# Tag Info

14

The book Cryptography Engineering devotes part of a chapter to this topic. Overwriting sensitive data with zeroes is a good start, but there are lots of other considerations. If you rely on a language's default object destruction behavior to zero the memory, it's possible for an unexpected error to prematurely halt the program's execution without it ...

7

For your application: "I need the (underpowered 8-bit) slave to be able to tell if a command issued is really trustable", RSA signature with low public exponent ($e=3$), or Rabin (an analog with $e=2$), is likely the most appropriate, assuming you can't trust the slaves to keep a key secret, which is the only realistic assumption unless that slave uses ...

7

Rather risk vulnerabilities of third party library than implement your own. If you feel novice on this field, only implement cryptography yourself as an learning exercise. Why: Mistakes, lack of know-how and maintenance. It is very easy to make novice mistakes in custom implementation of cryptography. Even battle scarred veterans of the field do mistakes ...

6

It's generally strongly recommended you use an existing library for your crypto, instead of trying to reimplement it. One big advantage of a widely used existing library is that it's been improved over time to deal with new threats. You may be aware of timing attacks as a current weakness, but these libraries have already solved those problems and many ...

6

The two last equations don't directly give you the value of $C_i$, they are telling you the values of the remainder of Ci when divided by $P$ and $Q$. You then use the Chinese Remainder Theorem with this information to produce the value of $C_i$ (modulo $N$) that you are looking for. See en.wikipedia.org/wiki/Chinese_remainder_theorem (there is an algorithm ...

5

The question is subjective in nature, and this comment is also subjective. It was too long to leave as an actual comment so I'm posting it as an answer, although it isn't really an answer, it's a comment. This is for posterity, I guess -- this thread is already high in Google searches. NaCl is probably the most widely respected library. It's authored by ...

5

Actually, the fundamental mathematical operation is not \begin{align} \mathbb{N} &\to \mathbb{N} \\ m &\mapsto (m^e) \bmod n & \text{(elevate to the power of $$e$$, divide by $$n$$ and take the remainder)} \\ \end{align} but  \begin{align} \mathbb{Z}/n\mathbb{Z} &\to \mathbb{Z}/n\mathbb{Z} \\ m &\mapsto (m^e) \bmod n & ...

4

Almost all other languages can call C code, so using C is a safe bet. Serpent, Twofish, Threefish and scrypt all provide C implementations. (See the links.) Some even provide optimized code. Writing objC or C++ wrappers seems unnecessary since both can call C funtions. The sleep(3) library function is part of POSIX. So you'll find it on linux, mac, *BSD but ...

4

From a quick read, there are a couple of potential issues. decrypt_128_256 is iterating rounds in the same order as in encrypt_128_256, so the round keys are being applied in the wrong order on decrypt. decrypt_128_256 needs to iterate through the round keys starting from the last round and working backwards. 68 rounds are being used for Speck128/256 ...

4

The answer is: Why do the encrypted files always start with "Salted__" ("U2FsdGVkX1" in base64)? Isn't giving away information like this insecure? The encrypted files must always start with "Salted_" to interoperate with OpenSSL. OpenSSL expects this. The 8 bytes that spell "Salted_" are always immediately followed by another random 8 bytes of salt. ...

4

I did something similar last year with SHA-3 finalists. I can tell you from personal experience that the best course of action is to find the C/C++ reference implementations and port them to CUDA. Start naively by writing a kernel that does the entire operation in one GPU thread. Once you have it working, you can optimize for the hardware.

4

If you take a close look at line 105 of the C++ implementation, you see that it subtracts delta from the sum instead of adding it: 103 for (int32_t i = 32; --i >= 0;) { 104 v0 += ((v1 << 4 ^ v1 >> 5) + v1) ^ (sum + k[sum & 3]); 105 sum -= delta; 106 v1 += ((v0 << 4 ...

4

The risks are much higher that there will be mistakes in a novice (or even advanced) implementation. Look at the history of OpenSSL. It was long thought secure, until someone discovered a timing side channel attack. How would you know your code is secure against all the vulnerabilities you don't know about?

4

To clarify a misconception in your question: It is not true that $e$ is chosen large to make RSA more difficult to crack. Often $e$ is chosen from $\{3,5,17,257,65537\}$. This has computational advances with regard to square and multiply algorithms as mentioned by Gilles. The choice of $e$ has no influence in the security of RSA primitive (as long as ...

4

Well, if $g$ is a generator of $\bmod\ p$ for prime $p$; that is, if all values in the range $[1, p-1]$ are possible values for $g^i \bmod p$, then we have $g^a \neq 1 \bmod p$ for any $a = (p-1)/r$ where $r$ is a prime factor of $p-1$. You select $p$ to be a "safe prime", that is $p-1 = 2 \times q$ where $q$ is also a prime. This implies that, in this ...

3

The size of the padding could be made public, if you don't mind leaking some additional information about the plaintext size. Using a hash as padding bytes however does not make sense; you can not use the hash as authentication tag or to check the integrity, so the hash calculation becomes spurious. It may even leak data through a side channel. In the best ...

3

For AES CBC i would suggest you stick to the standards. The PKCS7 padding scheme is pretty easy to implement and has been tested extensively now that its been out in the public for a while. I had implemented PKCS7 padding for my AES CBC cipher a few weeks ago and you can see the code here if it helps. Note that hashing by itself does not provide you with ...

3

To perform an Ed25519 signature operation, you need to know three values, denoted by $\sf RH$, $a$ and $A$ in the diagram. Now, as it happens, these values are not independent: $A$ can be derived from $a$, and both $\sf RH$ and $a$ can be derived from the seed $k$. Thus, all you really need to store is the seed $k$; everything else can be derived from ...

3

The multiplication operation is indeed not uniquely reversible given just the output. But we also have one of the inputs, namely, the subkey. We can use that to reverse the multiplication. Decryption for IDEA requires changing the subkeys in the key schedule. I didn't find a good description of IDEA online, so I went back to Applied Cryptography, 2nd ...

3

An implementation should generate the IV from any cryptographically secure PRNG. TLS 1.1 further details the possible ways to do that: The IV can be obtained from a PRNG. A random string $r$ can be generated from a PRNG, and added to the plaintext to encrypt where the IV should go; then the whole lot is encrypted with either a fixed IV, or even the last ...

3

The RELIC library has support for binary fields. Check the functions fb_inv_exgcd for inversion and fb_mul_lodah (which calls fb_muln_low and fb_rdcn_low) for multiplication. There is even a ATMega128 backend written in assembly, though it does not support 128-bit fields (but should give you a head start if you need to write it). You will need to make a few ...

3

When I learned about SRP we were told it wasn't seeing much deployment due to possibly infringing on EKE patents. Network Computing had this to say in 2002: Standards groups have made several attempts to induce Lucent to talk about its EKE patent -- to no avail. Even with Lucent's silence on the topic, few vendors have been willing to use SRP. To further ...

3

See section D.2.2 of FIPS 186-3. The modular reduction can be expressed as two additions and two subtractions of values which are assembled by concatenating selected 32-bit words of the 448-bit value which is to be reduced. Note that these additions and subtractions are modular, so you may have to mind some carries.

3

That sort of thing is known as multi-party computation, and you should use a Socialist Millionaire Protocol for your particular instance.

3

To answer your questions in order: You won't find test vectors for the s-boxes in the submission - the s-box functions are implementation specific optimisations, especially the bit-sliced s-box functions like the Osvik and Gladman/Simpson, which actually compute multiple s-box lookups in parallel. If you need to test your s-box implementations, I would ...

3

0x61C88647 is the 2's complement representation of -0x9E3779B9. You can implement XTEA as: void XTEA_Encrypt(uint32_t v[2], uint32_t const key[4]) { unsigned int i; uint32_t v0=v[0], v1=v[1], sum=0, delta=0x9E3779B9; for (i=0; i < 32; i++) { v0 += (((v1 << 4) ^ (v1 >> 5)) + v1) ^ (sum + key[sum & 3]); sum ...

3

You don't need fully homomorphic encryption for this. In particular, you don't need to use Gentry's scheme. Any standard scheme for additively homomorphic encryption will be fine. For instance, Paillier should work fine, as should exponential El Gamal. Search this site and you can find lots of information on additively homomorphic encryption. See, ...

3

You could, however the one part that doesn't translate in an obvious manner is the Galois field representation; you would need to pick a field representation for $GF(2^{256})$ and $GF(2^{512})$, because those have not be predefined for those sizes. Here's the issue; GCM does field multiplications internally; that is, it takes two $N$-bit vectors (where $N$ ...

2

The formula you are looking for is Lagrange Basis Polynomials. Essentially, each share consists of two values, an x coordinate and an y coordinate. The x coordinate might, depending on your specific needs, be implicitly determined by context, such as a preexisting identifier for the entity holding the share. The only requirement is that it is non-zero and ...

2

Have you considered using symmetric key crypto (MAC) instead ? Elliptic Curve Crypto or even regular (but costly) modular arithmetic might be overkill in your case. As I understand it you would be able to precharge MAC keys into your master and slaves before deployment and you would be set. You can even generate a different key for each so that the ...

Only top voted, non community-wiki answers of a minimum length are eligible