3 ms·

SPECK is a really attractive design for software implementation. The key schedule and the round function are the same, it's an ARX design that lends itself to n

SPECK is a really attractive design for software implementation. The key schedule and the round function are the same, it's an ARX design that lends itself to naturally constant-time implementation. If the design is free of fault and it gets thrown out because of its origin and admittedly questionable public analysis statements, that's rather unfortunate. Alas, it's hard to trust given the backstory, but on the other hand the author(s) might be relying entirely on cryptanalytic techniques and results they're not able to publish for whatever reason.

GTP 5y ago
>but on the other hand the author(s) might be relying entirely on cryptanalytic techniques and results they're not able to publish for whatever reason But this is bad, the best way to ensure that some cryptanalytic technique works is to publish it so every cryptographer in the world can review it.
- espadrine 5y ago
  > the best way to ensure that some cryptanalytic technique works is to publish it so every cryptographer in the world can review it The best way to ensure that a design is sound, is to publish it, but that is not true of cryptanalysis techniques. They are generally tied to a mathematical proof, so they can be quite confident of their correctness. A design, on the other hand, has an unknown number of ways in which it can fail. Also, historically, secret cryptanalyses have proved invaluable in warfare; the most famous examples are the techniques used for Enigma, Lorenz SZ42, and the “Purple” Type B Cipher Machine, which allowed reading various crucial messages from the Nazi and Imperial Japan during WWII; had the techniques been published, the ciphers would have been improved. There is still a very good reason to not like that situation: first, commercial information is much more sizeable and is arguably much more sensitive nowadays, as warfare is shifting to the weakening of the enemies’ economy (look at Russia turning a blind eye or more on the groups behind the Colonial Pipeline hack). Second, the government’s cryptanalysis effort is financed by the people, so it would be reasonable for them to receive its fruits.
  - GTP 5y ago
    another reason to not like it: if there are out there ciphers which could be broken with such hypotetic tecnique we miss the chance to move away from them/design ciphers that are robust against that tecnique. which is exactly what secret services usually want to have a cryptographic advantage over enemies, but at the same time they endanger everyone else, as also the enemy coukd independently discover that tecnique and start using that against e.g. businesses.
- MertsA 5y ago
  The NSA will never do that as it would be tipping their hand about whatever novel technique they reveal. In the past the NSA actually did provide some constants that went into DES and people were suspicious as the constants weren't randomly chosen. Later on it came out that differential cryptanalysis would have broken the original constants but the NSA provided ones were chosen to thwart this. They clearly knew about it well ahead of it being discovered in academia. Then you have the NSA's shady dealings around Dual_EC_DRBG where there was speculation that this might be similar to when the NSA secured DES against publicly unknown advanced cryptanalytic attacks. Of course for Dual_EC_DRBG that wasn't the case, it was a malicious backdoor, nothing more. The question comes down to "Is this a repeat of DES or Dual_EC_DRBG?" and the NSA has poisoned the well with their previous attack on cryptography standards.
JoachimS 5y ago
But both algorithms are confidentiality only, not AE. And they need a lot of rounds to provide any real security.

GTP 5y ago

>but on the other hand the author(s) might be relying entirely on cryptanalytic techniques and results they're not able to publish for whatever reason But this is bad, the best way to ensure that some cryptanalytic technique works is to publish it so every cryptographer in the world can review it.

espadrine 5y ago
> the best way to ensure that some cryptanalytic technique works is to publish it so every cryptographer in the world can review it The best way to ensure that a design is sound, is to publish it, but that is not true of cryptanalysis techniques. They are generally tied to a mathematical proof, so they can be quite confident of their correctness. A design, on the other hand, has an unknown number of ways in which it can fail. Also, historically, secret cryptanalyses have proved invaluable in warfare; the most famous examples are the techniques used for Enigma, Lorenz SZ42, and the “Purple” Type B Cipher Machine, which allowed reading various crucial messages from the Nazi and Imperial Japan during WWII; had the techniques been published, the ciphers would have been improved. There is still a very good reason to not like that situation: first, commercial information is much more sizeable and is arguably much more sensitive nowadays, as warfare is shifting to the weakening of the enemies’ economy (look at Russia turning a blind eye or more on the groups behind the Colonial Pipeline hack). Second, the government’s cryptanalysis effort is financed by the people, so it would be reasonable for them to receive its fruits.
- GTP 5y ago
  another reason to not like it: if there are out there ciphers which could be broken with such hypotetic tecnique we miss the chance to move away from them/design ciphers that are robust against that tecnique. which is exactly what secret services usually want to have a cryptographic advantage over enemies, but at the same time they endanger everyone else, as also the enemy coukd independently discover that tecnique and start using that against e.g. businesses.
MertsA 5y ago
The NSA will never do that as it would be tipping their hand about whatever novel technique they reveal. In the past the NSA actually did provide some constants that went into DES and people were suspicious as the constants weren't randomly chosen. Later on it came out that differential cryptanalysis would have broken the original constants but the NSA provided ones were chosen to thwart this. They clearly knew about it well ahead of it being discovered in academia. Then you have the NSA's shady dealings around Dual_EC_DRBG where there was speculation that this might be similar to when the NSA secured DES against publicly unknown advanced cryptanalytic attacks. Of course for Dual_EC_DRBG that wasn't the case, it was a malicious backdoor, nothing more. The question comes down to "Is this a repeat of DES or Dual_EC_DRBG?" and the NSA has poisoned the well with their previous attack on cryptography standards.

JoachimS 5y ago

But both algorithms are confidentiality only, not AE. And they need a lot of rounds to provide any real security.