Questions tagged [implementation]
Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.
546
questions
1
vote
1
answer
854
views
How to represent the point-at-infinity(Elliptic Curves) in code? [duplicate]
I am writing code for Elliptic Curve Cryptography. I have a class class EllipticCurvePoint.
...
CommunityBot
- 1
8
votes
3
answers
2k
views
Where can I find a description of the SHA-0 hash algorithm?
Where can I find the description and or pseudocode for the SHA-0 hash algorithm? I am looking for something on these lines: HMAC RIPEMD.
I have been implementing a few of those (HMAC, HOTP, TOTP and ...
CommunityBot
- 1
1
vote
1
answer
552
views
SHA3-512 troubleshooting - is there a worked example for hashing the "zero-length string"?
(I wondered if this question should be asked on StackOverflow instead because it's a programming related issue, but it's bound to the intricacies of SHA3, which I figured was a better fit for Crypto....
- 92.6k
0
votes
1
answer
70
views
Reference books in security and privacy preservation [closed]
I am looking for books or reference guides to learn and teach "cryptography, security and privacy preservation techniques"? I need some advice to good resources that I can use.
- 115
0
votes
1
answer
120
views
How to interpret a specific mathematical notation in "FIPS 202" (SHA-3 / Keccak)
tl;dr What does "d <= |Z|" mean in the context of bit array manipulations?
As a learning exercise I'm working on an implementation of SHA-3. I am not a cryptography specialist in any way but I ...
- 48.4k
1
vote
1
answer
368
views
What does modular inversion mean?
I'm trying to implement an e-voting algorithm, which is described at the paper "Internet Voting Protocol Based on Improved Implicit Security" by Abhishek Parakh & Subhash Kak.
At the Example 1 ...
- 3,132
3
votes
1
answer
124
views
Crypto implementations bits and bytes
Reading many papers in the homomorphic encryption domain and in cryptography, a lot of schemes operate on bits as 1 and 0.
If I wanted to implement a scheme, for example, Gentry's FHE, would I have ...
- 48.5k
8
votes
2
answers
1k
views
Hardware AES: can we have a decryption implementation only?
I'm wondering if implementing only the AES decryption can reduce the hardware cost? And does anybody have some examples of the cost (speed, size) of hardware AES implementation?
- 48.5k
1
vote
1
answer
76
views
Why algorithmic symmetry is important in hardware implementation?
In AES, the encryption and decryption functions ordered in a symmetric way, I mean the same order of functions are used inside the round structure of both encryption and decryption (subbytes, ...
- 4,820
1
vote
0
answers
154
views
Burmester Desmedt confused on the last step
I try to implement in code the traditional burmester desmedt algorithm for group key agreement:
But I have the following question regarding the last step:
$K=k_{i-1}^{nx_i}K_i^{n-1}K_i+1^{n-2}\dots ...
- 1
2
votes
2
answers
240
views
Efficient way of generating a random number of N (less than 64) bits with exactly M bits equal to one [closed]
Would there be an efficient way to implement a function with the following signature:
unsigned long long int random_word(size_t n, size_t m)
that would generate ...
- 92.6k
4
votes
3
answers
3k
views
Is the curve25519 algorithm a special(implementation) one of ECDH?
It's the first time for me to learn about Key Exchange Protocol. And I thought that in both ECDH and DH there is a necessary step to share some public infomation(the common parameters) to each sides ...
CommunityBot
- 1
11
votes
3
answers
5k
views
Accelerating SHA-1
I have a program where computing SHA-1 is the bottleneck. This is using OpenSSL 1.0.0e on a 2.6Ghz 16-core Opteron where I get about 325MiB/s throughput. (SHA1 here is via Andy Polyakov's x86-64 ...
CommunityBot
- 1
1
vote
1
answer
185
views
Lookup table for DSA/ECDSA/Schnorr multiplication
Something in common to [EC]DSA and related signature schemes like Schnorr is that the most expensive part of signing is calculating $r = g^k$ in the group for some per-signature $k$ of length $b$ bits....
- 147k
4
votes
2
answers
1k
views
Implementing randomness extractors
A randomness extractor is a function that takes an input sampled from high entropy distribution and outputs a value that is close to uniform distribution. It is slightly different from a PRG. PRGs ...
CommunityBot
- 1
3
votes
1
answer
1k
views
How are Elliptic Curve private and public keys actually used to encrypt or sign data?
I've read article after article about curve parameters, generator points, the dot operation, and how you dot the generator point priv times to get the ...
- 48.4k
2
votes
1
answer
72
views
Serpent intermediate rounds differs from example code, but result is still correct, is it a problem?
Through great pain and suffering, I've been able to successfully implement Serpent. For example, when using the key 00112233445566778899aabbccddeeff, and encrypting ...
- 163
2
votes
3
answers
491
views
Are XOFs and KDFs more usable than DRBGs?
CSPRNGs have 2 design requirements:
output unpredictability,
back-tracing resistance.
In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization,...
- 48.4k
5
votes
1
answer
266
views
How would we design a fast circuit to solve LCS35?
LCS35 is a time-lock puzzle, stated in Ronald L. Rivest's Description of the LCS35 Time Capsule Crypto-Puzzle [1] (April 1999). That instantiates a system in Ronald L. Rivest, Adi Shamir and David A. ...
- 141k
2
votes
2
answers
296
views
Why should one model an entropy source in order to build a TRNG?
Some assert that a theoretical model of the unconditioned source must be created when building any TRNG. It's believed to be a fundamental requirement. So a few related questions arise:-
What is a "...
CommunityBot
- 1
1
vote
1
answer
328
views
Can I use NaCl's scalar multiplication functions for Diffie Hellman Key Agreement?
I want to create some software that performs diffie hellman group key agreement but I don't want to reinvent the wheel even if I know how it's done. So I came accross the NaCl library, especially the <...
- 48.4k
5
votes
2
answers
2k
views
How to securely map messages to points on an elliptic curve
I'm implementing a demonstration hybrid cryptosystem in Python (FinCrypt, I know the name is bad) and I'm migrating over from my Weierstrass curve implementation, which was based off of this, to one ...
- 9
3
votes
1
answer
444
views
Setting protocol parameters to achieve concrete security
Background
One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
- 48.4k
2
votes
1
answer
451
views
Sane implementations of Bitcoin cryptography routines w.r.t. side-channel attacks
Bitcoin uses SHA-256, Base58Check, ECDSA (Sep256k1) and RIPEMD-160 as the basis of its encryption (see this article for a short guide on how addresses are created).
I would like to create an iOS-...
- 48.4k
6
votes
1
answer
340
views
Does a masked look-up table prevent cache timing attacks?
When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...
- 4,820
1
vote
0
answers
206
views
Efficient polynomial ring multiplication with coefficients in GF(2^s)
Is there something similar (or an other efficient approach) to the NTT for the multiplication of polynomials in polynomial rings modulo $X^{2^n} + 1$ with coefficients in $\operatorname{GF}(p)$ with $...
- 48.4k
2
votes
1
answer
887
views
Implementation details of the π step of the Keccak round function
In the official Keccak implementation overview, there is a section discussing different ways to organise the internal Keccak-f state -- namely section 1.2, Bit and byte numbering conventions -- and at ...
1
vote
1
answer
133
views
Implement Google Adiantum else where?
Google made the headlines with its new Adiantum encryption method, and i read (TechCrunch) that:
In the meantime don’t expect any instant gains, but future low-power
devices may offer better ...
- 2,974
0
votes
0
answers
60
views
Proxy decrypt algorithm in Extended Proxy-Assisted Attribute Based Encryption (ABE) Scheme
Context
I'm trying to implement the Attribute-Based Encryption (ABE) scheme described in the paper - Extended Proxy-Assisted Approach: Achieving Revocable Fine-Grained Encryption of Cloud Data (Yang ...
- 103
6
votes
2
answers
3k
views
Are developers expected to implement Diffie-Hellman key exchange themselves?
I noticed that the GO standard library has some really nice functions for performing AES encryption / decryption in various modes. However, I couldn't (yet) find anything for Diffie-Hellman key ...
0
votes
1
answer
156
views
Starting stream cypher, first block (Salsa20)
I'm implementing Salsa20 in Rust for fun.
I have the initial state (4x4 32-bit matrix) setup from the key, nonce, and stream position 0. I'm using the Wikipedia Salsa20 article as reference, and I'm ...
- 19.6k
1
vote
1
answer
104
views
Reducing the XOR's in Implementation Cost
Suppose that we want to implement the following equations in binary finite field.
$$
\begin{array}{l}\tag{1}
y_{{1}}=x_{{1}}\oplus x_{{2}}\oplus x_{{7}}\oplus x_{{8}},\\
y_{{2}}=x_{{1}}\oplus x_{{2}}\...
- 253
2
votes
1
answer
372
views
zero knowledge framework for c programs - how to prove correct C program execution with private inputs
I am looking for a zk framework that could be used for proving correct execution of programs written in C (or any other high level language) such as:
I know x s.t. SHA-256(x) = y (y is public, x is ...
CommunityBot
- 1
3
votes
1
answer
1k
views
Choosing good entropy $g$ and $p$ for a classic Diffie-Hellman Key exchange
When selecting $g$ and $p$ for the Diffie-Hellman modular exponentiation:
$ s= g^x \bmod p $
Which pairs of $g$ and $p$ are considered good nowadays, are recommended by bibliography?
What I try ...
1
vote
0
answers
105
views
Could you design something like a ring signature that uses website accounts instead of keys?
Ring signatures allow one to prove that you own a private key corresponding to a public key from a set of keys, without revealing which private key you control.
This is useful if you are part of some ...
- 48.5k
4
votes
1
answer
212
views
Magic Number to calculate number of rounds for M-R in FIPS 186-4
In Fips 186-4, there is an algorithm in Appendix F (at page 117 in my copy of the 2013 version) to calculate the number of rounds of the Miller-Rabin primality test to random bases.
Does anybody ...
- 12.5k
1
vote
1
answer
667
views
Polynomial multiplication and division in $2^{128}$
I want to multiply and divide polynomials, and implement the extended Euclidean algorithm for polynomial greatest common divisors, over a Galois Field of size $2^{128}$. Moreover, I want to use the ...
- 15.3k
6
votes
1
answer
357
views
MARS and RC6 in CUDA
I am working on a project where I am benchmarking the 5 AES finalists (Rijndael, Twofish, Serpent, MARS and RC6) on CUDA Hardware.
My problem is that I am no experienced CUDA programmer. My approach ...
- 15.3k
1
vote
2
answers
319
views
Implementations of GCM with 64-bit cipher
The paper The Galois/Counter Mode of Operation (GCM) describes mainly the 128-bit case, for use with 128-bit block ciphers such as AES. AES-GCM test vectors are available from NIST.
The paper also ...
- 4,820
2
votes
1
answer
8k
views
How can I implement the "Multiplication Modulo" and "Addition Modulo" operations in IDEA?
I am currently working on IDEA (International Data Encryption Algorithm), and I don't know how to perform Multiplication Modulo and Addition Modulo.
This is how IDEA operates:
IDEA operates on 64-bit ...
CommunityBot
- 1
14
votes
1
answer
546
views
WOTS+: Why does it XOR before running data through the hash function?
I'm implementing WOTS+ in a new language and I can't seem to wrap my head around the fact that WOTS+ XOR's their input with its mask right before hashing it.
I tried to look for any reasoning but so ...
CommunityBot
- 1
-3
votes
1
answer
964
views
2
votes
1
answer
240
views
Non interactive Zero Knowledge Proof for Satisfiability of Pairing Product Equations
In the paper "Simulation-Sound NIZK Proofs for a Practical Language and
Constant Size Group Signatures" from Groth, the section 6 describes a NIZK proof for pairing product equations.
I only know ...
CommunityBot
- 1
19
votes
3
answers
5k
views
Webcam random number generator
I have a question about random number generators.
I have read from a real random number generator, based on a webcam ("randcam"). My problem is, that I do not really understand how the generation of ...
- 15.4k
1
vote
0
answers
59
views
Gate count for Ring-LWE
In one of my recent research, I need to compare the number of gates needed in Ring-LWE encryption to AES in the circuit model. For AES we can find some estimation like this site, but for Ring-LWE we ...
- 48.5k
4
votes
0
answers
296
views
Why is this Trivium implementation working bytewise instead of bitwise?
I am currently looking into a Trivium implementation available in the FELICS framework.
Parameters of the Trivium stream cipher:
Key size: 80 bit
IV size: 80 bit
State size: 288 bit
The Trivium ...
- 41
1
vote
2
answers
86
views
Is one big file as secure as X small files with the same password?
Hello people of StackExchange.
It's my first time asking and I know little about Cryptography, so be gentle.
My problem can be simplified to this:
I can create a 2GB Volume that contains 1GB of text ...
- 3,313
7
votes
2
answers
491
views
Regular and Efficient doubling in $GF(2^n)$
A naive approach to compute a multiplication $a \cdot b$ in a Galois field of the form $GF(2^n)$ is the russian peasant algorithm. However, it does not run in constant time and therefore is not safe ...
- 48.5k
30
votes
3
answers
24k
views
What is the recommended number of iterations for Argon2?
I've recompiled my operating system ("LionBSD" based on FreeBSD) to use Argon2i as the default password hashing algorithm in crypt/libcrypt.
I'm wondering what the recommended number of iterations ...
- 48.5k
3
votes
1
answer
323
views
Constructing of 16x16 Involutory Binary Matrices of Branch Number 7
In the PDF “Algebraic Construction of 16×16 Binary Matrices of Branch Number 7 with One Fixed Point”, it was given that:
...
CommunityBot
- 1