QARMA

Key takeaways

QARMA belongs to science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect QARMA to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of QARMA from memory before moving on to harder problems.

Reference excerpt

QARMA (from Qualcomm ARM Authenticator) is a lightweight tweakable block cipher primarily known for its use in the ARMv8 architecture for protection of software as a cryptographic hash for the Pointer Authentication Code. The cipher was proposed by Roberto Avanzi in 2016. Two versions of QARMA are defined: QARMA-64 (64-bit block size with a 128-bit encryption key) and QARMA-128 (128-bit block size with a 256-bit key). The design of the QARMA was influenced by PRINCE and MANTIS. The cipher is intended for fully-unrolled hardware implementations with low latency (like memory encryption). Unlike the XTS mode, the address can be directly used as a tweak and does not need to be whitened with the block encryption first.

Architecture

QARMA is an Even–Mansour cipher using three stages, with whitening keys w0 and w1 XORed in between:

permutation F is using core key k0 and parameterized by a tweak T. It has r rounds inside (r = 7 for QARMA-64, r = 11 for QARMA-128); "central" permutation C is using key k1 and is designed to be reversible via a simple key transformation (contains two central rounds); the third permutation is an inverse of the first (r more rounds). All keys are derived from the master encryption key K using specialisation:

K is partitioned into halves as w0 Concatenation k0, each will have halfsize bits; for encryption w1 = (w0 >>> 1) + (w0 >> (halfsize-1)); for encryption k1 = k0; for decryption, the same design can be used as long as k0+α is used as a core key, k1 = Q•k0, w1 and w0 are swapped. α here is a special constant and Q a special involutary matrix. This construct is similar to the alpha reflection in PRINCE.

The data is split into 16 cells (4-bit nibbles for QARMA-64, 8-bit bytes for QARMA-128). Internal state also contains 16 cells, arranged in a 4x4 matrix, and is initialized by plaintext (XORed with w0). In each round of ϝ {\displaystyle \digamma } , the state is transformed via operations τ , M , S {\displaystyle \tau ,M,S} :

τ {\displaystyle \tau } is ShuffleCells, a MIDORI permutation of cells ([ 0, 11, 6, 13, 10, 1, 12, 7, 5, 14, 3, 8, 15, 4, 9, 2]);

M {\displaystyle M} is MixColumns: each column is multiplied by a fixed matrix M;

S {\displaystyle S} is SubCells: each cell is transformed using an S-box. The tweak for each round is updated using h , ω {\displaystyle h,\omega } :

h {\displaystyle h} is a cell permutation from MANTIS ([ 6, 5, 14, 15, 0, 1, 2, 3, 7, 12, 13, 4, 8, 9, 10, 11]);

ω {\displaystyle \omega } is an LFSR applied to each of the cells with numbers [0, 1, 3, 4, 8, 11, 13]. For QARMA-64, the LFSR is (b3, b2, b1, b0) ⇒ (b0 + b1, b3, b2, b1), for QARMA-128, (b7, b6, ..., b0) ⇒ (b0 + b2, b7, b6, ..., b1), The rounds of ϝ ¯ {\displaystyle {\overline {\digamma }}} consist of inverse operations τ ¯ , M ¯ , S ¯ , h ¯ , ω ¯ {\displaystyle {\overline {\tau }},{\overline {M}},{\overline {S}},{\overline {h}},{\overline {\omega }}} . Central rounds, in addition to two rounds ( τ , M , S {\displaystyle \tau ,M,S} and τ ¯ , M ¯ , S ¯ {\displaystyle {\overline {\tau }},{\overline {M}},{\overline {S}}} ), include multiplication of the state by an involutary matrix Q.

References

Sources Avanzi, Roberto (2016). The QARMA Block Cipher Family (PDF). IACR Transactions on Symmetric Cryptology (ToSC). Vol. 17 (published 8 March 2017). pp. 4–44. doi:10.13154/tosc.v2017.i1.4-44. Archived from the original (PDF) on May 13, 2020. Zong, Rui; Dong, Xiaoyang (2016). "Meet-in-the-Middle Attack on QARMA Block Cipher" (PDF). iacr.org. IACR. Retrieved 10 June 2022. Kaur, Jasmin; Kermani, Mehran Mozaffari; Azarderakhsh, Reza (1 January 2022). "Hardware Constructions for Lightweight Cryptographic Block Cipher QARMA With Error Detection Mechanisms". IEEE Transactions on Emerging Topics in Computing. 10 (1): 514–519. doi:10.1109/TETC.2020.3027789. eISSN 2376-4562. S2CID 226665710. Li, Rongjia; Jin, Chenhui (4 May 2018). "Meet-in-the-Middle Attacks on Reduced-Round QARMA-64/128". The Computer Journal. 61 (8): 1158–1165. doi:10.1093/comjnl/bxy045. eISSN 1460-2067. ISSN 0010-4620. Yang, Dong; Qi, Wen-feng; Chen, Hua-jin (2018). "Impossible Differential Attack on QARMA Family of Block Ciphers". Cryptology ePrint Archive.

External links Public-domain Python implementation of QARMA-64 Open-source (MIT license) implementation of QARMA-64 in C

Illustrations

Worked examples

Example 1 — a first encounter with QARMA

Start with the simplest possible case. Write down what QARMA claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to QARMA before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about QARMA ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of QARMA

In research: QARMA appears in science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses QARMA in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: QARMA is common in secondary-school and first-year university syllabi. It links to neighbouring topics Block ciphers, so understanding it makes those chapters shorter.
In everyday life: Look for QARMA outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

How to study QARMA in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what QARMA means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain QARMA out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is QARMA in simple terms?

QARMA (from Qualcomm ARM Authenticator) is a lightweight tweakable block cipher primarily known for its use in the ARMv8 architecture for protection of software as a cryptographic hash for the Pointer Authentication Code. The cipher was proposed by Roberto Avanzi in 2016.

Why does QARMA matter?

Because it connects several science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study QARMA?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on QARMA.