Questions tagged [implementation]

Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.

Filter by
Sorted by
Tagged with
1
vote
1answer
67 views

How should one handle the identity value and other “obviously” weak secret random values?

In RSA, ECDSA, ElGamal and quite a few other schemes, using a secret (random) value equal to 1 might not provide any form of security, while still being mathematically sound. For RSA, ECDSA or ...
2
votes
1answer
622 views

ECDSA with common nonce?

I'm new to cryptography, and I've searching about ECDSA because I'm trying to solve a CTF. I've already check this site and Google, and I think I'm in the right path, but probably I am missing ...
1
vote
1answer
69 views

A bit-sliced implementation (or the algebraic normal form) of the two FIDES S-Boxes

I want to see a bit-sliced implementation of 5-bit and 6-bit S-Boxes of FIDES or, at least, a representation of these two functions in algebraic normal form. Where can I find it?
48
votes
2answers
7k views

How is the Swiss post e-voting system supposed to work, and how was it wrong?

I read that the Swiss post had an e-voting solution developed, made it possible to obtain the source code for review, and that vulnerabilities were found. Apparently we are not talking about the ...
7
votes
2answers
605 views

Is there an upper limit to plaintext size in XSalsa20Poly1305?

While fiddling with the NaCl implementation in Go, specifically SecretBox, a general crypto question came up after reading the documentation. Quote: Package secretbox encrypts and authenticates ...
1
vote
0answers
57 views

Ressources for implementing cryptography [closed]

I am looking for resources on how to implement cryptographic algorithms. I am a cryptographic researcher, so I am not interested in reviewing the basics, and I don't need the talk about it not being ...
0
votes
1answer
180 views

How to represent the point-at-infinity(Elliptic Curves) in code? [duplicate]

I am writing code for Elliptic Curve Cryptography. I have a class class EllipticCurvePoint. ...
8
votes
3answers
1k views

Where can I find a description of the SHA-0 hash algorithm?

Where can I find the description and or pseudocode for the SHA-0 hash algorithm? I am looking for something on these lines: HMAC RIPEMD. I have been implementing a few of those (HMAC, HOTP, TOTP and ...
1
vote
1answer
156 views

SHA3-512 troubleshooting - is there a worked example for hashing the “zero-length string”?

(I wondered if this question should be asked on StackOverflow instead because it's a programming related issue, but it's bound to the intricacies of SHA3, which I figured was a better fit for Crypto....
0
votes
1answer
50 views

Reference books in security and privacy preservation [closed]

I am looking for books or reference guides to learn and teach "cryptography, security and privacy preservation techniques"? I need some advice to good resources that I can use.
0
votes
1answer
73 views

How to interpret a specific mathematical notation in “FIPS 202” (SHA-3 / Keccak)

tl;dr What does "d <= |Z|" mean in the context of bit array manipulations? As a learning exercise I'm working on an implementation of SHA-3. I am not a cryptography specialist in any way but I ...
1
vote
1answer
325 views

What does modular inversion mean?

I'm trying to implement an e-voting algorithm, which is described at the paper "Internet Voting Protocol Based on Improved Implicit Security" by Abhishek Parakh & Subhash Kak. At the Example 1 ...
3
votes
1answer
111 views

Crypto implementations bits and bytes

Reading many papers in the homomorphic encryption domain and in cryptography, a lot of schemes operate on bits as 1 and 0. If I wanted to implement a scheme, for example, Gentry's FHE, would I have ...
8
votes
2answers
1k views

Hardware AES: can we have a decryption implementation only?

I'm wondering if implementing only the AES decryption can reduce the hardware cost? And does anybody have some examples of the cost (speed, size) of hardware AES implementation?
1
vote
1answer
63 views

Why algorithmic symmetry is important in hardware implementation?

In AES, the encryption and decryption functions ordered in a symmetric way, I mean the same order of functions are used inside the round structure of both encryption and decryption (subbytes, ...
1
vote
0answers
101 views

Burmester Desmedt confused on the last step

I try to implement in code the traditional burmester desmedt algorithm for group key agreement: But I have the following question regarding the last step: $K=k_{i-1}^{nx_i}K_i^{n-1}K_i+1^{n-2}\dots ...
2
votes
2answers
167 views

Efficient way of generating a random number of N (less than 64) bits with exactly M bits equal to one [closed]

Would there be an efficient way to implement a function with the following signature: unsigned long long int random_word(size_t n, size_t m) that would generate ...
4
votes
3answers
1k views

Is the curve25519 algorithm a special(implementation) one of ECDH?

It's the first time for me to learn about Key Exchange Protocol. And I thought that in both ECDH and DH there is a necessary step to share some public infomation(the common parameters) to each sides ...
11
votes
3answers
5k views

Accelerating SHA-1

I have a program where computing SHA-1 is the bottleneck. This is using OpenSSL 1.0.0e on a 2.6Ghz 16-core Opteron where I get about 325MiB/s throughput. (SHA1 here is via Andy Polyakov's x86-64 ...
1
vote
1answer
72 views

Lookup table for DSA/ECDSA/Schnorr multiplication

Something in common to [EC]DSA and related signature schemes like Schnorr is that the most expensive part of signing is calculating $r = g^k$ in the group for some per-signature $k$ of length $b$ bits....
3
votes
2answers
416 views

Implementing randomness extractors

A randomness extractor is a function that takes an input sampled from high entropy distribution and outputs a value that is close to uniform distribution. It is slightly different from a PRG. PRGs ...
3
votes
1answer
672 views

How are Elliptic Curve private and public keys actually used to encrypt or sign data?

I've read article after article about curve parameters, generator points, the dot operation, and how you dot the generator point priv times to get the ...
2
votes
1answer
59 views

Serpent intermediate rounds differs from example code, but result is still correct, is it a problem?

Through great pain and suffering, I've been able to successfully implement Serpent. For example, when using the key 00112233445566778899aabbccddeeff, and encrypting ...
2
votes
3answers
214 views

Are XOFs and KDFs more usable than DRBGs?

CSPRNGs have 2 design requirements: output unpredictability, back-tracing resistance. In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization,...
5
votes
1answer
203 views

How would we design a fast circuit to solve LCS35?

LCS35 is a time-lock puzzle, stated in Ronald L. Rivest's Description of the LCS35 Time Capsule Crypto-Puzzle [1] (April 1999). That instantiates a system in Ronald L. Rivest, Adi Shamir and David A. ...
2
votes
2answers
206 views

Why should one model an entropy source in order to build a TRNG?

Some assert that a theoretical model of the unconditioned source must be created when building any TRNG. It's believed to be a fundamental requirement. So a few related questions arise:- What is a "...
1
vote
1answer
144 views

Can I use NaCl's scalar multiplication functions for Diffie Hellman Key Agreement?

I want to create some software that performs diffie hellman group key agreement but I don't want to reinvent the wheel even if I know how it's done. So I came accross the NaCl library, especially the <...
8
votes
1answer
17k views

What is U2FsdGVkX1?

Using CryptoJS 3.1 I noticed that using 3Des, the encrypted message always start with U2FsdGVkX1 Why is the first part of the encryption always the same? What information does this hold and how ...
5
votes
2answers
655 views

How to securely map messages to points on an elliptic curve

I'm implementing a demonstration hybrid cryptosystem in Python (FinCrypt, I know the name is bad) and I'm migrating over from my Weierstrass curve implementation, which was based off of this, to one ...
3
votes
1answer
368 views

Setting protocol parameters to achieve concrete security

Background One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
2
votes
1answer
386 views

Sane implementations of Bitcoin cryptography routines w.r.t. side-channel attacks

Bitcoin uses SHA-256, Base58Check, ECDSA (Sep256k1) and RIPEMD-160 as the basis of its encryption (see this article for a short guide on how addresses are created). I would like to create an iOS-...
6
votes
1answer
201 views

Does a masked look-up table prevent cache timing attacks?

When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...
1
vote
0answers
110 views

Efficient polynomial ring multiplication with coefficients in GF(2^s)

Is there something similar (or an other efficient approach) to the NTT for the multiplication of polynomials in polynomial rings modulo $X^{2^n} + 1$ with coefficients in $\operatorname{GF}(p)$ with $...
2
votes
1answer
493 views

Implementation details of the π step of the Keccak round function

In the official Keccak implementation overview, there is a section discussing different ways to organise the internal Keccak-f state -- namely section 1.2, Bit and byte numbering conventions -- and at ...
-5
votes
1answer
193 views

at rest encrypton question from someone who knows nothing

this forum is way above me and the members here are far, far smarter than I am, so this probaby isn't the place to ask such a simple question, but whatever. All I wanted to ask is for at rest ...
1
vote
1answer
98 views

Implement Google Adiantum else where?

Google made the headlines with its new Adiantum encryption method, and i read (TechCrunch) that: In the meantime don’t expect any instant gains, but future low-power devices may offer better ...
0
votes
0answers
51 views

Proxy decrypt algorithm in Extended Proxy-Assisted Attribute Based Encryption (ABE) Scheme

Context I'm trying to implement the Attribute-Based Encryption (ABE) scheme described in the paper - Extended Proxy-Assisted Approach: Achieving Revocable Fine-Grained Encryption of Cloud Data (Yang ...
5
votes
2answers
2k views

Are developers expected to implement Diffie-Hellman key exchange themselves?

I noticed that the GO standard library has some really nice functions for performing AES encryption / decryption in various modes. However, I couldn't (yet) find anything for Diffie-Hellman key ...
0
votes
1answer
66 views

Starting stream cypher, first block (Salsa20)

I'm implementing Salsa20 in Rust for fun. I have the initial state (4x4 32-bit matrix) setup from the key, nonce, and stream position 0. I'm using the Wikipedia Salsa20 article as reference, and I'm ...
1
vote
1answer
96 views

Reducing the XOR's in Implementation Cost

Suppose that we want to implement the following equations in binary finite field. $$ \begin{array}{l}\tag{1} y_{{1}}=x_{{1}}\oplus x_{{2}}\oplus x_{{7}}\oplus x_{{8}},\\ y_{{2}}=x_{{1}}\oplus x_{{2}}\...
2
votes
1answer
339 views

zero knowledge framework for c programs - how to prove correct C program execution with private inputs

I am looking for a zk framework that could be used for proving correct execution of programs written in C (or any other high level language) such as: I know x s.t. SHA-256(x) = y (y is public, x is ...
9
votes
1answer
572 views

Can Whirlpool take advantage of AES-NI?

Whirlpool uses a modified version of the AES / Rijndael algorithm. Can Whirlpool take advantage of AES-NI instructions (or possibly other specialized constructs) on Intel and Intel compatible ...
3
votes
1answer
487 views

Choosing good entropy $g$ and $p$ for a classic Diffie-Hellman Key exchange

When selecting $g$ and $p$ for the Diffie-Hellman modular exponentiation: $ s= g^x \bmod p $ Which pairs of $g$ and $p$ are considered good nowadays, are recommended by bibliography? What I try ...
1
vote
0answers
83 views

Could you design something like a ring signature that uses website accounts instead of keys?

Ring signatures allow one to prove that you own a private key corresponding to a public key from a set of keys, without revealing which private key you control. This is useful if you are part of some ...
4
votes
1answer
124 views

Magic Number to calculate number of rounds for M-R in FIPS 186-4

In Fips 186-4, there is an algorithm in Appendix F (at page 117 in my copy of the 2013 version) to calculate the number of rounds of the Miller-Rabin primality test to random bases. Does anybody ...
1
vote
1answer
584 views

Polynomial multiplication and division in $2^{128}$

I want to multiply and divide polynomials, and implement the extended Euclidean algorithm for polynomial greatest common divisors, over a Galois Field of size $2^{128}$. Moreover, I want to use the ...
5
votes
1answer
318 views

MARS and RC6 in CUDA

I am working on a project where I am benchmarking the 5 AES finalists (Rijndael, Twofish, Serpent, MARS and RC6) on CUDA Hardware. My problem is that I am no experienced CUDA programmer. My approach ...
1
vote
2answers
129 views

Implementations of GCM with 64-bit cipher

The paper The Galois/Counter Mode of Operation (GCM) describes mainly the 128-bit case, for use with 128-bit block ciphers such as AES. AES-GCM test vectors are available from NIST. The paper also ...
2
votes
1answer
7k views

How can I implement the “Multiplication Modulo” and “Addition Modulo” operations in IDEA?

I am currently working on IDEA (International Data Encryption Algorithm), and I don't know how to perform Multiplication Modulo and Addition Modulo. This is how IDEA operates: IDEA operates on 64-bit ...
13
votes
1answer
273 views

WOTS+: Why does it XOR before running data through the hash function?

I'm implementing WOTS+ in a new language and I can't seem to wrap my head around the fact that WOTS+ XOR's their input with its mask right before hashing it. I tried to look for any reasoning but so ...

1
2
3 4 5
9