# Tag Info

4

Yes, in case of VeraCrypt there is a difference, but it is negligible in practice. First we need to consider how VeraCrypt actually performs the cascading of the encryption algorithms which is (literally) a block-wise chaining. E.g.: $$C=E_{XTS}^{1}(E_{XTS}^{2}(E_{XTS}^{3}(M)))$$ where each $E$ is a block cipher run in XTS mode and all using the same XTS ...

3

I'm not sure about your definition, so let's take branch number in terms of the byte-wise differential branch number, i.e. the branch number of a function $F(x)$ is $$\mathcal{B}_{F(x)} = \min_{a,b \neq a}\{ w(a \oplus b) + w(F(a) \oplus F(b))\}$$ where $w(x)$ is the number of non-zero bytes in $x$. In this case, the branch number of the Twofish round ...

3

Just use AES. It's hardware-accelerated and implementations have had ages to have flaws discovered and patched. More strongly, just use GPG to encrypt data at rest and just use TLS (>= 1.2, with appropriate AEAD ciphers) for data in motion. "If you're typing the letters A-E-S into your code, you're doing it wrong." Anything you build yourself is infinitely ...

1

This question and answer covers the requirements of a key schedule. I could not find a simpler description of Camellia then this rfc The following excerpt outlines the key schedule. Addressing only the 128 bit cipher for simplicity: 128-bit key K: KL = K; KR = 0; ... The 128-bit variables KA and KB are generated from KL and KR ...

1

After trying all the possible inputs with Hamming Weight of 8 and below from the space of 2^64, it seems that MDS + PHT combined achieves branch number not less than 8. Since there was no output which had Hamming Weight of 0 in case of Input Hamming Weight from 1-7, MDS + PHT combined will never attain Branch Number less than 8.

Only top voted, non community-wiki answers of a minimum length are eligible