Clause 6: Deoxys-TBC

What the clause requires

The clause specifies the Deoxys-TBC family in four subclauses: two versions, encryption, decryption and the tweakey schedule. Both versions use a 128-bit block; the tweakey is 256 or 384 bits, split between a key of at least 128 bits and the remainder as tweak.

What the public text does not state

• Clause 6.4, the tweakey schedule, which is not in the ISO public preview
• Whether the amendment changes the round count or the versions

What it means for you

Deoxys-TBC is one of the two families in the document and the one with a 128-bit block throughout. The clause is written for an implementer: it numbers the versions, gives the round transformations in order, gives the inverse transformations for decryption, and then describes how the per-round sub-tweakeys are derived. The ISO public preview holds the first three subclauses and the contents entry for the fourth.

The structure is AES-like, and the standard says so. One round applies an exclusive-or with a sub-tweakey, a byte substitution, a row rotation and a column mixing step, and the final round adds the last sub-tweakey without the mixing step. The number of rounds is 14 for the 256-bit tweakey version and 16 for the 384-bit version. The record keeps those numbers because they are checkable facts in the text, not because a buyer needs to implement the cipher.

The buyer s interest is narrower. If a product claims Deoxys-TBC, the useful evidence is a known-answer test against Annex A, a configuration record that states the key and tweak split, and a review that the implementation uses the round count for the right version. The clause itself does not ask an organisation to do any of that, but the claim cannot be supported without it.

Evidence to keep

What an auditor or a customer is likely to ask for

Artefact	Owner	Why it matters
Known-answer test result against the numerical example for the version in use	Engineering	The annex is informative; a test that cites it is still the clearest conformance evidence.
Configuration record with block length, tweakey length and round count	Engineering	Catches a version mismatch that a product name would hide.
Source or module identification and version	Procurement	Makes the claim traceable to code someone can inspect.

How to verify it

Ask for the test vector result and the round count. A Deoxys-TBC-256 implementation with 16 rounds, or a Deoxys-TBC-384 implementation with 14, is not the algorithm in this clause.

Dates

The kit plan for clause 6 sets the evidence review at 17 June 2027, 90 days before the estimated publication date of 15 September 2027.

Cross references

• 5 Requirements on the usage of tweakable block ciphers
• 6.1 Deoxys-TBC versions
• 6.2 Deoxys-TBC encryption
• 6.3 Deoxys-TBC decryption
• 6.4 Deoxys-TBC tweakey schedule
• A Annex A, Numerical examples

Where this comes from