Hot answers tagged

13 votes
Accepted

Fast cipher without needing hardware support (like ChaCha20) for disk encryption

Adiantum1 is a wide-block cipher built out of ChaCha12, NH-Poly1305, and—for only a small part of the computation—AES. Being a wide-block cipher, Adiantum can encrypt, for example, entire 512-byte or ...
Taylor R Campbell's user avatar
9 votes
Accepted

Selection of rotation constants in ARX design

Leaving besides that the designers (NSA) of Simon and Speck did not provide an initial design rational for their ciphers/parameter choices, they added some notes later after pressure from the ...
TheBananaMan's user avatar
8 votes

Weaknesses in ARX block ciphers

What are the weaknesses in a block cipher that uses modular addition, rotations with fixed amounts, and XOR? Can substitution boxes or permutation boxes be replicated with these three operations? The ...
poncho's user avatar
  • 146k
7 votes
Accepted

How are boolean functions used in cryptography?

Many properties of boolean functions are used in stream and block cipher design, e.g., when they are used as filtering and combining functions. Some important examples are: Nonlinearity (minimal ...
kodlu's user avatar
  • 21.9k
7 votes
Accepted

ChaCha20 core vs ideal unkeyed PRP

It would be extremily surprising if the ChaCha core was a permutation (as the last P in PRP), although we have no proof it is not (if it was a permutation, it would at least be one we do not known how ...
fgrieu's user avatar
  • 140k
6 votes
Accepted

Converting a 32-bit ARX cipher to a 64-bit one, should the rounds be increased?

Typically when there's a variant of an ARX algorithm that goes from 32-bit words to 64-bit words, we do increase the rounds. As DannyNiu mentioned, BLAKE2 is a variant of ChaCha, and while BLAKE2s (...
bk2204's user avatar
  • 3,046
4 votes
Accepted

How to symmetrically encrypt 64bit values?

Are there any existing algorithms that work for this scenario? Yes, actually, there are a number of 64 bit block ciphers. The standard wisdom is that they aren't encouraged for general use, ...
poncho's user avatar
  • 146k
4 votes
Accepted

Would modifying the key of an arbitrary ARX cipher make it harder to break?

Consider a simple ARX block cipher in which after each block is encrypted, the key is rotated and/or XORed by some variable value It sounds like you are asking "What if we apply a key schedule at the ...
Ella Rose's user avatar
  • 19.6k
4 votes

Achieving non-linearity in a block cipher using only rotations, shifts, AND, OR, and XOR

The brief answer is: Yes, you can! You may wish to study NORX, an AEAD scheme submitted to the CAESAR competition, whose essential thesis is that you can simultaneously attain high security, high ...
Squeamish Ossifrage's user avatar
4 votes

Weaknesses in ARX block ciphers

You ask "what permutations can you form using those three operations?" The answer was: you can create all permutations by ARX. However, you can do even better and need only two of them: the XOR is ...
modulo's user avatar
  • 41
3 votes
Accepted

Why is SHA-2 considered an ARX construction when it also uses non-ARX operations?

The answer depends on the definition of what is an “ARX” algorithm. According to the first approach, if some cryptographic algorithm (namely, a permutation or transformation) uses (modular) additions, ...
lyrically wicked's user avatar
3 votes
Accepted

DDT for boolean functions must contain only powers of two

It is perfectly possible for the Difference Distribution Table (DDT) to have entries that are not powers of $2.$ There is no "reasonable" criterion that would rule this out that I am aware ...
kodlu's user avatar
  • 21.9k
3 votes

Weaknesses in ARX block ciphers

One generic weakness of ARX designs is that for certain inputs $x,\ y$, $x + y \equiv x \oplus y$. This allows you to linearize subsections of the state and view them as if addition were not applied ...
Ella Rose's user avatar
  • 19.6k
3 votes
Accepted

Role of xor in ARX construction

Xor is the "addition" operator for algebra with boolean operators, while AND is the "multiplication" operator for boolean operators. "Regular" addition and multiplication are the addition/...
Ella Rose's user avatar
  • 19.6k
2 votes

Which precautions to protect against side-channel attacks on ARX ciphers?

Side channels Essentially, side channels tell something about the secret data by using properties (e.g. timing, power consumption) of the algorithm itself. If an algorithm executes in a different way ...
dusk's user avatar
  • 1,175
2 votes
Accepted

what are the benefits/limits of constructing AEAD using Duplex mode with ARX primitive (chacha20 for example)?

It is possible! The SPARKLE suite is a round 2 family of NIST candidates that uses ARX-based permutations to build sponge-based hash functions (called ESCH) and duplex-based AEAD (called Schwaemm): ...
picarresursix's user avatar
2 votes
Accepted

Term for non-ARX symmetric-key cryptographic primitive design strategy

Primitives based purely on bitwise and shift/rotate operations can be described as being based on: Binary Polynomials Bitwise and, or, not, xor are element-wise $\mathbb{F}_2$ additions and ...
DannyNiu's user avatar
  • 9,080
2 votes

Why is SHA-2 considered an ARX construction when it also uses non-ARX operations?

SHA2 and MD5 predate most ARX designs. It probably inspired ARX designs. It is all based on same idea of mixing different operations to get non-linearity. Some consider RC6 and IDEA to be ARX. Some ...
LightBit's user avatar
  • 1,649
1 vote

Why is SHA-2 considered an ARX construction when it also uses non-ARX operations?

It really depends on your definition of "ARX". The only things in SHA-2 that are not ARX on their surface are AND, NOT, and shift. However, we can define these in terms of ARX operations. ...
Myria's user avatar
  • 2,575
1 vote

Good S-boxes from ARX designs

Alzette is relatively weak S-box for its size. It has comparable linear and differential properties to AES S-box as described in paper. There is also SPARX cipher with 32-bit ARX-box. I'm unaware of 8-...
LightBit's user avatar
  • 1,649
1 vote

Fastest order-sensitive operations

This is one simple idea. I will use $x_i$ for the vector in $d$ dimensions and use $a_i$ for the corresponding integer in $\{0,1,\ldots, 2^d-1\}$. Sort the $a_i$ from small to large. Let $r_i$ be the ...
kodlu's user avatar
  • 21.9k
1 vote
Accepted

Countermeasures to prevent integral cryptanalysis against 4-rounds AES

This question may be theoretically interesting. However, it looks to me strongly likely that the nice diffusion properties of AES using operations of order $4$ ShiftRows) and matrix ($4\times 4$) ...
kodlu's user avatar
  • 21.9k
1 vote

Achieving non-linearity in a block cipher using only rotations, shifts, AND, OR, and XOR

Notice applying xor against the constant 1 is the not gate. And adding either Or gates or And gates is sufficient to create any function. Xoring, shift and rotation alone are not sufficient.
Meir Maor's user avatar
  • 11.8k
1 vote

Alternative block cipher design paradigms to SP-networks and Feistel-like ones?

Are ARX block ciphers considered there own class of block cipher separate from SPNs and Feistel-like ones? Generally speaking, yes. ARX ciphers typically only use simple CPU instructions (Addition, ...
Ella Rose's user avatar
  • 19.6k

Only top scored, non community-wiki answers of a minimum length are eligible