Khafre [22] is a software-oriented cryptosystem with 64-bit blocks whose number of rounds (which should be a multiple of eight) is not specified. Each block is divided into two halves, called the right half and the left half. In each round the lowest byte of the right half is used as an eight-bit input to an S box with 32-bit output. The left half is XORed with the output of the S box. The right half is rotated and the two halves are exchanged. The rotation is such that every byte is used once every eight rounds as an input to an S box. Before the first round and after every eighth round the data is XORed with 64-bit subkeys. These subkeys are the only way the key is involved in the cryptosystem.