Questions tagged [implementation]

Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.

0
votes
2answers
55 views

What is a cryptocoin made of?

I want to know whether a cryptocoin is made of some piece of code or it is kind of a bill that says a person has transferred conceptual coin to another person when a transaction is published. If it is ...
0
votes
0answers
11 views

Using Chameleon-HF-enabled security in practice

If one were to implement a digital signature scheme that is only EUF-CMA-secure when using Chameleon Hash Functions, would one actually use a Chameleon Hash Function or a standard cryptographic hash ...
1
vote
1answer
41 views

Serpent intermediate rounds differs from example code, but result is still correct, is it a problem?

Through great pain and suffering, I've been able to successfully implement Serpent. For example, when using the key 00112233445566778899aabbccddeeff, and encrypting ...
0
votes
3answers
138 views

Is the curve25519 algorithm a special(implementation) one of ECDH?

It's the first time for me to learn about Key Exchange Protocol. And I thought that in both ECDH and DH there is a necessary step to share some public infomation(the common parameters) to each sides ...
2
votes
3answers
145 views

Are XOFs and KDFs more usable than DRBGs?

CSPRNGs have 2 design requirements: output unpredictability, back-tracing resistance. In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization,...
1
vote
1answer
93 views

Generating a random point on an elliptic curve over a finite field

I have coded an implementation of elliptic curves in order to apply some of the ECC algorithms. However, in most of them, Alice needs to choose a point P on a given curve. What is the general ...
1
vote
1answer
75 views

Application of MDS matrices in serial and round-based implementations

We know that MDS matrices are used in the diffusion layers of block ciphers. My question: what types of MDS matrices can be applied to serial or round-based implementations or both of them? I ...
2
votes
2answers
153 views

Why should one model an entropy source in order to build a TRNG?

Some assert that a theoretical model of the unconditioned source must be created when building any TRNG. It's believed to be a fundamental requirement. So a few related questions arise:- What is a "...
43
votes
2answers
5k views

How is the Swiss post e-voting system supposed to work, and how was it wrong?

I read that the Swiss post had an e-voting solution developed, made it possible to obtain the source code for review, and that vulnerabilities were found. Apparently we are not talking about the ...
5
votes
1answer
154 views

How would we design a fast circuit to solve LCS35?

LCS35 is a time-lock puzzle, stated in Ronald L. Rivest's Description of the LCS35 Time Capsule Crypto-Puzzle [1] (April 1999). That instantiates a system in Ronald L. Rivest, Adi Shamir and David A. ...
1
vote
0answers
71 views

Efficient polynomial ring multiplication with coefficients in GF(2^s)

Is there something similar (or an other efficient approach) to the NTT for the multiplication of polynomials in polynomial rings modulo $X^{2^n} + 1$ with coefficients in $\operatorname{GF}(p)$ with $...
1
vote
1answer
80 views

Implement Google Adiantum else where?

Google made the headlines with its new Adiantum encryption method, and i read (TechCrunch) that: In the meantime don’t expect any instant gains, but future low-power devices may offer better ...
6
votes
1answer
159 views

Does a masked look-up table prevent cache timing attacks?

When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...
0
votes
0answers
33 views

Proxy decrypt algorithm in Extended Proxy-Assisted Attribute Based Encryption (ABE) Scheme

Context I'm trying to implement the Attribute-Based Encryption (ABE) scheme described in the paper - Extended Proxy-Assisted Approach: Achieving Revocable Fine-Grained Encryption of Cloud Data (Yang ...
0
votes
1answer
45 views

Starting stream cypher, first block (Salsa20)

I'm implementing Salsa20 in Rust for fun. I have the initial state (4x4 32-bit matrix) setup from the key, nonce, and stream position 0. I'm using the Wikipedia Salsa20 article as reference, and I'm ...
1
vote
1answer
87 views

Reducing the XOR's in Implementation Cost

Suppose that we want to implement the following equations in binary finite field. $$ \begin{array}{l}\tag{1} y_{{1}}=x_{{1}}\oplus x_{{2}}\oplus x_{{7}}\oplus x_{{8}},\\ y_{{2}}=x_{{1}}\oplus x_{{2}}\...
0
votes
0answers
60 views

Burmester Desmedt confused on the last step

I try to implement in code the traditional burmester desmedt algorithm for group key agreement: But I have the following question regarding the last step: $K=k_{i-1}^{nx_i}K_i^{n-1}K_i+1^{n-2}\dots ...
1
vote
0answers
55 views

Could you design something like a ring signature that uses website accounts instead of keys?

Ring signatures allow one to prove that you own a private key corresponding to a public key from a set of keys, without revealing which private key you control. This is useful if you are part of some ...
4
votes
1answer
90 views

Magic Number to calculate number of rounds for M-R in FIPS 186-4

In Fips 186-4, there is an algorithm in Appendix F (at page 117 in my copy of the 2013 version) to calculate the number of rounds of the Miller-Rabin primality test to random bases. Does anybody ...
1
vote
2answers
80 views

Implementations of GCM with 64-bit cipher

The paper The Galois/Counter Mode of Operation (GCM) describes mainly the 128-bit case, for use with 128-bit block ciphers such as AES. AES-GCM test vectors are available from NIST. The paper also ...
3
votes
2answers
196 views

Implementing randomness extractors

A randomness extractor is a function that takes an input sampled from high entropy distribution and outputs a value that is close to uniform distribution. It is slightly different from a PRG. PRGs ...
11
votes
1answer
153 views

WOTS+: Why does it XOR before running data through the hash function?

I'm implementing WOTS+ in a new language and I can't seem to wrap my head around the fact that WOTS+ XOR's their input with its mask right before hashing it. I tried to look for any reasoning but so ...
2
votes
1answer
188 views

ECDSA with common nounce?

I'm new to cryptography, and I've searching about ECDSA because I'm trying to solve a CTF. I've already check this site and Google, and I think I'm in the right path, but probably I am missing ...
1
vote
1answer
115 views

Choosing good entropy $g$ and $p$ for a classic Diffie-Hellman Key exchange

When selecting $g$ and $p$ for the Diffie-Hellman modular exponentiation: $ s= g^x \bmod p $ Which pairs of $g$ and $p$ are considered good nowadays, are recommended by bibliography? What I try ...
1
vote
1answer
66 views

Can I use NaCl's scalar multiplication functions for Diffie Hellman Key Agreement?

I want to create some software that performs diffie hellman group key agreement but I don't want to reinvent the wheel even if I know how it's done. So I came accross the NaCl library, especially the <...
1
vote
0answers
41 views

Gate count for Ring-LWE

In one of my recent research, I need to compare the number of gates needed in Ring-LWE encryption to AES in the circuit model. For AES we can find some estimation like this site, but for Ring-LWE we ...
4
votes
0answers
98 views

Why is this Trivium implementation working bytewise instead of bitwise?

I am currently looking into a Trivium implementation available in the FELICS framework. Parameters of the Trivium stream cipher: Key size: 80 bit IV size: 80 bit State size: 288 bit The Trivium ...
0
votes
2answers
53 views

Is one big file as secure as X small files with the same password?

Hello people of StackExchange. It's my first time asking and I know little about Cryptography, so be gentle. My problem can be simplified to this: I can create a 2GB Volume that contains 1GB of text ...
4
votes
1answer
103 views

Can the CRT speed-up Paillier decryption by more than a factor of two?

In the Pailler cryptosystem, decryption goes $m\gets\displaystyle\left\lfloor\frac {\left(c^\lambda\bmod n^2\right)-1}n\right\rfloor\mu\bmod n$ with $\mu<n$ being a part of the private key just ...
7
votes
2answers
155 views

Regular and Efficient doubling in $GF(2^n)$

A naive approach to compute a multiplication $a \cdot b$ in a Galois field of the form $GF(2^n)$ is the russian peasant algorithm. However, it does not run in constant time and therefore is not safe ...
5
votes
2answers
269 views

How to securely map messages to points on an elliptic curve

I'm implementing a demonstration hybrid cryptosystem in Python (FinCrypt, I know the name is bad) and I'm migrating over from my Weierstrass curve implementation, which was based off of this, to one ...
8
votes
2answers
1k views

Hardware AES: can we have a decryption implementation only?

I'm wondering if implementing only the AES decryption can reduce the hardware cost? And does anybody have some examples of the cost (speed, size) of hardware AES implementation? Thanks, Abaobaide
5
votes
3answers
374 views

Where can I find the description of SHA0 algorithm?

Where may I find the description and or pseudocode for the SHA0 algorithm. I am looking for something on these lines - HMAC RIPEMD. I have been implementing a few of those (HMAC, HOTP, TOTP and MD4, ...
1
vote
0answers
54 views

What should I change in my implementation to pass from a curve $y^2=x^3+1$ to $y^2=x^3+x$

I tried to change my implementation of pairing in curves $y^2 = x^3 + 1$ to use curves of the type $y^2 = x^3 + x$ but it didn't work. I thought the only thing I had to change in my code was the ...
1
vote
1answer
96 views

In a specific Paillier implementation, why is r prime?

I have a question about an implementation of the Paillier cryptosystem. In the description of Paillier above, encryption of a plaintext message $m$ on $\mathbb {Z}_{n^{2}}$, $0\leq m<n$, proceeds ...
2
votes
1answer
94 views

Non interactive Zero Knowledge Proof for Satisfiability of Pairing Product Equations

In the paper "Simulation-Sound NIZK Proofs for a Practical Language and Constant Size Group Signatures" from Groth, the section 6 describes a NIZK proof for pairing product equations. I only know ...
1
vote
3answers
164 views

Is there a consensus on what text encoding to use when hashing a string?

Let's suppose we are hashing a string input from the user via keyboard. A string can be interpreted in many different text encodings (ANSI, UTF-8, UTF-16 and many others). Based on what encoding is ...
4
votes
3answers
240 views

How to Calculate GE of Sbox?

How to count Gate Equivalent (GE) of Sbox used in block Cipher. For example how much area does the Sbox of Block Cipher Prince take? And How is it calculated?
5
votes
2answers
882 views

Why do algebraic proofs apply to cryptography?

How do we know that the number theoretic and algebraic results used in cryptography provide a perfect model for the behavior of integers as implemented in computers? Does there exist a bijection ...
2
votes
1answer
242 views

Right way to hash elliptic curve points into finite field

I would like to know how I can implement several hash functions : $H_1:\{0,1\}^* \rightarrow P $ with $P \in E(\mathbb{F}_q)$ and $H_2:P \rightarrow \mathbb{Z_q}^*$ And others where the ...
0
votes
1answer
61 views

Can you create asymmetrical encryption algorithm from symmetrical, without knowing how the algorithm works?

Let's imagine that we have some symmetrical encryption algorithm, that has only two functions: Encrypt(Data, Key) and ...
0
votes
1answer
456 views

Decode & Verify Base64urlUInt-encoded RS256 Public Key from Google

According to Google, to access the id_token it sends along with Access Tokens (for accessing their API), you must first validate the token using the RS256 Public Key available from this page. The ...
1
vote
0answers
54 views

Sigma protocol compiler?

Is there a well maintained, preferably documented, Sigma protocols compiler library? i.e. takes an abstraction of statements to prove, and outputs a cryptographic protocol between verifier and prover? ...
-1
votes
1answer
399 views

ECDH over secp256k1 implementation

I'm using ECDH over secp256k1 in multiple languages, and I saw something a little weird in the rust library I use. After the point multiplication it changes y to <...
0
votes
2answers
151 views

UDP and AES with C++

I'm implementing different applications that will use UDP to exchange real-time data, thus a low impact on performance is very important. This system will not be connected to the Internet so I just ...
1
vote
0answers
66 views

How is pipelined DES different from sequential DES?

I implemented DES Coder in VHDL using ISE IDE by Xilinx in sequential architecture which was pretty easy and straightforward. Now my task is to do the same using pipelined architecture so that the ...
2
votes
1answer
82 views

Crypto implementations bits and bytes

Reading many papers in the Homomorphic Encryption domain and in Cryptography, a lot of schemes operate on bits as 1 and 0. If I wanted to implement a scheme, for example Gentry's FHE, would I have ...
1
vote
1answer
75 views

Implementation of ECC operations in BMR

I want to implement computing ECC operations(i.e multiplication) in BMR scheme (secure Multi-party computation) What is the best way to do it? I found Fairplay MPC - to allow BMR computation through ...
2
votes
1answer
332 views

Implementation details of the π step of the Keccak round function

In the official Keccak implementation overview, there is a section discussing different ways to organise the internal Keccak-f state -- namely section 1.2, Bit and byte numbering conventions -- and at ...