E2 (cipher)

Like other AES candidates, E2 operates on blocks of 128 bits, using a key of 128, 192, or 256 bits. It uses a 12-round Feistel network. E2 has an input transformation and output transformation that both use modular multiplication, but the round function itself consists only of XORs and S-box lookups. The single 8×8-bit S-box is constructed from the composition of an affine transformation with the discrete exponentiation x¹²⁷ over the finite field GF(2⁸). NTT adopted many of E2's special characteristics in Camellia, which has essentially replaced E2.