21 votes

why XOR is recommended/Used in every paper I read for encryption and decryption stream cipher?

Why can't I use other opeartions such as NAND, AND, OR Because it needs to be invertible. For example, if you use NAND, then if the bit from the key generator is a 0, then the output of the NAND will ...
poncho's user avatar
  • 147k
15 votes
Accepted

Is it possible to utilize an AES-128 encryption hardware unit for AES-256?

There are two important differences between AES-128 and AES-256: AES-128 has 10 rounds, AES-256 has 14 The key expansion process (that is, how they generate subkeys) is different If your AES-128 ...
poncho's user avatar
  • 147k
15 votes
Accepted

How does hash speed vary based on string length?

Contrary to the other answer, I'll be assuming the hash function is of the password-oriented kind; and my answer will be: input size has almost no influence on speed in good practice, even for much ...
fgrieu's user avatar
  • 141k
13 votes
Accepted

What is the fastest block cipher in the (Intel) world?

The fastest block cipher is identity, which leaves input blocks completely unchanged. This is infinitely fast on all platforms; however, it is not secure. So maybe you want the fastest block cipher ...
Thomas Pornin's user avatar
12 votes
Accepted

Lightweight cipher using only 8-bit operations

SPECK was actually designed with 8-bit CPUs in mind. I use Simon and Speck extensively, and there's example source code and comparisons out there, as well as a good paper. The references are good ...
b degnan's user avatar
  • 4,820
11 votes

Is there a floating point CSPRNG?

Are you sure? Float operations are very hard to reproduce in diverse environments. Do you round towards positive, negative or zero? Do you handle denormals or just treat them as zero? What about ...
axapaxa's user avatar
  • 2,940
11 votes

Lightweight cipher using only 8-bit operations

I second Richie Frame's observation that AES is an excellent choice. I'd use AES-128 in CTR mode, which has the advantage that decryption is the same as encryption (thus is as fast, contrary to some ...
fgrieu's user avatar
  • 141k
11 votes
Accepted

Can reduced-round ChaCha be used as non-cryptographic fast PRNG to produce output indistinguishable from random data?

As cypherfox had correctly pointed out during our chat, two rounds is not enough to reliably diffuse a single changed bit throughout the entire output. My question appears to have been answered ...
forest's user avatar
  • 15.3k
10 votes

How to measure Cycles per Byte of an Algorithm?

To perform a good check, please use a large number of iterations (i.e. a for loop) of calls to the cryptographic primitive with your specific data size. Then ...
Maarten Bodewes's user avatar
  • 92.6k
9 votes

Is it possible to utilize an AES-128 encryption hardware unit for AES-256?

It depends how the “AES-128 encryption hardware units” you mention are actually defined. I've already encountered processors that allow to independently compute AES operations such as $\texttt{...
Raoul722's user avatar
  • 2,836
8 votes

What is the fastest block cipher in the (Intel) world?

Is Rijndael the fastest block cipher in the world? No. On an Intel 64 Sandy Bridge without AES-NI, AES (a subset of Rijndael) is outperfomed by ChaCha20 (and also likely by Threefish 512 which has ...
SEJPM's user avatar
  • 46k
8 votes
Accepted

Why is Poly1305, which is based on AES, faster than AES?

Poly1305 is not based on AES, it was used together with AES in Bernstein's first description http://cr.yp.to/mac/poly1305-20050329.pdf. For pseudocode of the Poly1305 algorithm see e.g. https://www....
gammatester's user avatar
  • 1,005
8 votes

why XOR is recommended/Used in every paper I read for encryption and decryption stream cipher?

Edit: For any additive group operation, including addition modulo $k$ if the added keystream symbols $z_t$ are uniformly distributed, which means $$ Pr(z_t=a)=1/k, \quad \forall a \in \{0,\ldots, k-1\...
kodlu's user avatar
  • 22.5k
7 votes

How does hash speed vary based on string length?

All hashes I know of are block oriented. The time required to calculate the hash scales with the number of blocks to be hashed. There is a small constant overhead dealing with the IV and, possibly, a ...
Michael Anders's user avatar
7 votes

why XOR is recommended/Used in every paper I read for encryption and decryption stream cipher?

The first reason obviously is that XOR is reversible. AND and NAND are not reversible. But the important reason is found by looking at the truth table for XOR Let $x$ be the plain text bit & let ...
user93353's user avatar
  • 2,211
6 votes

Performance of ECDSA, ECKCDSA and ECGDSA

If you want to know practical measurements, which depend not just on the signature scheme family but also on the choice of curve and so on, your best approach will be to submit the software you are ...
Squeamish Ossifrage's user avatar
6 votes

Are there encryption schemes with which it takes (significantly) longer to encrypt than to decrypt?

Rather than using a form of encryption which is slow in one direction, you could use a proof-of-work function instead, as Ricky Demer pointed out in the comments. This allows you to freely tune the ...
otus's user avatar
  • 32.1k
6 votes

Are there encryption schemes with which it takes (significantly) longer to encrypt than to decrypt?

Perhaps not of relevance if the question is meant in a purely thoretical (i.e. asymptotical) sense, but the CBC encryption mode is inherently sequential, while decryption can easily be performed in ...
dkaeae's user avatar
  • 530
6 votes

is DES Faster Than AES on software

Yes, it is possible that AES is slower than DES. There is no limit to the slowness of un-optimized software! Some factors that I have witnessed slowing a software AES implementation: not using ...
fgrieu's user avatar
  • 141k
6 votes
Accepted

Which is slower, AES or GCM hash (GHASH), if CPU has no special instructions?

First things first: the passage you quote does not claim that GHASH is slower than AES. What it says is that if you replace AES/CTR with a much faster stream cipher, then the GHASH part will be ...
Thomas Pornin's user avatar
6 votes

Performance metrices of cryptographic algorithms

Criteria for evaluation of Cryptography Algorithms: Having public specification (the only secret is the key). Patent status. What it aims at: block cipher (DES, AES..), cipher, message digest, MAC, ...
5 votes

Are there encryption schemes with which it takes (significantly) longer to encrypt than to decrypt?

In lattice-based encryption schemes, the encryption is often slower than the decryption (not artificially, but just as the natural way it works). See this paper Efficient Software Implementation of ...
Yehuda Lindell's user avatar
5 votes

Is this a good choice of a digital signature scheme?

Rabin-Williams signature verification with 3072 bit keys is much faster than EdDSA signature verification of comparable security (when done in software). How much depends on care of coding, hardware, ...
fgrieu's user avatar
  • 141k
5 votes

How to calculate time taken by encryption?

The speed depends a lot on the exact model of the processor, and on the software. New(-ish) processors with hardware support for AES are much faster than older processors without it (AES-NI in x86 ...
ilkkachu's user avatar
  • 903
5 votes

How much time does AES decryption take?

I am attempting to decrypt a 90 GB file that is encrypted using 256 AES. [...] How long should this take to complete? If the AES implementation and the program doing the decryption are any good ...
SEJPM's user avatar
  • 46k
5 votes
Accepted

Does password length affect AES encrypt/decrypt velocity?

No, password length does not perceptibly change encryption throughput. That's valid for overwhelmingly most password-based encryption schemes using AES-256, especially the secure ones. More precisely,...
fgrieu's user avatar
  • 141k
5 votes

Performance metrices of cryptographic algorithms

The SUPERCOP page lists the following criteria: Hashing Time to hash a very short packet of data. Time to hash a typical-size Internet packet. Time to hash a long message. Length of the hash ...
Ella Rose's user avatar
  • 19.6k
5 votes

Why Stream Ciphers can be slower in software than Block Ciphers

Almost everything depends on the hardware platform the algorithm is implemented for and specifics of the implementation. So really one cannot say "algorithm x is faster than y" without referring to ...
Kris's user avatar
  • 632
5 votes

What would be the benefit of using a Stream Cipher which achieves encryption performance of 0.01 cpb using 1 CPU thread?

In most cases, our cryptography is already faster than we need it to be. For example, on my 3-year old laptop with a 1.9 GHz CPU, I can use AES-GCM with a 128-bit key at 5.8 GB/s and with a 256-bit ...
bk2204's user avatar
  • 3,361
5 votes
Accepted

XChaCha20-Poly1305 vs Plain ChaCha20-Poly1305 performance

ChaCha20-Poly1305 is slightly more performant because there's no HChaCha20 subkey derivation. If you benchmark the two, this will be detectable. However, in the real world, the difference is ...
samuel-lucas6's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible