Skip to content

Questions about FROG

Short answers, pulled from the story.

What is the FROG block cipher?

FROG is a block cipher authored by Georgoudis, Leroux, and Chaves. It can work with any block size between 8 and 128 bytes, supports key sizes between 5 and 125 bytes, and consists of 8 rounds with a very complicated key schedule.

Who created the FROG cipher and when was it submitted?

FROG was authored by Georgoudis, Leroux, and Chaves. It was submitted in 1998 by TecApro, a Costa Rican software company, to the AES competition as a candidate to become the Advanced Encryption Standard.

What makes the FROG cipher's design philosophy unusual?

FROG hides the exact sequence of primitive operations even though the cipher itself is known. It uses the key both as data and as instructions on how to combine that data, so an expanded version of the key works as a program that FROG interprets to encrypt the plaintext.

How does the FROG key schedule work?

The FROG key schedule, or internal key, is 2304 bytes long. It is produced recursively by iteratively applying FROG to an empty plaintext, then processed into a well formatted internal key with 8 records, one for each of FROG's 8 rounds. All operations are byte-wide and consist of XORs and substitutions.

Why was the FROG cipher not selected as an AES finalist?

FROG was not selected as a finalist because Wagner and colleagues found a number of weak key classes in 1999, and the cipher also had very slow key setup and relatively slow encryption.

What weaknesses did David Wagner find in the FROG cipher?

David Wagner and colleagues found that 2 to the power of minus 33 of FROG's keys are weak and can be broken with 258 chosen plaintexts. They also found that the decryption function has much slower diffusion, with 2 to the power of minus 29 of keys weak and breakable using 236 chosen ciphertexts.

How fast and how small is the FROG cipher implementation?

The reference C version of FROG has only about 150 lines of code, and full encryption and decryption can be written in just 22 machine instructions. Once the internal key is computed it is fairly fast, with an 8086 assembler version reaching over 2.2 megabytes per second on a 200 MHz Pentium PC.