Questions tagged [implementation]
Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.
532
questions
1
vote
1
answer
296
views
What is meant by software and hardware implementations? How to do it?
I have read many cryptographic papers or articles where I have came across about the software and hardware implementation for the cryptographic algorithms. I want to know how its been done. Is there ...
- 11
0
votes
0
answers
51
views
Does ISAAC really guarantee a cycle length of at least 2**40?
I just noticed that the FSE 1996 conference paper which defines ISAAC mentions a counter variable cc.
This variable is said to be the reason why ISAAC has a ...
2
votes
0
answers
30
views
Is ISAAC+ actually an improvement over ISAAC?
I just tried to implement ISAAC from scratch, using the Jean-Philippe Aumasson paper from 2007 as a reference.
This paper gives a definition of the original ISAAC algorithm as well as the improved ...
4
votes
0
answers
71
views
Masking countermeasures for AES-GCM
Suppose I have a masked AES encryption $AES(\oplus_i K_i, \oplus_i P_i)=\oplus_i C_i$, i.e. the key, plaintext, and resulting ciphertext are tuples $K_i$, $P_i$, and $C_i$ that sum to $K$, $P$, and $C$...
- 327
0
votes
0
answers
17
views
Noise of Public Key Ciphertexts in HElib
I would like to get a feeling on how the noise develops in different FHE schemes. So I ran some experiments using HElib for both BGV and CKKS. I wanted to look at the noise of a fresh public key and a ...
- 1
2
votes
1
answer
68
views
$\epsilon$ parameter choice in lattice-based schemes
I am trying to implement Pei10 and BB13, but I am confused about what concrete parameters to use.
In Pei10, Algorithm 1 takes a rounding parameter $r = \omega(\sqrt{\log n})$ as parameter, but it does ...
- 340
6
votes
2
answers
335
views
Efficient multiplication modulo a square
Can anyone point me to techniques for efficient computation of modular multiplication/exponentiation modulo a square, as comes up, e.g., in the context of Paillier encryption? The standard references ...
- 270
0
votes
0
answers
17
views
Fixed-base exponentation with preprocessing [duplicate]
Is anyone aware of an in-depth study of algorithms using preprocessing to compute fixed-base exponentiations? Assuming I am willing to do arbitrary computation in the preprocessing phase (but not ...
- 270
1
vote
1
answer
72
views
Constant-Time Base64 Codec - Necessity and Implementation
As we know, the popular PEM format for textualizing private key binary blobs uses base64 encoding. Typical base64 codecs use look-up tables to find characters and byte values and pack them together, ...
- 8,648
7
votes
2
answers
776
views
Is it reasonable to re-use a keypair across multiple systems that support the same public key signature system?
This question is relevant for both crypto stack exchange and infosec stack exchange. I thought I'd ask here to get answers from a cryptography perspective.
If two systems use the same public key ...
- 497
1
vote
1
answer
94
views
modular reduction using solinas prime
I want to perform a modular reduction using Solinas prime value as q = 2^383-2^33+1. How can I efficiently compute it taking advantage of q being Solinas prime?
- 11
0
votes
1
answer
26
views
Transform a large integer to Plaintext ERROR in SEAL Library
In SEAL library, I want to multiply a BFV ciphertext ct with an integer inverse. Here are what I do:
Compute the integer inverse as follows:
...
- 1
1
vote
1
answer
61
views
Which Rust library is recommended if I would like to implement PLONK? [closed]
I think it should have APIs for polynomials, FFT and bilinear mapping if KZG commitment scheme is used.
- 61
0
votes
0
answers
13
views
How to read libsodium's scalar from integer/bytes or NTL:zz
Hi I am new to lib sodium, may I ask that is it possible to get scalar of ristretto255 from integer/bytes or NTL:zz?
Some thing as follows:
...
- 173
0
votes
1
answer
33
views
implementing pedersen commtiment using lib sodium
Hi I want to implement pedersen commitment ontop of lib sodium
Below is what I am trying to do:
comm1: m1G+r1H
comm2: m2G+r2H
comm3: (m1+m2)G+(r1+r2)H
comm4: comm1+comm2
and comm3 should equals ...
- 173
1
vote
0
answers
55
views
Issue with AWS Encryption SDK for JavaScript in Browser: 'Buffer is not defined' [closed]
I'm trying to implement AWS Encryption SDK for JavaScript in a browser environment within a React application. When I attempt to construct an instance of the encryption client using buildClient ...
2
votes
1
answer
36
views
How is the message considered in the STROBE-based Schnorr signature example?
I've been studying the Schnorr signature scheme and recently came across an example that uses the STROBE protocol. In the classic version of Schnorr signatures, the challenge e is calculated as e = H(...
- 122
1
vote
1
answer
79
views
Is it fatal if a blockcipher uses a sbox with a fixed point at 0?
In a previous question, I asked how to implement arbitrary s-box in side-channel-free fashion. The code I posted in the question loops over all 256 values of a byte to avoid timing channel, and I want ...
- 8,648
6
votes
1
answer
817
views
Does the order of validations and MAC with clear text matter?
I have a request in which I get a series of data in clear (nothing encrypted) and a MAC / authentication tag.
The question is whether the MAC should be validated first or if the fields are filled in ...
3
votes
0
answers
31
views
Data type transformation in Rust library
I am using some ark libraries, such as ark_ff and ark_bls12_381, to implement some cryptographic algorithms. In these algorithms, random oracles are needed, which gets some group elements in G1,G2,Gt ...
- 61
1
vote
1
answer
99
views
Looking for efficient implementations for Pedersen commitment
Hi I am currently developing a research project, but it seems that my implementation of Pedersen commitment is not efficient. I wonder if there are any efficient implementation of Pedersen ...
- 173
1
vote
0
answers
60
views
Secure permutation of $E(\mathbb{F}_q)$ as a set for an elliptic curve $E$ over a finite field $\mathbb{F}_q$
Let $E$ be an elliptic curve over a finite field $\mathbb{F}_q$. For simplicity, let the group $E(\mathbb{F}_q)$ be of prime order.
Assume that I know how to construct an efficiently computable ...
- 365
1
vote
1
answer
85
views
Are you aware of cryptographic contexts (e.g., post-quantum) in which a square root $\sqrt{\cdot}$ must be computed in constant time?
Let $\mathbb{F}_q$ be a finite field of odd characteristic. I know that a constant-time implementation of the square root extraction $\sqrt{\cdot} \in \mathbb{F}_q$ is used in the context of hashing ...
- 365
3
votes
3
answers
502
views
Reference implementation of Shamir's Secret Sharing
Is there an implementation of Shamir's Secret Sharing that can be regarded as a "canonical" (or "reference" or "standard") implementation, so that I can test other ...
- 133
2
votes
1
answer
239
views
Help with adding and multiplying points on secp256k1
I'm currently working on implementing digital signatures on the curve secp256k1 (for learning purposes only), and I'm having some trouble implementing ECDSA on curve secp256k1. As I understand it, ...
- 41
1
vote
3
answers
93
views
How do certificates add data to public key and how is this implemented into TLS?
I want to create a self signed PKI for a couple servers I am running. I am finding tutorials with copy paste commands from openssl, and hand waving explanations that describe the general purpose of ...
- 11
5
votes
2
answers
856
views
How do you instantiate a Random Oracle?
I was recently discussing with a friend how to instantiate something that requires a RO (with a potentially long output) in a practical implementation. Specifically, for a Fiat-Shamir transform.
The ...
- 4,883
2
votes
0
answers
118
views
How to implement hash functions $H1 \colon \{0,1\}^* \to \mathbb{Z}_p^*$ and $H2 \colon \mathbb{Z}_p^* \to \{0,1\}^k$?
I would like to implement a hash function $H1 \colon \{0,1\}^* \to \mathbb{Z}_p^*$ such that $p$ is a prime number and second fonction $H2 \colon \mathbb{Z}_p^* \to \{0,1\}^k$ where $k$ is a security ...
- 21
2
votes
2
answers
41
views
Verify that a user submitted data without identifying which data was submitted
I'm not fully sure what the most accurate terms would be to describe what I'm looking for, but here's the gist:
Let $u_1, \cdots, u_n$ be the users from a set of users $U$. Users may or may not ...
- 21
1
vote
0
answers
31
views
Browser javascript: TLS sequence number authentication
I am implementing TLS (or something like it perhaps) because the browser doesn't seem to provide a direct client-script interface to TLS. The browser provides a ...
- 111
1
vote
0
answers
62
views
Good libraries for lattice-crypto [closed]
I'm searching good libraries to manipulate lattice tools to do cryptography.
I'm mainly interested by C/C++. But I'm also interested if it is in python.
- 2,554
1
vote
0
answers
35
views
Make linkable ring signatures shorter?
I need a way to make the signatures shorter, currently with a ring size of 1000 members I get a signature size of 34000 bytes, this is too big for me I need a way to make it smaller.
I tried ...
- 21
2
votes
2
answers
951
views
What are the performance reasons behind "xor-a-rotated-sum" instead of "add-a-rotated-xor" in Salsa20?
I'm currently reading the specification of Salsa20 (link). DJB on whether he chooses
"xor-a-rotated-sum" instead of "add-a-rotated-xor" states the following :
Should there be ...
- 848
0
votes
1
answer
67
views
Is gcc's stack canary cryptographically secured? Does stack canary in general has to be cryptographically secured?
I want to ask 2 questions:
Is GCC's stack canary cryptographically secured?
Does stack canary in general has to be cryptographically secured?
1
vote
0
answers
42
views
Accelerating Syndrome-Trellis Codes (STC) for GPU [closed]
From the literature, STC seems to be the current state-of-the-art for the coding part of steganography. From the description of the method, it appears to me it could be parallelized for GPU. Does ...
- 155
0
votes
1
answer
65
views
Faster linkable ring signatures libraries
I need a fast linkable ring signatures library, something that is O(log(n)) and n is the ring size.
I read a few papers about these kinds of schemes but I didnt find any implementations of them.
Here ...
- 21
3
votes
0
answers
126
views
Can reinforcement learning speed up modular multiplication?
In Discovering faster matrix multiplication algorithms with reinforcement learning (Nature, 2022; lightweight intro), the authors used reinforcement learning (an artificial intelligence technique) to ...
- 137k
0
votes
1
answer
88
views
Universal Dynamic Accumulators : all parties know keys p and q. Is the original set needed to validate set membership and non membership?
I read this paper on RSA cryptographic accumulators have some questions on a few points :
"Universal Accumulators with Efficient Nonmembership Proofs"
https://www.cs.purdue.edu/homes/ninghui/...
-1
votes
1
answer
58
views
How to read clock cycle from latency tables?
I see many papers that compare the latency of the signature schemes in terms of clock cycles by two-three numbers. I don't know why they write 2-3 numbers instead of one number to represent clock ...
2
votes
1
answer
78
views
API design that maximizes the potential of parallel and tree hashing
Traditionally, hash functions are single-threaded, and have the 'Init-Update-Final' API style. This is true of MD5, SHA-1/2/3, BLAKE2, to name a few.
However, there have been proposal of parallel hash ...
- 8,648
0
votes
1
answer
124
views
How do we calculate a power with a gigantic exponent?
In RSA, signing the hash of a message is doing the operation $h^{d} \bmod N$ where $d$ is the private key.
Given that the size of $d$ is usually 2048 bits and $h$ is a quite big number, the ...
- 101
0
votes
3
answers
270
views
Do we want to allow/Have we allowed parallelization (e.g GPU programming) to enter the cryptographic field? What are the consequences?
With the term GPU programming, I'm referring to highly parallelizable computing in general.
Lastly, I have built a bit of a background in cryptography. So I have started to wonder if/where GPU ...
- 848
1
vote
0
answers
163
views
Minimal, secure and reasonably efficient P384 implementations
For a project I'm working on, I need to implement ECDSA over the NIST P-384 curve (AKA secp384r1). For what it's worth, the choice of curve is beyond my control in ...
- 111
2
votes
1
answer
74
views
Is this half-smart way of verifying EdDSA signature secure?
In the final step of verifying an EdDSA signature, 4[S]B is compared to [4]R + [4][k]A.
Because I'm using the XYTZ - extended ...
- 8,648
-2
votes
1
answer
48
views
Straightforward modular arithmetic for power-of-two moduli [closed]
Why if $q$ is a power-of-two integer, then doing arithmetic modulo $q$ (addition and multiplication) is very efficient and straightforward?
- 425
4
votes
2
answers
1k
views
Are there prime numbers that are easy to modulo within 40 bits to 60 bits?
I want to implement LWE-based encryption scheme, the modulo $q$ could be decomposed as $q = q_0\cdot q_1\cdots q_k$ according to CRT. I guess the modular arithmetic by $q_i$ is key operation, so I ...
- 499
3
votes
1
answer
120
views
What is the most viable and common hardware for public key cryptography implementation?
I am an FPGA engineer and my last experiences were related to digital communication implementation. I am about to start an experience for the cryptography market.
In digital radio communication, FPGA ...
- 33
2
votes
1
answer
2k
views
Generating and validating a signature with ED25519 expanded private key
I am building a encrypted messaging app over tor network and currently I'm struggling on using tor generated ed25519 private key to sign and verify any message.
Below piece of code works with a 32 ...
- 21
5
votes
2
answers
1k
views
Difference between FFT and NTT
What are the main differences between the Fast Fourier Transform (FFT) and the Number Theoretical Transform (NTT)?
Why do we use the NTT and not the FFT in cryptographic applications?
Which one is a ...
- 425
4
votes
1
answer
287
views
Notion of base2-logarithm in RC6 specification
I was reading this paper on RC6 and formally, the algorithm is defined for an arbitrary word size $w$, even though only $w=32$ was considered for the AES submission. Now the paper explicitly mentions ...
- 143