Questions tagged [implementation]

Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.

Filter by
Sorted by
Tagged with
0
votes
1answer
113 views

Which is the most overall 'compatible' encryption type? [closed]

What is the "MP3" of encryption formats today, which hopefully will make it easy and compatible to send to other recipients (not via e-mail), without them having to download and learn a software suite ...
7
votes
1answer
502 views

Goofs that could creep in ECDSA signature verification?

What are goofs that could creep in ECDSA signature verification, perhaps with focus on curves based on prime-order $\mathbb Z_p$, specifically P-256 aka secp256r1? Is it possible to construct test ...
1
vote
0answers
156 views

Which cryptographic operations can be optimized with a GPU? When shouldn't it be done?

I'm under the impression that GPUs are only used to optimize some (not all) of a given cryptographic operation. Furthermore, I've only seen this GPU optimization done in Bitcoin. This observation ...
1
vote
1answer
1k views

What's the maximum length for AAD in GCM?

...
8
votes
1answer
188 views

LWE: error and float operations

Background I'm trying to make sense of the error in implementations of LWE and R-LWE. In LWE and R-LWE error is added to vectors in lattices to make it computationally infeasible to recover any ...
4
votes
1answer
267 views

O(1) EC Linkable Ring Signature Without Group Manager

I'm looking for a practical example for creating an EC Ring Signature, very much at the level of detail as found in the CryptoNote Whitepaper but with O(1). I saw Short Linkable Ring Signatures for E-...
8
votes
3answers
342 views

Should a company ever implement a (recent) published cryptographic protocol

I understand that you should never, EVER, EVER implement your own unpublished cryptographic protocols. This topic has been well discussed in many places, e.g. here. However, once a protocol has been ...
6
votes
1answer
374 views

Is there a quick way to know the length of a message hashed using SHA3?

Let M be the message that has been padded for use into the SHA3 (standardized Keccak) hash function. Is there a way, like it's the case for SHA1, to know the total length of the message M just by ...
11
votes
2answers
2k views

Different ways/algorithms for implementing AES

I have seen a couple software implementations of the Advanced Encryption Standard. They are pretty much straight forward, i.e. they are implemented exactly the same way as the AES is described. This ...
9
votes
1answer
404 views

Are there any security issues when replacing the SHA-256 initialisation values?

As RFC 4634 describes in section 6.1, SHA-256 is initialized using eight 32-bit words. These were obtained by taking the first 32 bits of the fractional parts of the square roots of the first eight ...
14
votes
2answers
1k views

Interesting implementation practices in popular crypto library

So reading through the salsa20 implementation for the crypto library for go-lang, I noticed something interesting. Specifically this portion. It looks like something I would expect from someone ...
1
vote
0answers
132 views

zero knowledge messaging implementation

I understand that messages are encrypted using a symmetric algorithm such as AES, and the symmetric key is encrypted using an asymmetric algorithm such as RSA. In my particular implementation, the ...
8
votes
1answer
145 views

How to implement “online” feature of GCM?

I've heard that Galois Counter Mode (GCM) is an "online" encryption algorithm—it is not necessary to know the size of the input ahead of time. But does GCM require that all authenticated-but-not-...
1
vote
1answer
286 views

Wikipedia pseudo code is unclear about how to pad SHA-512

In Wikipedia pseudo code of SHA-512 the padding section says pad 1 bit then 0 bits. It then goes on to say append length without 1 or 0 padding. What does that mean? https://en.wikipedia.org/wiki/SHA-...
5
votes
1answer
97 views

Is there a standard method to compare hardware-implemented ciphers?

I have been reviewing literature and I am trying to determine the best method to compare ciphers in hardware. The two methods that seem to be somewhat de facto standard the literature are looking at ...
3
votes
0answers
59 views

How can I obtain a code with same weight codewords?

I want to implement "A new one-time signature scheme from syndrome decoding". My first challenge is how to obtain $P$. $P$ is a generator matrix whose codewords have weight not exceeding an integer ...
5
votes
2answers
337 views

implementing GCM with dev/urandom for a nonce

I'm currently trying to integrate GCM into my code, and I have just enough knowledge to know I'm probably doing this wrong. I know for GCM and other CTR like ciphers, using the same key with the same ...
1
vote
0answers
85 views

What do the inputs of `hash_df` look like?

I am making an implementation of hash_df (NIST documentation found in SP800-90A.pdf on page 67) I found “Does hash_df use binary or an ASCII hexadecimal ...
1
vote
1answer
55 views

Ensuring integrity in a multi-user secret vault

Assume you have a vault containing secrets. Each one is encrypted for at least one authorized recipient using some public key crypto (one file per secret). Each authorzied recipient can decrypt all of ...
1
vote
0answers
66 views

Why does facebook uses two secrets to secure API

I am working on a public API for my personal forum. Concerning the authentification of the requests and responses I plan to hash the payloads with a secret, known to me and the API user, and send the ...
-1
votes
1answer
582 views

What is the simplest digital signature algorithm known?

The hardest part about this question is explaining what I mean by simple. I'm measuring simplicity as, simply, the amount of lines of code it takes to implement that algorithm in a simple programming ...
9
votes
2answers
770 views

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly? I was ...
1
vote
1answer
195 views

Costs of operations in elliptic curves explanation

I'm trying to understand the cost of operation in elliptic curve (only Weierstrass curve for simplicity) from Wikipedia and there seems to be lack of online information/papers regarding this. I ...
1
vote
0answers
160 views

Implementing AES algorithm using Arduino [closed]

I am using an Arduino board to implement the AES Algorithm: I am having a large data of length approximately 500 bytes. I did all the basic stuff in implementing this AES Algorithm. I am getting ...
5
votes
3answers
797 views

How do you make Fermat's primality test go fast?

This small Lisp-function implements Fermat's primality test in a very simple way and it is very slow at $n >= 10^6$ because we reach into bignum territory. ...
7
votes
3answers
1k views

Usage difference between x86 RDRAND and RDSEED

Modern x86 CPUs often have the RDRAND and RDSEED instructions for hardware generation of random numbers. I just don't understand the difference between them. Intel has this document: https://...
3
votes
0answers
241 views

How to modify the Socialist Millionaire Protocol to be symmetric.

In the Socialist Millionaire Protocol, the roles of Alice and Bob are almost symmetric. By this I mean they do almost the same thing, until the very last step. In the final step, both parties check a ...
1
vote
1answer
81 views

Is using Euler's Totient/phi in Tonelli-Shanks (used to recover EC coordinate) safe?

I'm implementing an algorithm in order to recover the $y$ co-ordinate from $x$ in order to construct a co-ordinate pair that satisfies secp256k1's elliptic curve equation, which is: $y^2 = x^3 + 7 \...
1
vote
1answer
363 views

Speeding up the Denning-Sacco protocol?

I have started to study cryptography and I have come across Denning-Sacco protocol. I understand multiplicity vulnerability. My question is why Denning-Sacco protocol choose to generate key on ...
9
votes
1answer
463 views

Can Whirlpool take advantage of AES-NI?

Whirlpool uses a modified version of the AES / Rijndael algorithm. Can Whirlpool take advantage of AES-NI instructions (or possibly other specialized constructs) on Intel and Intel compatible ...
2
votes
1answer
1k views

Pohlig-Hellman and Shanks algorithm on ECC

First, sorry for my english which is not my natural language and secondly, I hope I am posting on the right section. So let's explain my problem. I am trying to implement the Pohlig-Hellman ...
3
votes
1answer
375 views

Can authenticated encryption reduce bandwidth overhead of per-packet encryption?

I know that authenticated encryption modes of operation like GCM offer certain security advantages, as well as increased performance. (On my laptop with AES-NI, the benchmark performance of ...
6
votes
2answers
516 views

Is there an upper limit to plaintext size in XSalsa20Poly1305?

While fiddling with the NaCl implementation in Go, specifically SecretBox, a general crypto question came up after reading the documentation. Quote: Package secretbox encrypts and authenticates ...
4
votes
1answer
431 views

How does mutlivariate crypto schemes work?

I have been studying multivariate cryptography for post-quantum cryptography lately, but I have a hard time in understanding how these signature schemes work. As long as I see there there is UOV ...
2
votes
1answer
113 views

Secure instant messaging protocol and implementation for an anonymous end-to-end chat?

all is said in the title but I will go further. First question : I searched here and I found Tox to be the most powerful protocol. It uses Curve25519, XSalsa20 and Poly1305. They seem to be good ...
2
votes
2answers
1k views

Parsing of X.509 certificates

I'm working on a firmware for a platform with limited resources with C as programming language. There are a set of cryptographic primitives to be implemented, including AES, GCM/GMAC, ECDSA, ECDH. ...
0
votes
1answer
1k views

Crypto++ and SHA3 [closed]

I'm using c++ with the crypto++ library, which includes the keccak algorithm for hashing. I could find instances with specific length of the hashvalues. There are 224, 256, 384 and 512 bits. But I ...
5
votes
3answers
125 views

Adding a number congruent to $0$ to ensure that the mod operation takes a constant number of instruction cycles

I've been looking at the s2n implementation of HMAC, and in the `update' function (line 175), it says ...
2
votes
1answer
30 views

Securely testing the presence of an item in a list without exposing the list

Not even sure what terms would describe what I'm looking for, but the general idea: Given a list of strings of a finite length, determine whether or not a test string belongs to the list. Then, ...
-1
votes
1answer
642 views

Python Code review of AES implementation

My long term goal is to make a tool similar to boxcryptor but first I need to learn how to program and how to properly implement AES. So far I've been using Python for simplicity but I plan to use a ...
0
votes
2answers
1k views

Rabin cryptosystem decryption when p=q

I'm currently trying to implement the Rabin Cryptosystem when I realized something when gave p and q the same value: So my values are as follows: Original message = 20 p=11 q=11 Encrypted message ...
2
votes
1answer
298 views

Memory during crypto computation

I'm implementing a cryptographic primitive and I have a question about the memory model. The function (simplified) looks something like this: ...
2
votes
1answer
93 views

Small roots of bivariate modular linear equation?

Say I have a simple affine relationship between two variables $x$ and $y$ in a field $\mathbb{F}_p$ ($p$ is a large security parameter): $ax + by + c = 0$ What algorithm would be appropriate to find ...
3
votes
2answers
907 views

What do we need white box crypto for?

I am familiar with white box cryptography, but somehow I still fail to see its potential applications? Which situations would necessitate using it? Maybe you can even give me an example or two? I ...
2
votes
1answer
121 views

Security model scalar multiplication in NaCl

I'm having trouble understanding what the “security model” for “scalar multiplication” in NaCl is. Security model crypto_scalarmult is designed to be strong ...
1
vote
1answer
162 views

Why am I getting a wrong output when implementing Feige-Fiat-Shamir ID protocol?

I am trying to implement the Feige-Fiat-Shamir identification protocol. I've read another posting here on this site and I tried to adapt - however the end results always fail to match. Maybe because ...
1
vote
0answers
56 views

Freely available softwares for simulating/implementing MPC protocols [closed]

I have been designing multiparty computation (MPC) protocols for functions that interest me. Although theoretically I am able to deduce the asymptotic complexity of the protocol, I wish to know as to ...
6
votes
2answers
254 views

Are any of the practical implementations of ORAM being used in a real world system?

The concept of Oblivious RAM (ORAM) was first introduced by Oded Goldreich and Rafail Ostrovsky in 1996. However, in the past 5-10 years there has been a surge in the amount of research that looks ...
12
votes
1answer
968 views

Is it possible to test implementation for side-channel attacks?

When it comes to implementing cryptographic algorithms, there seems to be a big focus on the difficulty of doing so without introducing the potential for side channel attacks and the knowledge ...
6
votes
1answer
2k views

Is the use of AES in LoRaWAN correct?

I'm reading about LoRaWAN (specification). This network protocol has a particular way to encrypt data, detailed in the part 4.3.3.1. Here is a recap of how the encryption work, as I understood it. ...