1. 2001.9.12 2nd NESSIE Workshop Copyright (C) NTT&MELCO 2001 Update on Camellia Camellia Design Team

2. 2001.9.12 2nd NESSIE Workshop Copyright (C) NTT&MELCO 2001 New Results on Security As far as we know, the following results are published. No attacks exist on 12 and more rounds without FL/FL -1 for 128-bit key (14 and more rounds for 256-bit key). Full Camellia [18 (for 128-bit key) or 24 (for 192/256-bit key) rounds with FL/FL -1 ] seems to be secure and achieve high security margin. AttackersMain ResultsPresentation T.Kawabata, T.Kaneko 8rounds without FL/FL -1 are breakable for 128-bit keys by H.O.D. This Workshop Y. He, S. Qing 6 rounds are breakable by Square attack ICICS 2001 M. Sugita, et. al. 9 rounds without FL/FL -1 are distinguishable (and 11 rounds are breakable for 128-bit key) by T.D.C. ASIACRYPT 2001

3. 2001.9.12 2nd NESSIE Workshop Copyright (C) NTT&MELCO 2001 Updated Performance on SW #1 From CRYPTREC Report 2000 For 32-bit and 64-bit processors Assembly code Measurement function is provided by CRYPTREC Processors Encryption (Decryption) Speed One block encryption (decryption) and Key Generation Encryption [cycles] Decryption [cycles] Enc + Key [cycles] Dec + Key [cycles] Pentium III326 467474 UltraSPARCIIi355 403 Alpha 21264282 448435

4. 2001.9.12 2nd NESSIE Workshop Copyright (C) NTT&MELCO 2001 Updated Performance on SW #2 New Implementation – Best Results Assembly code for Z80 processor  ROM Usage: 1,268 bytes  RAM Usage: 60 bytes (including stack, text, key area)  Enc+Key: 35,951 states  Dec+Key: 37,553 states (using on-the-fly key generation) Java for Pentium III  Key Generation: 9,091 cycles  Encryption Speed: 793 cycles

5. 2001.9.12 2nd NESSIE Workshop Copyright (C) NTT&MELCO 2001 Updated Performance on HW New Implementation – Best Results (ASIC) Mitsubishi 0.18  m ASIC CMOS (FPGA) Xilinx VirtexE TargetArea [Kgates]Speed [Mbps] Efficiency (=Speed/Area) Smallest8.12177.6221.87 Best Efficiency11.871,050.9088.52 Fastest44.301,881.2542.47 TargetArea [slices]Speed [Mbps] Efficiency (=Speed/Area) Smallest1,780227.42127.76 Best Efficiency (Fastest) 9,6926,749.99696.45

6. 2001.9.12 2nd NESSIE Workshop Copyright (C) NTT&MELCO 2001 Summary New Results on Security of Camellia Updated Performance on SW and HW A Comment on D14 “Report on the Performance Evaluation of NESSIE Candidates I” D14 contains (I) Estimation of # of basic operations (II) Performance measurement using reference C code Our reference C code is NOT optimized.  D14 describes 161 cycles/byte on P III for Camellia  Our optimized C code runs in 36 cycles/byte on P II/III (See NESSIE submission) Please also look at performance of optimized codes !! Camellia is a Royalty-free algorithm