(IJCNS) International Journal of Computer and Network Security, 1

Vol. 1, No. 2, November 2009

The Stone Cipher-192 (SC-192): A Metamorphic

Cipher
Magdy Saeb

Computer Engineering Department,

Arab Academy for Science, Tech. & Maritime Transport
Alexandria, EGYPT
(On-Leave), Malaysian Institute of Microelectronic Systems MIMOS
Kuala Lumpur, MALAYSIA
[email protected]

Abstract: The Stone Cipher-192 is a metamorphic cipher that user key. The key stream is used to select the operation; thus
utilizes a variable word size and variable-size user’s key. In the providing a random however recoverable sequence of such
preprocessing stage, the user key is extended into a larger table or operations. A bit-balanced operation provides an output that
bit-level S-box using a specially developed one-way function. has the same number of ones and zeroes. These operations
However for added security, the user key is first encrypted using are XOR, INV, ROR and NOP. Respectively, these are,
the cipher encryption function with agreed-upon initial values. The
xoring a key bit with a plaintext bit, inverting a plaintext
generated table is used in a special configuration to considerably
bit, exchanging one plaintext bit with another one in a given
increase the substitution addressing space. Accordingly, we call
this table the S-orb. Four bit-balanced operations are pseudo- plaintext word using a rotation right operation and
randomly selected to generate the sequence of operations producing the plaintext bit without any change. In fact,
constituting the cipher. These operations are: XOR, INV, ROR, these four operations are the only bit-balanced logic
NOP for bitwise xor, invert, rotate right and no operation operations. In the next few sections, we discuss the design
respectively. The resulting key stream is used to generate the bits rationale, the structure of the cipher, the one-way function
required to select these operations. We show that the proposed employed to generate the sub-keys, the software and
cipher furnishes concepts of key-dependent pseudo random hardware implementations of the cipher, a comparison with
sequence of operations that even the cipher designer cannot a polymorphic cipher and a discussion of its security against
predict in advance. In this approach, the sub-keys act as program known and some probable cryptanalysis attacks. Finally, we
instructions not merely as a data source. Moreover, the provide a summary of results and our conclusions.
parameters used to generate the different S-orb words are likewise
key-dependent. We establish that the self-modifying proposed
cipher, based on the aforementioned key-dependencies, provides 2. Design Rationale
an algorithm metamorphism and adequate security with a simple It is a long-familiar fact that all ciphers, including block and
parallelizable structure. The ideas incorporated in the
development of this cipher may pave the way for key-driven stream ciphers, are emulating a one-time pad OTP.
encryption rather than merely using the key for sub-key However, for provable security, the key bits have to be used
generation. The cipher is adaptable to both hardware and only once for each encrypted plaintext bit. Obviously, with
software implementations. Potential applications include voice
present day technology this is not a practical solution.
and image encryption.
Alternatively, one resorts to computational complexity
Keywords: metamorphic, polymorphic, cipher, cryptography, security. In this case, the key bits will be used more than
filters, hash. once. Unfortunately, this will provide the cipher
cryptanalyst with the means to launch feasible statistical
1. Introduction attacks. To overcome these known attacks, we propose an
A metamorphic reaction takes place in a rock when various improvement in the nonlinearity-associated filtering of the
minerals go from amphibolites facies to some color schist plaintext bits. This can be achieved in various ways as
facies. Some of the minerals such as quartz may not take shown in [1]; however, the process can be further simplified
place in this reaction. The process in its essence follows and become appreciably faster and more riotously-secure if
certain rules; however the end result provides a pseudo
we parallelize all operations employed. We will establish
random distribution of the minerals in the rock or stone.
The metamorphic natural process results in thousands or that the proposed configuration can be further parallelized
even millions of different shapes of the rock or stone. This to enormously improve its security and throughput. One can
process has inspired us to design and implement a new imagine the algorithm as a pseudo random sequence of
metamorphic cipher that we call “Stone Cipher-192”. The operations that are totally key-dependent. Accordingly, we
internal sub-keys are generated using a combination of the presuppose that most known attacks will be very difficult to
encryption function itself and a 192-bit specially-designed
launch since there are no statistical clues left to the attacker.
one-way function. The idea of this cipher is to use four low
level operations that are all bit-balanced to encrypt the The algorithm utilized is randomly selected. Even the cipher
plaintext bit stream based on the expanded stream of the designer has no clear idea what is the sequence of bitwise
2 (IJCNS) International Journal of Computer and Network Security,
Vol. 1, No. 2, November 2009

operations would be. The encryption low-level operations

are selected to be bit-balanced. That is, they do not provide The basic crypto logic unit (CLU) is shown in Figure 2. All
any bias to the number of zeroes or ones in the output operations are at the bit level. The unit is to be repeated a
number of times depending on the required word or block
cipher. The result of such an approach will be the creation
size. The rotation operation, referred to by the circular
of an immense number of wrong messages that conceal the arrow, is performed using multiplexers as shown in Figure
only correct one. Therefore, the cryptanalyst is left with the 3. In the software version these multiplexers are replaced by
sole option of attacking the key itself. However, if the sub- “case” or “switch” statement. This CLU is used as the
keys are generated based on a cascade of the same encryptor or the decryptor. This can be easily verified, if we
encryption function and a one-way hash, then we conceive investigate the truth table shown in Appendix A. In this
table, if we change the output cipher bit to become an input
that these attacks will be unmanageable to launch. We are
plain text bit, the new output will be the same as the old
producing an unexampled key-dependent encryption plain text bit. Obviously, this is a feature of the applied
algorithm. In this case, the least high-priced kept secret is functions namely XOR, INV or NOP. The only exception is
the key. The proposed system is malleable and resilient if in the case of ROR, the decryptor will use ROL.
Pi Ki
unknowingly disclosed. This theme does not dispute
XOR
AND3

Kerckhoffs' principle [2] or Shannon’s maxim since the inst5

7404

inst14
7404 inst8

“enemy knows the system”. However, it provides a degree of inst16

7404 AND3
7404

security against statistical attacks [3] that, we believe, inst12

inst17
inst9
OR4

cannot be attained with conventional ciphers [4], [5], [6],

Ci
AND3

[7], [8],[9]. 7404

inst18 inst10
inst

AND3

inst11

3. The Structure of the Cipher

S1
The conceptual block diagram of the proposed cipher is S0

shown below in Figure 1. It is constructed of two basic Figure 2. The basic crypto logic unit
functions; the encryption function and the sub-key
generation one-way hash function. The pseudo random
number generator is built using the same encryption
function and the one-way hash function in cascade. Two
large numbers (a, b) are used to iteratively generate the sub-
keys. The details of the substitution box or what we call the
S-orb can be found in [1]. The user key is first encrypted
then the encrypted key is used to generate the sub-keys.

Figure 3. The rotation operation (ROTR) implementation

using multiplexers
The operation selection bits (S1 S0) can be chosen from any
two sub-key consecutive bits; as shown in Figure 4. The
same applies for the rotation selection bits (S’1 S’0).

Figure 1. The structure of the cipher

The encryption function or the cipher engine is built using

four low-level operations. These are XOR, INV, ROR and
NOP. Table 1 demonstrates the details of each one of these
operations.
Figure 4. The proposed key format where the location of the
Table 1: The basic cipher engine (encryption function)
operations selection bits is shown
Mnemonic Operation Select Operation
code
XOR Ci = Ki Pi 00 4. The One-way Hash Function
INV Ci = ¬(Pi) 01 Cryptographic one-way functions or message digest have
ROR Pi ← Pj 10 numerous applications in data security. The recent crypto-
NOP Ci = Pi 11 analysis attacks on existing hash functions have provided
 (IJCNS) International Journal of Computer and Network Security, 3
Vol. 1, No. 2, November 2009

the motivation for improving the structure of such functions.

The design of the proposed hash is based on the principles Theorem 5.1:
provided by Merkle’s work [10], Rivest MD-5 [11], SHA-1 Let h be an m-bit to n-bit hash function where m >= n input
and RIPEMD [12]. However, a large number of keys k1, k2 to h.
modifications and improvements are implemented to enable Then h (k1) = h (k2) with probability equal to:
this hash to resist present and some probable future crypto- 2-m + 2-n – 2-m-n
analysis attacks. The procedure, shown in Figure 5, Proof:
provides a 192-bit long hash [13] that utilizes six variables If k1 = k2 , then h (k1) = h (k2).
for the round function. However, if k1≠ k2, then h(k1) = h(k2) with probability 2-n.
k1 = k2 with probability 2-m and k1≠ k2 with probability 1- 2-
m
.
Then the probability that h (k1) = h(k2) is given by:
Pr {h (k1) = h (k2)} = 2-m + (1 - 2-m). 2-n
As an example, assume two 192-bit different keys x1, x2
then
Pr {h(x1) = h(x2)} = 2. 2-192 – 2-384
= 2-191 (1 - 2-193) ≈ 3.186 x 10-58
This is a negligible probability of collision of two different
keys.

5. The Pseudo Random Number Generator

(PRG)

Figure 5. Operation of MDP-192 one-way function [13] The combination of the encryption function and the one-way
hash function is used to generate the sub-keys. The cipher
A 1024-bit block size, with cascaded xor operations and
designer has to select which one should precede the other.
deliberate asymmetry in the design structure, is used to
provide higher security with negligible increase in execution Based on the work by Maurer and Massey [15] where they
time. The design of new hashes should follow, we believe, have proved that a cascade of two ciphers is as strong as its
an evolutionary rather than a revolutionary paradigm. first cipher. Therefore, we have adjudicated to start with the
Consequently, changes to the original structure are kept to a encryption function. The one-way hash function is then used
minimum to utilize the confidence previously gained with recursively to generate the sub-keys based on two large
SHA-1 and its predecessors MD4[14] and MD5. However,
numbers that are derived from the user key. In this case, the
the main improvements included in MDP-192[13] are: The
increased size of the hash; that is 192 bits compared to 128 encryption function requires some initial agreed-upon vector
and 160 bits for the MD-5 and SHA-1 schemes. The security value (IV), [16], [17], [18] to complete the encryption
bits have been increased from 64 and 80 to 96 bits. The process. This IV can be regarded as a long-term key or even
message block size is increased to 1024 bits providing faster a group-key that can be changed on a regular basis or when
execution times. The message words in the different rounds a member leaves the group. The combination of the
are not only permuted but computed by xor and addition
encryption function and the one-way function are used as
with the previous message words. This renders it harder for
local changes to be confined to a few bits. In other words, the required pseudo random number generator PRG. It is
individual message bits influence the computations at a worth pointing out that the design of the cipher intentionally
large number of places. This, in turn, provides faster allows the change of the one-way hash if successfully
avalanche effect and added security. Moreover, adding two attacked.
nonlinear functions and one of the variables to compute
another variable, not only eliminates the possibility of
certain attacks but also provides faster data diffusion. The 6. The Algorithm
fifth improvement is based on processing the message
blocks employing six variables rather than four or five The algorithm can be formally described as shown in the
variables. This contributes to better security and faster next few lines.
avalanche effect. We have introduced a deliberate
asymmetry in the procedure structure to impede potential Algorithm: STONEMETAMORPHIC
and some future attacks. The xor and addition operations do
INPUT: Plain text message P, User Key K, Block Size B
not cause appreciable execution delays for today’s
processors. Nevertheless, the number of rotation operations, OUTPUT: Cipher Text C
in each branch, has been optimized to provide fast Algorithm body:
avalanche with minimum overall execution delays. To verify
the security of this hash function, we discuss the following Begin
simple theorem [13]: Begin key schedule
4 (IJCNS) International Journal of Computer and Network Security,
Vol. 1, No. 2, November 2009

1. Read user key; 7. Software Implementation

2. Encrypt user key by calling encrypt function and using
The pseudo C-function [19] that represents such a table is
the initial agreed-upon values as the random input to this
given by:
function; encrypt (plain-text-bit, key-bit, selection-bit0, selection-bit1,
3. Read the values of the large numbers a and b from the rot-bit)
encrypted key; {
4. Generate a sub-key by calling the hash one-way function a1= plain-text-bit ^ key-bit;
and using the constants a, b; e1= a1 & (~selection-bit0) & (~selection-bit1);
5. Store the generated value of the subkey; b1= ~ plain-text-bit;
f1= b1 & (selection-bit0) & (~selection-bit1);
6. Repeat steps 5 and 6 to generate the required number of
g1= rot-bit & (~selection-bit0) & (selection-bit1);
subkeys;
h1= plain-text-bit & (selection-bit0) & (selection-
End key schedule; bit1);
cipher-bit = e1|f1|g1|h1;
Begin Encryption return (cipher-bit);
7. Read a block B of the message P into the message cache; }
8. Use the next generated 192-bit key to bit-wise encrypt the
plain text bits by calling the encrypt function; 8. Hardware Implementation
9. If message cache is not empty, Goto step 8;
The hardware version of the CLU, previously shown in
10. Else if message cache is empty: Figure 2, is FPGA-implemented. We have used Altera
If message not finished Quartus II 6.1 Web Edition, [20]. The average delay per
10.1 Load next block into message cache; byte was found to be 4.33 cycles per byte. Straightaway, if
we use four CLUs in-parallel, this delay will be
10.2 Goto 8;
approximately equal to one cycle per byte. This proposed
Else if message is finished then halt; parallel configuration is shown in Figure 6.
End Encryption;
End Algorithm.

Function ENCRYPT
Begin
1. Read next message bit;
2. Read next key bit from sub-key;
3. Read selection bits from sub-key;
4. Read rotation selection bits from sub-key;
5. Use selection & rotation bits to select and perform
Figure 6. The proposed parallel configuration
operation: XOR, INV, ROR, NOP;
6. Perform the encryption operation using plaintext bit and A representative code of the Verilog file used to FPGA-
sub-key bit to get a cipher bit; implement the CLU is given by:
7. Store the resulting cipher bit; module metamorph (p1,k1,s0,s1,p2,c1);
End; input p1,k1,s0,s1,p2;
output c1;
As seen from the above formal description of the algorithm, xor(a1,p1,k1);
and(e1,a1,~s0,~s1);
it simply consists of a series of pseudo random calls of the
assign b1= ~p1;
encryption function. However, each call will trigger a and(f1,b1,s0,~s1);
different bitwise operation. The simplicity of this algorithm and(g1,p2,~s0,s1);
readily lends itself to parallelism. This parallelism can be and(h1,p1,s0,s1);
achieved using today’s superscalar multi-threading or(c1,e1,f1,g1,h1);
capabilities or multiple data paths on a specialized hardware endmodule
such as FPGA with their contemporary vast gate count.
 (IJCNS) International Journal of Computer and Network Security, 5
Vol. 1, No. 2, November 2009

9. Comparison with Chameleon Polymorphic operations provides the metamorphic nature of the cipher.
Cipher This, in turn, hides most statistical traces that can be
utilized to launch these attacks. Each key has its own unique
“weaknesses” that will affect the new form of the algorithm
As seen from the given analysis and results, one can
utilized. Thus, different keys will produce completely
summarize the various characteristics of this cipher, when
different forms (meta-forms) of the cipher. Even the cipher
compared to Chameleon Polymorphic Cipher [Saeb09], as
designer cannot predict in advance what these forms are. It
follows:
can be easily shown that the probability of guessing the

Table 2: A comparison between Stone Metamorphic Cipher correct sequence of operations is of the order of , where
and Chameleon Polymorphic Cipher w is the word size and N is the number of rounds. That is
for, say, a word size of 8 bits, the probability of guessing this
Cipher Chameleon-192 Stone-192 word only is . For a block size of 64 bits, this
Characteristic Polymorphic Metamorphic
Cipher Cipher probability is . Consequently, statistical analysis is not
User key size Variable Variable adequate to link the plain text to the cipher text. With
Sub-keys 192-bit K, S(K) 192-bit K,
different user keys, we end up with a different “morph” of
S(K), S’(K)
Estimated 10 cycles/byte 6 cycles/byte the cipher; therefore, it is totally infeasible to launch attacks
maximum by varying keys or parts of the key. The only option left to
delay per byte the cryptanalyst is to attack the key itself. To thwart this
Estimated 9.1 cycles/byte 4.3 cycles/byte type of attacks, we have used the encryption function as a
average delay first stage in a cascade of the encryption function and the
per byte one-way function. Regarding the key collision probability, it
PRG One-way One-way
was shown in section 4 that the key collision probability is
(Sub-key Function cascaded with
Generation) the Encryption negligible when a 192-bit hash is applied. Moreover, the
Function cryptanalyst has a negligible probability of guessing the
Structural Sequential: Concurrent: correct form of the algorithm utilized. As was previously
Sel-1, ROT, Sel- XOR, ROT, discussed, the simple structure of the proposed cipher
0 INV, NOP provides a foundation for efficient software and hardware-
Number of Variable (key- Variable (key- based implementation. Depending on the word or the block
rounds dependent with dependent with
size required, it is relatively easy to parallelize the data path
minimum equal minimum equal
to 5 rounds) to 8 rounds) either using multi-threading on a superscalar processor or
Algorithm Yes No by cloning this path on the FPGA material. Undeniably,
Template (key changes (key selects using the same encryption process and sub-keys for each
operation operations) block is a disadvantage from a security point of view. Still,
parameters) this is exactly the same issue with block ciphers in general.
Parallelizable Yes Yes
The advantage obtained from such a configuration, similarly
( some (operations are
sequential selected to block ciphers, is saving memory and communication
operations) concurrently) bandwidth on the chip and the channel levels. The pseudo
Security Secure Improved random selection of operations and the key-dependent
Security (pseudo number of rotations provide a barrier against pattern leakage
random and block replay attacks. These attacks are quite frequent in
sequence of multi-media applications. Using ECB mode, when
operations and
encrypting images with conventional ciphers, a great deal of
more secure
PRG) the structure of the original image is preserved [3]. This
contributes to the problem of block replay. However, the
selective operations allow the cipher to encrypt images with
no traces of the original image. This is a major advantage of
10. Security Analysis
the Stone Metamorphic Cipher bit-level operations when
applied to multimedia files.
One claims that differential cryptanalysis, linear
cryptanalysis, Interpolation attack, partial key guessing
attacks, and side-channel attacks, barely apply in this
metamorphic cipher. The pseudo random selection of
6 (IJCNS) International Journal of Computer and Network Security,
Vol. 1, No. 2, November 2009

11. Summary & Conclusions 1 0 0 1 1 NOP 1

1 0 1 0 0 XOR 1
We have presented a metamorphic cipher that is altogether
key-dependent. The four bit-balanced operations are pseudo- 1 0 1 0 1 INV 0
randomly selected. Known statistical attacks are barely
1 0 1 1 0 ROR 1
applicable to crypt-analyze this type of ciphers. The
proposed simple structure, based on the crypto logic unit 1 0 1 1 1 NOP 1
CLU, can be easily parallelized using multi-threading
1 1 0 0 0 XOR 0
superscalar processors or FPGA-based hardware
implementations. This presented CLU can be viewed as a 1 1 0 0 1 INV 0
nonlinearity-associated filtering of the data and key streams.
1 1 0 1 0 ROR 0
The PRG, constructed from a cascade of the encryption
function and the one-way hash function, provides the 1 1 0 1 1 NOP 1
required security against known key attacks. On the other
1 1 1 0 0 XOR 0
hand, it easily allows the replacement of the hash function if
successfully attacked. The cipher is well-adapted for use in 1 1 1 0 1 INV 0
multi-media applications. We trust that this approach will 1 1 1 1 0 ROR 1
pave the way for key-driven encryption rather than simply
using the key for sub-key generation. 1 1 1 1 1 NOP 1

Appendix A: The truth table of the CLU

References
Pi Ki S’1 S’0 S1 S0 OP Ci
→ Pj [1] Magdy Saeb, “The Chameleon Cipher-192: A
0 0 0 0 Polymorphic Cipher,” SECRYPT2009, International
0 XOR 0
Conference on Security & Cryptography, Milan, Italy;
0 0 0 0 1 INV 1 7-10 July, 2009.
[2] Auguste Kerckhoffs, “La cryptographie militaire,”
0 0 0 1 0 ROR 0 Journal des sciences militaire, vol. IX, pp. 5-83, Jan.
0 0 1 1 1883, pp.161-191, Feb. 1883.
0 NOP 0
[3] Swenson, C., Modern Cryptanalysis; Techniques for
0 0 1 0 0 XOR 0 Advanced Code Breaking, Wiley Pub. Inc., 2008.
[4] Merkle, R.C., “Fast Software Encryption Functions,”
0 0 1 0 1 INV 1
Advances in Cryptology-CRYPTO ’90 Proceedings,
0 0 1 1 0 ROR 1 pages.476-501, Springer Verlag, 1991.
[5] Massey, J. L., “On Probabilistic Encipherment,” IEEE.
0 0 1 1 1 NOP 0 Information Theory Workshop, Bellagio, Italy, 1987.
0 1 0 0 0 XOR 1 [6] Massey, J.L., “Some Applications of Source Coding in
Cryptography,” European Transactions on
0 1 0 0 1 INV 1 Telecommunications, vol. 5, No. 4, pp.7/421-15/429,
1994.
0 1 0 1 0 ROR 0 [7] Rogaway, P., Coppersmith, D., “A Software-oriented
0 1 0 1 1 NOP 0 Encryption Algorithm,” Fast Software Encryption
Cambridge Security workshop Proceedings, Springer-
0 1 1 0 0 XOR 1 Verlag, pages 56-63, 1994.
[8] Bruce Schneier, “Description of a New Variable-Length
0 1 1 0 1 INV 1 key, 64-bit Block Cipher (Blowfish),” Fast Software
0 1 1 1 0 ROR 1 Encryption, Cambridge Security Workshop
Proceedings, Springer-Verlag, pages 191-204, 1994.
0 1 1 1 1 NOP 0 [9] Bruce Schneier, John Kelsey, Doug Whiting, David
Wagner, Chris Hall, Niels Ferguson, “ Twofish: A 128-
1 0 0 0 0 XOR 1 bit Block Cipher,” First AES conference, California,
1 0 0 0 1 INV 0 US., 1998.
[10] Ralph C. Merkle, June, Secrecy, Authentication and
1 0 0 1 0 ROR 0 Public Key Systems, Ph.D. Dissertation, Stanford
University, 1979.
 (IJCNS) International Journal of Computer and Network Security, 7
Vol. 1, No. 2, November 2009

[11] Rivest, R.L., “The MD5 Message Digest Algorithm,”

RFC 1321, 1992.
[12] Hans Dobbertin, Antoon Bosselaers, Bart Preneel,
“RIPEMD-160: A Strengthened Version of RIPEMD,”
Fast Software Encryption, LNCS 1039, Springer-
Verlag, pages 71–82, 1996.
[13] Magdy Saeb, “Design & Implementation of the
Message Digest Procedures MDP-192 and MDP-384,”
ICCCIS2009, International Conference on
Cryptography, Coding & Information Security, Paris,
June 24-26, 2009.
[14] Rivest, R.L., “The MD4 Message Digest Algorithm,”
RFC 1186, 1990.
[15] Ueli Maurer, James Massey, “Cascade Ciphers: The
Importance of Being First,” Journal of Cryptography,
vol. 6, no. 1, pp. 55-61, 1993.
[16] Discussions by Terry Ritter, et al., Accessed 2007.
http://www.ciphersbyritter.com/LEARNING.HTM.
[17] Erik Zenner, On Cryptographic Properties of LFSR-
based Pseudorandom Generators, Ph.D. Dissertation,
University of Mannheim, Germany, 2004.
[18] Erik Zenner, “Why IV Setup for Stream Ciphers is
Difficult,” Dagstuhl Seminar Proceedings 07021,
Symmetric Cryptography, March14, 2007.
[19] Michael Welschenbach, Cryptography in C and C++,
Apress, 2005.
[20] S. Brown, Z. Vranesic, Fundamental of Digital Logic
with Verilog Design, McGraw-Hill International
Edition, 2008.

Author Profile

Magdy Saeb received the BSEE. School

of Engineering, Cairo University, in
1974; the MSEE. and Ph.D. in Electrical
& Computer Engineering, University of
California, Irvine, in 1981 and 1985,
respectively. He was with Kaiser
Aerospace and Electronics, Irvine
California, and The Atomic Energy
Establishment, Anshas, Egypt. Currently, he is a professor
in the Department of Computer Engineering, Arab Academy
for Science, Technology & Maritime Transport,
Alexandria, Egypt, (on leave) to Malaysian Institute of
Microelectronic Systems (MIMOS), Kuala Lumpur,
Malaysia. His current research interests include
Cryptography, FPGA Implementations of Cryptography and
Steganography Data Security Techniques, Encryption
Processors, Computer Network Reliability, Mobile Agent
Security. www.magdysaeb.net.