QARMA (from Qualcomm ARM Authenticator) is a lightweight tweakable block cipher primarily known for its use in the ARMv8 architecture for protection of software as a cryptographic hash for the Pointer Authentication Code. The cipher was proposed by Roberto Avanzi in 2016. Two versions of QARMA are defined: QARMA-64 (64-bit block size with a 128-bit encryption key) and QARMA-128 (128-bit block size with a 256-bit key). The design of the QARMA was influenced by PRINCE and MANTIS. The cipher is intended for fully-unrolled hardware implementations with low latency (like memory encryption). Unlike the XTS mode, the address can be directly used as a tweak and does not need to be whitened with the block encryption first.

QARMA is an Even–Mansour cipher using three stages, with whitening keys w⁰ and w¹ XORed in between:

All keys are derived from the master encryption key K using specialisation:

The data is split into 16 cells (4-bit nibbles for QARMA-64, 8-bit bytes for QARMA-128). Internal state also contains 16 cells, arranged in a 4x4 matrix, and is initialized by plaintext (XORed with w⁰). In each round of ${\displaystyle \digamma }$, the state is transformed via operations ${\displaystyle \tau ,M,S}$:

The tweak for each round is updated using ${\displaystyle h,\omega }$:

The rounds of ${\displaystyle {\overline {\digamma }}}$ consist of inverse operations ${\displaystyle {\overline {\tau }},{\overline {M}},{\overline {S}},{\overline {h}},{\overline {\omega }}}$. Central rounds, in addition to two rounds (${\displaystyle \tau ,M,S}$ and ${\displaystyle {\overline {\tau }},{\overline {M}},{\overline {S}}}$), include multiplication of the state by an involutary matrix Q.