Questions tagged [implementation]

Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.

Filter by
Sorted by
Tagged with
0
votes
1answer
466 views

Need of Image Encryption [closed]

Question is simple yet confusing, why there is the need for image encryption. How text encryption is different from image encryption if using same technique like AES, DES, Chaotic algorithm. If the ...
1
vote
1answer
4k views

How do you get the original salt after it's been hashed to the user's password in the database?

I'm researching how to do salt and hashing. I'll be using SHA256. Here is what I found: To Store a Password Generate a long random salt using a CSPRNG. Prepend the salt to the password ...
3
votes
1answer
649 views

How are Elliptic Curve private and public keys actually used to encrypt or sign data?

I've read article after article about curve parameters, generator points, the dot operation, and how you dot the generator point priv times to get the ...
2
votes
3answers
1k views

Why is AES encryption decryption not platform agnostic?

We work on C++ code which compiles on Windows and Linux. I have been told that AES encryption/decryption is platform dependent. Is it true? If so, why is it OS dependent?
8
votes
1answer
433 views

Do people not care about side channel resistance?

Recently, I have been browsing a lot through libraries that implementing Shamir secret sharing. I see a lot of code that implements this cryptographic algorithm without any side channel (timing/branch/...
2
votes
1answer
163 views

How to implement a hash function $H \colon \{0,1\}^* \to \mathbb{Z}_p^*$?

I would like to implement a hash function $H \colon \{0,1\}^* \to \mathbb{Z}_p^*$ such that $p$ is a prime number and $\log_2(p) > 256$. I am wondering if it is a good idea to use the hash function ...
2
votes
1answer
424 views

How to interpret the article claiming NIST P-256 curve to be unsafe?

Here: http://safecurves.cr.yp.to/ , I read that the NIST P-256 elliptic-curve is not safe. The article lists several aspects (off-curve point, side-channel, etc.) where implementing P256 can fail the ...
0
votes
1answer
88 views

Does this ECIES scheme make MAC redundant?

I've implemented ECIES (see the below pseudo-Python). ...
2
votes
1answer
339 views

Size and usage of lookup table in cryptographic schemes

I would like to understand the typical size of a lookup table for software implementations of a cryptographic scheme. What size is considered reasonable? What make them (in)efficient? Are there ...
8
votes
2answers
387 views

Timing vulnerability of byte array equality test?

Would the following code to test MAC equality leak timing information ? ...
3
votes
1answer
225 views

Necessary to authenticate nonce if authentication-key is derived from nonce?

Lets suppose my messages are composed like this: unique_message_nonce + encrypted_message + mac Because I don't have an AEAD-scheme, I can encrypt and authenticate ...
7
votes
1answer
523 views

How can a non-crypto-expert implement crypto libraries in a programming language?

I'm a regular developer and thus not a crypto expert. I'd like to use ECDSA as a library in a programming language, Idris, which still doesn't have one. I could, obviously, try and port a particular ...
15
votes
2answers
10k views

How fast can a SHA-256 implementation go?

I'm looking for high-speed SHA-256 implementations, and specifically, ones with low latency; that is, the time between when you submit the message block, and when the output (or internal state) is ...
6
votes
3answers
646 views

Has any alternative to RSA and Discrete Logarithm been standardized for deployment?

Suppose RSA and Discrete Logarithm over any group (including elliptic curves) gets broken what other schemes we have for DEPLOYMENT IMMEDIATELY do we have to rescue the internet from collapse? So ...
2
votes
1answer
238 views

Using negative values / unsigned integers to implement SHA-2

What happens if we allow implementation of SHA-2 using negative values? What happens if a negative value was used in the first round? Would the algorithm still result in a secure value? I have a ...
2
votes
1answer
526 views

How do I multiply a Twisted Edwards point in Montgomery space?

EdDSA (and ed25519) signatures require a scalar multiplication. Currently, I do this directly in Twisted Edwards space. (The code can be found in my crypto library.) My research and my tests ...
1
vote
1answer
90 views

Online attendance system

This summer I have made a website for my school's NHS program and integrated it with google scripts to automate tasks such as accessing how many hours users have and to allow members to view how many ...
26
votes
5answers
3k views

Timing-Safety in JVM-Languages

How is it possible to write timing-safe code in JVM-languages (Java, Scala, Clojure...)? Is it possible to make libraries like BouncyCastle safe against timing-attacks? I know that even in C it is ...
1
vote
1answer
237 views

AES ShiftRow Confusion

I'm implementing AES and I'm getting confused in the ShiftRows step. So far, my key expansion and SubBytes works and I get the ...
0
votes
3answers
287 views

Optimal MDS matrix - circulant or recursive?

One of the special matrix in $GF(2^q)$ is MDS matrix which can be used in the cryptography like mix column of AES. Two forms of MDS matrices are circulant and recursive. Which form of MDS matrix (...
0
votes
1answer
114 views

Which is the most overall 'compatible' encryption type? [closed]

What is the "MP3" of encryption formats today, which hopefully will make it easy and compatible to send to other recipients (not via e-mail), without them having to download and learn a software suite ...
7
votes
1answer
613 views

Goofs that could creep in ECDSA signature verification?

What are goofs that could creep in ECDSA signature verification, perhaps with focus on curves based on prime-order $\mathbb Z_p$, specifically P-256 aka secp256r1? Is it possible to construct test ...
1
vote
0answers
183 views

Which cryptographic operations can be optimized with a GPU? When shouldn't it be done?

I'm under the impression that GPUs are only used to optimize some (not all) of a given cryptographic operation. Furthermore, I've only seen this GPU optimization done in Bitcoin. This observation ...
1
vote
1answer
1k views

What's the maximum length for AAD in GCM?

...
8
votes
1answer
214 views

LWE: error and float operations

Background I'm trying to make sense of the error in implementations of LWE and R-LWE. In LWE and R-LWE error is added to vectors in lattices to make it computationally infeasible to recover any ...
4
votes
1answer
312 views

O(1) EC Linkable Ring Signature Without Group Manager

I'm looking for a practical example for creating an EC Ring Signature, very much at the level of detail as found in the CryptoNote Whitepaper but with O(1). I saw Short Linkable Ring Signatures for E-...
8
votes
3answers
362 views

Should a company ever implement a (recent) published cryptographic protocol

I understand that you should never, EVER, EVER implement your own unpublished cryptographic protocols. This topic has been well discussed in many places, e.g. here. However, once a protocol has been ...
6
votes
1answer
447 views

Is there a quick way to know the length of a message hashed using SHA3?

Let M be the message that has been padded for use into the SHA3 (standardized Keccak) hash function. Is there a way, like it's the case for SHA1, to know the total length of the message M just by ...
11
votes
2answers
2k views

Different ways/algorithms for implementing AES

I have seen a couple software implementations of the Advanced Encryption Standard. They are pretty much straight forward, i.e. they are implemented exactly the same way as the AES is described. This ...
9
votes
1answer
445 views

Are there any security issues when replacing the SHA-256 initialisation values?

As RFC 4634 describes in section 6.1, SHA-256 is initialized using eight 32-bit words. These were obtained by taking the first 32 bits of the fractional parts of the square roots of the first eight ...
14
votes
2answers
1k views

Interesting implementation practices in popular crypto library

So reading through the salsa20 implementation for the crypto library for go-lang, I noticed something interesting. Specifically this portion. It looks like something I would expect from someone ...
1
vote
0answers
139 views

zero knowledge messaging implementation

I understand that messages are encrypted using a symmetric algorithm such as AES, and the symmetric key is encrypted using an asymmetric algorithm such as RSA. In my particular implementation, the ...
8
votes
1answer
159 views

How to implement “online” feature of GCM?

I've heard that Galois Counter Mode (GCM) is an "online" encryption algorithm—it is not necessary to know the size of the input ahead of time. But does GCM require that all authenticated-but-not-...
0
votes
1answer
363 views

Wikipedia pseudo code is unclear about how to pad SHA-512

In Wikipedia pseudo code of SHA-512 the padding section says pad 1 bit then 0 bits. It then goes on to say append length without 1 or 0 padding. What does that mean? https://en.wikipedia.org/wiki/SHA-...
5
votes
1answer
100 views

Is there a standard method to compare hardware-implemented ciphers?

I have been reviewing literature and I am trying to determine the best method to compare ciphers in hardware. The two methods that seem to be somewhat de facto standard the literature are looking at ...
3
votes
0answers
60 views

How can I obtain a code with same weight codewords?

I want to implement "A new one-time signature scheme from syndrome decoding". My first challenge is how to obtain $P$. $P$ is a generator matrix whose codewords have weight not exceeding an integer ...
5
votes
2answers
381 views

implementing GCM with dev/urandom for a nonce

I'm currently trying to integrate GCM into my code, and I have just enough knowledge to know I'm probably doing this wrong. I know for GCM and other CTR like ciphers, using the same key with the same ...
1
vote
0answers
96 views

What do the inputs of `hash_df` look like?

I am making an implementation of hash_df (NIST documentation found in SP800-90A.pdf on page 67) I found “Does hash_df use binary or an ASCII hexadecimal ...
1
vote
1answer
55 views

Ensuring integrity in a multi-user secret vault

Assume you have a vault containing secrets. Each one is encrypted for at least one authorized recipient using some public key crypto (one file per secret). Each authorzied recipient can decrypt all of ...
1
vote
0answers
68 views

Why does facebook uses two secrets to secure API

I am working on a public API for my personal forum. Concerning the authentification of the requests and responses I plan to hash the payloads with a secret, known to me and the API user, and send the ...
-1
votes
1answer
725 views

What is the simplest digital signature algorithm known?

The hardest part about this question is explaining what I mean by simple. I'm measuring simplicity as, simply, the amount of lines of code it takes to implement that algorithm in a simple programming ...
9
votes
2answers
826 views

Are lookup tables safe when they fit in a cache line?

The typical cache line size of modern x86 machines is 64 bytes. Is it safe to use lookup tables with secret data if the table does not exceed the cache line size, and is aligned accordingly? I was ...
1
vote
1answer
230 views

Costs of operations in elliptic curves explanation

I'm trying to understand the cost of operation in elliptic curve (only Weierstrass curve for simplicity) from Wikipedia and there seems to be lack of online information/papers regarding this. I ...
1
vote
0answers
170 views

Implementing AES algorithm using Arduino [closed]

I am using an Arduino board to implement the AES Algorithm: I am having a large data of length approximately 500 bytes. I did all the basic stuff in implementing this AES Algorithm. I am getting ...
5
votes
3answers
839 views

How do you make Fermat's primality test go fast?

This small Lisp-function implements Fermat's primality test in a very simple way and it is very slow at $n >= 10^6$ because we reach into bignum territory. ...
8
votes
3answers
2k views

Usage difference between x86 RDRAND and RDSEED

Modern x86 CPUs often have the RDRAND and RDSEED instructions for hardware generation of random numbers. I just don't understand the difference between them. Intel has this document: https://...
3
votes
0answers
267 views

How to modify the Socialist Millionaire Protocol to be symmetric.

In the Socialist Millionaire Protocol, the roles of Alice and Bob are almost symmetric. By this I mean they do almost the same thing, until the very last step. In the final step, both parties check a ...
1
vote
1answer
109 views

Is using Euler's Totient/phi in Tonelli-Shanks (used to recover EC coordinate) safe?

I'm implementing an algorithm in order to recover the $y$ co-ordinate from $x$ in order to construct a co-ordinate pair that satisfies secp256k1's elliptic curve equation, which is: $y^2 = x^3 + 7 \...
1
vote
1answer
472 views

Speeding up the Denning-Sacco protocol?

I have started to study cryptography and I have come across Denning-Sacco protocol. I understand multiplicity vulnerability. My question is why Denning-Sacco protocol choose to generate key on ...
9
votes
1answer
534 views

Can Whirlpool take advantage of AES-NI?

Whirlpool uses a modified version of the AES / Rijndael algorithm. Can Whirlpool take advantage of AES-NI instructions (or possibly other specialized constructs) on Intel and Intel compatible ...

1 2
3
4 5
9