Questions tagged [implementation]
Implementing a cipher or protocol is the process of taking it from its mathematical or algorithmic description and producing a working version, often in computer software or hardware. This tag should be used for any question discussing the various potential considerations and pitfalls of this process, for example padding.
584 questions
3
votes
0
answers
37
views
Use of symmetric remainder (balanced mod) to eliminate branching in polynomial additions for lattice-based cryptography: prior art/known limitations?
I have been exploring a formulation of integer division where the remainder is taken from the symmetric interval:
$$[−⌊d/2⌋,⌊d/2⌋]$$
instead of the classical interval:
$$[0,d)$$
Mathematically this is ...
1
vote
0
answers
57
views
ML-KEM (Kyber) implementation not matching ACVP Gen/Vals test vectors [closed]
I implemented the ML-KEM (Kyber) code from https://github.com/pq-crystals.
I’m using the deterministic input values "z" and "d" taken directly from the ACVP Gen/Vals JSON file, but ...
- 175
2
votes
2
answers
319
views
How to load/export SHA3 state?
To make the question as specific as possible, take the SHA3-256 example from https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/SHA3-256_Msg30.pdf.
How ...
- 532
2
votes
1
answer
119
views
Modulus blinding in RSA?
To prevent some side-channel attacks in RSA, I've seen people use multiplicative blinding
$$
a^d\bmod N=(r^{-1})^d(ra)^d\bmod N
$$
or additive exponent blinding
$$
a^d=a^{d+r\phi(N)}\bmod N.
$$
...
- 532
2
votes
1
answer
123
views
Code implementing efficient knapsack attacks (Howgrave-Graham and Joux / Becker Coron Joux)?
I have been unable to locate code for the attacks in
Howgrave-Graham and Joux: New generic algorithms for hard knapsacks
and in Becker, Coron and Joux: Improved generic algorithms for hard knapsacks
...
- 25.7k
2
votes
1
answer
146
views
Advice on Student Project: Hybrid TRNG + PQC + AES-256 Encryption with ESP32 Communication
I am a high school student participating in a secure satellite communication idea competition. I am building a prototype to generate unpredictable encryption keys using ATECC608A (TRNG) and hardware ...
- 21
3
votes
1
answer
321
views
Why isn't there a 2nth root of unity for n =256 (Kyber specifications)
Currently I am working on implementing a radix-4 NTT algorithm, but most of the research papers use a $2n$th root of unity as an input. However, in the Kyber specification, for $n = 256$ we don't ...
2
votes
0
answers
84
views
Can I have a 32-byte nonce XChaCha20 by XORing the counter?
XChaCha20 takes a 192-bit nonce and a 64-bit counter, but I need a 256-bit nonce.
Can I simply XOR the 64-bit counter to the bottom of a 256-bit random nonce?
This would be analogue to the XCTR mode ...
- 95
1
vote
2
answers
299
views
Why clamp Poly1305?
Introduction
In 2005, Daniel J. Bernstein proposed a simple polynomial over $2^{130} - 5$
for fast universal hashing with applications to authenticated encryption [1].
Over the years, Poly1305 gained ...
- 95
1
vote
1
answer
79
views
Research article with error? Mixnet pseudocode not working
I tried to implement the mixnet pseudocode in this article (Pseudo-Code Algorithms for Verifiable Re-Encryption Mix-Nets), but one of the equalities to check the proof correctness is not matching. I ...
2
votes
3
answers
335
views
Who has checked that AES-NI produces the expected results? (i.e. the exact same as software-only AES encryption)
Everybody seems to rely happily on the set of Intel instructions on > 2010 CPUs to accelerate AES256 encryption.
This might be a too naive question but, being the exact algorithms an industrial ...
- 163
0
votes
1
answer
73
views
Is this zero-knowledge proof correct?
The following algorithm is supposed to implement Pk according to the following description:
...
- 155
1
vote
0
answers
85
views
Well-known cyphertext generation
Sorry for the very basic question. I could not find wikipedia-level resources to learn about zero knowledge proofs, El Gamal reencryption and stuff, and could not figure out which research papers to ...
- 155
1
vote
0
answers
59
views
Preimage Sampling for Lattice in Sagemath
I would like to run some examples of Gaussian Preimage sampling as used in various lattice based schemes, following GPV08 and MP12, on sagemath.
I do not know how to do it and I hope this is the ...
- 11
1
vote
1
answer
231
views
Is this custom 512-bit elliptic curve cryptographically secure? (EECCFrog512)
Is this custom 512-bit elliptic curve (EECCFrog512) cryptographically sound and secure against known ECC attacks?
Body:
I’m submitting a custom elliptic curve construction for community review and ...
- 121