Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this ...

learn more… | top users | synonyms

0
votes
1answer
51 views

Is there a library-less implementation of DSA available to read? [closed]

Is there a pedagogical library-less implementation of DSA available to read? (Not ECDSA.) Obviously BigInteger and hash functions may be from libraries, but I want to read the implementation of all ...
9
votes
3answers
408 views

How is bitslicing faster?

I have read a paper on Bit Slicing and Lightweight crypto but cannot understand how bitslicing makes encryption scheme faster. Please can someone explain with an example exactly how bit slicing makes ...
3
votes
1answer
110 views

Fast reduction in $GF(2^{128})$ using x86 `PCLMULQDQ`

Modern x86 CPUs support the PCLMULQDQ instruction, which does an XOR-multiply of two 64-bit numbers instead of an add-multiply (i.e. typical arithmetic ...
2
votes
1answer
239 views

RSA Signature Verification Implementation on Cortex M0

I have to implement RSA Signature Verification procedure (RSA-2048) on a Cortex M0 based MCU. My budget is 15kB Flash and 2-4kB Flash RAM. Is it even possible to do RSA on a low end MCU based on ...
2
votes
1answer
151 views

Is succinct verification of an arbitrary data transformation theoretically possible? Is it feasible? How?

Given input string S, and transformation (i.e. computer program) T, is it possible to provide a succinct proof that another binary string S' is identical to the output T(S)? By "succinct", I ...
3
votes
1answer
220 views

Encrypt with one cipher and decrypt with a different cipher?

I recently installed an android app called Secret Space Encryptor and think I found a serious flaw in it. Let me explain: This app provides a variety of different ciphers to use and I used Threefish ...
12
votes
1answer
223 views

Edwards / Montgomery ECC with Weierstrass Implementation?

So let's assume I want to perform Ed448 or Ed25519 digital signatures or want to perform a DH key-exchange. Assume further that those curves (Curve448 or Curve25519) are required. But the problem is, ...
1
vote
1answer
44 views

Authenticating with a document

Hope you're having a nice day. I need to implement an authentication system between a "document" (it's not exactly a document, but an object without any computing capacity, only able to store ...
3
votes
4answers
436 views

Cryptography and FPGA

I see a lot of papers about FPGA implementations. For what kind of "concrete" application should we implement cryptographic algorithms on FPGA ? Which secured application require such a huge data ...
4
votes
2answers
99 views

Are there simpler FHE methods than Craig Gentry's original paper?

Craig Gentry's 2010 paper on FHE is very cool, and I'm planning on implementing a basic proof of concept FHE. I was wondering though, are there any simpler methods that have been discovered since ...
9
votes
1answer
1k views

Why do crypto libs use table lookups when they're vulnerable to timing attacks?

AESEngine.java, from BouncyCastle, uses table lookups as does aes_x86core.c, in OpenSSL. But per Cache-timing attacks on AES table lookups like what OpenSSL and BouncyCastle are doing are vulnerable ...
2
votes
1answer
62 views

Can string lookups be vulnerable to timing attacks like array lookups are?

Per “Can non-assembly crypto libraries truly be secure against timing attacks?”, array lookups are vulnerable to timing attacks. Like, if you do cresult[map[i]] and ...
7
votes
1answer
271 views

Can non-assembly crypto libraries truly be secure against timing attacks?

http://cr.yp.to/antiforgery/cachetiming-20050414.pdf states the following: So what went wrong? Answer: NIST failed to recognize that table lookups do not take constant time. “Table lookup: not ...
1
vote
0answers
80 views

Library to find an addition chain for a large number? [closed]

I need a short addition chain for a number $n>2^{100}$ in order to implement a fast exponentiation. The memory footprint is not important. Finding an optimal chain for a large number $n$ is ...
4
votes
4answers
570 views

Are specially designed fonts sometimes used in cryptography?

As a font designer, I was thinking that it would be very easy to design a special font that could either jumble characters of a language (or of a code) or simply (with the features offered by the OTF ...
4
votes
1answer
184 views

Parallelization of CFB mode encryption and decryption

While reading Evaluation of Some Blockcipher Modes of Operation by Rogaway (someone just linked it somewhere), I noticed two claims about CFB that I'm not sure I understand: Regarding whether CFB ...
1
vote
1answer
286 views

Discrete Logarithm (512 bits numbers) - Find exponent parameter

I'm trying to resolve a discrete logarithm equation: $$y = g^x \bmod p$$ Every parameter is a 512-bit number. I know the values for $g$, $y$ and $p$ and I need to find the $x$ value. Finally, I know ...
4
votes
1answer
175 views

Implementing AES MixColumns with fewest XOR gates

I'm playing with Contiki (O.S. for constrained devices such as sensors and micro-controllers) and particularly with the AES encryption in software (the one available in Contiki source code). I'm ...
0
votes
0answers
90 views

Understanding the PRINCE cipher linear layer

I am struggling to understand how to implement the PRINCE cipher linear layer. (https://eprint.iacr.org/2012/529.pdf) From my understanding I need to multiply the state with M, and with M' in between ...
0
votes
0answers
74 views

zero knowledge framework for c programs - how to prove correct C program execution with private inputs

I am looking for a zk framework that could be used for proving correct execution of programs written in C (or any other high level language) such as: I know x s.t. SHA-256(x) = y (y is public, x is ...
5
votes
1answer
119 views

Which attacks are possible against raw/textbook elliptic curve?

A quick question, we know that raw RSA is a no go. To solve this we have different PKCS standards forcing structure on the input messages. For EC the story is something else. For signatures we have ...