Questions tagged [implementation]

Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.

Filter by
Sorted by
Tagged with
13
votes
1answer
274 views

WOTS+: Why does it XOR before running data through the hash function?

I'm implementing WOTS+ in a new language and I can't seem to wrap my head around the fact that WOTS+ XOR's their input with its mask right before hashing it. I tried to look for any reasoning but so ...
2
votes
1answer
151 views

Non interactive Zero Knowledge Proof for Satisfiability of Pairing Product Equations

In the paper "Simulation-Sound NIZK Proofs for a Practical Language and Constant Size Group Signatures" from Groth, the section 6 describes a NIZK proof for pairing product equations. I only know ...
16
votes
3answers
4k views

Webcam random number generator

I have a question about random number generators. I have read from a real random number generator, based on a webcam ("randcam"). My problem is, that I do not really understand how the generation of ...
1
vote
0answers
44 views

Gate count for Ring-LWE

In one of my recent research, I need to compare the number of gates needed in Ring-LWE encryption to AES in the circuit model. For AES we can find some estimation like this site, but for Ring-LWE we ...
4
votes
0answers
234 views

Why is this Trivium implementation working bytewise instead of bitwise?

I am currently looking into a Trivium implementation available in the FELICS framework. Parameters of the Trivium stream cipher: Key size: 80 bit IV size: 80 bit State size: 288 bit The Trivium ...
1
vote
2answers
64 views

Is one big file as secure as X small files with the same password?

Hello people of StackExchange. It's my first time asking and I know little about Cryptography, so be gentle. My problem can be simplified to this: I can create a 2GB Volume that contains 1GB of text ...
4
votes
1answer
165 views

Can the CRT speed-up Paillier decryption by more than a factor of two?

In the Pailler cryptosystem, decryption goes $m\gets\displaystyle\left\lfloor\frac {\left(c^\lambda\bmod n^2\right)-1}n\right\rfloor\mu\bmod n$ with $\mu<n$ being a part of the private key just ...
7
votes
2answers
202 views

Regular and Efficient doubling in $GF(2^n)$

A naive approach to compute a multiplication $a \cdot b$ in a Galois field of the form $GF(2^n)$ is the russian peasant algorithm. However, it does not run in constant time and therefore is not safe ...
22
votes
3answers
14k views

What is the recommended number of iterations for Argon2?

I've recompiled my operating system ("LionBSD" based on FreeBSD) to use Argon2i as the default password hashing algorithm in crypt/libcrypt. I'm wondering what the recommended number of iterations ...
3
votes
1answer
267 views

Constructing of 16x16 Involutory Binary Matrices of Branch Number 7

In the PDF “Algebraic Construction of 16×16 Binary Matrices of Branch Number 7 with One Fixed Point”, it was given that: ...
8
votes
3answers
2k views

Usage difference between x86 RDRAND and RDSEED

Modern x86 CPUs often have the RDRAND and RDSEED instructions for hardware generation of random numbers. I just don't understand the difference between them. Intel has this document: https://...
15
votes
2answers
11k views

How fast can a SHA-256 implementation go?

I'm looking for high-speed SHA-256 implementations, and specifically, ones with low latency; that is, the time between when you submit the message block, and when the output (or internal state) is ...
1
vote
0answers
56 views

What should I change in my implementation to pass from a curve $y^2=x^3+1$ to $y^2=x^3+x$

I tried to change my implementation of pairing in curves $y^2 = x^3 + 1$ to use curves of the type $y^2 = x^3 + x$ but it didn't work. I thought the only thing I had to change in my code was the ...
1
vote
1answer
178 views

In a specific Paillier implementation, why is r prime?

I have a question about an implementation of the Paillier cryptosystem. In the description of Paillier above, encryption of a plaintext message $m$ on $\mathbb {Z}_{n^{2}}$, $0\leq m<n$, proceeds ...
4
votes
3answers
468 views

How to Calculate GE of Sbox?

How to count Gate Equivalent (GE) of Sbox used in block Cipher. For example how much area does the Sbox of Block Cipher Prince take? And How is it calculated?
3
votes
1answer
1k views

Supersingular Isogeny Key Exchange Software [closed]

Are there any optimised implementations of the Supersingular Isogeny Key Exchange by Defeo, Jao, and Plut. It seems like this would be a great drop-in replacement for Diffie-Hellman in both OpenSSL ...
5
votes
1answer
1k views

HW acceleration for Camellia cipher (x86_64/AES-NI/AVX2)

Modern processors support hardware acceleration for various crypto functions such as AES directly, or general vector operations which can be used in crypto ...
4
votes
3answers
1k views

Is there a consensus on what text encoding to use when hashing a string?

Let's suppose we are hashing a string input from the user via keyboard. A string can be interpreted in many different text encodings (ANSI, UTF-8, UTF-16 and many others). Based on what encoding is ...
2
votes
1answer
516 views

Right way to hash elliptic curve points into finite field

I would like to know how I can implement several hash functions : $H_1:\{0,1\}^* \rightarrow P $ with $P \in E(\mathbb{F}_q)$ and $H_2:P \rightarrow \mathbb{Z_q}^*$ And others where the ...
5
votes
2answers
894 views

Why do algebraic proofs apply to cryptography?

How do we know that the number theoretic and algebraic results used in cryptography provide a perfect model for the behavior of integers as implemented in computers? Does there exist a bijection ...
0
votes
1answer
62 views

Can you create asymmetrical encryption algorithm from symmetrical, without knowing how the algorithm works?

Let's imagine that we have some symmetrical encryption algorithm, that has only two functions: Encrypt(Data, Key) and ...
1
vote
1answer
1k views

Decode & Verify Base64urlUInt-encoded RS256 Public Key from Google

According to Google, to access the id_token it sends along with Access Tokens (for accessing their API), you must first validate the token using the RS256 Public Key available from this page. The ...
1
vote
0answers
83 views

Sigma protocol compiler?

Is there a well maintained, preferably documented, Sigma protocols compiler library? i.e. takes an abstraction of statements to prove, and outputs a cryptographic protocol between verifier and prover? ...
0
votes
2answers
243 views

UDP and AES with C++

I'm implementing different applications that will use UDP to exchange real-time data, thus a low impact on performance is very important. This system will not be connected to the Internet so I just ...
-1
votes
1answer
774 views

ECDH over secp256k1 implementation

I'm using ECDH over secp256k1 in multiple languages, and I saw something a little weird in the rust library I use. After the point multiplication it changes y to <...
1
vote
0answers
76 views

How is pipelined DES different from sequential DES?

I implemented DES Coder in VHDL using ISE IDE by Xilinx in sequential architecture which was pretty easy and straightforward. Now my task is to do the same using pipelined architecture so that the ...
3
votes
1answer
483 views

Wrong Miller's Weil Pairing implementation?

I tried to implement the Miller's Weil Pairing algorithm in python using the book "An introduction to mathematical cryptography" by Hoffstein, Pipher and Silverman. I tried my code with the example ...
1
vote
1answer
94 views

Implementation of ECC operations in BMR

I want to implement computing ECC operations(i.e multiplication) in BMR scheme (secure Multi-party computation) What is the best way to do it? I found Fairplay MPC - to allow BMR computation through ...
1
vote
0answers
140 views

Fermat's FFT based large integer multiplication

I was going through the documentation of GMP (https://gmplib.org/gmp-man-6.1.2.pdf), specially section 15.1.6 where they refer to the use of Fermat's style FFT. I tried to follow the reference but ...
2
votes
1answer
470 views

How to interpret the article claiming NIST P-256 curve to be unsafe?

Here: http://safecurves.cr.yp.to/ , I read that the NIST P-256 elliptic-curve is not safe. The article lists several aspects (off-curve point, side-channel, etc.) where implementing P256 can fail the ...
4
votes
3answers
200 views

How to thwart a cleartext message's size?

Here is a question I don't find addressed in my cryptography books: let's say Alice want to send Bob a message of length N. what is the proper way for Alice to hide N? I am thinking Alice should do ...
23
votes
7answers
10k views

Why is SRP not widely used?

SRP seems to be a very good password authentication protocol, compared to any other things used now. So why is there no popular implementations, or even no working secure implementations? I tried to ...
2
votes
1answer
521 views

Schnorr Identification protocol sometimes wrong?

I'm implementing the Schnorr Identification protocol as part of a larger protocol. In a large percentage of cases, around 20%, my test fails. I don't think it's a code problem, although possible, but ...
3
votes
2answers
190 views

Why does TWINKLE use light instead of current?

TWINKLE is a device devised by Adi Shamir to optimize the sieving step of GNFS. It consists of a cylinder, at the bottom of which are LEDs corresponding to factor base primes which blink with ...
-1
votes
1answer
476 views

How are multiple iterations of SHA-256 handled for longer inputs?

I wrote a python program to perform the SHA-256 function. It works just fine until I try to hash longer strings. If I hash (in HEX) ...
3
votes
1answer
1k views

Varying ECDH key output on different ECC implementations on the secp256k1 curve

Like the title says, I have used several implementations of ECDH, and I have found a discrepancy with libraries that wrap ...
-1
votes
1answer
69 views

How to compute this equation $(g^k)^\alpha\bmod p$

I have a question about implementation. How is an operation like this implemented? $$(g^k)^\alpha\bmod p$$ With all $g$, $k$, and $\alpha$ being large numbers. The thing that I find tricky is that ...
10
votes
6answers
10k views

Is there any open-source white-box implementation of AES or DES? [closed]

I googled it, but got no result. There is a binary executable of a white-box implementation of DES (scroll down), but no source code is provided. The same page also links various papers about white-...
0
votes
1answer
371 views

Cache Timing Attack SHA-3

I’ve been tinkering with SHA-3 for a little bit, and I have some questions regarding the applicability of cache timing attacks on this particular hash function. The two sub functions that I believe ...
1
vote
0answers
172 views

What steps are needed for fully homomorphic encryption? [closed]

In my project work, I want to encrypt the keywords extracted from certain documents by using fully homomorphic encryption. What are the algorithmic steps to perform fully homomorphic encryption on ...
1
vote
1answer
230 views

Is streaming API to ChaCha20-Poly1305 possible or recommended against?

None of the implementations of ChaCha20-Poly1305 AEAD scheme I've seen so far provide a streaming API. Instead, ChaCha20-Poly1305 is presented as an inseparable combination, closely adhering to the ...
-1
votes
2answers
358 views

Can duplication of encrypted characters lead to a weakness in RSA?

Of course, I know RSA is to widely used and tested to have any legitimate threats, but I still am confused by this. I have been trying to implement C++ (in a effort to learn how it works, not to be ...
6
votes
3answers
699 views

Has any alternative to RSA and Discrete Logarithm been standardized for deployment?

Suppose RSA and Discrete Logarithm over any group (including elliptic curves) gets broken what other schemes we have for DEPLOYMENT IMMEDIATELY do we have to rescue the internet from collapse? So ...
4
votes
0answers
94 views

Implications of TLS-SRP client with improper N validation?

During development of a client side application of TLS-SRP, i noticed a bug that allows an attacker spoofing as the server to send custom, but non-arbitrary $N$ values, with the client accepting them. ...
7
votes
1answer
429 views

Does a conditional statement depending on a round number introduce timing attack problems?

In a cryptographic implementation I’m playing with, there’s a round function which includes a conditional if statement. Stripping the superfluous stuff, the C ...
8
votes
2answers
442 views

Timing vulnerability of byte array equality test?

Would the following code to test MAC equality leak timing information ? ...
-2
votes
1answer
653 views

Is it possible to attack an SHA-256 hash seeded with PHP’s mt_rand function?

Is it possible to attack this construction if the attacker only knows the hash? ...
6
votes
1answer
485 views

Is there a quick way to know the length of a message hashed using SHA3?

Let M be the message that has been padded for use into the SHA3 (standardized Keccak) hash function. Is there a way, like it's the case for SHA1, to know the total length of the message M just by ...

1 2
3
4 5
9