The IDEA Algorithm

Introduction

The International Data Encryption Algorithm (IDEA) was developed in Switzerland by Xuejia Lai and James Massey, first published in 1991. It’s best known for one thing above all: it was the default symmetric cipher in the earliest, most widely used versions of PGP, securing email encryption for millions of users throughout the 1990s. IDEA’s defining design trick is combining three algebraically “incompatible” operations — XOR, addition, and multiplication from three different mathematical groups — within every round, a technique that made it resistant to the linear and differential cryptanalysis techniques of its era.

Table of Contents

• Design Philosophy: Mixing Incompatible Groups
• How IDEA Works
• Key Schedule
• Security Status
• IDEA and PGP
• FAQ
• References

Design Philosophy: Mixing Incompatible Groups

Most block ciphers of IDEA’s era relied primarily on substitution (via S-boxes) and permutation for their non-linearity and diffusion. IDEA took a different approach: it operates entirely on 16-bit sub-blocks using just three simple operations, deliberately chosen because they behave inconsistently with each other, mathematically speaking:

• XOR (bitwise addition in the group of 16-bit vectors under XOR)
• Addition modulo 2¹⁶ (ordinary integer addition, wrapping at 65,536)
• Multiplication modulo 2¹⁶ + 1 (multiplication in a finite field of 65,537 elements — a prime — with the value 0 specially representing 2¹⁶ so every value has a valid multiplicative inverse)

No two of these operations distribute over each other the way, say, multiplication distributes over addition in ordinary arithmetic. This deliberate “algebraic incompatibility” is what gives IDEA its non-linearity and resistance to the attack techniques of the early 1990s, without needing large S-box lookup tables at all.

How IDEA Works

IDEA encrypts 64-bit blocks, split into four 16-bit sub-blocks (X1, X2, X3, X4), through 8 identical rounds followed by a final output transformation half-round:

Each round:

1. Multiply X1 by subkey K1 (mod 2¹⁶+1) → A
2. Add X2 and subkey K2 (mod 2¹⁶) → B
3. Add X3 and subkey K3 (mod 2¹⁶) → C
4. Multiply X4 by subkey K4 (mod 2¹⁶+1) → D
5. XOR A and C → E; XOR B and D → F
6. Multiply E by subkey K5 (mod 2¹⁶+1) → G
7. Add F and G (mod 2¹⁶) → H
8. Multiply H by subkey K6 (mod 2¹⁶+1) → I
9. Add G and I (mod 2¹⁶) → J
10. The new sub-blocks are: A⊕I, C⊕I, B⊕J, D⊕J

Between rounds (except after the last), the middle two sub-blocks are swapped, spreading their influence across the whole block over successive rounds. After all 8 rounds, a final output transformation (using four more subkeys) recombines the sub-blocks into the 64-bit ciphertext.

Interactive Visualizer

The visualizer above runs this exact algorithm — real key schedule, real modular arithmetic, real round structure — animating each of the four 16-bit sub-blocks as they transform round by round.

Key Schedule

IDEA uses a 128-bit key, expanded into fifty-two 16-bit subkeys (6 per round × 8 rounds, plus 4 for the output transformation) through a remarkably simple process: the 128-bit key is split directly into the first eight 16-bit subkeys, then the entire 128-bit key is cyclically rotated left by 25 bits and split again for the next eight, repeating until all 52 subkeys are generated. Decryption uses the same round structure with a different derived set of subkeys — computed using multiplicative and additive inverses of the encryption subkeys, applied in reverse round order.

Security Status

IDEA has held up well against decades of cryptanalysis — no practical attack breaks the full 8.5-round cipher, though its weak key classes (a small number of keys, out of the enormous 128-bit keyspace, that produce a detectably non-random cipher) have been documented, and reduced-round variants have been broken academically, standard practice for any well-studied cipher. Its main practical limitation today is its small 64-bit block size, which — like DES, 3DES, and Blowfish — makes it unsuitable for encrypting large volumes of data under one key in long-lived connections, for the same birthday-attack reasons covered in the 3DES guide.

IDEA and PGP

IDEA’s most significant real-world legacy is its role as the original symmetric cipher in Phil Zimmermann’s PGP 2.0, released in 1992. At the time, IDEA’s then-unencumbered international availability (unlike DES, which faced U.S. export restrictions) made it an attractive default for the fledgling email-encryption movement. IDEA was patented in several countries (through 2012 in most jurisdictions, later than most competing designs of its era), which — combined with the arrival of the openly licensed AES in 2001 — gradually pushed later PGP and OpenPGP implementations toward AES and other patent-free alternatives.

FAQ

Is IDEA still safe to use?

Its core algorithm remains unbroken at full rounds, but its small 64-bit block size and general obsolescence relative to AES mean it’s rarely recommended for new systems today.

Why does IDEA use three different mathematical operations?

Mixing operations from algebraically incompatible groups (XOR, addition mod 2¹⁶, multiplication mod 2¹⁶+1) creates strong non-linearity without needing large S-box lookup tables, which was an elegant, memory-efficient design choice for early-1990s hardware.

What are IDEA’s “weak keys”?

A very small number of the 2¹²⁸ possible keys produce detectably non-random behavior under certain conditions. Given how astronomically rare they are relative to the full keyspace, they pose essentially no practical risk with properly random key generation, but they’re a well-documented theoretical property.

Why was IDEA important to PGP?

It was the original default symmetric cipher in PGP 2.0 (1992), at a time when DES faced U.S. export restrictions and no equivalent free international standard yet existed — making IDEA a practical enabler of the first widely deployed email encryption software.

Why isn’t IDEA used more today?

Its patent status (through 2012 in most countries) discouraged royalty-free adoption during a critical period, and by the time it entered the public domain, AES had already become the entrenched global standard with far broader hardware and software support.

References

1. Lai, X. and Massey, J. “A Proposal for a New Block Encryption Standard.” EUROCRYPT 1990.

2. Wikipedia. “International Data Encryption Algorithm.” Available at: https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm

3. Zimmermann, P. “PGP User’s Guide.” 1992 — documenting IDEA’s original role as PGP’s default cipher.

4. Daemen, J., Govaerts, R., and Vandewalle, J. “Weak Keys for IDEA.” CRYPTO 1993.