Hacker News Reader

Comment by MarekKnapek | Hacker News Reader

Implementing AES from scratch is easy and fun, just read the spec and implement it 1:1, until ... you encounter GCM mode and its Galois Field "weird" math. Very. Not. Fun.

View on HN

I also made a 1:1 implementation of the spec. The finite field math did cause a bit of head-scratching, but in the end I mostly made sense of things:

https://github.com/DavidBuchanan314/aes-playground/blob/mast...

(I left comments quoting the spec as much as possible, so it should be possible to map it back onto the spec, for anyone interested)

Here's a (not so fast) implementation of multiplication in GF(2^128) in 32 lines of code! :) http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/crypto/gmac...

Most cryptographic operations are easy to implement. The best part is when you make a mistake, you'll most likely get random nonsense out the end. Floating point code is much more difficult, often you'll get an answer that's almost correct or worse one that's correct most places...

Heard about a great floating point implementation bug just today. When nintendo released Super Mario 64 for the Wii virtual console, they essentially just made their own emulator that plays a single ROM. The emulator is pretty accurate, though they made a mistake when implementing floating point operation rounding: All operations end up rounding upwards to the next floating point number (as opposed to alternating, depending on the result). A consequence of this was that some of the moving platforms in the game that had a periodic up/down pattern would slowly (over the course of literal days) creep upwards. Ended up being exploited in a speedrun category where the player attempts to press the A button as little as possible.

Shades of the floating point truncation bug in Vancouver Stock Exchange Index in the early 1980s:

https://en.wikipedia.org/wiki/Vancouver_Stock_Exchange#Round...

The bug caused the index to creep up to twice the real index.

The even better part is that you can generate or find test vectors to test your implementation against a known-correct one.

AES is useful beyond AES-GCM.

Constructions such as AES-CMAC, but also recent ones such as AEGIS only require the AES round function.

Reply on news.ycombinator.com