Questions tagged [implementation]

Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.

Filter by
Sorted by
Tagged with
2
votes
1answer
82 views

Crypto implementations bits and bytes

Reading many papers in the Homomorphic Encryption domain and in Cryptography, a lot of schemes operate on bits as 1 and 0. If I wanted to implement a scheme, for example Gentry's FHE, would I have ...
1
vote
1answer
77 views

Implementation of ECC operations in BMR

I want to implement computing ECC operations(i.e multiplication) in BMR scheme (secure Multi-party computation) What is the best way to do it? I found Fairplay MPC - to allow BMR computation through ...
2
votes
1answer
337 views

Implementation details of the π step of the Keccak round function

In the official Keccak implementation overview, there is a section discussing different ways to organise the internal Keccak-f state -- namely section 1.2, Bit and byte numbering conventions -- and at ...
3
votes
3answers
145 views

How to thwart a cleartext message's size?

Here is a question I don't find addressed in my cryptography books: let's say Alice want to send Bob a message of length N. what is the proper way for Alice to hide N? I am thinking Alice should do ...
1
vote
0answers
118 views

Fermat's FFT based large integer multiplication

I was going through the documentation of GMP (https://gmplib.org/gmp-man-6.1.2.pdf), specially section 15.1.6 where they refer to the use of Fermat's style FFT. I tried to follow the reference but ...
-1
votes
1answer
44 views
3
votes
1answer
293 views

Wrong Miller's Weil Pairing implementation?

I tried to implement the Miller's Weil Pairing algorithm in python using the book "An introduction to mathematical cryptography" by Hoffstein, Pipher and Silverman. I tried my code with the example ...
3
votes
2answers
181 views

Why does TWINKLE use light instead of current?

TWINKLE is a device devised by Adi Shamir to optimize the sieving step of GNFS. It consists of a cylinder, at the bottom of which are LEDs corresponding to factor base primes which blink with ...
-1
votes
1answer
281 views

How are multiple iterations of SHA-256 handled for longer inputs?

I wrote a python program to perform the SHA-256 function. It works just fine until I try to hash longer strings. If I hash (in HEX) ...
3
votes
1answer
717 views

Varying ECDH key output on different ECC implementations on the secp256k1 curve

Like the title says, I have used several implementations of ECDH, and I have found a discrepancy with libraries that wrap ...
2
votes
0answers
61 views

Using XL Algorithm to solve overdetermined systems, simple example required

Can someone give a small example of how the XL algorithm is used to solve an overdetermined system, with numbers and variables along with the steps if possible as apposed to just a general case? This ...
-1
votes
1answer
68 views

How to compute this equation $(g^k)^\alpha\bmod p$

I have a question about implementation. How is an operation like this implemented? $$(g^k)^\alpha\bmod p$$ With all $g$, $k$, and $\alpha$ being large numbers. The thing that I find tricky is that ...
-4
votes
1answer
175 views

at rest encrypton question from someone who knows nothing

this forum is way above me and the members here are far, far smarter than I am, so this probaby isn't the place to ask such a simple question, but whatever. All I wanted to ask is for at rest ...
4
votes
1answer
273 views

A Lightweight Matrix Suggestion for MixColumns State of AES

We know that the matrix in the MixColumns state of AES is the circulant MDS matrix $C=circ(2,3,1,1)$ which is defined over $GF(2^8)$ with the irreducible polynomial $f=x^{8}+x^{4}+x^{3}+x+1$. Let we ...
2
votes
0answers
106 views

Lattices with hidden short vectors and an algorithm for a special case of the SVP

For the purpose of testing algorithms for lattice basis reduction or finding short vectors, it would be useful to have examples of lattices where short vectors are hidden, that is, a nontrivial ...
1
vote
0answers
164 views

What steps are needed for fully homomorphic encryption? [closed]

In my project work, I want to encrypt the keywords extracted from certain documents by using fully homomorphic encryption. What are the algorithmic steps to perform fully homomorphic encryption on ...
1
vote
1answer
171 views

Is streaming API to ChaCha20-Poly1305 possible or recommended against?

None of the implementations of ChaCha20-Poly1305 AEAD scheme I've seen so far provide a streaming API. Instead, ChaCha20-Poly1305 is presented as an inseparable combination, closely adhering to the ...
-1
votes
2answers
269 views

Can duplication of encrypted characters lead to a weakness in RSA?

Of course, I know RSA is to widely used and tested to have any legitimate threats, but I still am confused by this. I have been trying to implement C++ (in a effort to learn how it works, not to be ...
4
votes
0answers
78 views

Implications of TLS-SRP client with improper N validation?

During development of a client side application of TLS-SRP, i noticed a bug that allows an attacker spoofing as the server to send custom, but non-arbitrary $N$ values, with the client accepting them. ...
7
votes
1answer
419 views

Does a conditional statement depending on a round number introduce timing attack problems?

In a cryptographic implementation I’m playing with, there’s a round function which includes a conditional if statement. Stripping the superfluous stuff, the C ...
0
votes
1answer
282 views

Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...
-2
votes
1answer
446 views

Is it possible to attack an SHA-256 hash seeded with PHP’s mt_rand function?

Is it possible to attack this construction if the attacker only knows the hash? ...
7
votes
1answer
397 views

Security of Carter-Wegman polynomial authenticators, and their concatenation?

Carter-Wegman polynomial authenticators For a given finite field $(\mathbb F,+,\times)$ of $f$ elements, define a Carter-Wegman polynomial authenticator for a message $M=m_1\|m_2\|\dots\|m_l$ of $l$ ...
1
vote
2answers
122 views

Multiple XML files and known-plaintext attack

I have created an app which collects data in sets which may contain up to 20000 XML files of an average size of about 5 KB, and all with the same header and XML structure, so that only the data they ...
4
votes
1answer
2k views

How to use Libsodium encryption (in PHP) in the most secure possible way?

In a PHP project in which fool-proof encryption is fundamental, I'm using the Libsodium library. Hope you guys can shine some light on the following questions. For all of the following functions, it ...
2
votes
1answer
155 views

How does the nonlinear function of KeeLoq work?

I want to know how the nonlinear function of KeeLoq works. Here at Wikipedia it says that: The NLFSR feedback function is 0x3A5C742E I understand that ...
-2
votes
1answer
212 views

OpenSSH_7.4 Encryption Config [closed]

I have noticed that recent versions of OpenSSH allows the reporting of capabilities by using ssh -Q . The last time I really looked at my SSH setup was a couple of years ago (stribika) -- but I have ...
7
votes
1answer
408 views

Is it safe to store both the AES-related data and the PBKDF2-related data (except passwords) in one file?

Assume an "encrypted data package" file format which includes the following data PBKDF2 algorithm salt rounds keylen AES algorithm & mode IV ciphertext where the PBKDF2 salt and AES IV are ...
0
votes
1answer
386 views

Need of Image Encryption [closed]

Question is simple yet confusing, why there is the need for image encryption. How text encryption is different from image encryption if using same technique like AES, DES, Chaotic algorithm. If the ...
1
vote
1answer
2k views

How do you get the original salt after it's been hashed to the user's password in the database?

I'm researching how to do salt and hashing. I'll be using SHA256. Here is what I found: To Store a Password Generate a long random salt using a CSPRNG. Prepend the salt to the password ...
3
votes
1answer
539 views

How are Elliptic Curve private and public keys actually used to encrypt or sign data?

I've read article after article about curve parameters, generator points, the dot operation, and how you dot the generator point priv times to get the ...
2
votes
3answers
1k views

Why is AES encryption decryption not platform agnostic?

We work on C++ code which compiles on Windows and Linux. I have been told that AES encryption/decryption is platform dependent. Is it true? If so, why is it OS dependent?
8
votes
1answer
399 views

Do people not care about side channel resistance?

Recently, I have been browsing a lot through libraries that implementing Shamir secret sharing. I see a lot of code that implements this cryptographic algorithm without any side channel (timing/branch/...
2
votes
1answer
143 views

How to implement a hash function $H \colon \{0,1\}^* \to \mathbb{Z}_p^*$?

I would like to implement a hash function $H \colon \{0,1\}^* \to \mathbb{Z}_p^*$ such that $p$ is a prime number and $\log_2(p) > 256$. I am wondering if it is a good idea to use the hash function ...
1
vote
1answer
344 views

How to interpret the article claiming NIST P-256 curve to be unsafe?

Here: http://safecurves.cr.yp.to/ , I read that the NIST P-256 elliptic-curve is not safe. The article lists several aspects (off-curve point, side-channel, etc.) where implementing P256 can fail the ...
0
votes
1answer
73 views

Does this ECIES scheme make MAC redundant?

I've implemented ECIES (see the below pseudo-Python). ...
2
votes
1answer
332 views

Size and usage of lookup table in cryptographic schemes

I would like to understand the typical size of a lookup table for software implementations of a cryptographic scheme. What size is considered reasonable? What make them (in)efficient? Are there ...
9
votes
2answers
301 views

Timing vulnerability of byte array equality test?

Would the following code to test MAC equality leak timing information ? ...
3
votes
1answer
171 views

Necessary to authenticate nonce if authentication-key is derived from nonce?

Lets suppose my messages are composed like this: unique_message_nonce + encrypted_message + mac Because I don't have an AEAD-scheme, I can encrypt and authenticate ...
7
votes
1answer
470 views

How can a non-crypto-expert implement crypto libraries in a programming language?

I'm a regular developer and thus not a crypto expert. I'd like to use ECDSA as a library in a programming language, Idris, which still doesn't have one. I could, obviously, try and port a particular ...
15
votes
2answers
7k views

How fast can a SHA-256 implementation go?

I'm looking for high-speed SHA-256 implementations, and specifically, ones with low latency; that is, the time between when you submit the message block, and when the output (or internal state) is ...
6
votes
3answers
534 views

Has any alternative to RSA and Discrete Logarithm been standardized for deployment?

Suppose RSA and Discrete Logarithm over any group (including elliptic curves) gets broken what other schemes we have for DEPLOYMENT IMMEDIATELY do we have to rescue the internet from collapse? So ...
2
votes
1answer
188 views

Using negative values / unsigned integers to implement SHA-2

What happens if we allow implementation of SHA-2 using negative values? What happens if a negative value was used in the first round? Would the algorithm still result in a secure value? I have a ...
1
vote
1answer
432 views

How do I multiply a Twisted Edwards point in Montgomery space?

EdDSA (and ed25519) signatures require a scalar multiplication. Currently, I do this directly in Twisted Edwards space. (The code can be found in my crypto library.) My research and my tests ...
1
vote
1answer
81 views

Online attendance system

This summer I have made a website for my school's NHS program and integrated it with google scripts to automate tasks such as accessing how many hours users have and to allow members to view how many ...
26
votes
5answers
3k views

Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...
1
vote
1answer
171 views

AES ShiftRow Confusion

I'm implementing AES and I'm getting confused in the ShiftRows step. So far, my key expansion and SubBytes works and I get the ...
0
votes
3answers
226 views

Optimal MDS matrix - circulant or recursive?

One of the special matrix in $GF(2^q)$ is MDS matrix which can be used in the cryptography like mix column of AES. Two forms of MDS matrices are circulant and recursive. Which form of MDS matrix (...
0
votes
1answer
113 views

Which is the most overall 'compatible' encryption type? [closed]

What is the "MP3" of encryption formats today, which hopefully will make it easy and compatible to send to other recipients (not via e-mail), without them having to download and learn a software suite ...
7
votes
1answer
483 views

Goofs that could creep in ECDSA signature verification?

What are goofs that could creep in ECDSA signature verification, perhaps with focus on curves based on prime-order $\mathbb Z_p$, specifically P-256 aka secp256r1? Is it possible to construct test ...