Hasty Pudding cipher

Block cipher

The Hasty Pudding cipher (HPC) is a variable block size block cipher designed by Richard Schroeppel, which was an unsuccessful candidate in the competition for selecting the U. S. Advanced Encryption Standard (AES). It has a number of unusual properties for a block cipher: its input block size and key length are variable, and it includes an additional input parameter called the "spice" for use as a secondary, non secret key. The Hasty Pudding cipher was the only AES candidate designed exclusively by U. S. cryptographers. The Hasty Pudding cipher is in the public domain. HPC Tiny 0–35 bits HPC Short 36–64 bitsHPC Medium 65 128 bitsHPC Long 129–512 bitsHPC Extended513+ bits

The Hasty Pudding cipher algorithms all use 64 bit words internally. The cipher is designed to run on 64 bit machines, which can easily perform simple operations on 64 bit words.

The Hasty Pudding cipher can take a key of any number of bits for any one of the five subciphers. The cipher itself uses a key table of 16,384 bits (256 64 bit words). To derive the key table from the key, the key expansion function uses the following algorithm: Schroeppel claimed that it was twice as fast as its nearest competitor, DFC, and three times as fast as the other candidates, and that its performance on a 32 bit machine was adequate. On a 32 bit Pentium, Hasty Pudding encryption was rated by Schneier et al. at 1600 clock cycles, 10th best out of the 15 candidates.

There have been relatively few results on attacking the Hasty Pudding cipher. Early in the AES process, David Wagner noted that relatively large classes of Hasty Pudding keys were equivalent in that they led to the same key table. This was expanded upon by D'Halluin et al., who noted that for 128 bit keys, approximately 2120 keys are weak keys that each have 230 equivalent keys each. In response to this attack, Schroeppel modified the key expansion algorithm to include one additional step. Schroeppel has offered a bottle of Dom Pérignon champagne to the best paper presenting progress on the Hasty Pudding cipher. The Hasty Pudding cipher is considered the first tweakable block cipher.