Editing ICE (cipher)

{{Short description|Block cipher}}
{{Infobox block cipher
| name          = ICE
| image         = [[Image:ICE (cipher) InfoBox Diagram.png|280px|center]]
| caption       = The ICE Feistel function
| designers     = Matthew Kwan
| publish date  = 1997
| derived from  = [[Data Encryption Standard|DES]]
| derived to    = 
| key size      = 64 bits (ICE), 64×''n'' bits (ICE-''n'')
| block size    = 64 bits
| structure     = [[Feistel network]]
| rounds        = 16 (ICE), 8 (Thin-ICE), 16×''n'' (ICE-''n'')
| cryptanalysis = [[Differential cryptanalysis]] can break 15 out of 16 rounds of ICE with complexity 2<sup>56</sup>. Thin-ICE can be broken using 2<sup>27</sup> chosen plaintexts with a success probability of 95%.
}}

In [[cryptography]], '''ICE''' ('''''I'''nformation '''C'''oncealment '''E'''ngine'') is a [[Symmetric-key algorithm|symmetric-key]] [[block cipher]] published by Matthew Kwan in 1997. The algorithm is similar in structure to [[Data Encryption Standard|DES]], but with the addition of a key-dependent bit permutation in the round function. The key-dependent bit permutation is implemented efficiently in software. The ICE algorithm is not subject to patents, and the source code has been placed into the public domain.

ICE is a [[Feistel network]] with a [[block size (cryptography)|block size]] of 64 bits. The standard ICE algorithm takes a 64-bit key and has 16 rounds. A fast variant, '''Thin-ICE''', uses only 8 rounds. An open-ended variant, '''ICE-''n''''', uses 16''n'' rounds with 64''n'' bit key. 

Van Rompay et al. (1998) attempted to apply [[differential cryptanalysis]] to ICE. They described an attack on Thin-ICE which recovers the secret key using 2<sup>23</sup> [[chosen plaintext]]s with a 25% success probability. If 2<sup>27</sup> chosen plaintexts are used, the probability can be improved to 95%.  For the standard version of ICE, an attack on 15 out of 16 rounds was found, requiring 2<sup>56</sup> work and at most 2<sup>56</sup> chosen plaintexts.

==Structure==
ICE is a 16-round [[Feistel network]].  Each round uses a 32→32 bit F function, which uses 60 bits of key material.

The structure of the F function is somewhat similar to DES: The input is expanded by taking overlapping fields, the expanded input is XORed with a key, and the result is fed to a number of reducing S-boxes which undo the expansion.

First, ICE divides the input into 4 overlapping 10-bit values.  They are bits 30, 31 and 0–7 of the input for the first 10-bit value and for the next values 6–15, 14–23, and 22–31.

Second is a keyed permutation, which is unique to ICE.  Using a 20-bit permutation subkey, bits are swapped between halves of the 40-bit expanded input.  (If subkey bit ''i'' is 1, then bits ''i'' and ''i''+20 are swapped.)

Third, the 40-bit value is XORed with 40 more subkey bits.

Fourth, the value is fed through 4 10-bit S-boxes, each of which produces 8 bits of output.  (These are much larger than DES's 8 6→4 bit S-boxes.)

Fifth, the S-box output bits are permuted so that each S-box's outputs are routed to each 4-bit field of 32-bit word, including 2 of the 8 "overlap" bits duplicated during the next round's expansion.

Like DES, a software implementation would typically store the S-boxes pre-permuted, in 4 1024×32 bit lookup tables.

==References==
* Matthew Kwan, The Design of the ICE Encryption Algorithm, Fast Software Encryption 1997, pp.&nbsp;69&ndash;82 [http://www.darkside.com.au/ice/paper.html].
* Bart van Rompay, Lars R. Knudsen and Vincent Rijmen, Differential Cryptanalysis of the ICE Encryption Algorithm, Fast Software Encryption 1998, pp270&ndash;283 [https://link.springer.com/content/pdf/10.1007/3-540-69710-1_18.pdf (PDF)].

==External links==
* [http://www.darkside.com.au/ice/index.html The ICE Home Page]
* [http://www.darkside.com.au/ice/slides/slide01.htm The ICE information slides]

{{Cryptography navbox | block}}

[[Category:Feistel ciphers]]