15
votes
Accepted
What are the drawbacks of "lightweight crypto"?
As a caveat, I haven't been involved with the process, so can't speak fully to it (and would welcome an answer from someone more in-the-know).
That being said, it is worth mentioning how "light&...
- 13k
12
votes
Accepted
Lightweight cipher using only 8-bit operations
SPECK was actually designed with 8-bit CPUs in mind. I use Simon and Speck extensively, and there's example source code and comparisons out there, as well as a good paper. The references are good ...
- 4,820
11
votes
Lightweight cipher using only 8-bit operations
I second Richie Frame's observation that AES is an excellent choice. I'd use AES-128 in CTR mode, which has the advantage that decryption is the same as encryption (thus is as fast, contrary to some ...
- 141k
7
votes
Accepted
CAESAR finalists: Lightweight case (Ascon vs ACORN)
Ascon and ACORN both have interesting features. Let's discuss their pros and cons for some properties stated during the CAESAR competition for lightweight AEADs:
Fits into small hardware area and/or ...
- 2,836
7
votes
Is there a lower cost cryptography than elliptic-curves based cryptography?
In fact, for public-key operation (message encryption and signature verification, as opposed to message decryption and signature generation), RSA and, even more, the Rabin cryptosystem, outperform ECC....
- 87k
6
votes
Accepted
What is the official, generally accepted definition of "lightweight crypto"?
There is no official definition, of course. However, at least in my experience, the word is used consistently.
The word lightweight typically refers to something that is significantly less expensive ...
- 4,627
5
votes
Accepted
Why is symmetric lightweight crypto only about block ciphers and not about stream ciphers?
Why is symmetric lightweight cryptography only about block ciphers and not
about stream ciphers?
Why that assumption? There is a lot of work concerning stream ciphers for lightweight cryptography (...
- 2,836
5
votes
Accepted
NIST LWC finalists (AEAD) vs ChaCha20-Poly1305
As for every benchmark, it all depends on the computing platform.
As mentionned in comment, you will find benchmarks at bench.cr.yp.to that include NIST LWC finalists and ChaCha-20. However, most of ...
- 2,836
5
votes
Accepted
What is the status of the NIST Lightweight Cryptography Standardisation Process?
My contact in NIST has told me that they were expecting to announce first week of January, but now it looks more like it will happen late in the same month.
This is unofficial but I expect it to be ...
- 22.5k
4
votes
Accepted
Lightweight primality certificates for untrusted DH parameters
Well, one possibility to generate a moderately lightweight certificate would be to use this theorem:
If we have values $p, q, g$ such that:
$1 < g < p$
$q > \sqrt{p}$
$q \mid p-1$
$g^q \...
- 147k
4
votes
Why does TinyJAMBU-128 claim only 112-bit security?
I believe this is simply a statement of the intention to meet the submission requirements set out by NIST for lightweight ciphers. Note that the paper linked in the question refers to "security ...
- 1,443
4
votes
How to check that an $km \times km$ block-binary matrix is an MDS matrix in $k$-bit words over $\operatorname{GF}(2)$
Let $\bf A$ be an $n \times n$ binary matrix. Let we want to check that whether $\bf A$ is an MDS matrix over the finite field $\mathbb{F}_{2^k}$ for some $k$?
The necessary condition is that $k\mid n$...
- 253
4
votes
Accepted
Are there recommended modes of operation for lightweight ciphers?
When using lightweight ciphers, the block size can make a huge difference to security. Fortunately, there has been a lot of work in recent years on tight bounds for modes of operations, and methods ...
- 27.8k
4
votes
What is the lightweight key exchange protocol of choice?
I would personally use triple Diffie-Hellman, which is used often in secure instant-messaging protocols but unfortunately not very well-known beyond that. Essentially, both parties have a long-term ...
- 1,101
4
votes
What is the official, generally accepted definition of "lightweight crypto"?
"Lightweight" implies a comparison with a reference implementation or with another "heavyweight" implementation, so it's always context dependent. Since there is no single industry standard algorithm ...
- 3,728
4
votes
Accepted
What are the advantages of MICKEY over Trivium and Grain?
MICKEY appears to be a good low-power stream cipher but, in the context of the eSTREAM portfolio, it does not seem to excel at anything in particular. Trivium and Grain have more implementation ...
- 12.5k
4
votes
Accepted
Generating an IV for AES-CBC
If you have a nonrepeating (but possibly predictable) value, you can convert that into an unpredictable CBC-mode IV at fairly minimal cost. Here's how:
Prepend the 128 bit nonrepeating value to the ...
- 147k
4
votes
Lightweight cipher using only 8-bit operations
I do not have benchmarks on this particular processor, so this answer is opinion / guesswork.
Gimli is fast and low-memory, but is just a permutation. Ciphers can be pretty trivially implemented on ...
- 5,836
4
votes
Accepted
In what cases might PRESENT be implemented as encryption-only?
So in what cases might we need only encryption but not decryption? It seems strange we would encrypt something that does not need decrypting at some point.
For example, the CTR mode uses only ...
- 48.5k
4
votes
NIST vs ISO Encryption standardisation process
ISO/IEC are paid standards, it's a business.
The NIST produce free standards that can be made mandatory for US institutions (like the DoD) and its industrial partners.
Opinion: The NIST standards are ...
- 934
4
votes
Accepted
NIST vs ISO Encryption standardisation process
what's the difference ...
ISO standards are literally international, where as NIST is US-specific.
ISO standards are available FOR PURCHASE and are copyrighted. NIST as a government organ of US, ...
- 9,207
3
votes
Accepted
Could we use a more efficient hash for signature generation?
As mentioned in the comments already, you do not need collision resistance. You can get away with target collision resistance (TCR). The security game for TCR considers families of hash functions and ...
- 2,888
3
votes
Where can I find a clear diagram of the SPECK algorithm?
Where can I find a clear algorithm diagram of speck algorithm?
Have you looked at the spec wiki page - that (at the time I write this) includes both an algorithm diagram and a C implementation (...
- 147k
2
votes
Lightweight Asymmetric encryption algorithm
There is an alternative to ECC, called Ring-LWE,
it claims to be 10x faster than ECC on microcontrollers.
details: Efficient Software Implementation of Ring-LWE Encryption
There is a C/C++ ...
- 21
2
votes
Standard lightweight one-way hash functions for IoT devices
Here you have a study about different cryptographic methods in different IoT devices:
Midgar: Study of communications security among Smart Objects using a platform of heterogeneous devices for the ...
- 229
2
votes
Standard lightweight one-way hash functions for IoT devices
You should take a look at ISO/IEC 29192 which is a standard for lightweight cryptography that specifies several techniques for block/stream ciphers, asymmetric techniques and hash functions.
...
- 2,836
2
votes
Is there any dedicated research group which is working in energy efficient cryptographic functions?
For low energy usage, google for research groups focusing on lightweight cryptography. See Section 3 of http://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8114.pdf for NIST's contributions to ...
- 393
2
votes
In what cases might PRESENT be implemented as encryption-only?
A bona fide use case for encryption only is inside a true random number generator (TRNG). If you have something small like:-
it's common to whiten the raw entropy signal using a cryptographic ...
- 15.4k
2
votes
In what cases might PRESENT be implemented as encryption-only?
Ciphers that are targeted for light-weight applications often have some common, but one-off, use cases. I have an IC with and ADC that is passively powered via RFID, and then sends encrypted data via ...
- 4,820
2
votes
Accepted
How to obtain inverse key stream efficiently on Present cipher?
The PRESENT key schedule operates on a register the same length as the key size. The left most 64-bits are extracted as round keys and then the register updated by performing a 61-bit left rotation on ...
- 23.8k
Only top scored, non community-wiki answers of a minimum length are eligible