# Tag Info

6

You should think of Rijndael's S-box as a function that maps bytes to bytes, where a byte (octet) is considered to be a member of a finite field of size $2^8$ (with xor as addition). It's not seen as a 16x16 octet array, really. The substitution is then just done byte-wise: every octet in the 4x4 block is replaced by its function value under the S-box ...

5

You can (and should) do the reduction in constant time using masking. That is, instead of using the following (non-bitsliced) pseudo-C code to do the reduction: if ((result >> 8) & 1) { /* bit 8 is set: clear it and flip bits 0, 1, 3 and 4 */ result ^= 0x11b; } you can simply do: result ^= 0x11b * ((result >> 8) & 1); (where ...

5

At first glance, the MixColumn step from AES (actually, a single column of that transform) sounds like precisely what you're looking for. It is invertable (AES depends on that), and it does have the property that if one input octet changes, then all four output octets are guaranteed to change. Most commonly, it's done by table lookup; however there's no ...

4

standard AES disclaimer: Given the questions you've asked, you should not implement AES yourself in a real-world system because there are lots of security considerations when implementing ciphers. Think of the S-box as a function from byte $\to$ byte. So, to look up the image of $x$ under the s-box transformation, you simply use $S_\text{box}(x)$, which ...

3

Item 2 has been answered satisfactorily, so this will focus on point 1: the s-box. The size of the s-box is not a 16x16 array unless it is viewed as such. The s-box is actually an 8-bit non linear transformation of the input, and is only viewed as a 16x16 array if you arrange it as a table of such dimensions. This array would then be a 1 to 1 representation ...

2

I read about the AEZ encryption scheme as presented at the CAESAR competition. To me it seems like a construction of an arbitrary length block cipher from a smaller one. The construction is only used in the v1.x of AEZ, because it requires appriximately 1.8 AES calls per block of plaintext, while the one used in v2.0 requires only 1 AES per block ...

1

There should not be any need to use several different hashes. One such as SHA3 will provide what you need. A Hash, Salt, and Stretch configuration as provided by for example bcrypt or scrypt will add extra protection if you want it. As for shortening the code, yes this will decrease security but the same length of a NIST recommended password should suffice: ...

Only top voted, non community-wiki answers of a minimum length are eligible