15
votes
Accepted
What are the drawbacks of "lightweight crypto"?
As a caveat, I haven't been involved with the process, so can't speak fully to it (and would welcome an answer from someone more in-the-know).
That being said, it is worth mentioning how "light&...
- 14.6k
12
votes
Accepted
Lightweight cipher using only 8-bit operations
SPECK was actually designed with 8-bit CPUs in mind. I use Simon and Speck extensively, and there's example source code and comparisons out there, as well as a good paper. The references are good ...
- 4,948
11
votes
Lightweight cipher using only 8-bit operations
I second Richie Frame's observation that AES is an excellent choice. I'd use AES-128 in CTR mode, which has the advantage that decryption is the same as encryption (thus is as fast, contrary to some ...
- 145k
7
votes
Accepted
CAESAR finalists: Lightweight case (Ascon vs ACORN)
Ascon and ACORN both have interesting features. Let's discuss their pros and cons for some properties stated during the CAESAR competition for lightweight AEADs:
Fits into small hardware area and/or ...
- 2,903
7
votes
Is there a lower cost cryptography than elliptic-curves based cryptography?
In fact, for public-key operation (message encryption and signature verification, as opposed to message decryption and signature generation), RSA and, even more, the Rabin cryptosystem, outperform ECC....
- 87.8k
6
votes
Accepted
What is the official, generally accepted definition of "lightweight crypto"?
There is no official definition, of course. However, at least in my experience, the word is used consistently.
The word lightweight typically refers to something that is significantly less expensive ...
- 4,937
5
votes
Accepted
NIST LWC finalists (AEAD) vs ChaCha20-Poly1305
As for every benchmark, it all depends on the computing platform.
As mentionned in comment, you will find benchmarks at bench.cr.yp.to that include NIST LWC finalists and ChaCha-20. However, most of ...
- 2,903
5
votes
Accepted
What is the status of the NIST Lightweight Cryptography Standardisation Process?
My contact in NIST has told me that they were expecting to announce first week of January, but now it looks more like it will happen late in the same month.
This is unofficial but I expect it to be ...
- 23.7k
4
votes
Accepted
NIST vs ISO Encryption standardisation process
what's the difference ...
ISO standards are literally international, where as NIST is US-specific.
ISO standards are available FOR PURCHASE and are copyrighted. NIST as a government organ of US, ...
- 9,795
4
votes
NIST vs ISO Encryption standardisation process
ISO/IEC are paid standards, it's a business.
The NIST produce free standards that can be made mandatory for US institutions (like the DoD) and its industrial partners.
Opinion: The NIST standards are ...
- 954
4
votes
Why does TinyJAMBU-128 claim only 112-bit security?
I believe this is simply a statement of the intention to meet the submission requirements set out by NIST for lightweight ciphers. Note that the paper linked in the question refers to "security ...
- 1,463
4
votes
How to check that an $km \times km$ block-binary matrix is an MDS matrix in $k$-bit words over $\operatorname{GF}(2)$
Let $\bf A$ be an $n \times n$ binary matrix. Let we want to check that whether $\bf A$ is an MDS matrix over the finite field $\mathbb{F}_{2^k}$ for some $k$?
The necessary condition is that $k\mid n$...
- 253
4
votes
Accepted
Are there recommended modes of operation for lightweight ciphers?
When using lightweight ciphers, the block size can make a huge difference to security. Fortunately, there has been a lot of work in recent years on tight bounds for modes of operations, and methods ...
- 28.2k
4
votes
What is the official, generally accepted definition of "lightweight crypto"?
"Lightweight" implies a comparison with a reference implementation or with another "heavyweight" implementation, so it's always context dependent. Since there is no single industry standard algorithm ...
- 3,768
4
votes
Lightweight Asymmetric encryption algorithm
There is an alternative to ECC, called Ring-LWE,
it claims to be 10x faster than ECC on microcontrollers.
details: Efficient Software Implementation of Ring-LWE Encryption
There is a C/C++ ...
- 41
4
votes
What is the lightweight key exchange protocol of choice?
I would personally use triple Diffie-Hellman, which is used often in secure instant-messaging protocols but unfortunately not very well-known beyond that. Essentially, both parties have a long-term ...
- 1,101
4
votes
Lightweight cipher using only 8-bit operations
I do not have benchmarks on this particular processor, so this answer is opinion / guesswork.
Gimli is fast and low-memory, but is just a permutation. Ciphers can be pretty trivially implemented on ...
- 5,899
4
votes
Accepted
Lightweight primality certificates for untrusted DH parameters
Well, one possibility to generate a moderately lightweight certificate would be to use this theorem:
If we have values $p, q, g$ such that:
$1 < g < p$
$q > \sqrt{p}$
$q \mid p-1$
$g^q \...
- 151k
4
votes
Accepted
In what cases might PRESENT be implemented as encryption-only?
So in what cases might we need only encryption but not decryption? It seems strange we would encrypt something that does not need decrypting at some point.
For example, the CTR mode uses only ...
- 49.5k
3
votes
Accepted
Could we use a more efficient hash for signature generation?
As mentioned in the comments already, you do not need collision resistance. You can get away with target collision resistance (TCR). The security game for TCR considers families of hash functions and ...
- 2,958
3
votes
Where can I find a clear diagram of the SPECK algorithm?
Where can I find a clear algorithm diagram of speck algorithm?
Have you looked at the spec wiki page - that (at the time I write this) includes both an algorithm diagram and a C implementation (...
- 151k
3
votes
Accepted
Is there a 4 by 4 NMDS matrix which is better than M= [[0,1,1,1], [1,0,1,1], [1,1,0,1], [1,1,1,0]] used in MIDORI?
Let us consider "bricklayer" designs such as AES, MIDORI, SKINNY and MANTIS where such matrices are used to "mix columns" of 4 4-bit or 8-bit cells which make up the state. The ...
- 26.4k
2
votes
Is there any dedicated research group which is working in energy efficient cryptographic functions?
For low energy usage, google for research groups focusing on lightweight cryptography. See Section 3 of http://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8114.pdf for NIST's contributions to ...
- 393
2
votes
Standard lightweight one-way hash functions for IoT devices
Here you have a study about different cryptographic methods in different IoT devices:
Midgar: Study of communications security among Smart Objects using a platform of heterogeneous devices for the ...
- 229
2
votes
Standard lightweight one-way hash functions for IoT devices
You should take a look at ISO/IEC 29192 which is a standard for lightweight cryptography that specifies several techniques for block/stream ciphers, asymmetric techniques and hash functions.
...
- 2,903
2
votes
In what cases might PRESENT be implemented as encryption-only?
A bona fide use case for encryption only is inside a true random number generator (TRNG). If you have something small like:-
it's common to whiten the raw entropy signal using a cryptographic ...
- 15.7k
2
votes
In what cases might PRESENT be implemented as encryption-only?
Ciphers that are targeted for light-weight applications often have some common, but one-off, use cases. I have an IC with and ADC that is passively powered via RFID, and then sends encrypted data via ...
- 4,948
2
votes
Accepted
How to obtain inverse key stream efficiently on Present cipher?
The PRESENT key schedule operates on a register the same length as the key size. The left most 64-bits are extracted as round keys and then the register updated by performing a 61-bit left rotation on ...
- 26.4k
2
votes
Lightweight length preserving encryption
Most symmetric modes of encryption - i.e. block ciphers in a mode of operation or stream ciphers - do not require overhead other than a nonce and an optional authentication tag. Using RSA or ECDSA or ...
- 94.5k
1
vote
Why does TinyJAMBU-128 claim only 112-bit security?
I can't read the mind of the authors, but beside 112-bit security being enough to meet the submission requirements as pointed in that other answer, there are reasons to take a small security margin in ...
- 145k
Only top scored, non community-wiki answers of a minimum length are eligible