25 votes
Accepted

How is bitslicing faster?

Bitslicing is a technique where computation is: Reduced to elementary operations (called gates) with a single bit output (typically NOR, XOR, and similar like OR AND NAND NXOR, often with further ...
  • 126k
22 votes

How is bitslicing faster?

The basic idea of bitslicing, or SIMD within a register, involves two parts: expressing the cipher in terms of single-bit logical operations (AND, OR, XOR, NOT, etc.), as if you were implementing it ...
12 votes
Accepted

Lightweight cipher using only 8-bit operations

SPECK was actually designed with 8-bit CPUs in mind. I use Simon and Speck extensively, and there's example source code and comparisons out there, as well as a good paper. The references are good ...
  • 4,274
10 votes

Lightweight cipher using only 8-bit operations

I second Richie Frame's observation that AES is an excellent choice. I'd use AES-128 in CTR mode, which has the advantage that decryption is the same as encryption (thus is as fast, contrary to some ...
  • 126k
9 votes

How is bitslicing faster?

Bitslicing is a technique that allows multiple instructions/Data points to be encoded into a single register. The idea is that you encode several bitwise operations within a single register. So, ...
7 votes
Accepted

CAESAR finalists: Lightweight case (Ascon vs ACORN)

Ascon and ACORN both have interesting features. Let's discuss their pros and cons for some properties stated during the CAESAR competition for lightweight AEADs: Fits into small hardware area and/or ...
  • 2,694
6 votes
Accepted

What is the official, generally accepted definition of "lightweight crypto"?

There is no official definition, of course. However, at least in my experience, the word is used consistently. The word lightweight typically refers to something that is significantly less expensive ...
  • 4,467
5 votes

Is there a lower cost cryptography than elliptic-curves based cryptography?

In fact, for public-key operation (message encryption and signature verification, as opposed to message decryption and signature generation), RSA and, even more, the Rabin cryptosystem, outperform ECC....
5 votes

CLEFIA vs AES 128-bit

You benchmarked a highly optimized AES implementation against a reference implementation of CLEFIA: ...
  • 4,090
5 votes

Lightweight Asymmetric encryption algorithm

When an embedded device needs asymmetric crypto to encrypt, (e.g. measurements it makes) or check authenticity (e.g. of commands or firmware updates it receives), there is no need for a private key or ...
  • 126k
5 votes
Accepted

Why is symmetric lightweight crypto only about block ciphers and not about stream ciphers?

Why is symmetric lightweight cryptography only about block ciphers and not about stream ciphers? Why that assumption? There is a lot of work concerning stream ciphers for lightweight cryptography (...
  • 2,694
5 votes
Accepted

NIST LWC finalists (AEAD) vs ChaCha20-Poly1305

As for every benchmark, it all depends on the computing platform. As mentionned in comment, you will find benchmarks at bench.cr.yp.to that include NIST LWC finalists and ChaCha-20. However, most of ...
  • 2,694
4 votes

What is the official, generally accepted definition of "lightweight crypto"?

"Lightweight" implies a comparison with a reference implementation or with another "heavyweight" implementation, so it's always context dependent. Since there is no single industry standard algorithm ...
  • 3,650
4 votes
Accepted

What are the advantages of MICKEY over Trivium and Grain?

MICKEY appears to be a good low-power stream cipher but, in the context of the eSTREAM portfolio, it does not seem to excel at anything in particular. Trivium and Grain have more implementation ...
  • 11.9k
4 votes
Accepted

Generating an IV for AES-CBC

If you have a nonrepeating (but possibly predictable) value, you can convert that into an unpredictable CBC-mode IV at fairly minimal cost. Here's how: Prepend the 128 bit nonrepeating value to the ...
  • 134k
4 votes

Lightweight cipher using only 8-bit operations

I do not have benchmarks on this particular processor, so this answer is opinion / guesswork. Gimli is fast and low-memory, but is just a permutation. Ciphers can be pretty trivially implemented on ...
4 votes

What is the lightweight key exchange protocol of choice?

I would personally use triple Diffie-Hellman, which is used often in secure instant-messaging protocols but unfortunately not very well-known beyond that. Essentially, both parties have a long-term ...
  • 1,091
4 votes
Accepted

Are there recommended modes of operation for lightweight ciphers?

When using lightweight ciphers, the block size can make a huge difference to security. Fortunately, there has been a lot of work in recent years on tight bounds for modes of operations, and methods ...
4 votes
Accepted

Lightweight primality certificates for untrusted DH parameters

Well, one possibility to generate a moderately lightweight certificate would be to use this theorem: If we have values $p, q, g$ such that: $1 < g < p$ $q > \sqrt{p}$ $q \mid p-1$ $g^q \...
  • 134k
4 votes
Accepted

In what cases might PRESENT be implemented as encryption-only?

So in what cases might we need only encryption but not decryption? It seems strange we would encrypt something that does not need decrypting at some point. For example, the CTR mode uses only ...
  • 44.2k
4 votes

How to check that an $km \times km$ block-binary matrix is an MDS matrix in $k$-bit words over $\operatorname{GF}(2)$

Let $\bf A$ be an $n \times n$ binary matrix. Let we want to check that whether $\bf A$ is an MDS matrix over the finite field $\mathbb{F}_{2^k}$ for some $k$? The necessary condition is that $k\mid n$...
  • 233
4 votes

Why does TinyJAMBU-128 claim only 112-bit security?

I believe this is simply a statement of the intention to meet the submission requirements set out by NIST for lightweight ciphers. Note that the paper linked in the question refers to "security ...
  • 1,423
4 votes

NIST vs ISO Encryption standardisation process

ISO/IEC are paid standards, it's a business. The NIST produce free standards that can be made mandatory for US institutions (like the DoD) and its industrial partners. Opinion: The NIST standards are ...
4 votes
Accepted

NIST vs ISO Encryption standardisation process

what's the difference ... ISO standards are literally international, where as NIST is US-specific. ISO standards are available FOR PURCHASE and are copyrighted. NIST as a government organ of US, ...
  • 7,103
3 votes
Accepted

Could we use a more efficient hash for signature generation?

As mentioned in the comments already, you do not need collision resistance. You can get away with target collision resistance (TCR). The security game for TCR considers families of hash functions and ...
  • 2,870
3 votes

(Lightweight) Multicast one-way Authentication

Yes, the problem of multicast one-way authentication can be solved using symmetric cryptography only, assuming (at least) one of the following applies (there might be other ways): we trust each ...
  • 126k
3 votes
Accepted

What is the most light-weight symmetric cipher thats still usefull?

Salsa/ChaCha and the other eSTREAM winners are likely to be the "fastest but still secure" options today. Don't forget authentication of course. Reduced-round ChaCha/Poly1305 is likely to be the ...
  • 2,217
2 votes

Is there any dedicated research group which is working in energy efficient cryptographic functions?

For low energy usage, google for research groups focusing on lightweight cryptography. See Section 3 of http://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8114.pdf for NIST's contributions to ...
2 votes

In what cases might PRESENT be implemented as encryption-only?

A bona fide use case for encryption only is inside a true random number generator (TRNG). If you have something small like:- it's common to whiten the raw entropy signal using a cryptographic ...
2 votes

In what cases might PRESENT be implemented as encryption-only?

Ciphers that are targeted for light-weight applications often have some common, but one-off, use cases. I have an IC with and ADC that is passively powered via RFID, and then sends encrypted data via ...
  • 4,274

Only top scored, non community-wiki answers of a minimum length are eligible