26
votes
Accepted
How is bitslicing faster?
Bitslicing is a technique where computation is:
Reduced to elementary operations (called gates) with a single bit output (typically NOR, XOR, and similar like OR AND NAND NXOR, often with further ...
- 138k
22
votes
How is bitslicing faster?
The basic idea of bitslicing, or SIMD within a register, involves two parts:
expressing the cipher in terms of single-bit logical operations (AND, OR, XOR, NOT, etc.), as if you were implementing it ...
- 45.9k
15
votes
Accepted
What are the drawbacks of "lightweight crypto"?
As a caveat, I haven't been involved with the process, so can't speak fully to it (and would welcome an answer from someone more in-the-know).
That being said, it is worth mentioning how "light&...
- 11.6k
12
votes
Accepted
Lightweight cipher using only 8-bit operations
SPECK was actually designed with 8-bit CPUs in mind. I use Simon and Speck extensively, and there's example source code and comparisons out there, as well as a good paper. The references are good ...
- 4,625
11
votes
Lightweight cipher using only 8-bit operations
I second Richie Frame's observation that AES is an excellent choice. I'd use AES-128 in CTR mode, which has the advantage that decryption is the same as encryption (thus is as fast, contrary to some ...
- 138k
9
votes
How is bitslicing faster?
Bitslicing is a technique that allows multiple instructions/Data points to be encoded into a single register.
The idea is that you encode several bitwise operations within a single register. So, ...
- 286
7
votes
Accepted
CAESAR finalists: Lightweight case (Ascon vs ACORN)
Ascon and ACORN both have interesting features. Let's discuss their pros and cons for some properties stated during the CAESAR competition for lightweight AEADs:
Fits into small hardware area and/or ...
- 2,826
7
votes
Is there a lower cost cryptography than elliptic-curves based cryptography?
In fact, for public-key operation (message encryption and signature verification, as opposed to message decryption and signature generation), RSA and, even more, the Rabin cryptosystem, outperform ECC....
- 86.6k
6
votes
Accepted
What is the official, generally accepted definition of "lightweight crypto"?
There is no official definition, of course. However, at least in my experience, the word is used consistently.
The word lightweight typically refers to something that is significantly less expensive ...
- 4,597
5
votes
Lightweight Asymmetric encryption algorithm
When an embedded device needs asymmetric crypto to encrypt, (e.g. measurements it makes) or check authenticity (e.g. of commands or firmware updates it receives), there is no need for a private key or ...
- 138k
5
votes
Accepted
Why is symmetric lightweight crypto only about block ciphers and not about stream ciphers?
Why is symmetric lightweight cryptography only about block ciphers and not
about stream ciphers?
Why that assumption? There is a lot of work concerning stream ciphers for lightweight cryptography (...
- 2,826
5
votes
Accepted
NIST LWC finalists (AEAD) vs ChaCha20-Poly1305
As for every benchmark, it all depends on the computing platform.
As mentionned in comment, you will find benchmarks at bench.cr.yp.to that include NIST LWC finalists and ChaCha-20. However, most of ...
- 2,826
5
votes
Accepted
What is the status of the NIST Lightweight Cryptography Standardisation Process?
My contact in NIST has told me that they were expecting to announce first week of January, but now it looks more like it will happen late in the same month.
This is unofficial but I expect it to be ...
- 21.2k
4
votes
Lightweight cipher using only 8-bit operations
I do not have benchmarks on this particular processor, so this answer is opinion / guesswork.
Gimli is fast and low-memory, but is just a permutation. Ciphers can be pretty trivially implemented on ...
- 5,786
4
votes
What is the official, generally accepted definition of "lightweight crypto"?
"Lightweight" implies a comparison with a reference implementation or with another "heavyweight" implementation, so it's always context dependent. Since there is no single industry standard algorithm ...
- 3,718
4
votes
Accepted
What are the advantages of MICKEY over Trivium and Grain?
MICKEY appears to be a good low-power stream cipher but, in the context of the eSTREAM portfolio, it does not seem to excel at anything in particular. Trivium and Grain have more implementation ...
- 12.4k
4
votes
Accepted
Generating an IV for AES-CBC
If you have a nonrepeating (but possibly predictable) value, you can convert that into an unpredictable CBC-mode IV at fairly minimal cost. Here's how:
Prepend the 128 bit nonrepeating value to the ...
- 145k
4
votes
What is the lightweight key exchange protocol of choice?
I would personally use triple Diffie-Hellman, which is used often in secure instant-messaging protocols but unfortunately not very well-known beyond that. Essentially, both parties have a long-term ...
- 1,101
4
votes
Accepted
Lightweight primality certificates for untrusted DH parameters
Well, one possibility to generate a moderately lightweight certificate would be to use this theorem:
If we have values $p, q, g$ such that:
$1 < g < p$
$q > \sqrt{p}$
$q \mid p-1$
$g^q \...
- 145k
4
votes
Accepted
Are there recommended modes of operation for lightweight ciphers?
When using lightweight ciphers, the block size can make a huge difference to security. Fortunately, there has been a lot of work in recent years on tight bounds for modes of operations, and methods ...
- 27.6k
4
votes
Accepted
In what cases might PRESENT be implemented as encryption-only?
So in what cases might we need only encryption but not decryption? It seems strange we would encrypt something that does not need decrypting at some point.
For example, the CTR mode uses only ...
- 47.5k
4
votes
How to check that an $km \times km$ block-binary matrix is an MDS matrix in $k$-bit words over $\operatorname{GF}(2)$
Let $\bf A$ be an $n \times n$ binary matrix. Let we want to check that whether $\bf A$ is an MDS matrix over the finite field $\mathbb{F}_{2^k}$ for some $k$?
The necessary condition is that $k\mid n$...
- 253
4
votes
Why does TinyJAMBU-128 claim only 112-bit security?
I believe this is simply a statement of the intention to meet the submission requirements set out by NIST for lightweight ciphers. Note that the paper linked in the question refers to "security ...
- 1,443
4
votes
NIST vs ISO Encryption standardisation process
ISO/IEC are paid standards, it's a business.
The NIST produce free standards that can be made mandatory for US institutions (like the DoD) and its industrial partners.
Opinion: The NIST standards are ...
- 924
4
votes
Accepted
NIST vs ISO Encryption standardisation process
what's the difference ...
ISO standards are literally international, where as NIST is US-specific.
ISO standards are available FOR PURCHASE and are copyrighted. NIST as a government organ of US, ...
- 9,001
3
votes
Accepted
Could we use a more efficient hash for signature generation?
As mentioned in the comments already, you do not need collision resistance. You can get away with target collision resistance (TCR). The security game for TCR considers families of hash functions and ...
- 2,888
3
votes
(Lightweight) Multicast one-way Authentication
Yes, the problem of multicast one-way authentication can be solved using symmetric cryptography only, assuming (at least) one of the following applies (there might be other ways):
we trust each ...
- 138k
3
votes
Where can I find a clear diagram of the SPECK algorithm?
Where can I find a clear algorithm diagram of speck algorithm?
Have you looked at the spec wiki page - that (at the time I write this) includes both an algorithm diagram and a C implementation (...
- 145k
2
votes
Standard lightweight one-way hash functions for IoT devices
You should take a look at ISO/IEC 29192 which is a standard for lightweight cryptography that specifies several techniques for block/stream ciphers, asymmetric techniques and hash functions.
...
- 2,826
2
votes
Is there any dedicated research group which is working in energy efficient cryptographic functions?
For low energy usage, google for research groups focusing on lightweight cryptography. See Section 3 of http://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8114.pdf for NIST's contributions to ...
- 393
Only top scored, non community-wiki answers of a minimum length are eligible