In cryptography, M8 is a block cipher designed by Hitachi in 1999. It is a modification of Hitachi's earlier M6 algorithm, designed for greater security and high performance in both hardware and 32-bit software implementations. M8 was registered by Hitachi in March 1999 as ISO/IEC 9979-0020.

Like M6, M8 is a Feistel cipher with a block size of 64 bits. The round function can include 32-bit rotations, XORs, and modular addition, making it an early example of an ARX cipher.

The cipher features a variable number of rounds (any positive integer N), each of which has a structure determined by a round-specific "algorithm decision key". Making the rounds key-dependent is intended to make cryptanalysis more difficult (see FROG for a similar design philosophy).

The round count can be set to any positive integer N, but a round count of at least 10 is recommended. The key consists of four components: a 64-bit data key, 256-bit key expansion key, a set of N 24-bit algorithm decision keys, and a set of N 96-bit algorithm expansion keys.

The round function is used for both key expansion and encryption/decryption. The key expansion process transforms the 64-bit data key and 256-bit key expansion key into a 256-bit execution key, consisting of 4 pairs of 32-bit numbers ${\displaystyle K_{R_{0}},K_{L_{0}},...,K_{R_{3}},K_{L_{3}}}$.

The cipher has a typical Feistel cipher design. First, the 64-bit input block is split into two 32-bit halves. In each round, the left half undergoes a key-dependent transformation, and is then combined with the right half. Finally, the halves are swapped. In total, the round function consists of a sequence of nine customizable operations and three bitwise rotations:

${\displaystyle {\begin{aligned}R_{i+1}&=L_{i}\\x&=L_{i}\operatorname {op} _{1}K_{L_{i{\bmod {4}}}}\\y&=((x<<<S_{1})\operatorname {op} _{2}x)\operatorname {op} _{3}\alpha \\z&=(((y<<<S_{2})\operatorname {op} _{4}y)\operatorname {op} _{5}\beta )\operatorname {op} _{6}K_{R_{i{\bmod {4}}}}\\L_{i+1}&=(((z<<<S_{3})\operatorname {op} _{7}z)\operatorname {op} _{8}\gamma )\operatorname {op} _{9}R_{i}\end{aligned}}}$

${\displaystyle i}$ denotes the round number, which takes inputs ${\displaystyle L_{i}}$ and ${\displaystyle R_{i}}$. ${\displaystyle \alpha ,\beta ,\gamma }$ are the three 32-bit words of the round's algorithm expansion key. ${\displaystyle K_{R_{i{\bmod {4}}}},K_{L_{i{\bmod {4}}}}}$ are words from the execution key. ${\displaystyle <<<}$ denotes a left bitwise rotation. ${\displaystyle \operatorname {op} _{j}}$ and ${\displaystyle S_{k}}$ are defined by the 24-bit algorithm decision key as follows: