Skip to main content

Questions tagged [arx]

Design philosophy for ciphers. ARX solely relies on additions, rotations and XORs to build ciphers and similar algorithms. This usually constructs ciphers that are highly resistant against side-channel attacks. Well-known examples are Threefish and Salsa20/ChaCha.

Filter by
Sorted by
Tagged with
3 votes
3 answers
1k views

Why is SHA-2 considered an ARX construction when it also uses non-ARX operations?

SHA-2 makes use of non-ARX non-linear operators such as the Choice and Majority functions: \begin{align} \mathsf{Ch}(E,F,G) &= (E \wedge F) \oplus (\neg E \wedge G)\\ \mathsf{Ma}(A, B, C) &= (...
LightTunnelEnd's user avatar
1 vote
1 answer
88 views

DDT for boolean functions must contain only powers of two

I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
Alessio Proietti's user avatar
2 votes
1 answer
116 views

Good S-boxes from ARX designs

Have any good 8-bit S-boxes made using ARX principles been found yet? I found Alzette, but it's a huge S-box at 64 bits. I know that with a combination of addition, rotation, and XOR that any S-box ...
Melab's user avatar
  • 3,655
3 votes
0 answers
152 views

Cryptanalysis of ARX Ciphers

Rotational Cryptanalysis of ARX show that rotational probability of an ARX primitive can be computed by $p^q$ where $p$ is rotational probability of modular addition and $q$ is number of modular ...
crypt's user avatar
  • 2,449
7 votes
2 answers
734 views

Fast cipher without needing hardware support (like ChaCha20) for disk encryption

On my old laptop, ChaCha20 is quite a bit faster than AES as there is no hardware acceleration for AES. But for disk encryption AES based schemes seem to be the only option, as a stream cipher like ...
JanKanis's user avatar
  • 233
1 vote
1 answer
106 views

Alzette ARX round constants

In this paper Alzette "ARX-box" is presented and on page 9 authors claim about XORing round constants: They also break additive patterns that could arise on the left branch due to the chain ...
LightBit's user avatar
  • 1,659
2 votes
0 answers
79 views

Linear approximation of modular addition of a constant?

In Linear Approximations of Additions Modulo $2^n$, Wallén shows how to compute the correlation of the modular addition of two binary bit vectors. A simple recursive procedure was given by Schulte-...
Federico Lebrón's user avatar
2 votes
1 answer
149 views

Converting a 32-bit ARX cipher to a 64-bit one, should the rounds be increased?

I read about using 64-bit words in PRF functions. I want to convert the 32-bit ARX cipher Chacha into a 64-bit version, with key/block size of 1024-bits (512*2=1024-bits) My question is: Should I add ...
phantomcraft's user avatar
0 votes
0 answers
71 views

Why does SHA2 work? [duplicate]

I was reading how bitcoin uses sha2 I understand how sha2 works procedurally (i.e. https://qvault.io/cryptography/how-sha-2-works-step-by-step-sha-256/), but I have no clue why it works. Steps like s0 ...
user avatar
3 votes
1 answer
94 views

Fastest order-sensitive operations

For any $v$ many $b$-bits vectors $(\mathbf{x}_0, \mathbf{x}_1, \ldots, \mathbf{x}_{v-1}) \in \{\{0, 1\}^b\}^v$, what's the fastest way to combine $\mathbf{x}_0, \mathbf{x}_1, \ldots, \mathbf{x}_{v-1}$...
caveman's user avatar
  • 573
5 votes
0 answers
166 views

Why does chacha20 not use bitwise not?

Right now chacha20 and blake use constants in order to eliminate fixpoints. As far as I know however inserting a bitwise not every $n$ rounds should eliminate this ...
8321992485's user avatar
0 votes
2 answers
280 views

what are the benefits/limits of constructing AEAD using Duplex mode with ARX primitive (chacha20 for example)?

I understand that WAGE cipher uses duplex/sponge mode with stream based cipher for Authenticated encryption with associated data (AEAD) and NORX uses duplex/sponge mode with LRX structure , so , Is ...
hardyrama's user avatar
  • 2,136
1 vote
1 answer
101 views

Term for non-ARX symmetric-key cryptographic primitive design strategy

What's the term for describing designing symmetric-key cryptography primitive out of bitwise operations and shifts and rotations? The closest thing I've found is this Keccek team's page calling it ...
DannyNiu's user avatar
  • 9,421
2 votes
1 answer
1k views

How to symmetrically encrypt 64bit values?

I'm curious about an algorithm that would be good for the following scenario: 32-bit "plaintext" input, taken from a counter 32 or 64-bit "ciphertext" output It should be possible to decrypt the ...
shader's user avatar
  • 133
4 votes
0 answers
132 views

What is the probability equation of rotational cryptanalysis on modulo multiplication?

The answer in this question defined how to calculate the probability of rotational cryptanalysis on modulo multiplication $\odot$. This paper defined an algebraic equation of how to calculate the ...
hardyrama's user avatar
  • 2,136
3 votes
1 answer
203 views

Countermeasures to prevent integral cryptanalysis against 4-rounds AES

Integral cryptanalysis against 4-rounds AES is practical (Security of the AES with a Secret S-box). I did two experiments in order to find the impact and remove the integral distinguisher of 4 rounds:...
hardyrama's user avatar
  • 2,136
0 votes
0 answers
163 views

Differential probability of modular subtraction $xdp^-$

The modular addition has been a main component in block cipher. The use of modular subtraction in block cipher is not common but there are some cipher such as Bel-T cipher which uses both modular ...
hardyrama's user avatar
  • 2,136
16 votes
1 answer
742 views

Selection of rotation constants in ARX design

My question is about choosing the rotation values in ARX design such as SIMON-like or SPECK-like ciphers to provide optimal differential and linear immunity. According to this, the selection of $a$ ...
hardyrama's user avatar
  • 2,136
2 votes
2 answers
355 views

Achieving non-linearity in a block cipher using only rotations, shifts, AND, OR, and XOR

It is supposedly difficult to introduce enough non-linearity in block ciphers based on modular addition, data-independent bitwise rotations, and XOR to make them secure against certain kinds of ...
Melab's user avatar
  • 3,655
1 vote
1 answer
700 views

Alternative block cipher design paradigms to SP-networks and Feistel-like ones?

Before I familiarized myself with the type of cryptography that became popular with the rise of the information age, I was very much into what the community seems to call "classical" ciphers:...
Melab's user avatar
  • 3,655
6 votes
3 answers
2k views

Weaknesses in ARX block ciphers

What are the weaknesses in a block cipher that uses modular addition, rotations with fixed amounts, and XOR? Can substitution boxes or permutation boxes be replicated with these three operations? ...
Melab's user avatar
  • 3,655
2 votes
1 answer
181 views

Would modifying the key of an arbitrary ARX cipher make it harder to break?

Consider a simple ARX block cipher in which after each block is encrypted, the key is rotated and/or XORed by some variable value. Would this make the key any more secure, or just be a waste of time? ...
Jacob H's user avatar
  • 364
1 vote
0 answers
318 views

How well do ARX algorithms preform (in terms of diffusion)?

I have been researching ARX algorithms, but I would like to know how well does ARX (both single or multiple rounds of) provide diffusion compared to an s-box or an SP network. Also, are there any ...
Nat's user avatar
  • 415
3 votes
1 answer
531 views

Role of xor in ARX construction

In ARX construction like Salsa 20, why xor operation is required? That is why AR is not sufficient? Note that xor is a linear operation.
user15864's user avatar
  • 229
1 vote
0 answers
334 views

Algebraic Attacks against ARX

I have not seen much about algebraic attacks against ARX ciphers. How would ARX ciphers compare in algebraic security to AES or Present or Simon?
user3201068's user avatar
5 votes
1 answer
2k views

How are boolean functions used in cryptography?

I recently started becoming interested in Boolean functions. Because they are defined as $f: \{0, 1\}^n \rightarrow \{0, 1\}$, or in other words only over $\{0, 1\}$, I guessed they can somehow be ...
user avatar
3 votes
1 answer
267 views

ChaCha20 core vs ideal unkeyed PRP

I know that the ChaCha20 core (without the initial constant) is not an ideal PRP and must not be used as such. I also know that $\text{ChaChaCore}(0) = 0$. Are there any other differences?
Demi's user avatar
  • 4,793
5 votes
1 answer
484 views

Which precautions to protect against side-channel attacks on ARX ciphers?

In recent crypto there has been a trend to design ciphers using only the ARX set of instructions - i.e. additions (modulo $2^{32}$ or $2^{64}$), rotations (by a fixed constant) and XORs, examples ...
SEJPM's user avatar
  • 46.1k
1 vote
1 answer
453 views

rotational cryptanalysis on modulo multiplication?

I saw the paper 'Rotational Cryptanalysis of ARX', it is effective against design primitives using XOR, addition, and rotation. http://www.iacr.org/archive/fse2010/61470339/61470339.pdf However ...
meta_warrior's user avatar
5 votes
1 answer
869 views

Do data-dependent rotations have any advantage over fixed rotations?

There are many ARX ciphers, however most use fixed rotations. I know data-dependent compared to fixed rotations are: patented (expired) harder to implement constant time more expensive in hardware ...
LightBit's user avatar
  • 1,659