Re:Lightweight Cryptography Standardization Process: NIST Se...
by yarg on Tuesday February 07, 2023 @09:42PM
(#34703412)
Is there that much overhead in using a general block cypher to build a stream cypher?
Re:Lightweight Cryptography Standardization Process: NIST Se...
by throwaway81523 on Wednesday February 08, 2023 @04:56AM
(#34706172)
The issue is that for most authenticated modes, you have to run the block cipher twice in some manner, once to encrypt and once to authenticate. OCB is an exception but I don't know what its status is these days; and, iirc, it still has to do some finite field arithmetic which can be slow in software.
NIST has been testing the algorithms on ATmega328P in software, with specific comparisons to AES-GCM, where Ascon was twice as fast[0]. They also study hardware designs for various fabs; there was a study also giving significantly better results there[1].
> supports 256-bit keys (which are actually secure against quantum search)
(Small note here: this topic is a bit more complex than this, since Grover’s algorithm does not have a constant gate factor with respect to the number of key bits. 128-bit keys already require a number of gates that is unrealistic for a quantum computer to have, similar to expecting a classical computer to have over a quettabyte of RAM.)
[0]: https://csrc.nist.gov/csrc/media/Presentations/2022/update-o...
[1]: https://cryptography.gmu.edu/athena/LWC/SCA_Evaluation_and_B...