4

I believe this is simply a statement of the intention to meet the submission requirements set out by NIST for lightweight ciphers. Note that the paper linked in the question refers to "security goals". As per section 3.1: An AEAD algorithm shall not specify key lengths that are smaller than 128 bits. Cryptanalytic attacks on the AEAD algorithm ...


4

Let $\bf A$ be an $n \times n$ binary matrix. Let we want to check that whether $\bf A$ is an MDS matrix over the finite field $\mathbb{F}_{2^k}$ for some $k$? The necessary condition is that $k\mid n$ which means $n=km$ for some integer $m$. Now Let $\bf A$ be $km \times km$ binary matrix. The first step is that to consider the matrix $\bf A$ as a block ...


3

As for every benchmark, it all depends on the computing platform. As mentionned in comment, you will find benchmarks at bench.cr.yp.to that include NIST LWC finalists and ChaCha-20. However, most of the architectures considered for those benchmarks are rather high-end computing platforms, and they do not necessarily reflect the landscape of constrained ...


1

I can't read the mind of the authors, but beside 112-bit security being enough to meet the submission requirements as pointed in that other answer, there are reasons to take a small security margin in what's claimed compared to key size: The algorithm will still stand fully unbroken if one comes with an attack costing slightly less than brute force. ...


1

The first step in verifying a signature is to hash the message, which takes a few thousand x86 instructions. Your language doesn't seem to support the logical operations that are common in modern hash functions - implementing those with arithmetic operations will cost you some overhead. So you're talking about hours before you even get to the public key ...


Only top voted, non community-wiki answers of a minimum length are eligible