# Questions tagged [implementation]

Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.

532 questions
Filter by
Sorted by
Tagged with
1 vote
296 views

### What is meant by software and hardware implementations? How to do it?

I have read many cryptographic papers or articles where I have came across about the software and hardware implementation for the cryptographic algorithms. I want to know how its been done. Is there ...
51 views

### Does ISAAC really guarantee a cycle length of at least 2**40?

I just noticed that the FSE 1996 conference paper which defines ISAAC mentions a counter variable cc. This variable is said to be the reason why ISAAC has a ...
30 views

### Is ISAAC+ actually an improvement over ISAAC?

I just tried to implement ISAAC from scratch, using the Jean-Philippe Aumasson paper from 2007 as a reference. This paper gives a definition of the original ISAAC algorithm as well as the improved ...
71 views

Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
17 views

### Noise of Public Key Ciphertexts in HElib

I would like to get a feeling on how the noise develops in different FHE schemes. So I ran some experiments using HElib for both BGV and CKKS. I wanted to look at the noise of a fresh public key and a ...
68 views

### $\epsilon$ parameter choice in lattice-based schemes

I am trying to implement Pei10 and BB13, but I am confused about what concrete parameters to use. In Pei10, Algorithm 1 takes a rounding parameter $r = \omega(\sqrt{\log n})$ as parameter, but it does ...
335 views

### Efficient multiplication modulo a square

Can anyone point me to techniques for efficient computation of modular multiplication/exponentiation modulo a square, as comes up, e.g., in the context of Paillier encryption? The standard references ...
17 views

### Fixed-base exponentation with preprocessing [duplicate]

Is anyone aware of an in-depth study of algorithms using preprocessing to compute fixed-base exponentiations? Assuming I am willing to do arbitrary computation in the preprocessing phase (but not ...
1 vote
72 views

### Constant-Time Base64 Codec - Necessity and Implementation

As we know, the popular PEM format for textualizing private key binary blobs uses base64 encoding. Typical base64 codecs use look-up tables to find characters and byte values and pack them together, ...
776 views

### Is it reasonable to re-use a keypair across multiple systems that support the same public key signature system?

This question is relevant for both crypto stack exchange and infosec stack exchange. I thought I'd ask here to get answers from a cryptography perspective. If two systems use the same public key ...
1 vote
94 views

### modular reduction using solinas prime

I want to perform a modular reduction using Solinas prime value as q = 2^383-2^33+1. How can I efficiently compute it taking advantage of q being Solinas prime?
26 views

### Transform a large integer to Plaintext ERROR in SEAL Library

In SEAL library, I want to multiply a BFV ciphertext ct with an integer inverse. Here are what I do: Compute the integer inverse as follows: ...
1 vote
61 views

### Which Rust library is recommended if I would like to implement PLONK? [closed]

I think it should have APIs for polynomials, FFT and bilinear mapping if KZG commitment scheme is used.
13 views

### How to read libsodium's scalar from integer/bytes or NTL:zz

Hi I am new to lib sodium, may I ask that is it possible to get scalar of ristretto255 from integer/bytes or NTL:zz? Some thing as follows: ...
33 views

### implementing pedersen commtiment using lib sodium

Hi I want to implement pedersen commitment ontop of lib sodium Below is what I am trying to do: comm1: m1G+r1H comm2: m2G+r2H comm3: (m1+m2)G+(r1+r2)H comm4: comm1+comm2 and comm3 should equals ...
1 vote
55 views

### Issue with AWS Encryption SDK for JavaScript in Browser: 'Buffer is not defined' [closed]

I'm trying to implement AWS Encryption SDK for JavaScript in a browser environment within a React application. When I attempt to construct an instance of the encryption client using buildClient ...
36 views

### How is the message considered in the STROBE-based Schnorr signature example?

I've been studying the Schnorr signature scheme and recently came across an example that uses the STROBE protocol. In the classic version of Schnorr signatures, the challenge e is calculated as e = H(...
1 vote
79 views

### Is it fatal if a blockcipher uses a sbox with a fixed point at 0?

In a previous question, I asked how to implement arbitrary s-box in side-channel-free fashion. The code I posted in the question loops over all 256 values of a byte to avoid timing channel, and I want ...
817 views

### Does the order of validations and MAC with clear text matter?

I have a request in which I get a series of data in clear (nothing encrypted) and a MAC / authentication tag. The question is whether the MAC should be validated first or if the fields are filled in ...
31 views

### Data type transformation in Rust library

I am using some ark libraries, such as ark_ff and ark_bls12_381, to implement some cryptographic algorithms. In these algorithms, random oracles are needed, which gets some group elements in G1,G2,Gt ...
1 vote
99 views

### Looking for efficient implementations for Pedersen commitment

Hi I am currently developing a research project, but it seems that my implementation of Pedersen commitment is not efficient. I wonder if there are any efficient implementation of Pedersen ...
1 vote
60 views

### Secure permutation of $E(\mathbb{F}_q)$ as a set for an elliptic curve $E$ over a finite field $\mathbb{F}_q$

Let $E$ be an elliptic curve over a finite field $\mathbb{F}_q$. For simplicity, let the group $E(\mathbb{F}_q)$ be of prime order. Assume that I know how to construct an efficiently computable ...
1 vote
85 views

### Are you aware of cryptographic contexts (e.g., post-quantum) in which a square root $\sqrt{\cdot}$ must be computed in constant time?

Let $\mathbb{F}_q$ be a finite field of odd characteristic. I know that a constant-time implementation of the square root extraction $\sqrt{\cdot} \in \mathbb{F}_q$ is used in the context of hashing ...
502 views

### Reference implementation of Shamir's Secret Sharing

Is there an implementation of Shamir's Secret Sharing that can be regarded as a "canonical" (or "reference" or "standard") implementation, so that I can test other ...
239 views

### Help with adding and multiplying points on secp256k1

I'm currently working on implementing digital signatures on the curve secp256k1 (for learning purposes only), and I'm having some trouble implementing ECDSA on curve secp256k1. As I understand it, ...
1 vote
93 views

### How do certificates add data to public key and how is this implemented into TLS?

I want to create a self signed PKI for a couple servers I am running. I am finding tutorials with copy paste commands from openssl, and hand waving explanations that describe the general purpose of ...
856 views

### How do you instantiate a Random Oracle?

I was recently discussing with a friend how to instantiate something that requires a RO (with a potentially long output) in a practical implementation. Specifically, for a Fiat-Shamir transform. The ...
118 views

### How to implement hash functions $H1 \colon \{0,1\}^* \to \mathbb{Z}_p^*$ and $H2 \colon \mathbb{Z}_p^* \to \{0,1\}^k$?

I would like to implement a hash function $H1 \colon \{0,1\}^* \to \mathbb{Z}_p^*$ such that $p$ is a prime number and second fonction $H2 \colon \mathbb{Z}_p^* \to \{0,1\}^k$ where $k$ is a security ...
41 views

### Verify that a user submitted data without identifying which data was submitted

I'm not fully sure what the most accurate terms would be to describe what I'm looking for, but here's the gist: Let $u_1, \cdots, u_n$ be the users from a set of users $U$. Users may or may not ...
1 vote
31 views

### Browser javascript: TLS sequence number authentication

I am implementing TLS (or something like it perhaps) because the browser doesn't seem to provide a direct client-script interface to TLS. The browser provides a ...
1 vote
62 views

### Good libraries for lattice-crypto [closed]

I'm searching good libraries to manipulate lattice tools to do cryptography. I'm mainly interested by C/C++. But I'm also interested if it is in python.
1 vote
35 views

### Make linkable ring signatures shorter?

I need a way to make the signatures shorter, currently with a ring size of 1000 members I get a signature size of 34000 bytes, this is too big for me I need a way to make it smaller. I tried ...
951 views

### What are the performance reasons behind "xor-a-rotated-sum" instead of "add-a-rotated-xor" in Salsa20?

I'm currently reading the specification of Salsa20 (link). DJB on whether he chooses "xor-a-rotated-sum" instead of "add-a-rotated-xor" states the following : Should there be ...
67 views

### Is gcc's stack canary cryptographically secured? Does stack canary in general has to be cryptographically secured?

I want to ask 2 questions: Is GCC's stack canary cryptographically secured? Does stack canary in general has to be cryptographically secured?
1 vote
42 views

### Accelerating Syndrome-Trellis Codes (STC) for GPU [closed]

From the literature, STC seems to be the current state-of-the-art for the coding part of steganography. From the description of the method, it appears to me it could be parallelized for GPU. Does ...
65 views

### Faster linkable ring signatures libraries

I need a fast linkable ring signatures library, something that is O(log(n)) and n is the ring size. I read a few papers about these kinds of schemes but I didnt find any implementations of them. Here ...
126 views

### Can reinforcement learning speed up modular multiplication?

In Discovering faster matrix multiplication algorithms with reinforcement learning (Nature, 2022; lightweight intro), the authors used reinforcement learning (an artificial intelligence technique) to ...
88 views

### Universal Dynamic Accumulators : all parties know keys p and q. Is the original set needed to validate set membership and non membership?

I read this paper on RSA cryptographic accumulators have some questions on a few points : "Universal Accumulators with Efficient Nonmembership Proofs" https://www.cs.purdue.edu/homes/ninghui/...
58 views

### How to read clock cycle from latency tables?

I see many papers that compare the latency of the signature schemes in terms of clock cycles by two-three numbers. I don't know why they write 2-3 numbers instead of one number to represent clock ...
78 views

### API design that maximizes the potential of parallel and tree hashing

Traditionally, hash functions are single-threaded, and have the 'Init-Update-Final' API style. This is true of MD5, SHA-1/2/3, BLAKE2, to name a few. However, there have been proposal of parallel hash ...
124 views

### How do we calculate a power with a gigantic exponent?

In RSA, signing the hash of a message is doing the operation $h^{d} \bmod N$ where $d$ is the private key. Given that the size of $d$ is usually 2048 bits and $h$ is a quite big number, the ...
270 views

### Do we want to allow/Have we allowed parallelization (e.g GPU programming) to enter the cryptographic field? What are the consequences?

With the term GPU programming, I'm referring to highly parallelizable computing in general. Lastly, I have built a bit of a background in cryptography. So I have started to wonder if/where GPU ...
1 vote
163 views

### Minimal, secure and reasonably efficient P384 implementations

For a project I'm working on, I need to implement ECDSA over the NIST P-384 curve (AKA secp384r1). For what it's worth, the choice of curve is beyond my control in ...
74 views

### Is this half-smart way of verifying EdDSA signature secure?

In the final step of verifying an EdDSA signature, 4[S]B is compared to R + [k]A. Because I'm using the XYTZ - extended ...
48 views

### Straightforward modular arithmetic for power-of-two moduli [closed]

Why if $q$ is a power-of-two integer, then doing arithmetic modulo $q$ (addition and multiplication) is very efficient and straightforward?
1k views

### Are there prime numbers that are easy to modulo within 40 bits to 60 bits?

I want to implement LWE-based encryption scheme, the modulo $q$ could be decomposed as $q = q_0\cdot q_1\cdots q_k$ according to CRT. I guess the modular arithmetic by $q_i$ is key operation, so I ...
120 views

### What is the most viable and common hardware for public key cryptography implementation?

I am an FPGA engineer and my last experiences were related to digital communication implementation. I am about to start an experience for the cryptography market. In digital radio communication, FPGA ...
2k views

### Generating and validating a signature with ED25519 expanded private key

I am building a encrypted messaging app over tor network and currently I'm struggling on using tor generated ed25519 private key to sign and verify any message. Below piece of code works with a 32 ...
I was reading this paper on RC6 and formally, the algorithm is defined for an arbitrary word size $w$, even though only $w=32$ was considered for the AES submission. Now the paper explicitly mentions ...