Daniel J. Bernstein proposes an alternative to NIST AES-CTR based deterministic random number generator (AES-CTR-DRBG). Instead of a less performant complex construction, he uses an standard AES-CRT with a fast key erasure method.

I am asking myself, is AES key expansion overhead really necessary for this application?

Instead of using the the first 2 blocks of each 48 to generate a new key using the standard key expansion to generate the needed 15 round keys, use directly the first 15 blocks as round keys, bypassing completely the key expansion step.

Is this scheme less secure than the initial proposal of Daniel J. Bernstein?

  • 2
    $\begingroup$ What you propose may or may not be secure, but the security of djb's fast-key-erasure scheme relies only on the standard security conjecture of AES, whereas what you're suggesting requires custom analysis of AES components used in a nonstandard way. If you want something more efficient, you could just use a more efficient primitive like ChaCha that requires no key expansion. $\endgroup$ – Squeamish Ossifrage Nov 3 '19 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.