2
$\begingroup$

Recently, there has been a new paper accepted to CHES 2016 called "A High Throughput/Gate AES Hardware Architecture by Compressing Encryption and Decryption Datapaths" by R.Ueno et al.

In one line, they proposed a very efficient AES crypto processing technology via Galois filed arithmetic operations. I am no professional in this area, but I was wondering

"Does faster computation of AES allows for faster attacks on AES??"

For example lets assume if differential cryptanalysis was feasible for AES (which is not true). Then since one can compute AES on an input in, say half the time of previous computations, would that lead to an attack that is twice as fast??

I am no expert in this area, so I would like to know out of curiosity whether the paper above has any particular impact on cryptanalysis of AES.

$\endgroup$
4
$\begingroup$

Practically not, for two reasons:

  • the method described mostly speeds up AES computation with repeated use of the same key, rather than AES computation with repeated use of the same data, which is what a brute-force attacker does for key search, and what a side-channel attacker does to narrow a guess (there are other attacks, like detecting collisions in the CBC ciphertext, but a faster AES engine does not significantly help these).
  • even a speed up by a factor of 4 (more than claimed by the paper) would not qualitatively change the fact that AES key search, or other known AES attacks (excluding attacks on a particular implementation), are hopeless (when a single key is targeted, or when AES-192 or better is used); the technique in the paper reduces the security of AES-128 to 126 bits instead of 128, akin to reducing distance to notable nearby galaxies (excluding the Milky Way where we stand) to that of the Carina Dwarf instead of that to Andromeda.

Note: I have excluded side channel attacks against AES implementations using the technique described, but not use of the technique described to attack other implementations.

$\endgroup$
  • 1
    $\begingroup$ I partially disagree with your second point, because a factor of four would, if it applied to key search, make multi-target attacks easier. They are not quite as implausible against AES-128 as one might hope. $\endgroup$ – otus Aug 26 '16 at 10:26
  • 1
    $\begingroup$ @otus. Your are right; I have now modified my second point per your comment. $\endgroup$ – fgrieu Aug 26 '16 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.