0
$\begingroup$

I want to know how the Threefish cipher can be used to encrypt and decrypt. I tried to find out by searching the Internet but can't find a concrete answer. The only answers are theoretical in nature which is not usable to me.

$\endgroup$
  • $\begingroup$ Are you looking for how Threefish internally works or for how you can actually usefully encrypt data given a functional Threefish implementation? $\endgroup$ – SEJPM Nov 25 '17 at 20:06
3
$\begingroup$

As far as I know there isn't any Threefish-specific encryption standard specified. I actually asked Bruce Schneier back in the day (when I created my "SkeinFromSpec" implementation). Threefish is a tweakable block cipher with a large block size. I asked for instance if you should keep to the high amount of rounds (80 for Skein) and what mode I should use, but I never got a concrete answer. At that time the Skein team was of course mainly busy with the SHA-3 contest.

In principle you could use any mode of operation that is also available for normal block ciphers, as long as it allows for the larger block size. You are of course better off using an (authenticated) mode of operation for tweakable block ciphers. There are a few papers on that, but as you've indicated, they are usually theoretical in nature.

Things may have been different if Skein was the winner of the SHA-3 contest. There are a few proposed modes that use the Keccak sponge - the winner of the SHA-3 contest - which you could use, Keyak for instance.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Happy to delete this if things have changed by now... $\endgroup$ – Maarten Bodewes Nov 25 '17 at 18:56
  • $\begingroup$ I actually remember having stumbled over a really nice mode for tweakable ciphers a while back, I'll see whether I can find it again. As for the round-count, I think this is covered in the design rationale part of the Skein spec? $\endgroup$ – SEJPM Nov 25 '17 at 19:54
  • $\begingroup$ I found the mode! McOE is nonce misuse resistant while offering very little overhead. $\endgroup$ – SEJPM Nov 25 '17 at 20:02
  • $\begingroup$ Oh cool. Wrt to the rationale, sure it is there and it is likely as good for implementing the hash as a cipher - but there is no explicit rationale for the latter. 80 rounds is probably very secure but I wonder if you cannot get away with fewer rounds. Note that Threefish does require a lot of rounds; do not compare it directly with e.g. AES rounds. $\endgroup$ – Maarten Bodewes Nov 25 '17 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.