An observation on the Key Schedule of Twofish

The byte block cipher Two sh was proposed as a candidate for the Advanced En cryption Standard AES This paper notes the following two properties of the Two sh key schedule Firstly there is a non uniform distribution of byte whitening subkeys Sec ondly in a reduced xed Feistel round function Two sh with an byte key there is a non uniform distribution of any byte round subkey An example of two distinct byte keys giving the same round subkey is given Brief Description of Two sh Two sh is a block cipher on byte blocks under the action of a or byte key For simplicity we consider the version with a byte key Two sh has a Feistel type design Suppose we have a byte plaintext P PL PR and a byte key K KL KR Let F GF be the nite eld de ned by the primitive polynomial x x x x Two sh uses an invertible round function