Questions tagged [implementation]

Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.

Filter by
Sorted by
Tagged with
0 votes
2 answers
118 views

What efficiency can we expect from an average consumer computer for the RSA algorithm?

I am trying to implement the RSA algorithm using the C language, for learning purpose. I was wondering how much time should we expect it to take for encrypting a message of size 1024/2048/4096bits on ...
Wheatley's user avatar
  • 145
3 votes
1 answer
117 views

Problem with efficiency of projective coordinates in Elliptic Curve arithmetic

Ok sort of long post incoming. Will go slow to make it as clear as possible I'm trying to build a C library for Elliptic Curve Arithmetic. Since the idea is to learn from the process, I decided to ...
popeye's user avatar
  • 95
0 votes
2 answers
110 views

Has garbage-collection been used for side-channel attacks?

I'm thinking of cryptographic implementations on garbage-collected (gc) languages/runtimes and that the gc process can be potentially dangerous for an implementation even if the implementation has the ...
tur11ng's user avatar
  • 962
3 votes
0 answers
112 views

How do you securely implement a finite field?

I'm not sure if this question belongs here or to StackOverflow. Please flag it if not. I'm trying to implement a standalone library for finite field arithmetic of prime and prime power order as a way ...
tur11ng's user avatar
  • 962
3 votes
1 answer
629 views

Why is the constant in Montgomery Curve code 121665 instead of 486662 in the formula?

In the Montgomery Curve $y^2=x^3+486662x^2+x$, $A=486662$. So, why when applying its code in Python or another programming language, $A=121665$? ...
Nawras Hussein's user avatar
1 vote
3 answers
129 views

Is an if-else calling same function(s) vulnerable to side channel attacks

If I have a function f(x, y) and g(x, y) and f and g a are constant time, is the following code vulnerable to side channel ...
Rabool's user avatar
  • 13
1 vote
1 answer
63 views

Do you know any library for implementing lattice-based schemes? [closed]

Good afternoon! I'm trying to write a code for a lattice based scheme (based on the SIS problem). I'm looking for a library that may help me in this task without taking care of the implementation of ...
Herbrant's user avatar
1 vote
1 answer
70 views

Radix-2^51 arithmetic of edwards25519

The Golang implementation of edwards25519 (https://tip.golang.org/src/crypto/internal/edwards25519/field/fe.go) uses radix-251 representation. The description in section 3.2 in https://dl.acm.org/doi/...
devi prasad's user avatar
0 votes
1 answer
52 views

Homomorphic Encryption and Conjugation

In the implementation of HEAAN, they have implemented the conjugate function. It computes conjugate of a polynomial. Effectively they have reverted the positions of the coefficients and negated their ...
kindi's user avatar
  • 11
0 votes
1 answer
74 views

Can attackers see the values I pass on to OpenSSL API functions?

Respected community, I am using the OpenSSL API's, especially libcrypto and libssl and I am really depressed, thinking about ...
Aravind A's user avatar
  • 1,010
2 votes
1 answer
126 views

Operands size in RSA Cryptography (C language)

I am trying to implement the RSA cryptography algorithm using C language. I am not sure of the size that each operand should have. Let me explain: RSA requires to generate two huge prime numbers p and ...
Wheatley's user avatar
  • 145
3 votes
0 answers
75 views

Real-world protocols based on pairings such that the number of additions in $\mathbb{G}_1$ is equal to the number of additions in $\mathbb{G}_2$

Consider a pairing-friendly elliptic curve $E$ over a finite field $\mathbb{F}_q$ with embedding degree $k$. Do you know examples of real-world cryptographic protocols based on pairings $\mathbb{G}_1 \...
Dimitri Koshelev's user avatar
2 votes
2 answers
1k views

What is meant by software and hardware implementations of cryptograpic schemes? How to do it?

I have read many cryptographic papers or articles where I have came across about the software and hardware implementation for the cryptographic algorithms. I want to know how its been done. Is there ...
Ganesh's user avatar
  • 21
0 votes
1 answer
89 views

Does ISAAC really guarantee a cycle length of at least 2**40?

I just noticed that the FSE 1996 conference paper which defines ISAAC mentions a counter variable cc. This variable is said to be the reason why ISAAC has a ...
Guenther Brunthaler's user avatar
2 votes
0 answers
61 views

Is ISAAC+ actually an improvement over ISAAC?

I just tried to implement ISAAC from scratch, using the Jean-Philippe Aumasson paper from 2007 as a reference. This paper gives a definition of the original ISAAC algorithm as well as the improved ...
Guenther Brunthaler's user avatar
4 votes
0 answers
97 views

Masking countermeasures for AES-GCM

Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
yoyo's user avatar
  • 391
0 votes
0 answers
27 views

Noise of Public Key Ciphertexts in HElib

I would like to get a feeling on how the noise develops in different FHE schemes. So I ran some experiments using HElib for both BGV and CKKS. I wanted to look at the noise of a fresh public key and a ...
yael's user avatar
  • 1
2 votes
1 answer
86 views

$\epsilon$ parameter choice in lattice-based schemes

I am trying to implement Pei10 and BB13, but I am confused about what concrete parameters to use. In Pei10, Algorithm 1 takes a rounding parameter $r = \omega(\sqrt{\log n})$ as parameter, but it does ...
Gareth Ma's user avatar
  • 350
6 votes
2 answers
353 views

Efficient multiplication modulo a square

Can anyone point me to techniques for efficient computation of modular multiplication/exponentiation modulo a square, as comes up, e.g., in the context of Paillier encryption? The standard references ...
user432944's user avatar
0 votes
0 answers
18 views

Fixed-base exponentation with preprocessing [duplicate]

Is anyone aware of an in-depth study of algorithms using preprocessing to compute fixed-base exponentiations? Assuming I am willing to do arbitrary computation in the preprocessing phase (but not ...
user432944's user avatar
2 votes
1 answer
104 views

Constant-Time Base64 Codec - Necessity and Implementation

As we know, the popular PEM format for textualizing private key binary blobs uses base64 encoding. Typical base64 codecs use look-up tables to find characters and byte values and pack them together, ...
DannyNiu's user avatar
  • 9,080
7 votes
2 answers
787 views

Is it reasonable to re-use a keypair across multiple systems that support the same public key signature system?

This question is relevant for both crypto stack exchange and infosec stack exchange. I thought I'd ask here to get answers from a cryptography perspective. If two systems use the same public key ...
mikemaccana's user avatar
1 vote
1 answer
148 views

modular reduction using solinas prime

I want to perform a modular reduction using Solinas prime value as q = 2^383-2^33+1. How can I efficiently compute it taking advantage of q being Solinas prime?
Ayush's user avatar
  • 11
0 votes
1 answer
41 views

Transform a large integer to Plaintext ERROR in SEAL Library

In SEAL library, I want to multiply a BFV ciphertext ct with an integer inverse. Here are what I do: Compute the integer inverse as follows: ...
Zhu's user avatar
  • 1
1 vote
1 answer
104 views

Which Rust library is recommended if I would like to implement PLONK? [closed]

I think it should have APIs for polynomials, FFT and bilinear mapping if KZG commitment scheme is used.
Walker's user avatar
  • 61
0 votes
1 answer
32 views

How to read libsodium's scalar from integer/bytes or NTL:zz

Hi I am new to lib sodium, may I ask that is it possible to get scalar of ristretto255 from integer/bytes or NTL:zz? Some thing as follows: ...
js wang's user avatar
  • 327
0 votes
1 answer
38 views

implementing pedersen commtiment using lib sodium

Hi I want to implement pedersen commitment ontop of lib sodium Below is what I am trying to do: comm1: m1G+r1H comm2: m2G+r2H comm3: (m1+m2)G+(r1+r2)H comm4: comm1+comm2 and comm3 should equals ...
js wang's user avatar
  • 327
1 vote
0 answers
105 views

Issue with AWS Encryption SDK for JavaScript in Browser: 'Buffer is not defined' [closed]

I'm trying to implement AWS Encryption SDK for JavaScript in a browser environment within a React application. When I attempt to construct an instance of the encryption client using buildClient ...
CreativeDesign's user avatar
2 votes
1 answer
41 views

How is the message considered in the STROBE-based Schnorr signature example?

I've been studying the Schnorr signature scheme and recently came across an example that uses the STROBE protocol. In the classic version of Schnorr signatures, the challenge e is calculated as e = H(...
Paul Yu's user avatar
  • 156
1 vote
1 answer
102 views

Is it fatal if a blockcipher uses a sbox with a fixed point at 0?

In a previous question, I asked how to implement arbitrary s-box in side-channel-free fashion. The code I posted in the question loops over all 256 values of a byte to avoid timing channel, and I want ...
DannyNiu's user avatar
  • 9,080
6 votes
1 answer
819 views

Does the order of validations and MAC with clear text matter?

I have a request in which I get a series of data in clear (nothing encrypted) and a MAC / authentication tag. The question is whether the MAC should be validated first or if the fields are filled in ...
Felipe Rodriguez Fonte's user avatar
3 votes
0 answers
34 views

Data type transformation in Rust library

I am using some ark libraries, such as ark_ff and ark_bls12_381, to implement some cryptographic algorithms. In these algorithms, random oracles are needed, which gets some group elements in G1,G2,Gt ...
Walker's user avatar
  • 61
1 vote
1 answer
140 views

Looking for efficient implementations for Pedersen commitment

Hi I am currently developing a research project, but it seems that my implementation of Pedersen commitment is not efficient. I wonder if there are any efficient implementation of Pedersen ...
js wang's user avatar
  • 327
1 vote
0 answers
63 views

Secure permutation of $E(\mathbb{F}_q)$ as a set for an elliptic curve $E$ over a finite field $\mathbb{F}_q$

Let $E$ be an elliptic curve over a finite field $\mathbb{F}_q$. For simplicity, let the group $E(\mathbb{F}_q)$ be of prime order. Assume that I know how to construct an efficiently computable ...
Dimitri Koshelev's user avatar
1 vote
1 answer
89 views

Are you aware of cryptographic contexts (e.g., post-quantum) in which a square root $\sqrt{\cdot}$ must be computed in constant time?

Let $\mathbb{F}_q$ be a finite field of odd characteristic. I know that a constant-time implementation of the square root extraction $\sqrt{\cdot} \in \mathbb{F}_q$ is used in the context of hashing ...
Dimitri Koshelev's user avatar
3 votes
3 answers
598 views

Reference implementation of Shamir's Secret Sharing

Is there an implementation of Shamir's Secret Sharing that can be regarded as a "canonical" (or "reference" or "standard") implementation, so that I can test other ...
Georg's user avatar
  • 133
2 votes
1 answer
426 views

Help with adding and multiplying points on secp256k1

I'm currently working on implementing digital signatures on the curve secp256k1 (for learning purposes only), and I'm having some trouble implementing ECDSA on curve secp256k1. As I understand it, ...
Pedro's user avatar
  • 41
1 vote
3 answers
162 views

How do certificates add data to public key and how is this implemented into TLS?

I want to create a self signed PKI for a couple servers I am running. I am finding tutorials with copy paste commands from openssl, and hand waving explanations that describe the general purpose of ...
Damian Games's user avatar
5 votes
2 answers
916 views

How do you instantiate a Random Oracle?

I was recently discussing with a friend how to instantiate something that requires a RO (with a potentially long output) in a practical implementation. Specifically, for a Fiat-Shamir transform. The ...
Elias's user avatar
  • 4,903
2 votes
0 answers
126 views

How to implement hash functions $H1 \colon \{0,1\}^* \to \mathbb{Z}_p^*$ and $H2 \colon \mathbb{Z}_p^* \to \{0,1\}^k$?

I would like to implement a hash function $H1 \colon \{0,1\}^* \to \mathbb{Z}_p^*$ such that $p$ is a prime number and second fonction $H2 \colon \mathbb{Z}_p^* \to \{0,1\}^k$ where $k$ is a security ...
shxxlas's user avatar
  • 21
2 votes
2 answers
42 views

Verify that a user submitted data without identifying which data was submitted

I'm not fully sure what the most accurate terms would be to describe what I'm looking for, but here's the gist: Let $u_1, \cdots, u_n$ be the users from a set of users $U$. Users may or may not ...
jdkula's user avatar
  • 21
1 vote
0 answers
37 views

Browser javascript: TLS sequence number authentication

I am implementing TLS (or something like it perhaps) because the browser doesn't seem to provide a direct client-script interface to TLS. The browser provides a ...
personal_cloud's user avatar
1 vote
0 answers
64 views

Good libraries for lattice-crypto [closed]

I'm searching good libraries to manipulate lattice tools to do cryptography. I'm mainly interested by C/C++. But I'm also interested if it is in python.
Ievgeni's user avatar
  • 2,575
1 vote
0 answers
37 views

Make linkable ring signatures shorter?

I need a way to make the signatures shorter, currently with a ring size of 1000 members I get a signature size of 34000 bytes, this is too big for me I need a way to make it smaller. I tried ...
שחר כהן's user avatar
2 votes
2 answers
990 views

What are the performance reasons behind "xor-a-rotated-sum" instead of "add-a-rotated-xor" in Salsa20?

I'm currently reading the specification of Salsa20 (link). DJB on whether he chooses "xor-a-rotated-sum" instead of "add-a-rotated-xor" states the following : Should there be ...
tur11ng's user avatar
  • 962
0 votes
1 answer
74 views

Is gcc's stack canary cryptographically secured? Does stack canary in general has to be cryptographically secured?

I want to ask 2 questions: Is GCC's stack canary cryptographically secured? Does stack canary in general has to be cryptographically secured?
Huỳnh Thái Dương's user avatar
1 vote
0 answers
47 views

Accelerating Syndrome-Trellis Codes (STC) for GPU [closed]

From the literature, STC seems to be the current state-of-the-art for the coding part of steganography. From the description of the method, it appears to me it could be parallelized for GPU. Does ...
Martin Benes's user avatar
0 votes
1 answer
85 views

Faster linkable ring signatures libraries

I need a fast linkable ring signatures library, something that is O(log(n)) and n is the ring size. I read a few papers about these kinds of schemes but I didnt find any implementations of them. Here ...
שחר כהן's user avatar
3 votes
0 answers
144 views

Can reinforcement learning speed up modular multiplication?

In Discovering faster matrix multiplication algorithms with reinforcement learning (Nature, 2022; lightweight intro), the authors used reinforcement learning (an artificial intelligence technique) to ...
fgrieu's user avatar
  • 140k
0 votes
1 answer
115 views

Universal Dynamic Accumulators : all parties know keys p and q. Is the original set needed to validate set membership and non membership?

I read this paper on RSA cryptographic accumulators have some questions on a few points : "Universal Accumulators with Efficient Nonmembership Proofs" https://www.cs.purdue.edu/homes/ninghui/...
Jacob Hoffman's user avatar

1
2 3 4 5
11