Questions tagged [implementation]

Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.

Filter by
Sorted by
Tagged with
8
votes
1answer
439 views

Security of Carter-Wegman polynomial authenticators, and their concatenation?

Carter-Wegman polynomial authenticators For a given finite field $(\mathbb F,+,\times)$ of $f$ elements, define a Carter-Wegman polynomial authenticator for a message $M=m_1\|m_2\|\dots\|m_l$ of $l$ ...
5
votes
1answer
3k views

How to use Libsodium encryption (in PHP) in the most secure possible way?

In a PHP project in which fool-proof encryption is fundamental, I'm using the Libsodium library. Hope you guys can shine some light on the following questions. For all of the following functions, it ...
8
votes
1answer
437 views

Do people not care about side channel resistance?

Recently, I have been browsing a lot through libraries that implementing Shamir secret sharing. I see a lot of code that implements this cryptographic algorithm without any side channel (timing/branch/...
2
votes
1answer
219 views

How does the nonlinear function of KeeLoq work?

I want to know how the nonlinear function of KeeLoq works. Here at Wikipedia it says that: The NLFSR feedback function is 0x3A5C742E I understand that ...
29
votes
2answers
12k views

What is a white-box implementation of a cryptographic algorithm?

What is a white-box implementation? Does a white-box implementation have specific properties?
3
votes
2answers
1k views

What do we need white box crypto for?

I am familiar with white box cryptography, but somehow I still fail to see its potential applications? Which situations would necessitate using it? Maybe you can even give me an example or two? I ...
7
votes
1answer
541 views

Is it safe to store both the AES-related data and the PBKDF2-related data (except passwords) in one file?

Assume an "encrypted data package" file format which includes the following data PBKDF2 algorithm salt rounds keylen AES algorithm & mode IV ciphertext where the PBKDF2 salt and AES IV are ...
-2
votes
1answer
289 views

OpenSSH_7.4 Encryption Config [closed]

I have noticed that recent versions of OpenSSH allows the reporting of capabilities by using ssh -Q . The last time I really looked at my SSH setup was a couple of years ago (stribika) -- but I have ...
0
votes
1answer
478 views

Need of Image Encryption [closed]

Question is simple yet confusing, why there is the need for image encryption. How text encryption is different from image encryption if using same technique like AES, DES, Chaotic algorithm. If the ...
1
vote
1answer
5k views

How do you get the original salt after it's been hashed to the user's password in the database?

I'm researching how to do salt and hashing. I'll be using SHA256. Here is what I found: To Store a Password Generate a long random salt using a CSPRNG. Prepend the salt to the password ...
2
votes
3answers
1k views

Why is AES encryption decryption not platform agnostic?

We work on C++ code which compiles on Windows and Linux. I have been told that AES encryption/decryption is platform dependent. Is it true? If so, why is it OS dependent?
2
votes
1answer
179 views

How to implement a hash function $H \colon \{0,1\}^* \to \mathbb{Z}_p^*$?

I would like to implement a hash function $H \colon \{0,1\}^* \to \mathbb{Z}_p^*$ such that $p$ is a prime number and $\log_2(p) > 256$. I am wondering if it is a good idea to use the hash function ...
11
votes
2answers
3k views

How should I store passwords that need to be available in plain text?

Suppose I need to store login information for a third-party website for a few users, how would I go about doing it? Since I am logging into a third party website, I need the password in plain-text, ...
0
votes
1answer
96 views

Does this ECIES scheme make MAC redundant?

I've implemented ECIES (see the below pseudo-Python). ...
4
votes
1answer
422 views

Full encryption of IDs, partial decryption with customer specific key

I am looking for a "partial" encryption/decryption algorithm. Let's say I am encrypting the following List of IDs (long values) $[1,2,3,4]$ (with a secret key) to an encrypted string $e$, I would ...
2
votes
1answer
345 views

Size and usage of lookup table in cryptographic schemes

I would like to understand the typical size of a lookup table for software implementations of a cryptographic scheme. What size is considered reasonable? What make them (in)efficient? Are there ...
3
votes
1answer
239 views

Necessary to authenticate nonce if authentication-key is derived from nonce?

Lets suppose my messages are composed like this: unique_message_nonce + encrypted_message + mac Because I don't have an AEAD-scheme, I can encrypt and authenticate ...
7
votes
3answers
1k views

Is LUKS Anti-Forensic information splitter (AFsplit) indistinguishable from random data?

I want to know if AFsplit(random_data_input, stripes, digestmod=sha) output is indistinguishable from random data. The attacker ...
7
votes
1answer
556 views

How can a non-crypto-expert implement crypto libraries in a programming language?

I'm a regular developer and thus not a crypto expert. I'd like to use ECDSA as a library in a programming language, Idris, which still doesn't have one. I could, obviously, try and port a particular ...
3
votes
1answer
715 views

Crypto++: How to re-generate pseudo random integers in Crypto++

I'm using Crypto++ to implement my protocol to mask a value $y_i$ by a pseudo-random value $r_i$ such that $m_i=y_i \cdot r_i$. Since there are many $r_i$'s I want to generate them using PRNG and then ...
2
votes
1answer
251 views

Using negative values / unsigned integers to implement SHA-2

What happens if we allow implementation of SHA-2 using negative values? What happens if a negative value was used in the first round? Would the algorithm still result in a secure value? I have a ...
1
vote
1answer
93 views

Online attendance system

This summer I have made a website for my school's NHS program and integrated it with google scripts to automate tasks such as accessing how many hours users have and to allow members to view how many ...
27
votes
5answers
3k views

Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...
1
vote
1answer
260 views

AES ShiftRow Confusion

I'm implementing AES and I'm getting confused in the ShiftRows step. So far, my key expansion and SubBytes works and I get the ...
3
votes
2answers
977 views

Implementation of ECC over binary field

I am supposed to implement ECC over binary field (in C++) for equations of the type - $y^2 + xy = x^3 + ax + b$, as my project. I wish to include the following features : The user will enter a prime ...
0
votes
1answer
114 views

Which is the most overall 'compatible' encryption type? [closed]

What is the "MP3" of encryption formats today, which hopefully will make it easy and compatible to send to other recipients (not via e-mail), without them having to download and learn a software suite ...
8
votes
1answer
224 views

LWE: error and float operations

Background I'm trying to make sense of the error in implementations of LWE and R-LWE. In LWE and R-LWE error is added to vectors in lattices to make it computationally infeasible to recover any ...
7
votes
1answer
640 views

Goofs that could creep in ECDSA signature verification?

What are goofs that could creep in ECDSA signature verification, perhaps with focus on curves based on prime-order $\mathbb Z_p$, specifically P-256 aka secp256r1? Is it possible to construct test ...
1
vote
0answers
208 views

Which cryptographic operations can be optimized with a GPU? When shouldn't it be done?

I'm under the impression that GPUs are only used to optimize some (not all) of a given cryptographic operation. Furthermore, I've only seen this GPU optimization done in Bitcoin. This observation ...
4
votes
1answer
316 views

O(1) EC Linkable Ring Signature Without Group Manager

I'm looking for a practical example for creating an EC Ring Signature, very much at the level of detail as found in the CryptoNote Whitepaper but with O(1). I saw Short Linkable Ring Signatures for E-...
1
vote
1answer
2k views
1
vote
2answers
1k views

Calculating Polynomial Inverse with extended euclid in java

I'm trying to understand the NTRU-PKCS and therefor I wanted to code a naive Version of it. Now my Problem: I tried to calculate the inverse of a Polynomial with an extended Version of euclids ...
11
votes
2answers
2k views

Different ways/algorithms for implementing AES

I have seen a couple software implementations of the Advanced Encryption Standard. They are pretty much straight forward, i.e. they are implemented exactly the same way as the AES is described. This ...
8
votes
3answers
387 views

Should a company ever implement a (recent) published cryptographic protocol

I understand that you should never, EVER, EVER implement your own unpublished cryptographic protocols. This topic has been well discussed in many places, e.g. here. However, once a protocol has been ...
1
vote
2answers
465 views

System parameters in identity-based encryption

In IBE schemes, the system parameters are $(q, \mathbb{G}, F, \hat{e}, P, Q, T, H_1)$. I don't know $\hat{e}$. For example, in type A pairing… ...
0
votes
1answer
394 views

Wikipedia pseudo code is unclear about how to pad SHA-512

In Wikipedia pseudo code of SHA-512 the padding section says pad 1 bit then 0 bits. It then goes on to say append length without 1 or 0 padding. What does that mean? https://en.wikipedia.org/wiki/SHA-...
9
votes
1answer
473 views

Are there any security issues when replacing the SHA-256 initialisation values?

As RFC 4634 describes in section 6.1, SHA-256 is initialized using eight 32-bit words. These were obtained by taking the first 32 bits of the fractional parts of the square roots of the first eight ...
14
votes
2answers
1k views

Interesting implementation practices in popular crypto library

So reading through the salsa20 implementation for the crypto library for go-lang, I noticed something interesting. Specifically this portion. It looks like something I would expect from someone ...
1
vote
0answers
147 views

zero knowledge messaging implementation

I understand that messages are encrypted using a symmetric algorithm such as AES, and the symmetric key is encrypted using an asymmetric algorithm such as RSA. In my particular implementation, the ...
5
votes
2answers
431 views

implementing GCM with dev/urandom for a nonce

I'm currently trying to integrate GCM into my code, and I have just enough knowledge to know I'm probably doing this wrong. I know for GCM and other CTR like ciphers, using the same key with the same ...
3
votes
1answer
153 views

Can the attack against SHA-1 be parallelized?

Can this attack be parallelized? It is a $2^{57}$ complexity collision attack on SHA-1 based on disturbance vectors. If it is practical it is easy on a GPU ($\approx1.1$ GPU-days). If it is ...
8
votes
1answer
161 views

How to implement “online” feature of GCM?

I've heard that Galois Counter Mode (GCM) is an "online" encryption algorithm—it is not necessary to know the size of the input ahead of time. But does GCM require that all authenticated-but-not-...
3
votes
0answers
60 views

How can I obtain a code with same weight codewords?

I want to implement "A new one-time signature scheme from syndrome decoding". My first challenge is how to obtain $P$. $P$ is a generator matrix whose codewords have weight not exceeding an integer ...
5
votes
1answer
101 views

Is there a standard method to compare hardware-implemented ciphers?

I have been reviewing literature and I am trying to determine the best method to compare ciphers in hardware. The two methods that seem to be somewhat de facto standard the literature are looking at ...
1
vote
0answers
106 views

What do the inputs of `hash_df` look like?

I am making an implementation of hash_df (NIST documentation found in SP800-90A.pdf on page 67) I found “Does hash_df use binary or an ASCII hexadecimal ...
1
vote
1answer
55 views

Ensuring integrity in a multi-user secret vault

Assume you have a vault containing secrets. Each one is encrypted for at least one authorized recipient using some public key crypto (one file per secret). Each authorzied recipient can decrypt all of ...
9
votes
2answers
847 views

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly? I was ...
1
vote
0answers
68 views

Why does facebook uses two secrets to secure API

I am working on a public API for my personal forum. Concerning the authentification of the requests and responses I plan to hash the payloads with a secret, known to me and the API user, and send the ...
-1
votes
1answer
787 views

What is the simplest digital signature algorithm known?

The hardest part about this question is explaining what I mean by simple. I'm measuring simplicity as, simply, the amount of lines of code it takes to implement that algorithm in a simple programming ...
1
vote
1answer
248 views

Costs of operations in elliptic curves explanation

I'm trying to understand the cost of operation in elliptic curve (only Weierstrass curve for simplicity) from Wikipedia and there seems to be lack of online information/papers regarding this. I ...

1 2 3
4
5
9