Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [implementation]

Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.

Filter by
Sorted by
Tagged with
46
votes
2answers
5k views

How is the Swiss post e-voting system supposed to work, and how was it wrong?

I read that the Swiss post had an e-voting solution developed, made it possible to obtain the source code for review, and that vulnerabilities were found. Apparently we are not talking about the ...
39
votes
5answers
8k views

In RSA, how does the CPU deal with this huge modulus (8192 bits)?

Whilst I understand how the RSA algorithm works, I don't understand how the CPU operates when it needs to use the mod function with a huge number $n$, for example. ...
28
votes
2answers
11k views

What is a white-box implementation of a cryptographic algorithm?

What is a white-box implementation? Does a white-box implementation have specific properties?
26
votes
5answers
3k views

Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...
22
votes
6answers
13k views

Types of Cryptography for a 4-8 bit microcontroller

This is more of a research question. I was wondering what types of crypto algorithms would work best on a small 4-8 bit micro controller. I recently read a paper called Security Considerations for ...
21
votes
3answers
4k views

How is bitslicing faster?

I have read a paper on Bit Slicing and Lightweight crypto but cannot understand how bitslicing makes encryption scheme faster. Please can someone explain with an example exactly how bit slicing makes ...
21
votes
3answers
4k views

Known methods for constant time (table-free) AES implementation using 'standard' operations?

There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar ...
19
votes
3answers
9k views

Cryptanalysis to reverse engineer a hash?

I understand this may not be the best place to ask a question like this, but I believe that this community may be the best/only place I can ask such a question. I have inputs and outputs from an in-...
19
votes
3answers
9k views

What is the recommended number of iterations for Argon2?

I've recompiled my operating system ("LionBSD" based on FreeBSD) to use Argon2i as the default password hashing algorithm in crypt/libcrypt. I'm wondering what the recommended number of iterations ...
18
votes
7answers
8k views

Why is SRP not widely used?

SRP seems to be a very good password authentication protocol, compared to any other things used now. So why is there no popular implementations, or even no working secure implementations? I tried to ...
16
votes
3answers
6k views

How can a random salt for a hash function work in practice?

I understand the theory behind the use salts in hash functions, but when I see it implemented, the implementations always generate the salt on the fly and the salt appears to be different for every ...
16
votes
1answer
2k views

Edwards / Montgomery ECC with Weierstrass Implementation?

So let's assume I want to perform Ed448 or Ed25519 digital signatures or want to perform a DH key-exchange. Assume further that those curves (Curve448 or Curve25519) are required. But the problem is, ...
16
votes
3answers
4k views

Webcam random number generator

I have a question about random number generators. I have read from a real random number generator, based on a webcam ("randcam"). My problem is, that I do not really understand how the generation of ...
15
votes
2answers
8k views

How fast can a SHA-256 implementation go?

I'm looking for high-speed SHA-256 implementations, and specifically, ones with low latency; that is, the time between when you submit the message block, and when the output (or internal state) is ...
14
votes
2answers
1k views

Interesting implementation practices in popular crypto library

So reading through the salsa20 implementation for the crypto library for go-lang, I noticed something interesting. Specifically this portion. It looks like something I would expect from someone ...
14
votes
3answers
2k views

Should I delete cryptographic data from memory?

When dealing with cryptographic data, is there a chance that attacker recovers portion of data I used in my program? Should I try to delete every bit of keys and encrypted data that I used, overwrite ...
13
votes
1answer
2k views

Why do crypto libs use table lookups when they're vulnerable to timing attacks?

AESEngine.java, from BouncyCastle, uses table lookups as does aes_x86core.c, in OpenSSL. But per Cache-timing attacks on AES table lookups like what OpenSSL and BouncyCastle are doing are vulnerable ...
12
votes
4answers
2k views

Can I determine if a user has the wrong symmetric encryption key?

We're using the Objectivity/DB object database with a custom encryption plugin that encrypts serialized objects on disk. Encryption uses AES with a shared secret key held by all users. I would like to ...
12
votes
2answers
1k views

Are there any signature schemes for underpowered devices (8-bit microcontroller)?

I am currently researching into a small scale home automation system, aiming for cost. The system architecture is basically one master and several slaves which are connected in parallel. Recently i'...
12
votes
1answer
190 views

WOTS+: Why does it XOR before running data through the hash function?

I'm implementing WOTS+ in a new language and I can't seem to wrap my head around the fact that WOTS+ XOR's their input with its mask right before hashing it. I tried to look for any reasoning but so ...
12
votes
2answers
2k views

Linkable ring signature scheme

I need an implementation of linkable ring signature, a ring signature which allows identifying whether two signatures belong to the same signer. It has important privacy-related applications, like e-...
12
votes
1answer
960 views

On Linux, does /dev/random unblocking imply that /dev/urandom is seeded?

Linux has the familiar problem that /dev/random blocks too much (insisting on being information-theoretically secure), while /dev/urandom doesn't block enough (it will return data before it's been ...
12
votes
1answer
1k views

Is it possible to test implementation for side-channel attacks?

When it comes to implementing cryptographic algorithms, there seems to be a big focus on the difficulty of doing so without introducing the potential for side channel attacks and the knowledge ...
11
votes
2answers
929 views

Can one implement AES on 4-bit microcontroller?

It is possible to implement AES on 4-bit microcontroller? As far as I know, AES on 8-bit microcontroller are common especially for light weight application such as the RFID. I have yet to come across ...
11
votes
2answers
3k views

How does hash speed vary based on string length?

Surprisingly I have not been able to find an answer to this question on Google. If I have a function that is based on any of the popular hashing algorithms used for password generation, by what ...
11
votes
2answers
2k views

Different ways/algorithms for implementing AES

I have seen a couple software implementations of the Advanced Encryption Standard. They are pretty much straight forward, i.e. they are implemented exactly the same way as the AES is described. This ...
11
votes
2answers
2k views

How should I store passwords that need to be available in plain text?

Suppose I need to store login information for a third-party website for a few users, how would I go about doing it? Since I am logging into a third party website, I need the password in plain-text, ...
11
votes
2answers
3k views

Which crypto libraries/programs do we have the most confidence in? [closed]

I have recently begun studying crypto. If it's one thing I have learned it's that we should not implement our own crypto. Therefore we should look to using existing software and libraries. When I go ...
11
votes
1answer
873 views

Why x00 is usually avoided in salt?

In .NET Framework, there is a cryptographic Random Number Generator (RNG) provider which enables to generate a cryptographically strong sequence of random bytes. This provider contain, among others, ...
10
votes
3answers
4k views

Accelerating SHA-1

I have a program where computing SHA-1 is the bottleneck. This is using OpenSSL 1.0.0e on a 2.6Ghz 16-core Opteron where I get about 325MiB/s throughput. (SHA1 here is via Andy Polyakov's x86-64 ...
10
votes
1answer
2k views

Should the secret key of Shamir's secret-sharing algorithm be interpreted byte by byte?

Should the secret message of Shamir's secret-sharing algorithm be interpreted and processed byte by byte? Interpreting it byte by byte makes it easier to process, but in case one of the shareholders ...
9
votes
6answers
9k views

Is there any open-source white-box implementation of AES or DES? [closed]

I googled it, but got no result. There is a binary executable of a white-box implementation of DES (scroll down), but no source code is provided. The same page also links various papers about white-...
9
votes
2answers
6k views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ...
9
votes
2answers
789 views

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly? I was ...
9
votes
2answers
4k views

On-the-fly computation of AES Round Keys for decryption?

The usual implementation of AES first computes all the Round Keys sequentially starting from the key, and stores them in RAM for later uses. However, when enciphering a single block with a key that ...
9
votes
1answer
482 views

Can Whirlpool take advantage of AES-NI?

Whirlpool uses a modified version of the AES / Rijndael algorithm. Can Whirlpool take advantage of AES-NI instructions (or possibly other specialized constructs) on Intel and Intel compatible ...
9
votes
3answers
2k views

How can my application make sure the right symmetric key is used for decryption?

I am developing an Encryption/Decryption Utility using Adobe AIR. I have chosen the AES algorithm and currently use the as3crypto library for this. My query is in ...
9
votes
5answers
3k views

Software implementation of a commutative cipher?

I've got an application (detailed below) that calls for the use of a cipher that is commutative. I've been doing some googling & reading, and there are two algorithms that seem to get mentioned ...
9
votes
1answer
421 views

Are there any security issues when replacing the SHA-256 initialisation values?

As RFC 4634 describes in section 6.1, SHA-256 is initialized using eight 32-bit words. These were obtained by taking the first 32 bits of the fractional parts of the square roots of the first eight ...
8
votes
2answers
1k views

Hardware AES: can we have a decryption implementation only?

I'm wondering if implementing only the AES decryption can reduce the hardware cost? And does anybody have some examples of the cost (speed, size) of hardware AES implementation?
8
votes
3answers
650 views

Where can I find a description of the SHA-0 hash algorithm?

Where can I find the description and or pseudocode for the SHA-0 hash algorithm? I am looking for something on these lines: HMAC RIPEMD. I have been implementing a few of those (HMAC, HOTP, TOTP and ...
8
votes
3answers
347 views

Should a company ever implement a (recent) published cryptographic protocol

I understand that you should never, EVER, EVER implement your own unpublished cryptographic protocols. This topic has been well discussed in many places, e.g. here. However, once a protocol has been ...
8
votes
2answers
326 views

Timing vulnerability of byte array equality test?

Would the following code to test MAC equality leak timing information ? ...
8
votes
1answer
275 views

Branchless AES Implementation

Imagine a branchless implementation of the AES-128 cipher. Are there any benefits over the implementation that contains branches, other than possible prevention of timing attacks? Is it even true, ...
8
votes
2answers
1k views

How does Clifford Cocks 'Non-Secret Encryption' work?

I have read Clifford Cocks "A Note on 'Non-secret Encryption'" and thought I would try to implement this, but I don't seem to be able to get it to work. I'm obviously missing something. From the ...
8
votes
1answer
150 views

How to implement “online” feature of GCM?

I've heard that Galois Counter Mode (GCM) is an "online" encryption algorithm—it is not necessary to know the size of the input ahead of time. But does GCM require that all authenticated-but-not-...
8
votes
1answer
413 views

Security of Carter-Wegman polynomial authenticators, and their concatenation?

Carter-Wegman polynomial authenticators For a given finite field $(\mathbb F,+,\times)$ of $f$ elements, define a Carter-Wegman polynomial authenticator for a message $M=m_1\|m_2\|\dots\|m_l$ of $l$ ...
8
votes
1answer
414 views

Do people not care about side channel resistance?

Recently, I have been browsing a lot through libraries that implementing Shamir secret sharing. I see a lot of code that implements this cryptographic algorithm without any side channel (timing/branch/...
8
votes
1answer
3k views

What is the proper way to use a client nonce?

I've implemented an API for one of my clients, it relies on nonces and a shared secret. The structure: Client's Site (CS) requests nonce from My App (MA), posting their username MA verifies the ...
8
votes
2answers
15k views

How to obtain KCV from the key

Simple question: we have AES 128 encryption and a key. How can we calculate the key check value (KCV)? One example: key is 48C3B4286FF421A4A328E68AD9E542A4 and KCV should be 77DC84. I am trying it ...