Hot answers tagged

16

There are two important differences between AES-128 and AES-256: AES-128 has 10 rounds, AES-256 has 14 The key expansion process (that is, how they generate subkeys) is different If your AES-128 encryption hardware just takes a plaintext block and a 128 bit key, and produces a ciphertext block, well, no, there's not much you can do. In this case, the ...


8

It depends how the “AES-128 encryption hardware units” you mention are actually defined. I've already encountered processors that allow to independently compute AES operations such as $\texttt{SubBytes}$ and $\texttt{MixColumns}$ – which are the same regardless the key size involved (128 or 256 bits). In that case: yes, it can speed up the calculation for ...


8

Your doubts are absolutely valid. Disguising the algorithm is not a valid argument for security. It also contradicts to Kerckhoffs Law. It (the algorithm) should not require secrecy, and it should not be a problem if it falls into enemy hands; Designing cryptographic algorithms (ciphers, hashfunctions, ...) is a long and complicated process. In ...


7

A cryptographical algorithm can't be immune or not immune to side channel attacks; this is because a side channel attack attacks the implementation and not the actual algorithm. Any algorithm that uses secret data can be implemented in a way that has side channel attacks, and any algorithm can be implemented in a way that may be resistant (the hard-core ...


6

First, take note of my answer to the question Estimating bits of entropy. A key phrase therein: You'll never be able to look at a bitstream without knowing the distribution and say "there are X bits of entropy here." The ent program doesn't know the distribution of the data it's looking at; instead it performs some statistical tests that any ...


6

While unfortunately that is not possible deterministically, if you have a small amount of "guaranteed trustworthy" randomness, you can use several untrusted RNGs together to generate an unlimited supply of good randomness (under some weak assumptions of non-signaling between the RNGs). This is called "randomness expansion" and I am not aware of any use in ...


5

I have argued so 15 years ago, and not been proven wrong since. Basically, A5/1, with a $n$-bit state, offers a resistance of roughly $2n/3$ bits of security. With $n = 64$, the resistance is very low, thus amenable to not only direct breaking, but also all kinds of trade-offs. All the attacks published so far are dances around that resistance level of ...


5

There are typically four different settings where you want to run your crypto. The Central Processing Unit (CPU). This may be a classic desktop or laptop CPU or the one of your embedded device. Its characteristic is that it usually has rather few computation cores ( < 20), but it can use the ones it has very fast and can execute arbitrary instructions ...


5

Often people build hardware that contains cryptographic algorithms, and they are worried about what happens if that hardware falls into the hands of an attacker. Historically, there have been several approaches to making it harder for the attacker, often used in some combination: Hardware and cryptographic algorithms specifically chosen or designed to ...


5

In two key 3DES two keys are equal so that key size is only 112 bits, compared to the 168 bits of full 3DES. The advantage is a smaller key size without a correspondingly large loss in security: both two and three key 3DES can be attacked in about $2^{112}$ time. With the encrypt-decrypt-encrypt construction it clearly must be the first and last key that ...


4

Ah ... I see. I am not a C/C++-expert. So the union in injector "projects"ints on bitfield and vice versa. That is, the start of ints and bitfield in memory is the same. Writing on bitfield automatically writes on ints. See http://www.wachtler.de/ck/8_7_struct_union.html (in german). So everything is fine.


4

Most likely, the hardware engine has an API accepting an IV of 256 bits (32 bytes) and a data block of some size multiple of 512 bits (64 bytes), and returns a result of 32 bytes. Given that SHA-256 is a Merkle-Damgård hash, in order to chain invocations of that API, you want to pass the SHA-256 IV (given by FIPS 186-4 section 5.3.3) as the IV of the first ...


4

The problem with CPU jitter is that it is difficult to pin down an accurate physical model of it that would allow you to calculate the entropy involved. Therefore entropy estimates have to largely be grounded on statistical testing, as in the document I linked in the comments. As you may know, statistical testing alone can only ever give you an upper bound ...


3

If we want to make three successive DES encryptions or decryption using 2 secret keys K1, K2 at least one time, and possibly a public constant C0 used as key, we are bound to chose among the following six possibilities (listed by alphabetical order, ignoring configurations equivalent by exchange of K1 and K2); all except number 5 are vulnerable to a basic ...


2

Would it be useful for companies who need to keep their data safe? Not exactly. The One-Time-Pad is extremely inconvenient. If your client has to encrypt a piece of plaintext that's 4GB large, then they will not only have to generate 4GB of random data, they also will have to share that pad with the receivers of that message, making it a total of 8GB of ...


2

GCM is sometimes called a 1.5 pass AEAD cipher, where the CTR encryption counts for 1 and the GMAC counts for 0.5. So you would indeed expect it to be faster than encryption + CMAC and HMAC with regards to the amount of CPU instructions. That is: as long as the encryption is using AES for both solutions. GCM requires a 128 bit block cipher while CMAC and ...


2

I'll answer your question in order of appearance and leave the ones out which are off-topic here. For example I know you can get the $x/y$ or $x$ or $y$ from your public hexadecimal address, but can you get anything like that from the secret exponent? Not directly. You can use the secret exponent (a.k.a. private key) to calculate the public key ...


1

In the paper the following remark is probably most important: For example, observing the frequency-error characteristics of Figure 4, the hashing cores corresponding to both approximate adders, $\operatorname{GDA}_{(1,4)}$ and $\operatorname{KSA}_{16}$, have negligible error rates at nominal frequency. Also, their nominal operating frequencies are ...


1

As for "how to build the substitution as hardware", it should be easy if you know any of the hardware description language (eg. VHDL or Verilog). Simply write the Sboxes of DES, then the synthesis software will handle the rest. You can also "synthesis" by hand, although that may take a lot of effect. Still, I'm not sure if this is what you are looking for. ...


1

As the other answer correctly stated, this is likely a bad idea and they are essentially selling only a perception of high security. People who don't have a cryptographic background may be mislead. How does this work? How can they offer a cryptographic algorithm that can be customized by non-specialist customers without support and not run the risk of ...


1

A simple analogy is prospecting. Consider entropy as being gold. Gold comes in veins of ore. The amount of gold in a kg of ore can vary. A higher percentage of gold means higher quality ore and thus higher rate of entropy. It's still entropy though and all gold is gold. As to "sufficient", only you can answer that depending on your intentions. If ...



Only top voted, non community-wiki answers of a minimum length are eligible