# Questions tagged [implementation]

Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.

385 questions
Filter by
Sorted by
Tagged with
82 views

### Crypto implementations bits and bytes

Reading many papers in the Homomorphic Encryption domain and in Cryptography, a lot of schemes operate on bits as 1 and 0. If I wanted to implement a scheme, for example Gentry's FHE, would I have ...
77 views

### Implementation of ECC operations in BMR

I want to implement computing ECC operations(i.e multiplication) in BMR scheme (secure Multi-party computation) What is the best way to do it? I found Fairplay MPC - to allow BMR computation through ...
337 views

### Implementation details of the π step of the Keccak round function

In the official Keccak implementation overview, there is a section discussing different ways to organise the internal Keccak-f state -- namely section 1.2, Bit and byte numbering conventions -- and at ...
145 views

### How to thwart a cleartext message's size?

Here is a question I don't find addressed in my cryptography books: let's say Alice want to send Bob a message of length N. what is the proper way for Alice to hide N? I am thinking Alice should do ...
118 views

### Fermat's FFT based large integer multiplication

I was going through the documentation of GMP (https://gmplib.org/gmp-man-6.1.2.pdf), specially section 15.1.6 where they refer to the use of Fermat's style FFT. I tried to follow the reference but ...
44 views

### Does storing plain data length leak essential information about the cryptographic scheme?

Consider the function below: ...
293 views

### Wrong Miller's Weil Pairing implementation?

I tried to implement the Miller's Weil Pairing algorithm in python using the book "An introduction to mathematical cryptography" by Hoffstein, Pipher and Silverman. I tried my code with the example ...
181 views

### Why does TWINKLE use light instead of current?

TWINKLE is a device devised by Adi Shamir to optimize the sieving step of GNFS. It consists of a cylinder, at the bottom of which are LEDs corresponding to factor base primes which blink with ...
281 views

### How are multiple iterations of SHA-256 handled for longer inputs?

I wrote a python program to perform the SHA-256 function. It works just fine until I try to hash longer strings. If I hash (in HEX) ...
717 views

### Varying ECDH key output on different ECC implementations on the secp256k1 curve

Like the title says, I have used several implementations of ECDH, and I have found a discrepancy with libraries that wrap ...
61 views

### Using XL Algorithm to solve overdetermined systems, simple example required

Can someone give a small example of how the XL algorithm is used to solve an overdetermined system, with numbers and variables along with the steps if possible as apposed to just a general case? This ...
68 views

### How to compute this equation $(g^k)^\alpha\bmod p$

I have a question about implementation. How is an operation like this implemented? $$(g^k)^\alpha\bmod p$$ With all $g$, $k$, and $\alpha$ being large numbers. The thing that I find tricky is that ...
175 views

### at rest encrypton question from someone who knows nothing

this forum is way above me and the members here are far, far smarter than I am, so this probaby isn't the place to ask such a simple question, but whatever. All I wanted to ask is for at rest ...
273 views

### A Lightweight Matrix Suggestion for MixColumns State of AES

We know that the matrix in the MixColumns state of AES is the circulant MDS matrix $C=circ(2,3,1,1)$ which is defined over $GF(2^8)$ with the irreducible polynomial $f=x^{8}+x^{4}+x^{3}+x+1$. Let we ...
106 views

### Lattices with hidden short vectors and an algorithm for a special case of the SVP

For the purpose of testing algorithms for lattice basis reduction or finding short vectors, it would be useful to have examples of lattices where short vectors are hidden, that is, a nontrivial ...
164 views

### What steps are needed for fully homomorphic encryption? [closed]

In my project work, I want to encrypt the keywords extracted from certain documents by using fully homomorphic encryption. What are the algorithmic steps to perform fully homomorphic encryption on ...
171 views

### Is streaming API to ChaCha20-Poly1305 possible or recommended against?

None of the implementations of ChaCha20-Poly1305 AEAD scheme I've seen so far provide a streaming API. Instead, ChaCha20-Poly1305 is presented as an inseparable combination, closely adhering to the ...
269 views

### Can duplication of encrypted characters lead to a weakness in RSA?

Of course, I know RSA is to widely used and tested to have any legitimate threats, but I still am confused by this. I have been trying to implement C++ (in a effort to learn how it works, not to be ...
78 views

### Implications of TLS-SRP client with improper N validation?

During development of a client side application of TLS-SRP, i noticed a bug that allows an attacker spoofing as the server to send custom, but non-arbitrary $N$ values, with the client accepting them. ...
419 views

### Does a conditional statement depending on a round number introduce timing attack problems?

In a cryptographic implementation I’m playing with, there’s a round function which includes a conditional if statement. Stripping the superfluous stuff, the C ...
282 views

### Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...
446 views

### Is it possible to attack an SHA-256 hash seeded with PHP’s mt_rand function?

Is it possible to attack this construction if the attacker only knows the hash? ...
397 views

### Security of Carter-Wegman polynomial authenticators, and their concatenation?

Carter-Wegman polynomial authenticators For a given finite field $(\mathbb F,+,\times)$ of $f$ elements, define a Carter-Wegman polynomial authenticator for a message $M=m_1\|m_2\|\dots\|m_l$ of $l$ ...
122 views

### Multiple XML files and known-plaintext attack

I have created an app which collects data in sets which may contain up to 20000 XML files of an average size of about 5 KB, and all with the same header and XML structure, so that only the data they ...
2k views

### How to use Libsodium encryption (in PHP) in the most secure possible way?

In a PHP project in which fool-proof encryption is fundamental, I'm using the Libsodium library. Hope you guys can shine some light on the following questions. For all of the following functions, it ...
155 views

### How does the nonlinear function of KeeLoq work?

I want to know how the nonlinear function of KeeLoq works. Here at Wikipedia it says that: The NLFSR feedback function is 0x3A5C742E I understand that ...
212 views

### OpenSSH_7.4 Encryption Config [closed]

I have noticed that recent versions of OpenSSH allows the reporting of capabilities by using ssh -Q . The last time I really looked at my SSH setup was a couple of years ago (stribika) -- but I have ...
408 views

### Is it safe to store both the AES-related data and the PBKDF2-related data (except passwords) in one file?

Assume an "encrypted data package" file format which includes the following data PBKDF2 algorithm salt rounds keylen AES algorithm & mode IV ciphertext where the PBKDF2 salt and AES IV are ...
386 views

### Need of Image Encryption [closed]

Question is simple yet confusing, why there is the need for image encryption. How text encryption is different from image encryption if using same technique like AES, DES, Chaotic algorithm. If the ...
2k views

### How do you get the original salt after it's been hashed to the user's password in the database?

I'm researching how to do salt and hashing. I'll be using SHA256. Here is what I found: To Store a Password Generate a long random salt using a CSPRNG. Prepend the salt to the password ...
539 views

### How are Elliptic Curve private and public keys actually used to encrypt or sign data?

I've read article after article about curve parameters, generator points, the dot operation, and how you dot the generator point priv times to get the ...
1k views

### Why is AES encryption decryption not platform agnostic?

We work on C++ code which compiles on Windows and Linux. I have been told that AES encryption/decryption is platform dependent. Is it true? If so, why is it OS dependent?
399 views

### Do people not care about side channel resistance?

Recently, I have been browsing a lot through libraries that implementing Shamir secret sharing. I see a lot of code that implements this cryptographic algorithm without any side channel (timing/branch/...
143 views

### How to implement a hash function $H \colon \{0,1\}^* \to \mathbb{Z}_p^*$?

I would like to implement a hash function $H \colon \{0,1\}^* \to \mathbb{Z}_p^*$ such that $p$ is a prime number and $\log_2(p) > 256$. I am wondering if it is a good idea to use the hash function ...
344 views

### How to interpret the article claiming NIST P-256 curve to be unsafe?

Here: http://safecurves.cr.yp.to/ , I read that the NIST P-256 elliptic-curve is not safe. The article lists several aspects (off-curve point, side-channel, etc.) where implementing P256 can fail the ...
73 views

### Does this ECIES scheme make MAC redundant?

I've implemented ECIES (see the below pseudo-Python). ...
332 views

### Size and usage of lookup table in cryptographic schemes

I would like to understand the typical size of a lookup table for software implementations of a cryptographic scheme. What size is considered reasonable? What make them (in)efficient? Are there ...
301 views

### Timing vulnerability of byte array equality test?

Would the following code to test MAC equality leak timing information ? ...
171 views

### Necessary to authenticate nonce if authentication-key is derived from nonce?

Lets suppose my messages are composed like this: unique_message_nonce + encrypted_message + mac Because I don't have an AEAD-scheme, I can encrypt and authenticate ...
470 views

### How can a non-crypto-expert implement crypto libraries in a programming language?

I'm a regular developer and thus not a crypto expert. I'd like to use ECDSA as a library in a programming language, Idris, which still doesn't have one. I could, obviously, try and port a particular ...
7k views

### How fast can a SHA-256 implementation go?

I'm looking for high-speed SHA-256 implementations, and specifically, ones with low latency; that is, the time between when you submit the message block, and when the output (or internal state) is ...
534 views

### Has any alternative to RSA and Discrete Logarithm been standardized for deployment?

Suppose RSA and Discrete Logarithm over any group (including elliptic curves) gets broken what other schemes we have for DEPLOYMENT IMMEDIATELY do we have to rescue the internet from collapse? So ...
188 views

### Using negative values / unsigned integers to implement SHA-2

What happens if we allow implementation of SHA-2 using negative values? What happens if a negative value was used in the first round? Would the algorithm still result in a secure value? I have a ...
432 views

### How do I multiply a Twisted Edwards point in Montgomery space?

EdDSA (and ed25519) signatures require a scalar multiplication. Currently, I do this directly in Twisted Edwards space. (The code can be found in my crypto library.) My research and my tests ...
81 views

### Online attendance system

This summer I have made a website for my school's NHS program and integrated it with google scripts to automate tasks such as accessing how many hours users have and to allow members to view how many ...
3k views

### Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...
171 views

### AES ShiftRow Confusion

I'm implementing AES and I'm getting confused in the ShiftRows step. So far, my key expansion and SubBytes works and I get the ...
226 views

### Optimal MDS matrix - circulant or recursive?

One of the special matrix in $GF(2^q)$ is MDS matrix which can be used in the cryptography like mix column of AES. Two forms of MDS matrices are circulant and recursive. Which form of MDS matrix (...
What are goofs that could creep in ECDSA signature verification, perhaps with focus on curves based on prime-order $\mathbb Z_p$, specifically P-256 aka secp256r1? Is it possible to construct test ...