Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this ...

learn more… | top users | synonyms

1
vote
1answer
57 views

What is a good algorithm to scramble data in a 2-D grid

I want to know if there exists an algorithm i can use where the input is a string of data and the output is a scrambled version of the same but in a 2 D array ie given something like: |1 2 3 4 5 6 ...
1
vote
0answers
53 views

Is there a fast implementation of RSA for Microcontrollers?

Zhe Liu, Johann Großschädl, and Ilya Kizhvatov. "Efficient and Side-Channel Resistant RSA Implementation for 8-bit AVR Microcontrollers" describes a fast implementation, but only contains a sketch of ...
-1
votes
1answer
82 views

What are the security implications of an AES implementation that uses only 8-bit byte operations on the cipher state?

Some AES implementations in crypto libraries make use only 8-bit byte operations on the cipher state, like in the lorawan-parser (cf lib/aes.h). When I try to understand the implications of that, I ...
8
votes
5answers
5k views

Is there any opensource white-box implementation of AES or DES?

I googled it and give me no result. There is a binary executable of white-box implementation of DES (scroll down), but no source code provided. The same page also links various papers about ...
1
vote
0answers
81 views

Does the RSA algorithm use repeated squaring?

Simple question: in order to reduce such huge exponents in modular arithmetic, is repeated squaring used in RSA or is there a better way to implement it?
4
votes
2answers
690 views

Signature schemes for underpowered devices (8bit microcontroller)

I am currently researching into a small scale home automation system, aiming for cost. The system architecture is basically one master and several slaves which are connected in parallel. Recently ...
2
votes
1answer
82 views

Problem reproducing AES results

First of all, I just implemented AES because I wanted to understand how it works and as a challenge to see if I could do it and I won't use to encrypt anything important, ever. The (German) Wikipedia ...
2
votes
0answers
50 views

Reference AES-NI assembler code for AES-128-GCM? [closed]

I want to implement AES-128-GCM in assembler using Intel AES-NI instructions. I have found reference code in the Intel AES-NI Whitepaper but I don't see code for the GCM mode there (or indeed any use ...
7
votes
1answer
153 views

Branchless AES Implementation

Imagine a branchless implementation of the AES-128 cipher. Are there any benefits over the implementation that contains branches, other than possible prevention of timing attacks? Is it even true, ...
17
votes
3answers
4k views

Cryptanalysis to reverse engineer a hash?

I understand this may not be the best place to ask a question like this, but I believe that this community may be the best/only place I can ask such a question. I have inputs and outputs from an ...
8
votes
3answers
345 views

How is bitslicing faster?

I have read a paper on Bit Slicing and Lightweight crypto but cannot understand how bitslicing makes encryption scheme faster. Please can someone explain with an example exactly how bit slicing makes ...
0
votes
1answer
47 views

Is there a library-less implementation of DSA available to read? [closed]

Is there a pedagogical library-less implementation of DSA available to read? (Not ECDSA.) Obviously BigInteger and hash functions may be from libraries, but I want to read the implementation of all ...
3
votes
1answer
104 views

Fast reduction in $GF(2^{128})$ using x86 `PCLMULQDQ`

Modern x86 CPUs support the PCLMULQDQ instruction, which does an XOR-multiply of two 64-bit numbers instead of an add-multiply (i.e. typical arithmetic ...
2
votes
1answer
231 views

RSA Signature Verification Implementation on Cortex M0

I have to implement RSA Signature Verification procedure (RSA-2048) on a Cortex M0 based MCU. My budget is 15kB Flash and 2-4kB Flash RAM. Is it even possible to do RSA on a low end MCU based on ...
2
votes
1answer
119 views

Is succinct verification of an arbitrary data transformation theoretically possible? Is it feasible? How?

Given input string S, and transformation (i.e. computer program) T, is it possible to provide a succinct proof that another binary string S' is identical to the output T(S)? By "succinct", I ...
3
votes
1answer
219 views

Encrypt with one cipher and decrypt with a different cipher?

I recently installed an android app called Secret Space Encryptor and think I found a serious flaw in it. Let me explain: This app provides a variety of different ciphers to use and I used Threefish ...
5
votes
1answer
749 views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ...
12
votes
1answer
216 views

Edwards / Montgomery ECC with Weierstrass Implementation?

So let's assume I want to perform Ed448 or Ed25519 digital signatures or want to perform a DH key-exchange. Assume further that those curves (Curve448 or Curve25519) are required. But the problem is, ...
1
vote
1answer
44 views

Authenticating with a document

Hope you're having a nice day. I need to implement an authentication system between a "document" (it's not exactly a document, but an object without any computing capacity, only able to store ...
9
votes
1answer
1k views

Why do crypto libs use table lookups when they're vulnerable to timing attacks?

AESEngine.java, from BouncyCastle, uses table lookups as does aes_x86core.c, in OpenSSL. But per Cache-timing attacks on AES table lookups like what OpenSSL and BouncyCastle are doing are vulnerable ...
2
votes
1answer
62 views

Can string lookups be vulnerable to timing attacks like array lookups are?

Per “Can non-assembly crypto libraries truly be secure against timing attacks?”, array lookups are vulnerable to timing attacks. Like, if you do cresult[map[i]] and ...
7
votes
1answer
250 views

Can non-assembly crypto libraries truly be secure against timing attacks?

http://cr.yp.to/antiforgery/cachetiming-20050414.pdf states the following: So what went wrong? Answer: NIST failed to recognize that table lookups do not take constant time. “Table lookup: not ...
1
vote
0answers
79 views

Library to find an addition chain for a large number? [closed]

I need a short addition chain for a number $n>2^{100}$ in order to implement a fast exponentiation. The memory footprint is not important. Finding an optimal chain for a large number $n$ is ...
4
votes
1answer
2k views

Who uses the RSA BSAFE library? [duplicate]

Who uses RSA's BSAFE library? Does anyone know what products use it, or have any statistics on how many end users use something that is built on BSAFE? Background: BSAFE is one of the oldest ...
4
votes
1answer
184 views

Parallelization of CFB mode encryption and decryption

While reading Evaluation of Some Blockcipher Modes of Operation by Rogaway (someone just linked it somewhere), I noticed two claims about CFB that I'm not sure I understand: Regarding whether CFB ...
0
votes
1answer
78 views

How to select parameters based on some condition

I am implementing a protocol for authentication where parameters need to be selected with $gcd(\mu,\phi)=1$ where $\phi=(p−1)(q−1)$. What is the best way to select the parameters while implementing
4
votes
1answer
166 views

Implementing AES MixColumns with fewest XOR gates

I'm playing with Contiki (O.S. for constrained devices such as sensors and micro-controllers) and particularly with the AES encryption in software (the one available in Contiki source code). I'm ...
1
vote
1answer
284 views

Discrete Logarithm (512 bits numbers) - Find exponent parameter

I'm trying to resolve a discrete logarithm equation: $$y = g^x \bmod p$$ Every parameter is a 512-bit number. I know the values for $g$, $y$ and $p$ and I need to find the $x$ value. Finally, I know ...
2
votes
1answer
168 views

Calculate the security of a cascade cipher

I’m reading “The Security of Multiple Encryption in the Ideal Cipher Model” and I’m having a hard time understanding something. How do I calculate the bounds of cascade cipher from the following ...
4
votes
2answers
210 views

Addition step in MD5 implementation

In MD5, there are four rounds. After every round, why do we need to add the computed $Q$ values to the initial values and then take this value as input to the next round. For example after the first ...
4
votes
1answer
531 views

Blockwise Montgomery multiplication

I have to implement a 256*256 bit Montgomery multiplier for pairing computations. The straightforward approach is to use a bit-serial version, but I would like to utilize the built-in 64*64 bits ...
0
votes
0answers
88 views

Understanding the PRINCE cipher linear layer

I am struggling to understand how to implement the PRINCE cipher linear layer. (https://eprint.iacr.org/2012/529.pdf) From my understanding I need to multiply the state with M, and with M' in between ...
0
votes
0answers
73 views

zero knowledge framework for c programs - how to prove correct C program execution with private inputs

I am looking for a zk framework that could be used for proving correct execution of programs written in C (or any other high level language) such as: I know x s.t. SHA-256(x) = y (y is public, x is ...
7
votes
3answers
784 views

Order of cascaded ciphers

Does the order of a block cipher cascade (e.g. in TrueCrypt) make a difference to the security provided, assuming independant keys? For example: ...
0
votes
1answer
125 views

Rsa Key Exchange Protocol

Moderators: Maybe this question will be move to other sub-forum. My question is Anybody know some link with a tutorial of how implement the RSA key exchange protocol using java for chat comunication?
5
votes
4answers
970 views

How do institutions like banks do RSA with big primes?

When encrypting with RSA it is often infeasible to decrypt by just doing c^d mod n, because for example when using the primes $(p,q)=(12553,1233)$, which are small ...
1
vote
1answer
283 views

How to create a PEM file for storing an RSA key?

I have an RSA private key $\{d,n\}$ and a public key $\{e,n\}$, where $n$ is the modulus, and I also have the prime factors $p$ and $q$ of $n$. I want to create a PEM file containing this ...
2
votes
3answers
255 views

Sage Vs C++(with NTL) for implementing cryptosystems

Is Sage a better alternative to C++(with NTL), for programming that involves math objects like polynomial rings in cryptosystems? I hear that Sage is an open source alternative to Magma. I have used ...
0
votes
2answers
164 views

Asymmetric encryption that is secure for (almost) any foreseeable future

Recently, I've been reading a couple of papers about building cryptosystems that are secure for up to 30 years. But for some applications, this seems a bit low to me. So I am wondering if considering ...
3
votes
2answers
793 views

Is there any implementation of scrypt that allows a specific limit on memory?

The answerer has commented that scrypt's memory use is "only a function of r". $\:$ However, he has not addressed my argument that it also depends on N, in one of my comments from over 5 days ago. I ...
0
votes
1answer
350 views

What is the most light-weight symmetric cipher thats still usefull?

I need a very light encryption scheme which costs almost no performance during encryption (while decryption may be slow). I found 5 algorithms: RC4, DES, LED, PRESENT, and Piccolo. But how do I ...
-1
votes
1answer
160 views

Vigenere ciphers : Need help for math analysis

I've been learning about Vigenere ciphers and then thought of another method to Encrypt and decrypt that. This's my method to encrypt : ...
0
votes
1answer
224 views

How to implement the Salsa20 hash function?

I am currently implementing Salsa20 from the specification as an exercise in learning and self-flagellation. I have Sections 1-7 passing the test examples provided. I am now stuck on Section 8, The ...
2
votes
1answer
180 views

Crypto++: How to re-generate pseurandom integers in Crypto++

I'm using Crypto++ to implement my protocol to mask a value $y_i$ by a seudorandom value $r_i$ such that $m_i=y_i \cdot r_i$. Since there are many $r_i$'s I want to generate them using PRG and then ...
2
votes
1answer
76 views

How to construct the blind factors in practice?

I'm Implementing a protocol that uses masking techniques (or blinding factors), so we can mask a value $y_0$ as $m_0=y_0 \cdot r_0$ where $y_0 \in \mathbb{Z}_p$ and $r_0 \stackrel {R}\leftarrow ...
1
vote
1answer
94 views

Pseudorandom function library [closed]

I'm wondering if there is any library supporting pseudo-random function, so I can specify the key length and output domain. Is it correct that I need to use a block cipher for this purpose? Any ...
1
vote
1answer
335 views

Additional Data in AEAD (Chacha20-poly1305 libsodium)

I have recently been playing with Chacha20-Poly1305 with libsodium, and all of the examples state the additional data portion of the tag is stored in plaintext when encrypted. But from what I can tell ...
0
votes
0answers
236 views

Python implementation of a blind signature scheme which doesn't involve RSA

RSA seems a bit creepy after the Snowden revelations and i'm looking for a simple python based blind signature library to fiddle around with. So far i've been unable to find anything. What am i ...
0
votes
1answer
71 views

Why the data length is shifted 3-bit in MD4 Java implementation? [closed]

In RFC 1320, It is stated that "A 64-bit representation of b (the length of the message before the padding bits were added) is appended to the result of the previous step. In the unlikely event that b ...
1
vote
3answers
278 views

Programming language for modular arithmetic over large numbers [closed]

I'am trying to implement algorithms on integer factorization.This involves dealing with integers of 200-500 digits and doing modular arithmetic over them.Which programming language has inbuilt support ...