<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 28, 2016, at 1:22 PM, Jerry Leichter <<a href="mailto:leichter@lrw.com" class="">leichter@lrw.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html charset=us-ascii" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><blockquote type="cite" class=""><span style="font-family: Helvetica; font-size: 12px;" class="">What would a modern cipher designed for efficient hardware</span><br class=""><div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">implementation look like? Is it just DES with more rounds and a bigger</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">block size? How about mixing up different cipher principles in one</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">cipher? So start with a Feistel, then an S-box, then...</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""></div></blockquote></div><br class=""><div class="">Look at Simon and Speck</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span><a href="https://eprint.iacr.org/2013/404.pdf" class="">https://eprint.iacr.org/2013/404.pdf</a></div></div></div></blockquote>Simon and Speck specifically deal with the question of *expensive* gates: </div></div></div></blockquote><div><br class=""></div><div>That’s what the author’s claims, yes.</div><br class=""><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">They are for low-end, cheap devices. Just the opposite of what the OP brought up.</div></div></div></blockquote><div><br class=""></div><div>That’s also what the author’s claim, but both have 128 bit block and 256 bit keys, the same parameters of the heaviest AES. There have been no papers suggesting that it is not as secure as AES. So it’s a single algorithm that can be used for trivial or serious cryptography.</div><br class=""><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Suppose you had a budget of a million gates and wanted to design a cipher that made full use of them. What would you do?</div></div></div></blockquote><div><br class=""></div><div>I would not design a new just because I have a lot of gates. You should 1) choose an algorithm that you have confidence in being secure. 2) Implement it in a way that is correct and 3)make it fast. </div><div><br class=""></div><div>I would completely unroll Simpn and implement it in clockless hardware. The value of Simon is that there is no ALU or carry chain. Only requiring and, xor and shift. A hallway conversation with a cryptographer at <a href="http://galios.com" class="">Galios.com</a> said it was possible with their hardware synthesis methodology.</div></div><br class=""><div class="">In addition, the original thought was about a "modern cipher”. There are three such reasons I believe Simon meets this criteria. 1) Many would consider a cipher that is relatively trivial to analyze for security would be an advancement over many other ciphers. Algorithms with “expensive” gates (I read as complicated primitives) are harder to analyze. 2) S-Boxes have a significant amount of “magic” in the choice of the S-Box. An algorithm with S-Boxes has similarity to DES (not a modern cipher unless 1974 was the beginning of the “Modern” era). The choice of the S-Boxes was the number one worry about DES which was never proven to have or not have a flaw. 3) Another definition of Modern would be newer. Simon meets all three of these criteria.</div><div class=""><br class=""></div><div class="">Frankly, I don’t want this to devolve into a religious arguments, Simon is my current fav. We can drop it at that.</div></body></html>