# Tag Info

16

There are two important differences between AES-128 and AES-256: AES-128 has 10 rounds, AES-256 has 14 The key expansion process (that is, how they generate subkeys) is different If your AES-128 encryption hardware just takes a plaintext block and a 128 bit key, and produces a ciphertext block, well, no, there's not much you can do. In this case, the ...

8

Your doubts are absolutely valid. Disguising the algorithm is not a valid argument for security. It also contradicts to Kerckhoffs Law. It (the algorithm) should not require secrecy, and it should not be a problem if it falls into enemy hands; Designing cryptographic algorithms (ciphers, hashfunctions, ...) is a long and complicated process. In ...

8

It depends how the “AES-128 encryption hardware units” you mention are actually defined. I've already encountered processors that allow to independently compute AES operations such as $\texttt{SubBytes}$ and $\texttt{MixColumns}$ – which are the same regardless the key size involved (128 or 256 bits). In that case: yes, it can speed up the calculation for ...

6

While unfortunately that is not possible deterministically, if you have a small amount of "guaranteed trustworthy" randomness, you can use several untrusted RNGs together to generate an unlimited supply of good randomness (under some weak assumptions of non-signaling between the RNGs). This is called "randomness expansion" and I am not aware of any use in ...

5

I have argued so 15 years ago, and not been proven wrong since. Basically, A5/1, with a $n$-bit state, offers a resistance of roughly $2n/3$ bits of security. With $n = 64$, the resistance is very low, thus amenable to not only direct breaking, but also all kinds of trade-offs. All the attacks published so far are dances around that resistance level of ...

5

In two key 3DES two keys are equal so that key size is only 112 bits, compared to the 168 bits of full 3DES. The advantage is a smaller key size without a correspondingly large loss in security: both two and three key 3DES can be attacked in about $2^{112}$ time. With the encrypt-decrypt-encrypt construction it clearly must be the first and last key that ...

5

There are typically four different settings where you want to run your crypto. The Central Processing Unit (CPU). This may be a classic desktop or laptop CPU or the one of your embedded device. Its characteristic is that it usually has rather few computation cores ( < 20), but it can use the ones it has very fast and can execute arbitrary instructions (...

4

Most likely, the hardware engine has an API accepting an IV of 256 bits (32 bytes) and a data block of some size multiple of 512 bits (64 bytes), and returns a result of 32 bytes. Given that SHA-256 is a Merkle-Damgård hash, in order to chain invocations of that API, you want to pass the SHA-256 IV (given by FIPS 186-4 section 5.3.3) as the IV of the first ...

4

The problem with CPU jitter is that it is difficult to pin down an accurate physical model of it that would allow you to calculate the entropy involved. Therefore entropy estimates have to largely be grounded on statistical testing, as in the document I linked in the comments. As you may know, statistical testing alone can only ever give you an upper bound ...

3

If we want to make three successive DES encryptions or decryption using 2 secret keys K1, K2 at least one time, and possibly a public constant C0 used as key, we are bound to chose among the following six possibilities (listed by alphabetical order, ignoring configurations equivalent by exchange of K1 and K2); all except number 5 are vulnerable to a basic ...

2

GCM is sometimes called a 1.5 pass AEAD cipher, where the CTR encryption counts for 1 and the GMAC counts for 0.5. So you would indeed expect it to be faster than encryption + CMAC and HMAC with regards to the amount of CPU instructions. That is: as long as the encryption is using AES for both solutions. GCM requires a 128 bit block cipher while CMAC and ...

2

As for "how to build the substitution as hardware", it should be easy if you know any of the hardware description language (eg. VHDL or Verilog). Simply write the Sboxes of DES, then the synthesis software will handle the rest. You can also "synthesis" by hand, although that may take a lot of effect. Still, I'm not sure if this is what you are looking for. ...

2

Would it be useful for companies who need to keep their data safe? Not exactly. The One-Time-Pad is extremely inconvenient. If your client has to encrypt a piece of plaintext that's 4GB large, then they will not only have to generate 4GB of random data, they also will have to share that pad with the receivers of that message, making it a total of 8GB of ...

2

I'll answer your question in order of appearance and leave the ones out which are off-topic here. For example I know you can get the $x/y$ or $x$ or $y$ from your public hexadecimal address, but can you get anything like that from the secret exponent? Not directly. You can use the secret exponent (a.k.a. private key) to calculate the public key (...

1

In the paper the following remark is probably most important: For example, observing the frequency-error characteristics of Figure 4, the hashing cores corresponding to both approximate adders, $\operatorname{GDA}_{(1,4)}$ and $\operatorname{KSA}_{16}$, have negligible error rates at nominal frequency. Also, their nominal operating frequencies are ...

1

A simple way to think of the S-boxes of DES when it comes to a hardware implementation is: 8 independent ROM ICs, each with 6 address input lines and 4 data out lines. In an educational physical implementation with retro standard ICs, two such ROMs fit a 4 kiB EPROM (a 2732). Some actual software implementations of DES do group S-boxes two by two in order to ...

1

As the other answer correctly stated, this is likely a bad idea and they are essentially selling only a perception of high security. People who don't have a cryptographic background may be mislead. How does this work? How can they offer a cryptographic algorithm that can be customized by non-specialist customers without support and not run the risk of ...

1

A simple analogy is prospecting. Consider entropy as being gold. Gold comes in veins of ore. The amount of gold in a kg of ore can vary. A higher percentage of gold means higher quality ore and thus higher rate of entropy. It's still entropy though and all gold is gold. As to "sufficient", only you can answer that depending on your intentions. If you'...

Only top voted, non community-wiki answers of a minimum length are eligible