5
$\begingroup$

What is the basic difference between the following types of Authenticated Encryption (AE) schemes?

  1. Lightweight Authenticated encryption
  2. Online Authenticated Encryption
  3. Authenticated Encryption for low memory devices

Are they all the same or is there a specific difference between them?

Improve this question
$\endgroup$
8
  • 1
    $\begingroup$ @downvoters: How so? I think this is a reasonable question, particularly given one or more of them are given as key features of CAESER submissions. $\endgroup$
    – Cryptographeur
    Mar 21, 2014 at 12:48
  • 2
    $\begingroup$ @figlesquidge I guess it's due to lack of research. The question doesn't have the seemingly obligatory "what have you tried" clause. OP if you can please add some details, like demonstrate how they are similar and why that is confusing, I guess it would re-open the question. I hope this helps. $\endgroup$
    – rath
    Mar 21, 2014 at 18:10
  • 1
    $\begingroup$ That's a fair point, but two down-votes and 4 close-votes without anyone leaving a comment seems rather poor form. It is very clear what this question is asking. It might not have been asked well, but "unclear what you're asking" doesn't seem an acceptable reason to close it. [/rant] $\endgroup$
    – Cryptographeur
    Mar 21, 2014 at 18:12
  • 1
    $\begingroup$ @figlesquidge - I guess the question being closed because it's "unclear what you're asking" suffices in lieu of comments. I second Rath's comment. In my opinion, the question seems extremely vague, and too broadly open to interpretation. Adding some links, references, and/or previous research to the question might help provide context, and make the question answerable. However, if this question seems clear to you - go ahead and answer it. $\endgroup$
    – hunter
    Mar 21, 2014 at 19:10
  • 1
    $\begingroup$ Related to the “unclear what you're asking” votes… here's my humble point of view. After all, we've accepted alike questions with similar research efforts. $\endgroup$
    – e-sushi
    Mar 23, 2014 at 13:15

1 Answer 1

Reset to default
9
$\begingroup$

Thought I'd begin with some references for you that might be of interest. These terms are used as key 'selling points' for a number of schemes, including many of the CAESAR submissions. Some examples using the terms specifically are given below - most of which are from CAESER because I have the zoo in-front of me:

  • "Online": OCB, Ascon, CBA, APE, NORX
  • "memory-constrained devices": Ketje / Keyak / Spongewrap,
  • "lightweight": PRESENT, JAMBO, APE, BLINKER (presented CT-RSA14)

Also, there was an eCrypt report on Lightweight crypto.

I can't provide a decent distinction between the 1 & 3, since low memory footprint is a more specific sub-aim of lightweight. Both of these are types of schemes designed to be run in highly restricted environments, such as on embedded devices. These often have constraints that actually affect what operations you can/cannot run on them, such that more efficient algorithms than an AES-based mode may be preferred.

Online AE deals with something completely different. Let A be some associated data, $M=(M_1,\dots,M_n)$ a message, encrypting to $C=(C_0,\dots,C_n)$ and tag $T$. The scheme is online if $C_i$ can be calculated without knowledge of $M_j$ for any $j>i$.

Often lightweight or small footprint ciphers are 'online'. This is because it allows them to process plaintext blocks as they come through. In contrast, an offline cipher would have to collect the complete plaintext before calculating the ciphertext, which means it must have enough memory to store $n$ blocks of data, which not all devices will do - especially for example a small industrial sensor reporting on large amounts of data.

Recently there has been some controversy about the validity of an online decryption function, since they release unverified plaintext (for example, see the CAESER mailing list or this paper). For categorization of some schemes under development, see here.

Improve this answer
$\endgroup$
1
  • 2
    $\begingroup$ One may also note that there are "semi-online" schemes where the size of the input (but not the contents) must be known from start (e.g. CCM). $\endgroup$
    – Thomas Pornin
    Mar 27, 2014 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.