44 votes
Accepted

Can a hard drive store clear text data that is physically impossible to retrieve?

The normal way is to keep secret data in volatile static RAM (i.e. 6 transistors per bit, like in current CPU caches, not with capacitors like in DRAM). When the power is cut, the data is gone in a ...
Thomas Pornin's user avatar
25 votes
Accepted

Can error correction and detection be done without adding extra bits?

In general, no. Let us say you have a data vector $x$ of $k$ bits and one bit is flipped by an error. There is no way of detecting, let alone correcting this, unless the errored data vector $x'$ is ...
kodlu's user avatar
  • 22.5k
22 votes

Can a hard drive store clear text data that is physically impossible to retrieve?

It is not physically impossible to retrieve data, merely very difficult. Physical sensors such as light sensors and mesh layers on chips can be bypassed. Christopher Tarnovsky's work using a Focused ...
SAI Peregrinus's user avatar
15 votes
Accepted

Is it possible to utilize an AES-128 encryption hardware unit for AES-256?

There are two important differences between AES-128 and AES-256: AES-128 has 10 rounds, AES-256 has 14 The key expansion process (that is, how they generate subkeys) is different If your AES-128 ...
poncho's user avatar
  • 147k
15 votes
Accepted

Hardware AES: can we have a decryption implementation only?

In practice, AES encryption mostly use CTR mode or some authenticated encryption, and in these the block cipher itself is only used for encryption. There is thus often no need to implement AES ...
fgrieu's user avatar
  • 141k
13 votes
Accepted

Can AES-NI be used to accelerate asymmetric encryption?

These are the AES-NI instructions listed by wikipedia: AESENC: Perform one round of an AES encryption flow AESENCLAST: Perform the last round of an AES encryption flow AESDEC: Perform one round ...
Ella Rose's user avatar
  • 19.6k
12 votes

Different ways/algorithms for implementing AES

To my knowledge there are at least 4 ways to implement AES. I. lookup tables For simple blocs, lookup tables are fast but they are sensible to timings attacks. Here is an example of lookup table ...
Biv's user avatar
  • 9,988
11 votes

What are the dangers of using CPU clock drift for generating random data?

A TRNG is never used instead of a CSPRNG. They serve different purposes. A TRNG is used to seed a CSPRNG. A CSPRNG alone isn't enough to generate random data since it's reproducible. A hardware ...
Gilles 'SO- stop being evil''s user avatar
10 votes
Accepted

Is ChaCha20 safer than AES with respect to side-channel attacks?

It basically depends on what you consider side-channel attacks. If you consider time/cache side channel attacks than chacha20 has been design with resistance to such attacks in mind while AES didn't. ...
Ruggero's user avatar
  • 7,094
9 votes

Is it possible to utilize an AES-128 encryption hardware unit for AES-256?

It depends how the “AES-128 encryption hardware units” you mention are actually defined. I've already encountered processors that allow to independently compute AES operations such as $\texttt{...
Raoul722's user avatar
  • 2,836
9 votes

What is the relation between x y and r s in an ECDSA signature?

Yes, those encoded values are $r$ and $s$. The ASN.1 integers are signed big endian values while the two fixed sized values are unsigned big endian. So the value field may be identical or it may not, ...
Maarten Bodewes's user avatar
  • 92.6k
9 votes
Accepted

Choice of ECC curve on USB token

How NIST's ECC curves (P256 alias secp256r1 and friends) have been generated is public: that's in SEC2v1 (with reference to the "verifiably random" method of ANSI X9.62-1998, a draft of which is here),...
fgrieu's user avatar
  • 141k
9 votes

Can error correction and detection be done without adding extra bits?

No, because of the Pigeonhole Principle. Let's say you want to be able to send arbitrary $k$-bit messages. There are $2^k$ possible bit-patterns, and $2^k$ possible intended messages. Now let's say ...
Draconis's user avatar
  • 191
8 votes
Accepted

Usage difference between x86 RDRAND and RDSEED

The processors come, at a first approximation, with three components: A hardware noise source; A pseudorandom generator that's periodically seeded from that noise source, whose output is available ...
Luis Casillas's user avatar
8 votes

What is the security concept in printer cartridge?

A company can make more money if the printers it sells only work with the cartridges they sell, which does not work if there is competition. It's cheaper to force a vendor lock-in than it is to ...
forest's user avatar
  • 15.3k
7 votes
Accepted

(EC)DSA signature without hashing, or with offloaded hash?

Let's focus on DSA. The signing on a message $m\in \mathbb{Z}_q$ for the suggested "no-hash" protocol is done as follows: Pick $k\in_R \mathbb{Z}_q$, compute $r=f(g^k)$, where $f(\cdot):=(\...
ckamath's user avatar
  • 5,198
7 votes
Accepted

Are there any issues to doing 2 rounds of AES-128? How is the security compared to AES-256?

Double encryption with 128-bit AES and two different keys does not give 256-bit security. In particular, a classic Meet-in-the-Middle attack applies, with expected cost $2^{128}$ encryptions and $2^{...
fgrieu's user avatar
  • 141k
6 votes
Accepted

Are coprocessors (Intel Phi) a threat for modern key stretching functions?

The key idea of memory-hard functions like scrypt and Argon2, as I understand them, is to analyze the cost to the attacker in terms of a time-area product. Time is how much time the attacker spends. ...
Luis Casillas's user avatar
6 votes

Can error correction and detection be done without adding extra bits?

For the general case kodlus answer explained it is not possible. For detecting or correcting errors you need to have redundancy. But many kind of information have included redundancy: Some file ...
H. Idden's user avatar
  • 161
6 votes

Most secure but feasible encryption running on WWII technology

It depends on what you mean by widespread (military) use. The Russian VIC cipher, which used a lagged Fibonacci generator, classified as a "straddling bipartite monoalphabetic substitution ...
Patriot's user avatar
  • 3,132
6 votes
Accepted

Reverse engineering hardware crypto processor for modular multiplication

The numbers are consistent with the hypothesis that this hardware allows Montgomery modular multiplication of $a$ and $b$ modulo $p$ for (at least some) odd 256-bit $p$. Meaning it computes a 256-bit ...
fgrieu's user avatar
  • 141k
5 votes
Accepted

Would A5/1 with a much larger state be a good choice of stream cipher for hardware?

I have argued so 15 years ago, and not been proven wrong since. Basically, A5/1, with a $n$-bit state, offers a resistance of roughly $2n/3$ bits of security. With $n = 64$, the resistance is very low,...
Thomas Pornin's user avatar
5 votes

What are the dangers of using CPU clock drift for generating random data?

The biggest danger is an inherent feature of using clock drift inside a busy computer. It's very difficult to accurately estimate the rate of entropy generation. You can't rely on what you're going ...
Paul Uszak's user avatar
  • 15.4k
5 votes
Accepted

What is the relation between x y and r s in an ECDSA signature?

The ECDSA signature is the couple $(r, s)$ with $r \equiv (k\times G)_x \pmod{q}$ and $s \equiv k^{-1} (H(m) + r\,t) \pmod q$ where $G$ is a point of the elliptic curve of order $q$ and $t$ the secret ...
RegisPower's user avatar
5 votes

Modifying an Enigma machine to allow unchanged letters

There was at least one late Enigma derivative, the Russian M-125 Fialka, that did modify the reflector to allow a letter to encrypt to itself. Curiously, rather than simply making the cipher alphabet ...
Ilmari Karonen's user avatar
5 votes
Accepted

Constant time implementations of crypto algorithms

Any function can be made timing attack resistant, and may be more expensive. I.e. AES can be made safe by using a hardware-simulated constant time circuit for lookups (and maybe more magic). If you ...
cypherfox's user avatar
  • 1,422
5 votes

Constant time implementations of crypto algorithms

Regarding AES: AES in a straightforward, single-block mode is generally written in a way that can be vulnerable to cache timing attacks, and potentially related attacks like Spectre. This is because ...
Myria's user avatar
  • 2,575
5 votes
Accepted

AES s-box – How do I calculate the inverse of this field equation?

In a finite field, there are basically two main algorithms to compute an inverse: The Extended Euclidean Algorithm, also known as as "extended GCD". There is a variant called Binary GCD. In a finite ...
Thomas Pornin's user avatar
5 votes

How would we design a fast circuit to solve LCS35?

Turns out the LCS35 problem was first solved on April 15, 2019 by Bernard Fabrot. It took 3.5 years of runtime on a single core of a standard modern CPU, using GMP. Independently, the Cryptophage ...
fgrieu's user avatar
  • 141k
4 votes

Running Crypto on hardware -- e.g., AES in hardware

The difference between "software-based" and "hardware-based" lies in economics. From a formal, mathematical point of view, there is no qualitative difference: the algorithm takes some inputs (...
Thomas Pornin's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible