC Editor approves aren't candidates for any level of Internet Standard. See Section 2 of RFC 5741 if you want the deets.

Info about this doc's current status, any errata, and how to give feedback is at http://www.rfc-editor.org/info/rfc5830 🦋

Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they were in effect on the publication date. Please actually read these, because they lay out your rights and restrictions for this doc 🫶

This document may not be modified, and derivative works of it may not be created, except to format it for publication as an RFC or to translate it into languages other than English. So no remixing it, babe 🙅‍♀️

Table of Contents 🧚

   1. Introduction ....................................................3
      1.1. General Information ........................................3
   2. Applicability ...................................................3
   3. Definitions and Notations .......................................3
      3.1. Definitions ................................................3
      3.2. Notation ...................................................4
   4. General Statements ..............................................4
   5. The Electronic Codebook Mode ....................................6
      5.1. Encryption of Plain Text in the Electronic Codebook Mode ...6
      5.2. Decryption of the Ciphertext in the Electronic
           Codebook Mode ..............................................9
   6. The Counter Encryption Mode ....................................10
      6.1. Encryption of Plain Text in the Counter Encryption Mode ...10
      6.2. Decryption of Ciphertext in the Counter Encryption Mode ...13
   7. The Cipher Feedback Mode .......................................13
      7.1. Encryption of Plain Text in the Cipher Feedback Mode ......13
      7.2. Decryption of Ciphertext in the Cipher Feedback Mode ......14
   8. Message Authentication Code (MAC) Generation Mode ..............15
   9. Security Considerations ........................................17
   10. Normative References ..........................................17
   Appendix A. Values of the Constants C1 and C2 .....................18
   Appendix B. Contributors ..........................................19

1. Introduction ✨

1.1. General Information 🎀

Okay so [GOST28147-89] is the unified cryptographic transformation algorithm for information processing systems of all different purposes. It defines the encryption/decryption rules and the rules for generating a message authentication code (MAC) 🔐

This cryptographic transformation algorithm is meant for hardware or software implementation, and it matches the cryptographic requirements. It puts no limits on the secrecy level of the info being encrypted 💖

2. Applicability 🦋

GOST 28147-89 defines the encryption/decryption model and MAC generation for a given message (document) that's meant to be sent over insecure public telecom channels between data processing systems of different purposes 📡

GOST 28147-89 is obligatory to use in the Russian Federation in all data processing systems that provide public services 🇷🇺

3. Definitions and Notations 📚

3.1. Definitions 💜

The standard uses the following terms:

Running key: a pseudo-random bit sequence generated by a given algorithm for encrypting plain texts and decrypting encrypted texts 🎲

Encryption: the process of transforming plain text into encrypted data using a cipher 🔒

MAC: an information string of fixed length that's generated from plain text and a key according to some rule, and added to the encrypted data to protect against data falsification 🛡️

Key: a defined secret state of some parameters of a cryptographic transformation algorithm, which provides a choice of one transformation out of all the possible transformations 🗝️

Cryptographic protection: data protection using the data cryptographic transformations 💅

Cryptographic transformation: data transformation using encryption and (or) MAC ✨

Decryption: the process of transforming encrypted data back into plain text using a cipher 🔓

Initialisation vector: initial values of plain parameters of a cryptographic transformation algorithm 🌱

Encryption equation: a correlation showing the process of generating encrypted data out of plain text, as a result of transformations defined by the cryptographic transformation algorithm 🧮

Decryption equation: a correlation showing the process of generating plain text out of encrypted data, as a result of transformations defined by the cryptographic transformation algorithm 🧮

Cipher: a set of reversible transformations of the set of possible plain texts onto the set of encrypted data, made according to certain rules and using keys 🌈

3.2. Notation 🌸

In this document, the following notations are used:

 ^   is a power operator.

(+)  is a bitwise addition of the words of the same length modulo 2.

[+]  is an addition of 32-bit vectors modulo 2^32.

[+]' is an addition of the 32-bit vectors modulo 2^32-1.

1..N is all values from 1 to N.

4. General Statements 👑

The structure model of the cryptographic transformation algorithm (a cryptographic model) contains:

  • a 256-bit key data store (KDS) consisting of eight 32-bit registers (X0, X1, X2, X3, X4, X5, X6, X7);
  • four 32-bit registers (N1, N2, N3, N4);
  • two 32-bit registers (N5 and N6) containing constants C1 and C2;
  • two 32-bit adders modulo 2^32 (CM1, CM3);
  • a 32-bit adder of bitwise sums modulo 2 (CM2);
  • a 32-bit adder modulo (2^32-1) (CM4);
  • an adder modulo 2 (CM5), with no limitation to its width;
  • a substitution box (K);
  • a register for a cyclic shift of 11 steps to the top digit (R).

A substitution box (S-box) K consists of eight substitution points K1, K2, K3, K4, K5, K6, K7, K8, with 64-bit memory. A 32-bit vector coming into the substitution box is divided into eight successive 4-bit vectors, and each of them is transformed into a 4-bit vector by its corresponding substitution point. A substitution point is a table of 16 lines, each containing four bits. The incoming vector picks the line address in the table, and the contents of that line is the outgoing vector. Then these 4-bit outgoing vectors are successively combined into a 32-bit vector 🧩

Remark: the standard doesn't define any S-boxes. Some of them are defined in [RFC4357] 💡

When adding and cyclically shifting binary vectors, the registers with larger numbers are considered the top digits 🔢

When writing a key (W1, W2, ..., W256), with Wq = 0..1 and q = 1..256, into the KDS, the value goes like this:

  • W1 is written into the 1st bit of the register X0;
  • the value W2 is written into the 2nd bit of the register X0 (etc.);
  • the value W32 is written into the 32nd bit of the register X0;
  • the value W33 is written into the 1st bit of the register X1;
  • the value W34 is written into the 2nd bit of the register X1 (etc.);
  • the value W64 is written into the 32nd bit of the register X1;
  • the value W65 is written into the 1st bit of the register X2 (etc.);
  • the value W256 is written into the 32nd bit of the register X7.

When rewriting the information, the value of the p-th bit of one register (adder) is written into the p-th bit of another register (adder) 🔁

The values of the constants C1 and C2 in the registers N5 and N6 are in the Appendix 1 ✨

The keys that define the fillings of the KDS and the substitution box K tables are secret elements, and they're provided according to the established procedure 🤫

The filling of the substitution box K is described in GOST 28147-89 as a long-term key element common for a whole computer network. Usually, K is used as a parameter of the algorithm, and some possible sets of K are described in [RFC4357] 🌐

The cryptographic model contemplates four working modes:

  • data encryption (decryption) in the electronic codebook (ECB) mode,
  • data encryption (decryption) in the counter (CNT) mode,
  • data encryption (decryption) in the cipher feedback (CFB) mode, and
  • the MAC generation mode.

[RFC4357] also describes the CBC mode of GOST 28147-89, but this mode is not part of the standard 🙈

5. The Electronic Codebook Mode 🦋

5.1. Encryption of Plain Text in the Electronic Codebook Mode 💖

okay bestie, first things first: the plain text gets chopped into 64-bit blocks 🧩 ✨ Each binary block Tp gets loaded into two registers, N1 and N2, one bit at a time. The bits go in like this:

Tp = (a1(0), a2(0), ... , a31(0), a32(0), b1(0), b2(0), ..., b32(0))

So a1(0) goes into the first bit of N1, a2(0) into the second bit of N1, and so on until a32(0) lands in the 32nd bit of N1. Then b1(0) goes into the first bit of N2, b2(0) into the 2nd bit of N2, and b32(0) goes into the 32nd bit of N2. 🎀

After loading, the state of the registers reads like this:

(a32(0), a31(0), ..., a2(0), a1(0))   <- register N1
(b32(0), b31(0), ..., b1(0))          <- register N2

Next, the 256 bits of the key get entered into the KDS 🔐 and split into eight 32-bit registers, X0 through X7. They're set up like this, and honestly the pattern is so iconic 😭

X0 = W32, W31, ..., W2, W1

X1 = W64, W63, ..., W34, W33

. . . . . . . . . . . . . . .

X7 = W256, W255, ..., W226, W225

The whole enciphering process for a 64-bit block runs for 32 rounds 🔥 Let's go through the first one.

In round one, the starting value of N1 gets added modulo 2^32 in the adder CM1 to the contents of X0. Quick note: N1 itself stays unchanged during this step. 🦋

The result then goes through the substitution block K, and the output vector lands in register R, where it gets cyclically shifted 11 steps towards the top digit. That shifted result is added bitwise modulo 2 in the adder CM2 to the 32-bit contents of N2. The CM2 output gets written into N1, and the old contents of N1 get written into N2. And just like that, round one is done 🌸

The later rounds follow the same pattern, just with different keys:

  • in the second round, the contents of X1 are read from the KDS;
  • in the third round, the contents of X2 are read from the KDS, and so on;
  • in the 8th round, the contents of X7 are read from the KDS.
  • in rounds 9 through 16 and 17 through 24, the contents of the KDS are read in the same order:
X0, X1, X2, X3, X4, X5, X6, X7.
  • in the last eight rounds, from the 25th to the 32nd, the contents of the KDS are read backwards:
X7, X6, X5, X4, X3, X2, X1, X0.

So across all 32 rounds of encryption, the registers get picked in this exact order 👑

X0, X1, X2, X3, X4, X5, X6, X7, X0, X1, X2, X3, X4, X5, X6, X7,

X0, X1, X2, X3, X4, X5, X6, X7, X7, X6, X5, X4, X3, X2, X1, X0

In the 32nd round, the CM2 result goes into register N2, and the old contents of N1 stay unchanged 🙈 Once round 32 wraps up, N1 and N2 together hold an encrypted data block matching the plain text block. ✨

The encryption equations for the electronic codebook mode look like this:

|a(j) = (a(j-1) [+] X(j-1)(mod 8))*K*R (+) b (j-1)
|                                                      j = 1..24;
|b(j) = a(j-1)

|a(j) = (a(j-1) [+] X(32-j))*K*R (+) b(j-1)
|                                          j = 25..31; a32 = a31;
|b(j) = a(j-1)

b(32) = (a(31) [+] X0)*K*R (+) b(31)                        j=32,

Where:

  • a(0) = (a32(0), a31(0), ..., a1(0)) is the starting contents of N1 before the first round of encryption;
  • b(0) = (b32(0), b31(0), ..., b1(0)) is the starting contents of N2 before the first round of encryption;
  • a(j) = (a32(j), a31(j), ..., a1(j)) is the contents of N1 after the j-th round of encryption;
  • b(j) = (b32(j), b31(j), ..., b1(j)) is the contents of N2 after the j-th round of encryption, j = 1..32.

R is the cyclic shift towards the top digit by 11 steps. It works like this 🦄

R(r32, r31, r30, r29, r28, r27, r26, r25, r24, r23, r22, r21,
r20, ..., r2, r1) =

(r21, r20, ..., r2, r1, r32, r31, r30, r29, r28, r27, r26, r25,
r24, r23, r22)

Finally, the 64-bit ciphertext block Tc gets pulled out of N1 and N2 in this order: the first, second, ..., 32nd bit of N1, and then the first, second, ..., 32nd bit of N2, so:

Tc = a1(32), a2(32), ..., a32(32), b1(32), b2(32), ..., b32(32)).

The remaining plain text blocks in the electronic codebook mode get encrypted the exact same way. 💅

5.2. Decryption of the Ciphertext in the Electronic Codebook Mode 🔓

Decryption is basically encryption in reverse, bestie 💜 The same 256-bit key that was used for encryption gets loaded into the KDS, and the encrypted data gets split into 64-bit blocks. Any binary information block:

Tc = (a1(32), a2(32), ..., a32(32), b1(32), b2(32), ..., b32(32))

gets loaded into N1 and N2 like this:

  • the contents of a1(32) are written into the first bit of N1;
  • the contents of a2(32) are written into the second bit of N1 (and so on);
  • the contents of a32(32) are written into the 32nd bit of N1;
  • the contents of b1(32) are written into the first bit of N2 (and so on);
  • and the contents of b32(32) are written into the 32nd bit of N2.

The decryption procedure uses the same algorithm as plain text encryption, with one exception 🎯 In the decryption rounds, the registers X0, X1, ..., X7 get read from the KDS in this order:

X0,X1,X2,X3,X4,X5,X6,X7, X7,X6,X5,X4,X3,X2,X1,X0,

X7,X6,X5,X4,X3,X2,X1,X0, X7,X6,X5,X4,X3,X2,X1,X0.

The decryption equations are:

|a(32-j) = (a(32-j+1) [+] X(j-1))*K*R (+) b(32-j+1)
|                                                        j = 1..8;
|b(32-1) = a(32-j+1)

|a(32-j) = (a(32-j+1) [+] X(j-1)(mod 8))*K*R (+) b(32-j+1)
|                                                       j = 9..31;
|b(32-1) = a(32-j+1)

|a(0) = a(1)
|                                                            j=32.
|b(0) = (a(1) [+] X0)*K*R (+) b1

After 32 working rounds, the contents of the adders N1 and N2 form a plain text block:

Tp = (a1(0), a2(0), ... , a32(0), b1(0), b2(0), ..., b32(0))

which corresponds to the encrypted data block like so:

  • the value of a1(0) of the block Tp corresponds to the contents of the first bit of N1;
  • the value of a2(0) corresponds to the contents of the second bit of N1 (etc.);
  • the value of b1(0) corresponds to the contents of the first bit of N2;
  • the value of b2(0) corresponds to the contents of the second bit of N2 (etc.);
  • the value of b32(0) corresponds to the contents of 32nd bit of N2;
  • the remaining blocks of encrypted data are decrypted similarly.

The encryption algorithm in the electronic codebook mode for a 64-bit block Tp is called A, so:

A(Tp) is A(a(0), b(0)) = (a(32), b(32)) = Tc.

6. The Counter Encryption Mode 🧁

6.1. Encryption of Plain Text in the Counter Encryption Mode 🌈

Okay, now we're switching modes 🦋 The plain text, split into 64-bit blocks Tp(1), Tp(2), ..., Tp(M-1), Tp(M), gets encrypted by bitwise addition modulo 2 in the adder CM5 with a running key Gc, produced in 64-bit blocks:

Gc = (Gc(1), Gc(2), ..., Gc(M-1), Gc(M))

M depends on how big the plain text is. Gc(i) is the i-th 64-bit block, where i=1..M. The block Tp(M) can have fewer than 64 bits. In that case, the unused part of the running key block Gc(M) gets thrown away 🗑️

256 bits of the key go into the KDS 🔐 Registers N1 and N2 take a 64-bit binary sequence, an initialisation vector S = (S1, S2, ..., S64), which is the starting filling of those registers for generating the M running key blocks. The initialisation vector gets loaded like this:

  • the value of S1 is written into the first bit of N1;
  • the value of S2 is written into the second bit of N1 (etc.);
  • the value of S32 is written into the 32nd bit of N1;
  • the value of S33 is written into the first bit of N2;
  • the value of S34 is written into the 33th bit of N2 (etc.);
  • the value of S64 is written into the 32nd bit of N2.

The starting filling of N1 and N2 (the initialisation vector S) gets encrypted in the electronic codebook mode, following the rules from Section 5.1. The result of that encryption, A(S) = (Y0, Z0), is rewritten into the 32-bit registers N3 and N4, so that the contents of N1 go into N3 and the contents of N2 go into N4. ✨

The filling of N4 gets added modulo (2^32-1) in the adder CM4 to the 32-bit constant C1 from register N6, and the result is written into N4. The filling of N3 gets added modulo 2^32 in the adder CM3 to the 32-bit constant C2 from register N5, and the result is written into N3. 💖

The filling of N3 gets copied into N1, and the filling of N4 gets copied into N2, while the fillings of N3 and N4 stay as they are.

The filling of N1 and N2 gets encrypted in the electronic codebook mode, following Section 5.1. The encrypted filling of N1 and N2 becomes the first 64-bit block of the running key, Gc(1). This block then gets bitwise added modulo 2 in the adder CM5 to the first 64-bit block of the plain text:

Tp(1) = (t1(1), t2(1), ..., t63(1), t64(1)).

The result of that addition is a 64-bit block of encrypted data:

Tc(1) = (tau1(1), tau2(1), ..., tau63(1), tau64(1)).

Here's how the bits line up 🎀 The value of tau1(1) in block Tc(1) is the modulo 2 sum in CM5 of t1(1) from block Tp(1) and the value of the first bit of N1. The value of tau2(1) in block Tc(1) is the modulo 2 sum in CM5 of t2(1) from block Tp(1) and the value of the second bit of N1, and so on. Finally, the value of tau64(1) in block Tc(1) is the modulo 2 sum in CM5 of t64(1) from block Tp(1) and the value of the 32nd bit of N2.

To get the next 64-bit running key block, Gc(2), the filling of N4 gets added modulo (2^32-1) in the adder CM4 to the constant C1 from N6, and the filling of N3 gets added modulo 2^32 in the adder CM3 to the constant C2 from N5. The new filling of N3 gets copied into N1, and the new filling of N4 gets copied into N2, while the fillings of N3 and N4 stay as they are. 🔁

The filling of N1 and N2 gets encrypted in the electronic codebook mode, following Section 5.1. The encrypted filling becomes the second 64-bit block of the running key, Gc(2). This block gets bitwise added modulo 2 in the adder CM5 to the first 64-bit block of plain text Tp(2). Then the remaining running key blocks, Gc(3), Gc(4), ..., Gc(M), are generated, and the plain text blocks Tp(3), Tp(4), ..., Tp(M) get encrypted in the same way. If the last M-th block of plain text is shorter than 64 bits, only the matching number of bits from the last M-th block of the running key gets used, and the rest gets discarded. 🧚

The initialisation vector S and the encrypted data blocks Tc(1), Tc(2), ..., Tc(M) get sent over the telecommunication channel or stored in computer memory 📡

The encryption equation is:

Tc(i) = A(Y[i-1] [+] C2, Z[i-1]) [+]' C1) (+) Tp(i)
      = Gc(i) (+) Tp(i)     i=1..M

where:

Y[i] is the contents of the register N3 after encrypting the
i-th block of the plain text Tp(i);

Z(i) is the contents of the register N4 after encrypting the
i-th block of the plain text Tp(i);

(Y[0], Z[0]) = A(S).

6.2. Decryption of Ciphertext in the Counter Encryption Mode ✨

Okay bestie, the 256 bits of the key that encrypted Tp(1), Tp(2), ..., Tp(M) get dropped into the KDS 🔑. Then the initialisation vector S goes into the registers N1 and N2, and just like in section 6.1 we generate M blocks of the running key, Gc(1), Gc(2), ..., Gc(M) 💜. The encrypted blocks Tc(1), Tc(2), ..., Tc(M) get added bitwise modulo 2 in the adder CM5 with those running key blocks, and boom, you get the plain text blocks Tp(1), Tp(2), ..., Tp(M). Tp(M) might be shorter than 64 bits, so keep an eye on that one 👀.

The decryption equation is:

Tp(i) = A (Y[i-1] [+] C2, Z[i-1] [+]' C1) (+) Tc(i)
      = Gc(i) (+) Tc(i)     i = 1..M

7. The Cipher Feedback Mode 🦋

7.1. Encryption of Plain Text in the Cipher Feedback Mode

Now we're in the cipher feedback mode, and it's giving chain reaction 🔗. The plain text gets split into 64-bit blocks Tp(1), Tp(2), ..., Tp(M), and each one is encrypted by bitwise addition modulo 2 in the adder CM5 with a running key Gc that's built out of 64-bit blocks. So Gc(i)=(Gc(1), Gc(2), ..., Gc(M)), where M depends on the length of the plain text. Gc(i) is the i-th 64-bit block, with i=1,M. The block Tp(M) can have fewer than 64 bits, which is totally normal and not a bug 🙃.

The exact wording for how M is defined looks like this:

where M is defined by
                                                               ___
the length of the plain text, Gc(i) is the i-th 64-bit block, i=1,M.
The number of bits in the block Tp(M) may be less than 64.

Next up, 256 bits of the key get put into the KDS 🔑. The 64-bit initialisation vector S = (S1, S2, ..., S64) goes into N1 and N2, same as described in section 6.1 ✨.

The initial filling of N1 and N2 gets encrypted in the electronic codebook mode, following the requirements in section 6.1 💅. If that encrypted filling of N1 and N2 is the first 64-bit block of the running key, Gc(1)=A(S), then it gets added bitwise modulo 2 with the first 64-bit block of plain text, Tp(1) = (t1(1), t2(1), ..., t64(1)).

The result is a 64-bit block of encrypted data:

Tc(1) = (tau1(1), tau2(1), ..., tau64(1)).

Here's the feedback loop part, and it's lowkey my favourite 🌸. The block of encrypted data Tc(1) doubles as the starting state of N1 and N2, which is used to generate the second running key block Gc(2), and it gets written back into those registers as feedback. The bits land like this:

  • tau1(1) goes into the first bit of N1 🎀
  • tau2(1) goes into the second bit of N1, and so on 🌈
  • tau32(1) goes into the 32nd bit of N1 🍓
  • tau33(1) goes into the first bit of N2 🧚
  • tau34(1) goes into the second bit of N2, and so on 🦋
  • tau64(1) goes into the 32nd bit of N2 👑

The filling of N1 and N2 gets encrypted in the electronic codebook mode, following the requirements in section 6.1 💜. That encrypted filling becomes the second 64-bit running key block, Gc(2), and it gets added bitwise modulo 2 in the adder CM5 to the second plain text block, Tp(2).

Generating the later running key blocks Gc(i) and encrypting the matching plain text blocks Tp(i) (i = 3..M) works the exact same way ✨. If the last block, Tp(M), is shorter than 64 bits, only that many bits of the M-th running key block, Gc(M), get used, and the rest are thrown out 🗑️.

The encryption equations in the cipher feedback mode are:

|Tc(1) = A(S) (+) Tp(1) = Gc(1) (+) Tp(1)
|
|Tc(i) = A(Tc(i-1)) (+) Tp(i) = Gc(i) + Tp(i), i = 2..M.

Finally, the initialisation vector S and the encrypted blocks Tc(1), Tc(2), ..., Tc(M) get sent over the telecommunication channel or into computer memory 📡.

7.2. Decryption of Ciphertext in the Cipher Feedback Mode

Decryption is the same energy in reverse 🔄. The 256 bits of the key used for encrypting Tp(1), Tp(2), ..., Tp(M) go into the KDS 🔑. The initialisation vector S goes into N1 and N2, similar to section 6.1 💖.

The initial filling of N1 and N2 (that's the initialisation vector S) gets encrypted in the electronic codebook mode, following subsection 6.1. That encrypted filling of N1 and N2 is the first block of the running key, Gc(1) = A(S). It gets added bitwise modulo 2 in the adder CM5 with the encrypted data block Tc(1), and that gives you the first plain text block, Tp(1) ✨.

The encrypted data block Tc(1) becomes the starting filling of N1 and N2 for generating the second running key block, Gc(2). Tc(1) gets written into N1 and N2 following the requirements in subsection 6.1, and the resulting block Gc(2) is added bitwise modulo 2 in the adder CM5 to the second encrypted data block, Tc(2). That gives you the plain text block, which is written as Tc(2) in the original 🙈.

It keeps going the same way. The encrypted data blocks Tc(2), Tc(3), ..., Tc(M-1) get written into N1 and N2 one after another, and the running key blocks Gc(3), Gc(4), ..., Gc(M) get generated from them in the electronic codebook mode 🌀. Those running key blocks get added bitwise modulo 2 in the adder CM5 to the encrypted data blocks Tc(3), Tc(4), ..., Tc(M), which gives you the plain text blocks Tp(3), Tp(4), ..., Tp(M). Heads up: the last plain text block, Tp(M), can have fewer than 64 bits 💅.

The decryption equations in the cipher feedback mode are:

|Tp(1) = A(S) (+) Tc(1) = Gc(1) (+) Tc(1)
|
|Tp(1) = A(Tc(i-1)) (+) Tc(i) = Gc(i) (+) Tc(i), i=2..M

8. Message Authentication Code (MAC) Generation Mode 🔐

Okay, this part is about protecting against falsified plain text 🕵️‍♀️. To do that, you take plain text made of M 64-bit blocks, Tp(1), Tp(2), ..., Tp(M), where M >= 2, and generate one extra l-bit block called the message authentication code, I(l). The MAC generation process is the same for all the encryption and decryption modes, so you only learn it once 🧠.

Here's how it goes. First, the first plain text block:

Tp(1) = (t1(1), t1(2), ..., t64(1)) = (a1(1)[0], a2(1)[0], ...,
        a32(1)[0], b1(1)[0], b2(1)[0], ..., b32(1)[0])

gets written into the registers N1 and N2 💖. The bits map like this:

  • t1(1) = a1(1)[0] goes into the first bit of N1 🎀
  • t2(1) = a2(1)[0] goes into the second bit of N1, etc. 🌈
  • t32(1) = a32(1)[0] goes into the 32nd bit of N1 🍓
  • t33(1) = b1(1)[0] goes into the first bit of N2, etc. 🧚
  • t64(1) = b32(1)[0] goes into the 32nd bit of N2 👑

The filling of N1 and N2 gets transformed through the first 16 rounds of the encryption algorithm in the electronic codebook mode, which you can check out in subsection 6.1 ✨. The KDS has the same key that was used to encrypt the plain text blocks Tp(1), Tp(2), ..., Tp(M) into the matching encrypted data blocks Tc(1), Tc(2), ..., Tc(M) 🔑.

After those 16 working rounds, the filling of N1 and N2 looks like this:

(a1(1)[16], a2(1)[16], ..., a32(1)[16], b1(1)[16], b2(1)[16], ...,
 b32(1)[16])

It gets added in CM5 modulo 2 to the second block, Tp(2) = (t1(2), t2(2), ..., t64(2)) 💜.

The result of that addition is:

(a1(1)[16](+)t1(2), a2(1)[16](+)t2(2), ..., a32(1)[16](+)t32(2),
 b1(1)[16](+)t33(2), b2(1)[16](+)t34(2), ..., b32(1)[16](+)t64(2))

=

(a1(2)[0], a2(2)[0] ..., a32(2)[0], b1(2)[0], b2(2)[0], ...,
 b32(2)[0])

That gets written into N1 and N2, then transformed through the first 16 rounds of the encryption algorithm in the electronic codebook mode 🌸.

The resulting filling of N1 and N2 gets added in CM5 modulo 2 with the third block, Tp(3), and so on. The last block, Tp(M) = (t1(M), t2(M), ..., t64(M)), gets padded with zeros to a full 64-bit block if it needs it, then added in CM5 modulo 2 with the filling of N1 and N2 from (a1(M-1)[16], a2(M-1)[16], ..., a32(M-1)[16], b1(M-1)[16], b2(M-1)[16], ..., b32(M-1)[16]) 🧩.

That addition gives:

(a1(M-1)[16](+)t1(M), a2(M-1)[16](+)t2(M), ..., a32(M-1)[16](+)
 t32(M), b1(M-1)[16](+)t33(M), b2(M-1)[16](+)t34(M), ...,
 b32(M-1)[16](+)t64(M))

=

(a1(M)[0], a2(M)[0] ..., a32(M)[0], b1(M)[0], b2(M)[0], ...,
 b32(M)[0])

That result gets written into N1 and N2, and encrypted in the electronic codebook mode after the first 16 rounds of the algorithm 🔥. From the resulting filling of the registers N1 and N2:

(a1(M)[16], a2(M)[16] ..., a32(M)[16], b1(M)[16], b2(M)[16], ...,
 b32(M)[16])

you pick an l-bit string I(l), which is the MAC 🎉:

I(l) = [a(32-l+1)(M)[16], a(32-l+2)(M)[16], ..., a32(M)[16]].

The MAC I(l) gets sent over the telecommunication channel or into computer memory, attached to the end of the encrypted data, so it looks like Tc(1), Tc(2), ..., Tc(M), I(l) 📦.

When the encrypted data Tc(1), Tc(2), ..., Tc(M) shows up, it gets decrypted, which gives you the plain text blocks Tp(1), Tp(2), ..., Tp(M). Then the MAC I'(l) is generated as described in subsection 5.3, and it gets compared with the MAC I(l) that came along with the encrypted data, whether that came over the telecommunication channel or from computer memory 🔍. If the MACs don't match, the plain text blocks Tp(1), Tp(2), ..., Tp(M) are considered false 🚨.

The MAC I(l) (and I'(l) on the decryption side) can be generated either before encryption (or after decryption) for the whole message, or at the same time as encryption (or decryption), block by block ⏱️. The first plain text blocks used for MAC generation can hold service information, like the address section, a time mark, the initialisation vector, and so on, and they may be left unencrypted 🫶.

The parameter l (the bit length of the MAC) comes from the actual cryptographic requirements. The thing to remember is that the chance of false data getting imposed is 2^-l 🎯.

9. Security Considerations 💀

Plot twist: this entire document is about security considerations 😭🔐. Take that seriously, bestie, because the whole thing is built around protecting data, so treat every bit of it with respect 🫡.

10. Normative References 📚

[GOST28147-89] "Cryptographic Protection for Data Processing System",
               GOST 28147-89, Gosudarstvennyi Standard of USSR,
               Government Committee of the USSR for Standards, 1989.
               (In Russian)

[RFC4357]      Popov, V., Kurepkin, I., and S. Leontiev, "Additional
               Cryptographic Algorithms for Use with GOST 28147-89,
               GOST R 34.10-94, GOST R 34.10-2001, and GOST R
               34.11-94 Algorithms", RFC 4357, January 2006.

Appendix A. Values of the Constants C1 and C2 🌟

The constant C1 is:

The bit of N6   32 31 30 29 28 27 26 25 24 23 22 21 20 19 18

The bit value    0  0  0  0  0  0  0  1  0  0  0  0  0  0  0


The bit of N6   17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

The bit value    1  0 0  0  0  0  0  0  1 0 0 0 0 0 1 0 0

The constant C2 is:

The bit of N6   32 31 30 29 28 27 26 25 24 23 22 21 20 19 18

The bit value    0  0  0  0  0  0  0  1  0  0  0  0  0  0  0


The bit of N6   17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

The bit value    1  0 0  0  0  0  0  0  1 0 0 0 0 0 0 0 1

Appendix B. Contributors 🎀

Dmitry Kabelev
Cryptocom, Ltd.
14 Kedrova St., Bldg. 2
Moscow, 117218
Russian Federation

EMail: kdb@cryptocom.ru


Igor Ustinov
Cryptocom, Ltd.
14 Kedrova St., Bldg. 2
Moscow, 117218
Russian Federation

EMail: igus@cryptocom.ru


Irene Emelianova
Cryptocom Ltd.
14 Kedrova St., Bldg. 2
Moscow, 117218
Russian Federation

EMail: irene@cryptocom.ru

Author's Address 💌

Vasily Dolmatov, Ed.
Cryptocom, Ltd.
14 Kedrova St., Bldg. 2
Moscow, 117218
Russian Federation

EMail: dol@cryptocom.ru
📦 where this page comes from