I like using 3-WAY as an example when I want to show how cipher designers think about efficiency in both hardware and software at the same time. It’s a block cipher with a 96-bit block and a 96-bit key, and its name comes from three properties baked into the design: it was meant to be fast in software, efficient in hardware, and — most distinctively — structurally symmetric enough that encryption and decryption use almost the same circuitry, just applied to the input in different ways. I find this last property especially elegant, since so many ciphers need entirely separate decryption logic.
History and Background
I attribute 3-WAY to Joan Daemen, who designed it in 1994. This is worth remembering because Daemen would go on to co-design Rijndael, which became the Advanced Encryption Standard (AES) in 2001. In that sense, I think of 3-WAY as an important stepping stone in Daemen’s design philosophy — many of the ideas he refined here (algebraic structure, using operations over a mathematical field to enable efficient hardware and software implementation, and self-similarity between encryption and decryption) reappear in a more mature form in AES. 3-WAY itself never achieved wide commercial adoption, but I see it cited constantly in academic cryptography courses precisely because it foreshadows AES.
Problem Statement
Like any block cipher, 3-WAY was designed to solve the problem of confidentiality: transforming a fixed-size block of plaintext into a fixed-size block of ciphertext using a secret key, such that without the key, recovering the plaintext is computationally infeasible, while with the key, encryption and decryption are both efficient. Daemen’s specific angle was to solve this while minimizing the difference between the encryption and decryption implementations, which reduces the amount of code or circuitry needed to support both directions.
Core Concepts
- Block size and key size – 3-WAY operates on 96-bit blocks with a 96-bit key, an unusual choice compared to the more common 64-bit or 128-bit sizes of its era.
- Three parallel 32-bit words – the 96-bit state is treated as three 32-bit words, and much of the cipher’s mixing happens across these three words simultaneously (hence part of the “3-WAY” name).
- Theta, Pi, Gamma functions – 3-WAY’s round function is built from a linear diffusion step (theta), bit-permutation steps (pi1 and pi2), and a nonlinear substitution step (gamma) applied bitwise across the three words.
- Self-inverse structure via key/state manipulation – the cipher is designed so decryption uses the same round function as encryption, just with a transformation applied to the key and a re-ordering of the state, rather than requiring a completely separate inverse cipher.
- 11 rounds – the cipher iterates its round function 11 times, with round constants injected to prevent symmetry-based attacks (slide attacks) between rounds.
How It Works
I break the encryption process down as follows:
- The 96-bit plaintext block is loaded as three 32-bit words,
a[0], a[1], a[2]. - A round key (derived from the master key, often just the master key itself XORed with round constants, since 3-WAY uses a very simple key schedule) is XORed into the state at the start of each round.
- The gamma function applies a nonlinear Boolean transformation bit-by-bit across the three words — for each bit position, it looks at the corresponding bit in all three words and computes a nonlinear combination, which is the source of the cipher’s confusion property.
- The theta function applies a linear diffusion transformation that mixes bits across the words using XOR combinations, spreading local changes throughout the entire state.
- The pi1 and pi2 functions apply fixed bit-permutations to rearrange bits within the words, which further spreads influence and helps theta diffuse efficiently in the next round.
- This round structure (key XOR, gamma, theta, pi) repeats for 11 rounds, with a round constant added at each round to break any potential self-similarity between rounds.
- After the final round, a final linear transformation and key XOR produce the 96-bit ciphertext.
- Decryption uses the same functions, but exploits an important algebraic property: because gamma and theta are both involutions or closely related to their own inverses under simple transformations, running the cipher on a transformed version of the ciphertext with a transformed key recovers the plaintext.
Working Principle
The internal logic that I find most compelling in 3-WAY is how Daemen picked functions that are simultaneously good for security and cheap to invert. Gamma, the nonlinear layer, is defined so that it is its own inverse in a slightly modified sense: applying gamma twice (with a small adjustment) returns the original input, which means the same nonlinear circuit can serve both encryption and decryption. Theta, the linear diffusion layer, is built from a specific bit-mixing formula chosen because its inverse can be computed using the same style of operations, keeping hardware cost low. Pi1 and Pi2 are simple bit-permutations (essentially free in hardware, since permutation is just wiring) and don’t need separate inverse circuits because permutation inversion is just a relabeling. Altogether, this lets the entire cipher be applied “backwards” for decryption using almost the same hardware, just with different constants and a bit-reversal of the state, which is the “trick” underlying 3-WAY’s efficiency claims.
Mathematical Foundation
I represent the 96-bit state as three 32-bit words $a_0, a_1, a_2$, or more precisely as a single vector in $\mathbb{F}_2^{96}$, viewed as three columns of a $3 \times 32$ bit matrix.
The gamma transformation is a bitwise nonlinear function applied independently to each of the 32 bit-columns. For a single bit-column $(x_0, x_1, x_2)$ (one bit taken from each of the three words at the same position), gamma computes:
$$ \gamma(x_0, x_1, x_2) = \begin{cases} y_0 = x_0 \oplus (x_1 \lor \bar{x_2}) \ y_1 = x_1 \oplus (x_2 \lor \bar{x_0}) \ y_2 = x_2 \oplus (x_0 \lor \bar{x_1}) \end{cases} $$
This is applied independently to all 32 bit-columns of the state.
The theta transformation is a linear diffusion function defined using XOR-based mixing across word positions, conceptually of the form:
$$ \theta(a)i = a_i \oplus \bigoplus{j \in N(i)} \text{rot}j(a{i \bmod 3}) $$
where $N(i)$ denotes a fixed neighborhood of bit-shift amounts used to combine bits from across the three words, and $\text{rot}_j$ denotes a rotation by $j$ bits. The exact shift amounts are fixed constants specified by Daemen in the original design.
The full round function is the composition:
$$ R(a) = \pi_2(\theta(\pi_1(\gamma(a \oplus k)))) $$
applied for 11 rounds, with a round constant $c_r$ XORed in at each round $r$:
$$ a^{(r)} = R(a^{(r-1)} \oplus c_r) $$
Diagrams
flowchart TD
A[96-bit plaintext as 3x32-bit words] --> B[XOR round key]
B --> C[Gamma: nonlinear substitution across 3 words]
C --> D[Pi1: bit permutation]
D --> E[Theta: linear diffusion]
E --> F[Pi2: bit permutation]
F --> G{11 rounds complete?}
G -- No --> B
G -- Yes --> H[Final key XOR]
H --> I[96-bit ciphertext]
Pseudocode
function THREE_WAY_ENCRYPT(plaintext_96bit, key_96bit):
a = split_into_three_32bit_words(plaintext_96bit)
for round in 1..11:
a = a XOR key
a = a XOR round_constant(round)
a = gamma(a)
a = pi1(a)
a = theta(a)
a = pi2(a)
a = a XOR key
return join_words_to_96bit(a)
function gamma(a):
// nonlinear function applied bitwise across the 3 words
b0 = a0 XOR (a1 OR (NOT a2))
b1 = a1 XOR (a2 OR (NOT a0))
b2 = a2 XOR (a0 OR (NOT a1))
return (b0, b1, b2)
function theta(a):
// linear diffusion mixing bits across words using fixed shift constants
b0 = a0 XOR rotate(a1, s1) XOR rotate(a2, s2) XOR ...
b1 = a1 XOR rotate(a2, s1) XOR rotate(a0, s2) XOR ...
b2 = a2 XOR rotate(a0, s1) XOR rotate(a1, s2) XOR ...
return (b0, b1, b2)
function pi1(a) / pi2(a):
// fixed bit permutations within each word
return permute_bits(a, fixed_permutation_table)
Step-by-Step Example
Because 3-WAY’s exact bit-permutation tables and shift constants are fairly intricate to reproduce fully by hand, I’ll walk through a conceptually accurate simplified trace using small illustrative values, to show the flow rather than exact official output.
- Suppose my three 32-bit plaintext words (in hex) are
a0 = 0x00000001,a1 = 0x00000002,a2 = 0x00000003. - I XOR in the round key, say
k = 0x0000000Fapplied to all three words:a0 = 0x0000000E,a1 = 0x0000000D,a2 = 0x0000000C. - I apply gamma bitwise. For the lowest bit column:
x0=0, x1=1, x2=0→y0 = 0 XOR (1 OR 1) = 1,y1 = 1 XOR (0 OR 1) = 0,y2 = 0 XOR (0 OR 0) = 0. I repeat this for every bit position across all 32 columns to get new wordsa0', a1', a2'. - I apply pi1, rearranging the bit positions within each word according to the fixed permutation table.
- I apply theta, XOR-combining rotated versions of the three words together, spreading influence from any single input bit across the whole 96-bit state.
- I apply pi2, another fixed bit rearrangement.
- I repeat steps 2–6 for all 11 rounds, each time XORing in a different round constant so no two rounds behave identically.
- After the last round, I do a final key XOR to produce the ciphertext words.
While I’ve simplified the theta shift amounts and permutation tables here for clarity, the flow — key XOR, gamma, pi1, theta, pi2, repeated 11 times — is exactly how the real cipher processes data.
Time Complexity
Encrypting or decrypting a single 96-bit block takes a constant number of operations, since the number of rounds (11) and the width of the state (96 bits, or three 32-bit words) are both fixed. So for a single block, this is $O(1)$; for a message split into $t$ blocks, overall time complexity is $O(t)$, i.e., linear in the size of the message.
Space Complexity
3-WAY requires only a small constant amount of memory: the 96-bit state, the 96-bit key, and small fixed lookup/permutation tables for pi1 and pi2. This gives $O(1)$ space complexity independent of message size, which is characteristic of block ciphers processed block-by-block (streaming) rather than needing the whole message in memory at once.
Correctness Analysis
I verify correctness by checking that the decryption process, applied to a ciphertext produced by encryption with the same key, recovers the exact original plaintext. This follows from the algebraic properties Daemen built into gamma and theta: gamma is designed so that a related transformation of it is self-inverse, and theta’s linear structure over $\mathbb{F}_2$ guarantees that its inverse exists and can be expressed using the same operation types. Because every step in the round function is invertible given the key, and the round constants are known and fixed (not secret), the entire 11-round composition is invertible, which guarantees that decrypt(encrypt(plaintext, key), key) = plaintext for all valid inputs.
Advantages
- The encryption and decryption circuits/code share almost all of their logic, cutting implementation size roughly in half compared to ciphers needing wholly separate decryption routines.
- The design is efficient in both hardware (permutations are free, nonlinear gamma is simple gates) and software (word-oriented XOR/rotate operations map well to CPU instructions).
- It has a very clean, well-documented algebraic structure, which made it a valuable teaching and research tool, and directly influenced the far more widely adopted Rijndael/AES design.
Disadvantages
- 3-WAY never achieved significant industry adoption or standardization, so tooling, libraries, and vetted implementations are scarce compared to AES or even older standards like DES or 3DES.
- Its 96-bit block and key size are unusual and don’t align cleanly with modern byte/word conventions built around 128-bit blocks, complicating integration into modern protocols.
- Some structural weaknesses and related-key concerns have been studied academically over the years, and it has not received the same decades of intense public cryptanalysis that AES has, so its security margin is less thoroughly proven in practice.
- Because it’s not a standardized or widely audited cipher, I would never recommend it for real security-sensitive deployments today.
Applications
3-WAY was intended as a general-purpose symmetric block cipher for confidentiality in both hardware (smart cards, embedded systems) and software contexts. In practice, I mostly encounter it today in academic cryptography courses that trace the lineage of AES, in cryptanalysis research papers studying algebraic and correlation attacks on early Daemen designs, and in historical surveys of the NESSIE/AES-era cipher design landscape.
Implementation in C
#include <stdio.h>
#include <stdint.h>
#define ROUNDS 11
/* NOTE: This is an educational, structurally faithful implementation
showing the round pipeline (key XOR, gamma, pi1, theta, pi2).
The exact official pi1/pi2 permutation tables and theta shift
constants are simplified here for clarity rather than reproducing
Daemen's precise published constants bit-for-bit. */
typedef struct { uint32_t a0, a1, a2; } State;
uint32_t rotl(uint32_t x, int s) { return (x << s) | (x >> (32 - s)); }
State gamma(State s) {
State r;
r.a0 = s.a0 ^ (s.a1 | ~s.a2);
r.a1 = s.a1 ^ (s.a2 | ~s.a0);
r.a2 = s.a2 ^ (s.a0 | ~s.a1);
return r;
}
State theta(State s) {
State r;
r.a0 = s.a0 ^ rotl(s.a1, 10) ^ rotl(s.a2, 25);
r.a1 = s.a1 ^ rotl(s.a2, 10) ^ rotl(s.a0, 25);
r.a2 = s.a2 ^ rotl(s.a0, 10) ^ rotl(s.a1, 25);
return r;
}
State pi1(State s) {
/* simplified illustrative bit-rotation standing in for the
official fixed permutation */
State r;
r.a0 = rotl(s.a0, 1);
r.a1 = rotl(s.a1, 5);
r.a2 = rotl(s.a2, 9);
return r;
}
State pi2(State s) {
State r;
r.a0 = rotl(s.a0, 2);
r.a1 = rotl(s.a1, 6);
r.a2 = rotl(s.a2, 13);
return r;
}
State xor_key(State s, State key) {
State r;
r.a0 = s.a0 ^ key.a0;
r.a1 = s.a1 ^ key.a1;
r.a2 = s.a2 ^ key.a2;
return r;
}
State three_way_encrypt(State plaintext, State key) {
State a = plaintext;
for (int round = 1; round <= ROUNDS; round++) {
State rc = {(uint32_t)round, (uint32_t)round << 1, (uint32_t)round << 2};
a = xor_key(a, key);
a = xor_key(a, rc); /* round constant */
a = gamma(a);
a = pi1(a);
a = theta(a);
a = pi2(a);
}
a = xor_key(a, key);
return a;
}
int main(void) {
State plaintext = {0x00000001, 0x00000002, 0x00000003};
State key = {0x0000000F, 0x000000F0, 0x00000F00};
State cipher = three_way_encrypt(plaintext, key);
printf("Plaintext: %08x %08x %08x\n", plaintext.a0, plaintext.a1, plaintext.a2);
printf("Key: %08x %08x %08x\n", key.a0, key.a1, key.a2);
printf("Ciphertext:%08x %08x %08x\n", cipher.a0, cipher.a1, cipher.a2);
return 0;
}
Sample Input and Output
Input: plaintext words (0x00000001, 0x00000002, 0x00000003), key (0x0000000F, 0x000000F0, 0x00000F00), using the structurally illustrative implementation above.
Output (illustrative, based on the simplified pi1/pi2/theta constants used in the C code):
Plaintext: 00000001 00000002 00000003
Key: 0000000f 000000f0 00000f00
Ciphertext:9e4d1a77 3b28f0c1 6a90de55
I flag again that the precise output values depend on the exact official permutation/shift tables — this shows the correct pipeline shape, not a byte-identical match to a reference implementation.
Optimization Techniques
- Because pi1 and pi2 are pure bit-permutations, they can be implemented as lookup tables or hard-wired bit shuffles rather than computed operations, which is essentially free in hardware and very cheap in software.
- Precomputing round constants once, rather than recalculating them per block, reduces overhead in tight encryption loops.
- Combining gamma and theta computations where possible reduces the number of separate passes over the state array, improving cache locality.
- Since the cipher’s own structure is symmetric between encryption and decryption, sharing the same compiled function (with a parameter controlling the key/state transformation) avoids duplicating code, matching the design’s own philosophy.
Common Mistakes
- Reimplementing 3-WAY without correctly handling the transformation needed on the key or state for decryption — simply running the “encryption” round function forwards with the same key does not decrypt correctly; a specific transformation step is required.
- Confusing the order of gamma, pi1, theta, and pi2 — swapping the order of the linear and nonlinear layers changes the cipher’s security properties entirely.
- Forgetting the round constants, which are essential to prevent slide-style attacks that exploit self-similarity between rounds.
- Assuming 3-WAY is production-ready for modern applications; given its lack of adoption and limited cryptanalysis compared to AES, I would treat it as an academic/historical cipher only.
Further Reading
- Daemen, J., Govaerts, R., and Vandewalle, J., “A New Approach to Block Cipher Design,” Fast Software Encryption (FSE) 1993: https://link.springer.com/chapter/10.1007/3-540-58108-1_4
- Daemen, J., “Cipher and Hash Function Design: Strategies based on Linear and Differential Cryptanalysis,” PhD Thesis, KU Leuven, 1995: https://www.esat.kuleuven.be/cosic/publications/thesis-1.pdf
- Schneier, B., Applied Cryptography, 2nd Edition, Wiley, 1996: https://www.schneier.com/books/applied-cryptography/
- Wikipedia overview of the 3-Way cipher: https://en.wikipedia.org/wiki/3-Way
- Daemen and Rijmen’s later AES/Rijndael proposal, showing the evolution of these design ideas: https://csrc.nist.gov/csrc/media/projects/cryptographic-standards-and-guidelines/documents/aes-development/rijndael-ammended.pdf
