Skip to main content

Questions tagged [implementation]

Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.

Filter by
Sorted by
Tagged with
0 votes
1 answer
83 views

Question about error-Correction Code on Paper titled 'A New Public-Key Cryptosystem via Mersenne Number"

I've been implementing a cryptosystem outlined here, which relies on Mersenne Numbers, as part of my coursework in a Cryptography class. In this cryptosystem, both encryption and decryption require ...
Nuno Marques's user avatar
3 votes
0 answers
62 views

improved impossible differential crpytanalysis of 6-round rijndael

I'm studying the paper: "Improved Impossible Differential Cryptanalysis of Rijndael and Crypton". I've got two questions: Please explain the calculation performed for step 5? Step 4 ...
can balıkçı's user avatar
1 vote
0 answers
67 views

Kyber implementation possible overflow in the NTT subroutine?

I took a look at the code from Kyber, which I would like to quote here: ...
P_Gate's user avatar
  • 413
2 votes
0 answers
66 views

Matrix-vector multiplication in Kyber implementation

I took a look at the implementation of Kyber, which can be found in this GitRepo. I made a small discovery in the indcpa.c in the function indcpa_keypair, starting ...
TreeBook1's user avatar
  • 117
2 votes
1 answer
78 views

Kyber - Compression and Decompression Implementation Example

I have a question about the implementation of the functions $$Compress_q(x,d) = \left\lfloor (2^d/q)\cdot x\right\rceil mod^{+}2^d$$ and $$Decompress_q(x,d) = \left\lfloor (q/2^d)\cdot x\right\rceil$$ ...
TreeBook1's user avatar
  • 117
0 votes
2 answers
125 views

What efficiency can we expect from an average consumer computer for the RSA algorithm?

I am trying to implement the RSA algorithm using the C language, for learning purpose. I was wondering how much time should we expect it to take for encrypting a message of size 1024/2048/4096bits on ...
Wheatley's user avatar
  • 147
3 votes
1 answer
169 views

Problem with efficiency of projective coordinates in Elliptic Curve arithmetic

Ok sort of long post incoming. Will go slow to make it as clear as possible I'm trying to build a C library for Elliptic Curve Arithmetic. Since the idea is to learn from the process, I decided to ...
popeye's user avatar
  • 95
0 votes
2 answers
119 views

Has garbage-collection been used for side-channel attacks?

I'm thinking of cryptographic implementations on garbage-collected (gc) languages/runtimes and that the gc process can be potentially dangerous for an implementation even if the implementation has the ...
tur11ng's user avatar
  • 962
3 votes
0 answers
118 views

How do you securely implement a finite field?

I'm not sure if this question belongs here or to StackOverflow. Please flag it if not. I'm trying to implement a standalone library for finite field arithmetic of prime and prime power order as a way ...
tur11ng's user avatar
  • 962
3 votes
1 answer
639 views

Why is the constant in Montgomery Curve code 121665 instead of 486662 in the formula?

In the Montgomery Curve $y^2=x^3+486662x^2+x$, $A=486662$. So, why when applying its code in Python or another programming language, $A=121665$? ...
Nawras Hussein's user avatar
1 vote
3 answers
130 views

Is an if-else calling same function(s) vulnerable to side channel attacks

If I have a function f(x, y) and g(x, y) and f and g a are constant time, is the following code vulnerable to side channel ...
Rabool's user avatar
  • 13
1 vote
1 answer
79 views

Do you know any library for implementing lattice-based schemes? [closed]

Good afternoon! I'm trying to write a code for a lattice based scheme (based on the SIS problem). I'm looking for a library that may help me in this task without taking care of the implementation of ...
Herbrant's user avatar
1 vote
1 answer
74 views

Radix-2^51 arithmetic of edwards25519

The Golang implementation of edwards25519 (https://tip.golang.org/src/crypto/internal/edwards25519/field/fe.go) uses radix-251 representation. The description in section 3.2 in https://dl.acm.org/doi/...
devi prasad's user avatar
0 votes
1 answer
64 views

Homomorphic Encryption and Conjugation

In the implementation of HEAAN, they have implemented the conjugate function. It computes conjugate of a polynomial. Effectively they have reverted the positions of the coefficients and negated their ...
kindi's user avatar
  • 11
0 votes
1 answer
90 views

Can attackers see the values I pass on to OpenSSL API functions?

Respected community, I am using the OpenSSL API's, especially libcrypto and libssl and I am really depressed, thinking about ...
Aravind A's user avatar
  • 1,030
2 votes
1 answer
138 views

Operands size in RSA Cryptography (C language)

I am trying to implement the RSA cryptography algorithm using C language. I am not sure of the size that each operand should have. Let me explain: RSA requires to generate two huge prime numbers p and ...
Wheatley's user avatar
  • 147
3 votes
0 answers
76 views

Real-world protocols based on pairings such that the number of additions in $\mathbb{G}_1$ is equal to the number of additions in $\mathbb{G}_2$

Consider a pairing-friendly elliptic curve $E$ over a finite field $\mathbb{F}_q$ with embedding degree $k$. Do you know examples of real-world cryptographic protocols based on pairings $\mathbb{G}_1 \...
Dimitri Koshelev's user avatar
2 votes
2 answers
1k views

What is meant by software and hardware implementations of cryptograpic schemes? How to do it?

I have read many cryptographic papers or articles where I have came across about the software and hardware implementation for the cryptographic algorithms. I want to know how its been done. Is there ...
Ganesh's user avatar
  • 21
0 votes
1 answer
93 views

Does ISAAC really guarantee a cycle length of at least 2**40?

I just noticed that the FSE 1996 conference paper which defines ISAAC mentions a counter variable cc. This variable is said to be the reason why ISAAC has a ...
Guenther Brunthaler's user avatar
2 votes
0 answers
69 views

Is ISAAC+ actually an improvement over ISAAC?

I just tried to implement ISAAC from scratch, using the Jean-Philippe Aumasson paper from 2007 as a reference. This paper gives a definition of the original ISAAC algorithm as well as the improved ...
Guenther Brunthaler's user avatar
4 votes
0 answers
133 views

Masking countermeasures for AES-GCM

Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
yoyo's user avatar
  • 420
0 votes
0 answers
33 views

Noise of Public Key Ciphertexts in HElib

I would like to get a feeling on how the noise develops in different FHE schemes. So I ran some experiments using HElib for both BGV and CKKS. I wanted to look at the noise of a fresh public key and a ...
yael's user avatar
  • 1
2 votes
1 answer
89 views

$\epsilon$ parameter choice in lattice-based schemes

I am trying to implement Pei10 and BB13, but I am confused about what concrete parameters to use. In Pei10, Algorithm 1 takes a rounding parameter $r = \omega(\sqrt{\log n})$ as parameter, but it does ...
Gareth Ma's user avatar
  • 350
6 votes
2 answers
360 views

Efficient multiplication modulo a square

Can anyone point me to techniques for efficient computation of modular multiplication/exponentiation modulo a square, as comes up, e.g., in the context of Paillier encryption? The standard references ...
user432944's user avatar
0 votes
0 answers
18 views

Fixed-base exponentation with preprocessing [duplicate]

Is anyone aware of an in-depth study of algorithms using preprocessing to compute fixed-base exponentiations? Assuming I am willing to do arbitrary computation in the preprocessing phase (but not ...
user432944's user avatar
2 votes
1 answer
124 views

Constant-Time Base64 Codec - Necessity and Implementation

As we know, the popular PEM format for textualizing private key binary blobs uses base64 encoding. Typical base64 codecs use look-up tables to find characters and byte values and pack them together, ...
DannyNiu's user avatar
  • 9,422
7 votes
2 answers
791 views

Is it reasonable to re-use a keypair across multiple systems that support the same public key signature system?

This question is relevant for both crypto stack exchange and infosec stack exchange. I thought I'd ask here to get answers from a cryptography perspective. If two systems use the same public key ...
mikemaccana's user avatar
1 vote
1 answer
183 views

modular reduction using solinas prime

I want to perform a modular reduction using Solinas prime value as q = 2^383-2^33+1. How can I efficiently compute it taking advantage of q being Solinas prime?
Ayush's user avatar
  • 11
0 votes
1 answer
52 views

Transform a large integer to Plaintext ERROR in SEAL Library

In SEAL library, I want to multiply a BFV ciphertext ct with an integer inverse. Here are what I do: Compute the integer inverse as follows: ...
Zhu's user avatar
  • 1
1 vote
1 answer
135 views

Which Rust library is recommended if I would like to implement PLONK? [closed]

I think it should have APIs for polynomials, FFT and bilinear mapping if KZG commitment scheme is used.
Walker's user avatar
  • 61
0 votes
1 answer
43 views

How to read libsodium's scalar from integer/bytes or NTL:zz [closed]

Hi I am new to lib sodium, may I ask that is it possible to get scalar of ristretto255 from integer/bytes or NTL:zz? Some thing as follows: ...
js wang's user avatar
  • 327
0 votes
1 answer
46 views

implementing pedersen commtiment using lib sodium

Hi I want to implement pedersen commitment ontop of lib sodium Below is what I am trying to do: comm1: m1G+r1H comm2: m2G+r2H comm3: (m1+m2)G+(r1+r2)H comm4: comm1+comm2 and comm3 should equals ...
js wang's user avatar
  • 327
1 vote
0 answers
147 views

Issue with AWS Encryption SDK for JavaScript in Browser: 'Buffer is not defined' [closed]

I'm trying to implement AWS Encryption SDK for JavaScript in a browser environment within a React application. When I attempt to construct an instance of the encryption client using buildClient ...
CreativeDesign's user avatar
2 votes
1 answer
43 views

How is the message considered in the STROBE-based Schnorr signature example?

I've been studying the Schnorr signature scheme and recently came across an example that uses the STROBE protocol. In the classic version of Schnorr signatures, the challenge e is calculated as e = H(...
Paul Yu's user avatar
  • 156
1 vote
1 answer
115 views

Is it fatal if a blockcipher uses a sbox with a fixed point at 0?

In a previous question, I asked how to implement arbitrary s-box in side-channel-free fashion. The code I posted in the question loops over all 256 values of a byte to avoid timing channel, and I want ...
DannyNiu's user avatar
  • 9,422
6 votes
1 answer
820 views

Does the order of validations and MAC with clear text matter?

I have a request in which I get a series of data in clear (nothing encrypted) and a MAC / authentication tag. The question is whether the MAC should be validated first or if the fields are filled in ...
Felipe Rodriguez Fonte's user avatar
3 votes
0 answers
35 views

Data type transformation in Rust library

I am using some ark libraries, such as ark_ff and ark_bls12_381, to implement some cryptographic algorithms. In these algorithms, random oracles are needed, which gets some group elements in G1,G2,Gt ...
Walker's user avatar
  • 61
1 vote
1 answer
183 views

Looking for efficient implementations for Pedersen commitment

Hi I am currently developing a research project, but it seems that my implementation of Pedersen commitment is not efficient. I wonder if there are any efficient implementation of Pedersen ...
js wang's user avatar
  • 327
1 vote
0 answers
63 views

Secure permutation of $E(\mathbb{F}_q)$ as a set for an elliptic curve $E$ over a finite field $\mathbb{F}_q$

Let $E$ be an elliptic curve over a finite field $\mathbb{F}_q$. For simplicity, let the group $E(\mathbb{F}_q)$ be of prime order. Assume that I know how to construct an efficiently computable ...
Dimitri Koshelev's user avatar
1 vote
1 answer
95 views

Are you aware of cryptographic contexts (e.g., post-quantum) in which a square root $\sqrt{\cdot}$ must be computed in constant time?

Let $\mathbb{F}_q$ be a finite field of odd characteristic. I know that a constant-time implementation of the square root extraction $\sqrt{\cdot} \in \mathbb{F}_q$ is used in the context of hashing ...
Dimitri Koshelev's user avatar
3 votes
3 answers
735 views

Reference implementation of Shamir's Secret Sharing

Is there an implementation of Shamir's Secret Sharing that can be regarded as a "canonical" (or "reference" or "standard") implementation, so that I can test other ...
Georg's user avatar
  • 133
2 votes
1 answer
616 views

Help with adding and multiplying points on secp256k1

I'm currently working on implementing digital signatures on the curve secp256k1 (for learning purposes only), and I'm having some trouble implementing ECDSA on curve secp256k1. As I understand it, ...
Pedro's user avatar
  • 41
1 vote
3 answers
189 views

How do certificates add data to public key and how is this implemented into TLS?

I want to create a self signed PKI for a couple servers I am running. I am finding tutorials with copy paste commands from openssl, and hand waving explanations that describe the general purpose of ...
Damian Games's user avatar
6 votes
2 answers
971 views

How do you instantiate a Random Oracle?

I was recently discussing with a friend how to instantiate something that requires a RO (with a potentially long output) in a practical implementation. Specifically, for a Fiat-Shamir transform. The ...
Elias's user avatar
  • 4,923
2 votes
0 answers
131 views

How to implement hash functions $H1 \colon \{0,1\}^* \to \mathbb{Z}_p^*$ and $H2 \colon \mathbb{Z}_p^* \to \{0,1\}^k$?

I would like to implement a hash function $H1 \colon \{0,1\}^* \to \mathbb{Z}_p^*$ such that $p$ is a prime number and second fonction $H2 \colon \mathbb{Z}_p^* \to \{0,1\}^k$ where $k$ is a security ...
shxxlas's user avatar
  • 21
2 votes
2 answers
42 views

Verify that a user submitted data without identifying which data was submitted

I'm not fully sure what the most accurate terms would be to describe what I'm looking for, but here's the gist: Let $u_1, \cdots, u_n$ be the users from a set of users $U$. Users may or may not ...
jdkula's user avatar
  • 21
1 vote
0 answers
39 views

Browser javascript: TLS sequence number authentication

I am implementing TLS (or something like it perhaps) because the browser doesn't seem to provide a direct client-script interface to TLS. The browser provides a ...
personal_cloud's user avatar
1 vote
0 answers
65 views

Good libraries for lattice-crypto [closed]

I'm searching good libraries to manipulate lattice tools to do cryptography. I'm mainly interested by C/C++. But I'm also interested if it is in python.
Ievgeni's user avatar
  • 2,615
1 vote
0 answers
37 views

Make linkable ring signatures shorter?

I need a way to make the signatures shorter, currently with a ring size of 1000 members I get a signature size of 34000 bytes, this is too big for me I need a way to make it smaller. I tried ...
שחר כהן's user avatar
2 votes
2 answers
1k views

What are the performance reasons behind "xor-a-rotated-sum" instead of "add-a-rotated-xor" in Salsa20?

I'm currently reading the specification of Salsa20 (link). DJB on whether he chooses "xor-a-rotated-sum" instead of "add-a-rotated-xor" states the following : Should there be ...
tur11ng's user avatar
  • 962

1
2 3 4 5
11