# Tag Info

11

Let me begin by saying that if you have a hardware source of randomness, you don't need to be stingy with it. 1) Does modulo affect the quality of randomness, faking in some way the distribution of values? Yes, it does. Or at any rate, it can --- see my answer to (3) below for more details. (I'm assuming by "quality of randomness", you specifically mean ...

7

A cryptographical algorithm can't be immune or not immune to side channel attacks; this is because a side channel attack attacks the implementation and not the actual algorithm. Any algorithm that uses secret data can be implemented in a way that has side channel attacks, and any algorithm can be implemented in a way that may be resistant (the hard-core ...

6

Your doubts are absolutely valid. Disguising the algorithm is not a valid argument for security. It also contradicts to Kerckhoffs Law. It (the algorithm) should not require secrecy, and it should not be a problem if it falls into enemy hands; Designing cryptographic algorithms (ciphers, hashfunctions, ...) is a long and complicated process. In ...

5

First, take note of my answer to the question Estimating bits of entropy. A key phrase therein: You'll never be able to look at a bitstream without knowing the distribution and say "there are X bits of entropy here." The ent program doesn't know the distribution of the data it's looking at; instead it performs some statistical tests that any ...

5

In two key 3DES two keys are equal so that key size is only 112 bits, compared to the 168 bits of full 3DES. The advantage is a smaller key size without a correspondingly large loss in security: both two and three key 3DES can be attacked in about $2^{112}$ time. With the encrypt-decrypt-encrypt construction it clearly must be the first and last key that ...

4

Often people build hardware that contains cryptographic algorithms, and they are worried about what happens if that hardware falls into the hands of an attacker. Historically, there have been several approaches to making it harder for the attacker, often used in some combination: Hardware and cryptographic algorithms specifically chosen or designed to ...

3

I'll try to give additional explanation on algebraic number and the link with EC. Let $q=2^{163}$ the finite Field $F_q=GF(q)$, as selected by NIST has some features for doing cryptography. This field has been generated with the irreduccible pentanomial you gave in the table. To understand what the trace of the polynomial is, it corresponds to the ...

3

Ah ... I see. I am not a C/C++-expert. So the union in injector "projects"ints on bitfield and vice versa. That is, the start of ints and bitfield in memory is the same. Writing on bitfield automatically writes on ints. See http://www.wachtler.de/ck/8_7_struct_union.html (in german). So everything is fine.

2

I'll answer your question in order of appearance and leave the ones out which are off-topic here. For example I know you can get the $x/y$ or $x$ or $y$ from your public hexadecimal address, but can you get anything like that from the secret exponent? Not directly. You can use the secret exponent (a.k.a. private key) to calculate the public key ...

2

If we want to make three successive DES encryptions or decryption using 2 secret keys K1, K2 at least one time, and possibly a public constant C0 used as key, we are bound to chose among the following six possibilities (listed by alphabetical order, ignoring configurations equivalent by exchange of K1 and K2); all except number 5 are vulnerable to a basic ...

2

The bottom of page 3 of your second link (the specification for LED) seems pretty clear: "Note that for a 64-bit key $K$, all subkeys are equal to $K$, while for a 128-bit key $K$, the subkeys are alternatively equal to the left part $K^1$ and to the right part $K^2$ of $K$." Basically, the input master key is split into a sorted list of nibbles, and ...

2

First, you should not write your own CSPRNG - there are plenty of well vetted ones from which you may pick. Second, your text and your pseudo code do not match (rotate key or rotate the seed). Third, as I understand this algorithm it doesn't even give good randomness properties. For example: Main> let seed = `0x82398eeaf74239 : [64] Main> let key = ...

1

As for "how to build the substitution as hardware", it should be easy if you know any of the hardware description language (eg. VHDL or Verilog). Simply write the Sboxes of DES, then the synthesis software will handle the rest. You can also "synthesis" by hand, although that may take a lot of effect. Still, I'm not sure if this is what you are looking for. ...

1

GCM is sometimes called a 1.5 pass AEAD cipher, where the CTR encryption counts for 1 and the GMAC counts for 0.5. So you would indeed expect it to be faster than encryption + CMAC and HMAC with regards to the amount of CPU instructions. That is: as long as the encryption is using AES for both solutions. GCM requires a 128 bit block cipher while CMAC and ...

1

Actually, you don't compute the trace of a polynomial per se, but of a finite-field element, which is expressed as a polynomial-like expresssion with $u$ acting as the indeterminate. ($u$, as you are probably aware, is a root of the generating polynomial $p(t)$.) Mathematically, the trace of $u$ is $$\mathrm{Tr}(u) = u + u^2 + u^4 + \cdots + u^{2^{162}}$$ ...

1

I don't know if this can help you, but did you know if in Binary Arithmetic, you have: $f(z)=z^m+r(z)$; then $z^m =f(z)+r(z)$. NB: The addition here represents the bitwise XOR, that you can easily represent in hardware by appropriate gates. Then Let's continue by examining the reduction algorithm you show us: ...

1

I've already replied to the question posted some days before. Montgomery multiplication is another way to perform modular multiplication in the residue system representation. The operation induced is in fact a group morphism. In $GF(p)$, $p$ prime, or in the multiplicative group $\mathbb{Z}/n\mathbb{Z}$, the transformation allows to perform modular ...

1

So, you need to do a two-part work. First, you need to make 2+ hardware sensors of an entropy of a different kind. Use the Geiger tube counter [ http://kripton2035.free.fr/geiger-repositor.html ] , avalanche noise generator [ http://www.cryogenius.com/hardware/rng/ ] and when you'll make an ARM microcontroller act as a USB device - make an AM(NOT FM) radio ...

1

BouncyCastle (for Java) has code that performs the AAD processing anywhere in the stream. It does however require modular exponentiation and additional multiplication. GCM mode officially requires the AAD to be processed before the plaintext, but as stated, there is a way around that. I've asked for an explanation here Len A||C is only required at the end ...

Only top voted, non community-wiki answers of a minimum length are eligible