2.2.2. Key Schedule for ZD6474 128-Bit KeyAt the beginning of the LEA-128 key schedule, the key state T is assigned as Tn?1=Kn where 0 �� n < 4. The key schedule of LEA-128 is defined as follows:T0i+1��ROL1(T0i?ROLi(��imod4))T1i+1��ROL3(T1i?ROLi+1(��imod4))T2i+1��ROL6(T2i?ROLi+2(��imod4))T3i+1��ROL11(T3i?ROLi+3(��imod4))RKi��(T0i,T1i,T2i,T1i,T3i,T1i)(2)2.2.3. Key Schedule for 192-Bit KeyThe key schedule of LEA-192 also starts with setting T as Tn?1=Kn where 0 �� n < 6. The key schedule of LEA-192 is defined as follows:T0i+1��ROL1(T0i?ROLi(��imod6))T1i+1��ROL3(T1i?ROLi+1(��imod6))T2i+1��ROL6(T2i?ROLi+2(��imod6))T3i+1��ROL11(T3i?ROLi+3(��imod6))T4i+1��ROL13(T4i?ROLi+4(��imod6))T5i+1��ROL17(T5i?ROLi+5(��imod6))RKi��(T0i,T1i,T2i,T3i,T4i,T5i)(3)2.2.4. Key Schedule for 256-Bit KeyLikewise, the key schedule of LEA-256 starts with setting T as Tn?1=Kn where 0 �� n < 8, and is defined as follows:T6ii+1mod8��ROL1(T6iimod8?ROLi(��imod8))T6i+1i+1mod8��ROL3(T6i+1imod8?ROLi+1(��imod8))T6i+2i+1mod8��ROL6(T6i+2imod8?ROLi+2(��imod8))T6i+3i+1mod8��ROL11(T6i+3imod8?ROLi+3(��imod8))T6i+4i+1mod8��ROL13(T6i+4imod8?ROLi+4(��imod8))T6i+5i+1mod8��ROL17(T6i+5imod8?ROLi+5(��imod8))RKi��(T0i,T1i,T2i,T3i,T4i,T5i)(4)2.3. Encryption ProcedureAs described in Section 2.1, LEA-128/192/256 iterates in 24/28/32 rounds. Unlike AES [10] or HIGHT [2], which require a special final round function, LEA uses only one round function. Figure 1 shows the round function of LEA. At the beginning of the encryption, the intermediate state X is set as Xn0=Pn where 0 �� n < 4 and the following round function is executed r times:X0i+1��ROL9((X0i��RK0i)?(X1i��RK1i))X1i+1��ROR5((X1i��RK2i)?(X2i��RK3i))X2i+1��ROR3((X2i��RK4i)?(X3i��RK5i))X3i+1��X0i(5)Figure 1.Round function of LEA.The final Cn=Xnr is generated and used as ciphertext where 0 �� n < 4.3.?Elemental Hardware Structures for LEA CalculationThis section describes elemental hardware structures used for implementing LEA hardware.3.1. Constant Value Schedule Logic for Speed-Optimized ImplementationLEA employs several constants for key scheduling. To design the constant schedule logic, the usage patterns of constants need to be analyzed. In Equation (5), the constant values used for the i-th round function are ROLi(��imod 4), ROLi+1(��imod 4), ROLi+2(��imod 4), and ROLi+3(��imod 4). At the i-th round, the i mod 4-th constant is chosen; in other words, constants are used in increasing order, i.e., ��0, ��1, ��2, ��3,��0,��. After a constant is chosen, it is rotated i,i + 1, i + 2, and i + 3 times to the left.Figure 2 shows the intuitive structure of the constant schedule logic of the 128-bit speed-optimized version of LEA hardware. The speed-optimized version executes one round per clock cycle. Therefore, it should generate all four constants required for a round. Constants ��0 to ��3 are stored in 32-bit flip-flops c0 to c3.