Hot answers tagged

17

I'm one of the authors of Gimli. TL;DR: Test vectors provided by the paper are indeed wrong. We had a error when we generated the paper and the test vectors have not been updated with respect to the last iteration of Gimli (in development stages). Also one of the test vectors had a double space at some place. This has been corrected and will be updated in ...


6

Disclaimer: I'm one of the authors of the said permutation. Gimli does not aim to be used as a block cipher (in the traditional sense of it: $x \to (\sigma \circ K_{\mathit{add}})^{\mathit{nb}_{\mathit{rounds}}}$ with a block size of 384 bits or similar constructions); it is better to use it with a sponge construction such a Monkey-Duplex/Monkey-Wrap or ...


4

According to the spec, the Gimli state consists of four columns of three rows of 32-bit words, for a total of 4 × 3 × 32 = 4 × 96 = 384 bits. Each Gimli round consist of: a non-linear SP-box applied to each 96-bit column individually, on every second round, a linear mixing step that just swaps the first words of pairs of columns, and on ...


4

There is a library called Monocypher* that heavily utilizes derivatives of ChaCha and Salsa. (Plus Poly1305, X25519, and Ed25519.) The algorithms it uses, XChaCha20, Blake2b, and Argon2 all use different permutations but those permutations are all extremely similar. I don't know if any Salsa variant's permutation can be used as is. It certainly would be ...


Only top voted, non community-wiki answers of a minimum length are eligible