3 ms·

And man, the rounds we have are not so expensive. Even cheap phone SoCs tend to have hardware-accelerated crypto. Some server chips have AES-128 in the memory c

• tptacek 7y ago
  You're saying "the rounds are not very expensive" but the paper is generating 2x+ speedups. This is a paper by a cryptographer (Aumasson is an author of BLAKE and BLAKE2) and a participant in the cryptographic contests that have selected the primitives we use now, in significant part due to performance concerns. Which is just to say, to the extent that the performance issues Aumasson is talking about don't seem relevant to you, you might just not be the audience to whom the paper is directed.
  • twotwotwo 7y ago
    Yes, I know Aumasson's a highly respected professional and followed the contests, and am even, like I said, kinda sympathetic to the idea that keeping a big margin for unknown unknowns may make less sense than it once did. What's the practical play here though? I guess lower-round ChaCha-Poly1305 TLS cipher suites could be worth it for users without hardware AES. I suspect even less-aggressive folks would be comfortable enough with ChaCha12 instead of 20 (e.g. Android already uses it to encrypt storage when there's no AES acceleration). But trying to move to reduced-round variants of every already-standardized primitive would be a lot of effort to, for most applications, move symmetric crypto from one tiny amount of resource use to another (even if it's much smaller in relative terms!). I do realize that people care a lot about performance, that there are applications either building on tiny microcontrollers or handling redonkulous data flows, and that any possible bit of flexibility could help someone. Still seems fair to ask: if the broad change in perspective Aumasson wants does happen, is it really going to change much about crypto in the wild soon?
    • hermitdev 7y ago
      I think the big unknown unknown would be something along the lines of a hypothetical mathematical breakthrough that renders current cryptography useless. I'm not even suggesting quantum computing. Suppose someone figures out a way to rapidly factor large numbers easily using classical computing? Yes, we dont know how to do it now, but there have been a lot of things we didnt know how to do or was thought impossible 20, 50, 100 years ago. I dont have any special insight to this, just saying that what was once impossible can become a daily occurance in time and with the right breakthrough.
      • zahllos 7y ago
        Factoring large numbers won't have any effect on symmetric cryptography. Finite field cryptography, if you want to call it that (DH, RSA) requires the primes be big enough to generate sufficiently large finite fields for all algorithms that might factor or solve dlog to be so expensive to run you can't do it. Same with elliptic curves - the finite fields are chosen to be large enough to make the best algorithms that can solve the ecdlp impossible within our lifetime, modulo either quantum computers or a major classical speedup. At a very high level (I'm about to take liberties with the entire field), symmetric cryptography is a permutation of bits in the input block. To make it secure we need two things: confusion and diffusion. We don't want the relationship between plaintext, key and ciphertext to be simple to describe, and every time a bit is flipped, we want approximately half the output bits to be flipped. There's actually very little mathematics involved here: you can describe AES in terms of finite fields, but there's no hard to inverse problem in place. It's simply that finite fields a) conveniently describe binary in characteristic 2 (AES uses GF(2^8) which can be represented as 8 bits, or one byte) and b) have "weird" multiplication even when using the most obvious characteristic polynomial, which AES does not. Actually I think this was mildly controversial at the time, because it implies some structure (and we generally want no evidence of structure of any kind). Cryptanalysis, in this context, tries to find "chinks" in this confusion and diffusion. Imagine if you took two plaintexts, what happens if you start doing things like encrypting the xor of them, versus encrypting one or the other? Doing this with enough plaintext/ciphertext pairs gives us enough information to find the key being used, eventually. Or what happens if we can make linear approximations to parts of the cipher? Can we use this to take shortcuts and guess the key? Have a read of http://theamazingking.com/crypto-diff.php http://theamazingking.com/crypto-diff.php and the linear stuff there. This is the best we have. tl;dr factoring large numbers, or any advance in the mathematical areas has little bearing on symmetric cryptography. What we need is a way to see structure in something that has been deliberately designed to have as little as possible. Of course, nobody knows, but I'd guess that it's more likely someone will find a speedup for the ecdlp than any meaningful improvement to block cipher cryptanalysis.