Questions tagged [optimization]

Questions about problems that entail selecting the best element from some set of available alternatives, and methods to solve them.

Filter by
Sorted by
Tagged with
5 votes
0 answers

Why Salsa20 rotates columns vertically to optimize for SIMD?

I'm writing a school assignment and I'm trying to fully grasp the differences between Salsa20 and ChaCha. I've come to understand that by rotating upwards the initial matrix columns, DJB says that ...
Fabrizio Mele's user avatar
4 votes
1 answer

Optimized Garbled Circuit Algorithmic Description

The Garbled Circuit (GC) is now over thirty years old, and many optimization methodologies have been proposed, including point-and-permute, row-reduction, free-XOR, fixed-key blockcipher, half-and. ...
alexander's user avatar
  • 149
3 votes
1 answer

Sextic twist of BN pairing parameters vs security

I've previously asked questions on BN pairing parameters. Here's one more. In the BN construction, one is working in a subgroup of a curve over an extension field $\mathbf{F}_{p^{12}}$ for some ...
Morty's user avatar
  • 599
3 votes
1 answer

Prove you computed $hash^r(input)$ for some cryptographic hash function

What is the most efficient way to prove that a person computed $r$ rounds of some cryptographic hash function (ex. SHA256) on an input? Specifically, I'm trying to optimize (1) the running time of the ...
user74433's user avatar
3 votes
1 answer

Problem with efficiency of projective coordinates in Elliptic Curve arithmetic

Ok sort of long post incoming. Will go slow to make it as clear as possible I'm trying to build a C library for Elliptic Curve Arithmetic. Since the idea is to learn from the process, I decided to ...
popeye's user avatar
  • 95
2 votes
1 answer

Merge two multisignatures

I want to know if there is a multisignature scheme that allows the merging of two multisignatures for the same data but by two different sets of users, and without knowing the corresponding private ...
JacopoStanchi's user avatar
2 votes
1 answer

Number of rounds for constant header size in common hashes and XOFs

We compute hash $H(M_0\mathbin\|M_1)$ of size $d\ge1$ for some constant header $M_0$ of size $m_0$, and $\nu\ge1$ messages $M_1$ of random content and size $m_1$. For Merkle-Damgård hashes, a simple ...
fgrieu's user avatar
  • 141k
1 vote
1 answer

Ciphertext packing for bandwidth optimization

Let's say $Alice$ needs to send ciphertext $c_b = enc(m_b,k_b)$ to $Bob$ and ciphertext $c_c = enc(m_c,k_c)$ to $Carol$. For both the ciphertexts notice that underlying plaintexts are different (i.e. $...
sashank's user avatar
  • 6,174
1 vote
1 answer

Lookup table for DSA/ECDSA/Schnorr multiplication

Something in common to [EC]DSA and related signature schemes like Schnorr is that the most expensive part of signing is calculating $r = g^k$ in the group for some per-signature $k$ of length $b$ bits....
Myria's user avatar
  • 2,575
1 vote
1 answer

OPRF based on symmetric encryption

We need to use OPRF(oblivious pseudo random function) on very large sets. Unfortunately most of algorithms use elliptic curves and so this algorithms are very slow. Does exist some relaxation of oprf(...
Galois group's user avatar
1 vote
1 answer

Constant-time decompression on an elliptic curve

Let $E\!: y^2 = f(x)$ be an elliptic curve over a finite field $\mathbb{F}_{q}$ of odd characteristic. Consider an $\mathbb{F}_{q}$-point $P = (x,y)$ on $E$. Suppose that we only have the $x$-...
Dimitri Koshelev's user avatar
0 votes
2 answers

Why Crypto++ library's AES definition is so fast

I am trying to compare the CPU cycle required for two encryption algorithms. One algorithm is AES and lets the other algorithm is B(code name). I implemented algorithm B and having fewer and simpler ...
Radium's user avatar
  • 157
0 votes
1 answer

Hardware optimized stream ciphers?

As I understand it, ChaCha20 is slower than AES-CTR in hardware. Are there any hardware-optimized stream ciphers?
Demi's user avatar
  • 4,793
0 votes
1 answer

zkSnark Circuit

In practice, the circuit need to be proved always has a large size, maybe nearly billion gates, when turns such circuit to QAP, it will generate a large polynomial, which is a high cost to use zkSNARK....
Mkotori's user avatar
  • 95
0 votes
0 answers

What is the fastest 128-bit non-cryptographic hash function?

I need a 128-bit hash function which is extremely fast since it will be used for generating unique IDs for billions of objects. It doesn't need to be a cryptographic hash function nor does it have to ...
TypicalHog's user avatar
0 votes
0 answers

How optimize elliptic curve point multiplication?

For 256 bits "Double-and-add" multiplication uses about 128 addings and 256 doublings, where "Montgomery ladder" uses near 256 addings and 256 doublings. "Double-and-add" ...
Andrzej's user avatar
  • 59