Re: Blockcipher >256 bit (for hardware implementation)

Kristian Gjøsteen wrote:
Luc The Perverse <sll_noSpamlicious_z_XXX_m@xxxxxxxxxx> wrote:
"Mike Amling" <spamonly@xxxxxxxxxxx> wrote in message news:ep62ts$a4@xxxxxxxxxxxxxxxxxxxxxxxxxx
Two iterations of Rijndael with block size 192 bits, with code-stealing to get the block size down to 320.
I was about to make several uneducated responses - instead, could someone explain what code stealing is?

You'll find it if you search for "ciphertext stealing".

Yes, that's what I meant. The mind is the first thing to go.

It is problematic in that if the first 192 bits of two plaintexts are
identical, that would make the first 320-192 = 128 bits equal. So this
leaks more information about the plaintext than one 320-bit block cipher
does. I don't know if the OP cares about that, though.

The ciphertext stealing is just intended to cobble up a new effective block size. It's not a substitute for a proper mode and a proper IV. Your condition "if the first 192 bits of two plaintexts are identical" applies just as well to a plain old 128-bit block size encryption performed without a proper mode and IV. (The OP's idea that somehow a 256-bit message and its 64-bit MAC should be encrypted by the application of a cipher to a single 320-bit block is dubious.)

In any event, the OP could consider Phelix, which has been around--as Helix/Phelix--since 2003, has a built-in MAC of configurable length, and, AFAIK, is suitable for implementation in hardware.

Perhaps if you do three passes:

c1 = Rijndael(k,m[1..192])
c2 = Rijndael(k,c1[129..192] || m[193..256] || 0^64)
c3 = Rijndael(k,c1[1..128] || c2[1..128])

c = c3 || c2[129..256]

Depending on the number of ciphertexts you are creating, 64 bits of
overlap may not be enough (if you can get a collision in the overlap
part of c1, the tail of the ciphertext would be identical), it could be
better to use a 256-bit block size.

But the cost of this is may be fast approaching the cost of a generic
construction for a wide-block block cipher.

--Mike Amling
.

Relevant Pages

  • Re: Barcode Email
    ... Ari Silversteinn wrote: ... > It matters to the intended audience, where did you miss that part? ... cipher in a proper mode. ...
    (comp.security.misc)
  • Re: Barcode Email
    ... Ari Silversteinn wrote: ... > It matters to the intended audience, where did you miss that part? ... cipher in a proper mode. ...
    (sci.crypt)
  • Re: How fast computers have made ciphers unbreakable
    ... to compromise a cipher that vastly diminishes the cost of an attack. ... Change ciphers if you hear of a dangerous ...
    (sci.crypt)