# Tag Info

15

No, this isn't an oversight. AES is a block cipher, which is a keyed permutation. Now if you have a permutation of, say, three elements there are e few permutations possible: a -> a b -> b c -> c but also: a -> b b -> c c -> a and a -> c b -> a c -> b and a -> c b -> b c -> a (there should be $6$ for $3!$, the ...

9

The fastest block cipher is identity, which leaves input blocks completely unchanged. This is infinitely fast on all platforms; however, it is not secure. So maybe you want the fastest block cipher that still offers some given non-trivial level of security? Then it depends a lot on what you want to implement the block cipher on. With recent PC, you would ...

8

The use of the AES key many times is not a problem. However, there is a fundamental flaw with your solution. The server has no way of validating that it received the client's authentic public key. In particular, a man-in-the-middle can capture the client's public key, can forward its own public key to the server, and can then decrypt all traffic sent by each ...

7

Is Rijndael the fastest block cipher in the world? No. On an Intel 64 Sandy Bridge without AES-NI, AES (a subset of Rijndael) is outperfomed by ChaCha20 (and also likely by Threefish 512 which has about 6-7cpb cost on an older Intel Core 2 Duo with 64-bit ASM (link: original Skein paper PDF)) as opposed to AES' 11 cpb. (7.59 cpb on an Intel Core 2) ...

6

There is no NIST oversight here. The key size and the block size are two completely different parameters and issues. The only reason that you need a large block size is because bad things start to happen when you encrypt too many blocks. Specifically, for an $n$-bit block size, the birthday paradox kicks in at $\sqrt{2^n}$. So, for a 128-bit block, you need ...

5

I ("SEJPM" as of now) have contacted the authors asked them the same questions as in my question. I'm posting this as community wiki, as it's not my answer to this question but rather theirs. Now the responses follow: First off, the authors are working on a design rationale in english for their new cipher. As soon as it's published, it will be linked here....

5

The most likely rationale to change the AES design is political. It's a NIST standard, designed in Western Europe. It's a bad idea! How much scrutiny has it received? Almost none. How much will it receive? Almost none. Bad idea.

4

You may be overthinking this a bit. Just pick any byte in the ciphertext, and for each possible value of the last RoundKey in that byte, do the following: decrypt just that single byte of the 256 ciphertexts (i.e. compute $AR-SR^{-1}-BS^{-1}$ for that single selected byte using the candidate RoundKey byte in the $AR$ step), and then check to see if the ...

4

Quoting from FIPS 197 (PDF), on page 11: Rcon[] The round constant word array. So, the answer is obviously "round constant".

3

how do you add an 256 bit round key? Actually, each round key is 128 bits, and so XORing them into the state matrix is easy. What the AES key expansion process does is take the 256 bit AES key, and generate 15 round keys (one more than the number of AES rounds). Now, for AES256, the first two round keys are, in fact, 256 bits taken directly from the AES ...

3

RCon == Round Constant It's a value that slightly modifies how each round operates. Without it, AES might be vulnerable to a (related key) slide attack. Such an attack would probably not be of practical interest, however since it's so easy to avoid it (by including the RCon), it makes sense to.

2

Slide #8 in the presentation you linked to describes the way Käsper and Schwabe pack the bits of the AES data blocks into CPU registers. According to the slide, what they're doing is processing eight 128-bit AES blocks in parallel, using eight 128-bit XMM registers to store them. They're not doing basic "naïve bitslicing", which would involve using 128 $n$-...

1

The speed of a cipher actually depends on lots of factors, including: The specific hardware platform you're considering (CPU architecture, instruction set, number of cores etc). Implementation details. Compiler flags used. Some ciphers have a large initial overhead due e.g. to a slow key setup; as a result they are slow when encoding very small messages. ...

1

If you actually let a single byte take on all values, and let the rest all be the same constant value, the attack should work. This so-called square attack was first tried on the cipher Square by its designers, who were Daemen, Knudsen and Rijmen. In the way you are applying it, it seems like you're getting stuck in some subspace. Informally, the AES is ...

1

What you're describing is a ciphertext-only attack on AES. No, there's no (known) ciphertext-only attack on AES. Condition one: We know none of the weaknesses and similar plain-texts in these two blocks, I just mentioned, how easily could we discover it? By the lack of an transmitted IV, an attacker can learn whether the two messages are equal and ...

1

The Encryption is not likely Compression where one can choose Normal, High or Low or something from scale of 0-100 as you mentioned. If you really want to do it, you can think of it in two ways Reduce the keyspace, as already mentioned in an above answer Reduce the Rounds. But these both will lead to a situation where you may end up in a breakthrough (...

1

Why not use the mature, analysed, and successful pattern of PGP communications? First each party exchange the public keys of both the Client and Server. Even better out of band verify them depending on your threat model (i.e. phone call or some other independent method of verification of each side's identity and public key fingerprints) which prevents man-...

1

How the cipher key is scheduled if it is less than 128 bit (for AES 128), or less than 192 bit (for AES 192) or less than 256 (for AES 256)? That is undefined; the AES specification does not address that possibility. The AES 128 algorithm assumes that you give it 128 bits of key (and tells you exactly what to do with that key); it says nothing about what ...

1

To do EEA on a finite-field, you can't perform the operations using the operations in the ring of the integers (and they're not precisely the same operations in the field either, as you're working with bit vectors, not field elements). In particular: When you do "addition", you need to perform the addition as done in even characteristic fields (that is, ...

Only top voted, non community-wiki answers of a minimum length are eligible