44 votes
Accepted

Can a hard drive store clear text data that is physically impossible to retrieve?

The normal way is to keep secret data in volatile static RAM (i.e. 6 transistors per bit, like in current CPU caches, not with capacitors like in DRAM). When the power is cut, the data is gone in a ...
user avatar
25 votes
Accepted

Can error correction and detection be done without adding extra bits?

In general, no. Let us say you have a data vector $x$ of $k$ bits and one bit is flipped by an error. There is no way of detecting, let alone correcting this, unless the errored data vector $x'$ is ...
user avatar
  • 16.6k
22 votes

Can a hard drive store clear text data that is physically impossible to retrieve?

It is not physically impossible to retrieve data, merely very difficult. Physical sensors such as light sensors and mesh layers on chips can be bypassed. Christopher Tarnovsky's work using a Focused ...
user avatar
17 votes
Accepted

Does using modulo (%) affect quality of randomness?

Let me begin by saying that if you have a hardware source of randomness, you don't need to be stingy with it. 1) Does modulo affect the quality of randomness, faking in some way the distribution of ...
user avatar
  • 4,198
15 votes
Accepted

Is it possible to utilize an AES-128 encryption hardware unit for AES-256?

There are two important differences between AES-128 and AES-256: AES-128 has 10 rounds, AES-256 has 14 The key expansion process (that is, how they generate subkeys) is different If your AES-128 ...
user avatar
  • 133k
15 votes
Accepted

Hardware AES: can we have a decryption implementation only?

In practice, AES encryption mostly use CTR mode or some authenticated encryption, and in these the block cipher itself is only used for encryption. There is thus often no need to implement AES ...
user avatar
  • 125k
13 votes
Accepted

Can AES-NI be used to accelerate asymmetric encryption?

These are the AES-NI instructions listed by wikipedia: AESENC: Perform one round of an AES encryption flow AESENCLAST: Perform the last round of an AES encryption flow AESDEC: Perform one round ...
user avatar
  • 19.2k
12 votes
Accepted

Difference between Hardware implemented algorithm and software implemented one?

There are typically four different settings where you want to run your crypto. The Central Processing Unit (CPU). This may be a classic desktop or laptop CPU or the one of your embedded device. Its ...
user avatar
  • 44.7k
12 votes

Different ways/algorithms for implementing AES

To my knowledge there are at least 4 ways to implement AES. I. lookup tables For simple blocs, lookup tables are fast but they are sensible to timings attacks. Here is an example of lookup table ...
user avatar
  • 9,829
11 votes

What are the dangers of using CPU clock drift for generating random data?

A TRNG is never used instead of a CSPRNG. They serve different purposes. A TRNG is used to seed a CSPRNG. A CSPRNG alone isn't enough to generate random data since it's reproducible. A hardware ...
user avatar
10 votes

Is there a cryptographic algorithm which is immune to side channel attacks?

A cryptographical algorithm can't be immune or not immune to side channel attacks; this is because a side channel attack attacks the implementation and not the actual algorithm. Any algorithm that ...
user avatar
  • 133k
10 votes
Accepted

Is ChaCha20 safer than AES with respect to side-channel attacks?

It basically depends on what you consider side-channel attacks. If you consider time/cache side channel attacks than chacha20 has been design with resistance to such attacks in mind while AES didn't. ...
user avatar
  • 6,369
9 votes
Accepted

Customizable Crypto Algorithms in Hardware

Your doubts are absolutely valid. Disguising the algorithm is not a valid argument for security. It also contradicts to Kerckhoffs Law. It (the algorithm) should not require secrecy, and it should ...
user avatar
  • 146
9 votes

Is it possible to utilize an AES-128 encryption hardware unit for AES-256?

It depends how the “AES-128 encryption hardware units” you mention are actually defined. I've already encountered processors that allow to independently compute AES operations such as $\texttt{...
user avatar
  • 2,694
9 votes

What is the relation between x y and r s in an ECDSA signature?

Yes, those encoded values are $r$ and $s$. The ASN.1 integers are signed big endian values while the two fixed sized values are unsigned big endian. So the value field may be identical or it may not, ...
user avatar
  • 85.9k
9 votes
Accepted

Choice of ECC curve on USB token

How NIST's ECC curves (P256 alias secp256r1 and friends) have been generated is public: that's in SEC2v1 (with reference to the "verifiably random" method of ANSI X9.62-1998, a draft of which is here),...
user avatar
  • 125k
9 votes

Can error correction and detection be done without adding extra bits?

No, because of the Pigeonhole Principle. Let's say you want to be able to send arbitrary $k$-bit messages. There are $2^k$ possible bit-patterns, and $2^k$ possible intended messages. Now let's say ...
user avatar
  • 191
8 votes

What is the security concept in printer cartridge?

A company can make more money if the printers it sells only work with the cartridges they sell, which does not work if there is competition. It's cheaper to force a vendor lock-in than it is to ...
user avatar
  • 13.5k
7 votes

Physical entropy source: How many bits entropy per byte is sufficent?

First, take note of my answer to the question Estimating bits of entropy. A key phrase therein: You'll never be able to look at a bitstream without knowing the distribution and say "there are X ...
user avatar
  • 6,669
7 votes
Accepted

Is CPU timing jitter a usable entropy source?

The problem with CPU jitter is that it is difficult to pin down an accurate physical model of it that would allow you to calculate the entropy involved. Therefore entropy estimates have to largely be ...
user avatar
  • 31.3k
7 votes
Accepted

(EC)DSA signature without hashing, or with offloaded hash?

Let's focus on DSA. The signing on a message $m\in \mathbb{Z}_q$ for the suggested "no-hash" protocol is done as follows: Pick $k\in_R \mathbb{Z}_q$, compute $r=f(g^k)$, where $f(\cdot):=(\cdot \...
user avatar
  • 4,503
7 votes
Accepted

Are there any issues to doing 2 rounds of AES-128? How is the security compared to AES-256?

Double encryption with 128-bit AES and two different keys does not give 256-bit security. In particular, a classic Meet-in-the-Middle attack applies, with expected cost $2^{128}$ encryptions and $2^{...
user avatar
  • 125k
6 votes

Is there a cryptographic algorithm which is immune to side channel attacks?

Often people build hardware that contains cryptographic algorithms, and they are worried about what happens if that hardware falls into the hands of an attacker. Historically, there have been several ...
user avatar
  • 5,278
6 votes
Accepted

How to tell if a hardware RNG is rigged?

While unfortunately that is not possible deterministically, if you have a small amount of "guaranteed trustworthy" randomness, you can use several untrusted RNGs together to generate an unlimited ...
user avatar
  • 329
6 votes
Accepted

Are coprocessors (Intel Phi) a threat for modern key stretching functions?

The key idea of memory-hard functions like scrypt and Argon2, as I understand them, is to analyze the cost to the attacker in terms of a time-area product. Time is how much time the attacker spends. ...
user avatar
6 votes
Accepted

Usage difference between x86 RDRAND and RDSEED

The processors come, at a first approximation, with three components: A hardware noise source; A pseudorandom generator that's periodically seeded from that noise source, whose output is available ...
user avatar
6 votes

Can error correction and detection be done without adding extra bits?

For the general case kodlus answer explained it is not possible. For detecting or correcting errors you need to have redundancy. But many kind of information have included redundancy: Some file ...
user avatar
  • 161
6 votes

Most secure but feasible encryption running on WWII technology

It depends on what you mean by widespread (military) use. The Russian VIC cipher, which used a lagged Fibonacci generator, classified as a "straddling bipartite monoalphabetic substitution ...
user avatar
  • 3,067
5 votes
Accepted

Why do 1st and 3rd key have to be the same in 2 key 3DES?

In two key 3DES two keys are equal so that key size is only 112 bits, compared to the 168 bits of full 3DES. The advantage is a smaller key size without a correspondingly large loss in security: both ...
user avatar
  • 31.3k
5 votes
Accepted

LED cryptography algorithm

The bottom of page 3 of your second link (the specification for LED) seems pretty clear: "Note that for a 64-bit key $K$, all subkeys are equal to $K$, while for a 128-bit key $K$, the subkeys are ...
user avatar
  • 4,335

Only top scored, non community-wiki answers of a minimum length are eligible