Hot answers tagged

12

I believe that it is for two reasons: Nontable based implementations of AES are possible, but (assuming you don't have AES-NI or something similar) are significantly slower than table based implementations (perhaps $10\times$ to $20\times$ slower) For a lot of uses, timing attacks aren't particularly relevant (as either the attacker can't get the ...


9

If I understand your question correctly, you are essentially asking if points in Edwards and Montgomery curves can be represented in Weierstrass coordinates. This is true; in fact, any elliptic curve over a prime field can be represented in Weierstrass form $\mathcal{E}_{w}^{a, b} : y^2 = x^3 + ax + b$, and by extension its points can too. The question, ...


8

Bitslicing is a technique where a computation is Reduced to elementary operations (called gates) with two bit inputs (typically NOR, XOR, and similar like OR AND NAND NXOR), rather than operations on words or integers spanning several bits. Executed in parallel, with as many simultaneous instances (on a single CPU) as there are bits in some register kind, ...


8

What makes crypto code vulnerable to timing attacks is data dependent timing variations. Branching according to a round counter, or to the key size, does not create a vulnerability. Most implementations of AES make no branch according to key or data value, and supressing other branches won't help. The main source of data-dependent timing variations in AES ...


7

I've checked out the source code (well, more or less, it's not that well designed, the main crypto class is 1600 lines) and as Richie guessed, the algorithm is stored together with the ciphertext. Pretty gruesome stuff, but it does do EAX mode for text strings to my surprise. It probably only uses it for text strings originating from the password vault code ...


6

I add my whitebox AES implementation on GitHub in: C++ Java C++ version implements both Chow's (mixing bijections, input/output encodings, external encodings) and Karroumi's (dual AES in each column) whitebox AES scheme plus Billet's key recovery attack on both schemes. Java implements Chow's scheme only. PS: Due to low reputation I post links to ...


6

As pointed by CodesInChaos, you'll need to know the padding used; depending on application that could be RSASSA-PKCS1-V1_5, or RSASSA-PSS, or some of the three schemes of ISO/IEC 9796-2, etc.. Hashing, and padding check, are a significant part of the code. In any case, yes, it is possible to implement RSA-2048 signature verification on a Cortex-M0 ...


6

An initialization vector is, in fact, always binary. It's just random bits. So, if you choose to encode those bits as a hexadecimal string for ease of storage or transportation, that is fine. However, since it is the binary that is the IV, you will need to decode it back from hexadecimal to a binary value before using it in the decryption process. As a ...


5

So how secure can non-assembly code truly ever be against timing attacks? First of all, let me state that this is a tricky subject. The simplest method is of course to do away with the lookup tables or and other components that are vulnerable to timing attacks. So when a cipher designed, it should require a minimum of vulnerable components. And during ...


5

Is this something that exists and could be plausible? Yes, things like that already exist and have even been used by well-known serial killers! (So much for creating a dramatic intro – lol) Monoalphabetic Substitution Cipher What you are referring to, could be categorized as a classical “pigpen cipher”; a monoalphabetic substitution cipher where ...


5

Bitslicing is a technique that allows multiple instructions/Data points to be encoded into a single register. The idea is that you encode several bitwise operations within a single register. So, instead of 32 bitwise OR operations in sequence, you could reduce the total number of operations by cramming the data into SIMD registers and executing in ...


5

The basic idea of bitslicing, or SIMD within a register, involves two parts: expressing the cipher in terms of single-bit logical operations (AND, OR, XOR, NOT, etc.), as if you were implementing it in hardware, and carrying out those operations for multiple instances of the cipher in parallel, using bitwise operations on a CPU. That is, in a bitsliced ...


5

I think the flash implementation is wrong: (using Linux, OS X terminal etc.) not true, see below echo 328831e0435a3137f6309807a88da234 | xxd -r -p > plain.dat openssl enc -e -aes-128-ecb -iv 00 -K 2b28ab097eaef7cf15d2154f16a6883c -in plain.dat -out plain.dat.out -nopad yields hd plain.dat.out 00000000 57 16 aa fa ...


5

There are typically four different settings where you want to run your crypto. The Central Processing Unit (CPU). This may be a classic desktop or laptop CPU or the one of your embedded device. Its characteristic is that it usually has rather few computation cores ( < 20), but it can use the ones it has very fast and can execute arbitrary instructions ...


5

I'll assume the question really is: when I perform low-order-bit steganography on an uncompressed image (inserting 6 bits encoding a character into the low-order bit of 6 bytes coding the R, G and B channels of 2 pixels), I find that compressing the resulting image gives a bigger file than compressing the original image for a given setting of the program ...


4

I think that there is no chance of getting such an asymmetric cipher simply because you forgot about science. The security on todays asymmetric cryptography is mostly based on the assumption that some mathematical algorithms cannot be reversed (e.g. the discrete logarithm or integer factorization). If mathematics solves this problems then the algorithm is ...


4

All internal operations of a perfectly standard-conforming AES implementation can be conveniently implemented over bytes, without carry propagation. There's no security flaw implied. The worst that's bound to happen is that for some operations (like XOR with a 128-bit, 16-byte subkey), things must be repeated over several bytes, and a wider word would reduce ...


4

Triple DES is a block cipher. (Specifically, it's a variant of the old DES block cipher with better security, but several times lower performance.) You can use it to encrypt small blocks of data (64 bits = 8 bytes, for Triple DES), but what it's really useful for is as a building block for other cryptographic schemes, such as stream encryption or message ...


4

What you are looking for is a definition of PEM, privacy enhanced mail. Obviously PEM is not just used for mail anymore. The definition of the header lines seems to be best described by section 4.6: "Summary of Encapsulated Header Fields" of RFC 1421: "Privacy Enhancement for Internet Electronic Mail: Part I: Message Encryption and Authentication ...


4

The obvious answer to your question is "yes". The kernel mode implementation pointed to by otus clearly shows that it can be done. That it can be done doesn't mean it gets done however. Many Google searches for sourcecode don't show any OpenSSL code that implements this functionality. In general, OpenSSL doesn't rely on the crypto code of the kernel. So, ...


3

You're right in that there's little chance you can break the logarithm in a well-chosen 512 bit group (using a home computer, in reasonable time — as pointed out by SEJPM, it is possible investing some time and a good amount of money). However, in your case, the parameters are bad: The order of $(\mathbb Z/p\mathbb Z)^\ast$, that is $p-1$, is a smooth ...


3

Formally, what you're really looking for is a key derivation function (KDF). The Crypto++ API includes a PasswordBasedKeyDerivationFunction class, but that doesn't really seem optimal for your purposes; since you already have a high-entropy random seed, what you really want is a simple key-based KDF, not a fancy key-stretching KDF meant for use with ...


3

Q1. Here's an algorithm to test irreducibility of a univariate non-constant monic polynomial over a finite field $\mathbb F_q$. (I learnt this from von zur Gathen and Gerhard's Modern Computer Algebra.) Let $q=p^e$ be a prime power. A generalization of Fermat's little theorem states that for all $d\geq1$, $$ x^{q^d}-x \;=\;\prod \{\,f\in\mathbb ...


3

For what kind of "concrete" application should we implement cryptographic algorithms on FPGA? Which secured application require such a huge data processing performance ? Well, FPGAs are ideal for a wide variety of applications, from high-volume applications to state-of-the-art products. Imagine you are… a bank, or a Big Data service provider, or a ...


3

You can use any library you like, as long as it is has been tested for the specific algorithm. In other words, if $G^x$ is implemented in a specific library you must make sure that there are unit tests and if it is used in a verified algorithm. There are some hints you can take from the library to see if it was programmed well: the code should point to ...


2

Q1: generating a random irreducible binary polynomial Yes, the best known way to generate a random irreducible binary polynomial of a given degree $p$ is to randomly generate a binary polynomial of degree $p$ with an odd number of terms, including $x^p$ and $1$ (perhaps: not a polynomial among those previously considered; this helps if restricting to ...


2

An easier way of explaining it is here: http://www.demoivre.org/courses/CIS628/chapter15.pdf So for a point $(x_0,y_0,z_0)$ we set $x_0$ as the secret and then randomly choose $y_0$ and $z_0\pmod{P}$. Now we generate our plane to distribute to the participants: we pick two random integers $a$ and $b$, then we set $$C = z_0 - ax_0 -by_0 \pmod{P}$$ we now ...


2

Salsa/ChaCha and the other eSTREAM winners are likely to be the "fastest but still secure" options today. Don't forget authentication of course. Reduced-round ChaCha/Poly1305 is likely to be the fastest software-only option, due to tuned implementations in the libsodium and NaCl libraries. UPDATED: The following slide deck has good info on state of the art ...


2

Yes, string algorithms can be vulnerable to timing attacks. A very common example is string comparison. The best performing way to implement it in general is to compare two strings one character (or memory word) at a time and return inequality as soon as they don't match. However, this kind of a routine is vulnerable to timing attacks that can find the ...


2

RFC 2313 specifies the RSAPrivateKey ASN1 structure as a SEQUENCE containing the INTEGERs $0$; $n$; $e$; $d$; $p$; $q$; $d\bmod(p-1)$; $d\bmod(q-1)$; $q^{-1}\bmod p$. The PEM format consists of such a structure encoded as Base64 and framed by the typical BEGIN/END RSA PRIVATE KEY header and footer lines. Thus, you can use any ASN1 library you like to ...



Only top voted, non community-wiki answers of a minimum length are eligible