Table 6 Partial encryption and decryption on 28-round TWINE-128

1

\(K_{28}^{5}, K_{28}^{3}, K_{27}^{2}\)

N·2⁶⁴·2·17

\(y_{1}\left (y_{1}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |\)

2⁶⁰·2

\(K_{28}^{7}, K_{28}^{1}, K_{27}^{3}\)

\(X_{0}^{6}\left |X_{0}^{15}\right | X_{0}^{14}\left |X_{0}^{8}\right | X_{0}^{5}\left |X_{0}^{4}\right | X_{25}^{10}\left |X_{25}^{15}\right |\)

\(K_{26}^{2}, K_{25}^{0}, K_{28}^{0}\)

\(X_{23}^{3}\)

\(K_{27}^{1}, K_{28}^{6}, K_{26}^{3}\)

\(\left (K_{24}^{1}\right), K_{27}^{4}\)

\(\left (K_{28}^{5}\right), K_{27}^{5}, K_{26}^{7} \)

2

\(K_{1}^{2}\)

2⁶⁰·2⁶⁴⁺⁴·2

\(y_{2}\left (y_{2}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |\)

2⁵⁶·2

\(X_{0}^{6}\left |X_{0}^{15}\right | X_{0}^{14}\left |X_{0}^{8}\right | X_{1}^{12}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}\)

3

\(K_{2}^{6}\)

2⁵⁶·2⁶⁸⁺⁴·2

\(y_{3}\left (y_{3}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |\)

2⁵²·2

\(X_{0}^{6}\left |X_{0}^{15}\right | X_{0}^{14}\left |X_{2}^{10}\right | X_{25}^{10}\left |X_{25}^{15}\right | X_{23}^{3}\)

4

\(K_{1}^{7}\)

2⁵²·2⁷²⁺⁴·2

\(y_{4}\left (y_{4}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |\)

2⁴⁸·2

\(X_{0}^{6}\left |X_{1}^{14}\right | X_{2}^{10}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}\)

5

\(K_{3}^{5}\)

2⁴⁸·2⁷⁶⁺⁴·2

\(y_{5}\left (y_{5}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{0}^{7}\right |\)

2⁴⁴·2

\(X_{0}^{6}\left |X_{3}^{2}\right | X_{25}^{10}\left |X_{25}^{15}\right | X_{23}^{3}\)

6

\(K_{1}^{3}\)

2⁴⁴·2⁸⁰⁺⁴·2

\(y_{6}\left (y_{6}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{1}^{8}\right |\)

2⁴⁰·2

\(X_{3}^{2}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}\)

7

\(K_{2}^{4}\left (K_{4}^{1}\right)\)

2⁴⁰·2⁸⁴⁺⁴·4

\(y_{7}\left (y_{7}^{\prime }\right)=X_{0}^{11}\left |X_{0}^{10}\right | X_{0}^{2}\left |X_{0}^{1}\right | X_{0}^{0}\left |X_{4}^{4}\right |\)

2³⁶·2

\(X_{25}^{10}\left |X_{25}^{15}\right | X_{23}^{3}\)

8

\(K_{1}^{5}\)

2³⁶·2⁸⁸⁺⁴·2

\(y_{8}\left (y_{8}^{\prime }\right)=X_{1}^{2}\left |X_{0}^{2}\right | X_{0}^{1}\left |X_{0}^{0}\right | X_{4}^{4}\left |X_{25}^{10}\right |\)

2³²·2

\(X_{25}^{15} | X_{23}^{3}\)

9

\(K_{1}^{0}\)

2³²·2⁹²⁺⁴·2

\(y_{9}\left (y_{9}^{\prime }\right)=X_{1}^{2}\left |X_{0}^{2}\right | X_{1}^{0}\left |X_{4}^{4}\right | X_{25}^{10}\left |X_{25}^{15}\right |\)

2²⁸·2

\(X_{23}^{3}\)

10

\(K_{2}^{0}\)

2²⁸·2⁹⁶⁺⁴·2

\(y_{10}\left (y_{10}^{\prime }\right)=X_{1}^{2}\left |X_{2}^{0}\right | X_{4}^{4}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}\)

2²⁴·2

11

\(K_{3}^{0}\)

2²⁴·2¹⁰⁰⁺⁴·2

\(y_{11}\left (y_{11}^{\prime }\right)=X_{4}^{5}\left |X_{4}^{4}\right | X_{25}^{10}\left |X_{25}^{15}\right | X_{23}^{3}\)

2²⁰·2

12

\(K_{5}^{2}\)

2²⁰·2¹⁰⁴⁺⁴·2

\(y_{12}\left (y_{12}^{\prime }\right)=X_{5}^{12}\left |X_{25}^{10}\right | X_{25}^{15} | X_{23}^{3}\)

2¹⁶·2

13

\(K_{25}^{6}\)

2¹⁶·2¹⁰⁸⁺⁴·2

\(y_{13}\left (y_{13}^{\prime }\right)=X_{5}^{12}\left |X_{23}^{8}\right | X_{23}^{3}\)

2¹²·2

14

\(K_{23}^{3}\)

2¹²·2¹¹²⁺⁴·2

\(y_{14}\left (y_{14}^{\prime }\right)=X_{5}^{12} | X_{22}^{7}\)

2⁸·2