Re: Don't use S-boxes!

From: D. J. Bernstein (djb_at_cr.yp.to)
Date: 11/21/04 

Date: Sun, 21 Nov 2004 03:06:20 +0000 (UTC)

karl_m@acm.org wrote:
> There seems to be some difference of opinion as to the difficulty of
> obtaining a constant time AES implementation. You say it's trivial,
> while Professor Bernstein says it's nearly impossible.

No, I never said that. In fact, my paper says exactly the opposite:
``One can implement AES using these [constant-time] operations.''

Actually, what my paper says is ``One can implement AES using these
operations, of course.'' The knowledgeable reader is already aware that
every circuit can be implemented with those constant-time operations.

The problem is performance. Here's the complete sentence: ``One can
implement AES using these operations, of course, but the result is
painfully slow.'' Every fast AES implementation uses array lookups---and
making _those_ take constant time is difficult.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

Relevant Pages

  • Re: Successful remote AES key extraction
    ... >> I said that NIST failed to recognize that table lookups do not take ... >> constant time. ... Fourteen AES ... Last I checked Skipjack was valid in the US and CAST5 was a suitable ...
    (sci.crypt)
  • Re: Whats so funny? WAS Re: rotor replacement
    ... people disagree on what precisely the API should be. ... There are plenty of AES modules that people can get from ... understand that I don't want included batteries so much that I ... What I cannot promise is to include *your* AES implementation, ...
    (comp.lang.python)
  • Re: AES where is it?
    ... >I was trying to find a nice simple AES implementation on the ... >aes everywhere but no where. ... The original NIST AES web site was archived in 2001 and I don't think it ever made the reference code directly available from the site. ...
    (sci.crypt)