Hot answers tagged

9

Analyzable in this case means "simple to study". If your cipher consists of a small function that mixes a few things together, and then you repeat that often then your cipher is more easily understood and more easily fit into previous research knowledge than a overclomplicated large design. This is the case with Simon and Speck. Being easy to analyze is a ...


6

Let's first get something out of the way. You say ".. key-recovery attack for SPECK32/64 ..". This is not true. The cryptanalysis you linked attacks SPECK32/64 with 10 rounds. This is less than half the amount of rounds used for SPECK32/64. Then onto your actual question, is $2^{29}$ chosen plaintexts a good or a bad attack? I can't decide that for you, but ...


3

Yes, this is secure. (one of the few cases where I'm pretty confident about this). Here are the arguments: Combining a secure (e.g. SUF-CMA) MAC with a secure (e.g. CPA-secure) encryption method in encrypt-then-authenticate is generally proven secure. This was shown in "Authenticated Encryption: Relations among notions and analysis of the generic ...


3

A normal security notion for MAC's is that of unforgeability. So given some set of message,tag pairs $(m_0,t_0),\ldots,(m_k,t_k)$ is should be hard to create a tag for a new message not among the $\{m_0,\ldots,m_k\}$, stated informally. In your case, you could just use $E_k(m_0)$ with the secret MAC key $k$ ($H_0$ in your notation); no need for the extra ...


2

The main advantage I have heard is reducing the amount of data the client has to send to the cloud. As said in A Comparison of the Homomorphic Encryption Schemes FV and YASHE: [...] ciphertext expansion (i.e. the ciphertext size divided by the plaintext size) of current FHE schemes is prohibitive (thousands to millions). For example using ...


1

It is too early to interpret the cryptanalytic results on those ciphers, as the results have not been verified by third parties. These papers are preprints, and they have not been peer-reviewed. I recommend to wait for the upcoming conference Fast Software Encryption 2014, where I expect to see many more new results on those ciphers, and they would undergo ...



Only top voted, non community-wiki answers of a minimum length are eligible