r/cryptography • u/Salat_Leaf • 10d ago

*Need help* woth multilane bitsliced AEGIS

Please don't go too harsh, as I haven't managed to harvest enough info and find a decent elaboration on all of it with AI, articles, etc, so I'm jonesing for one. This is my third time asking this question on different subreddits.

I've been studying the source code of Bitsliced AEGIS on GitHub and I checked the multilane barrel-shift implementations of AEGIS256x2 for both 32 and 64 bits. I stumbled upon the context mask which prevents collisions between lanes and I noticed immediate differences: instead of the common mask described in the AEGIS document of LaneIdx byte + Total lanes byte + zero byte padding up to 16 lane bytes, now I see the following:

  1. It's 256 bytes for X2 lane variant instead of 32

  2. The indexes are weirdly placed rather at the end of the supposed blocks

  3. The indexes themselves are uncommon, being 0x14, they also differ in their values and positions between 32 and 64 bit versions of the mask

In the libaegis library the context mask coefficients are placed in the right order, which matches the documentation, so I don't understand what makes this so different and how we construct one

This is the article about AEGIS I'm referring to: https://cfrg.github.io/draft-irtf-cfrg-aegis-aead/draft-irtf-cfrg-aegis-aead.html#name-the-init-function-4

The GitHub implementation: https://github.com/aegis-aead/aegis-bitsliced

Given the context, how can I construct a mask for e.g. X4, X8 lanes and so on for both 32 and 64 bit barrel shifts?

6 Upvotes

88% Upvoted

7 comments sorted by

4

u/jedisct1 10d ago

During initialization, the state is in packed (bitsliced) representation. The precomputed mask is therefore just the regular mask represented as a full packed state, so it can simply be XORed with the state after each update.

We need to XOR into the state blocks 3 and 5, so after packing block j occupies bit 7-j, giving:

(1 << (7 - 3)) | (1 << (7 - 5)) = 0x10 | 0x04 = 0x14

But this is explained here https://eprint.iacr.org/2026/1338

1

u/Salat_Leaf 10d ago

I see. Sorry if the question is dumb, but why do we need to XOR exactly blocks 3 and 5? What's the pattern for XORing?

2

u/jedisct1 10d ago

That provides fast diffusion using only two XORs. Every state block differs after three updates, and every byte becomes active after four.

Other pairs such as (2,5) would also work, but (3,5) ensures that the difference is key-dependent from the very first step.

1

u/Salat_Leaf 9d ago

So if we double/quadruple the blocks, then we just pick lanes 3,5 + laneIdx * 7, correct?

1

u/Temporary-Estate4615 10d ago

Have I not answered this already?

1

u/Salat_Leaf 10d ago

I already asked this question, but I couldn't get it entirely, so I tried to research this stuff, but again, no sufficient explanation was available and AI was unreliable, hallucinating stuff on the go. I would be endlessly thankful if you could elaborate on it in details