20,455 reputation
12787
bio website
location Paris, France
age
visits member for 3 years, 2 months
seen 11 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


4m
revised RSA CRT modulo reduction
Clarify
18h
answered Is equal length of primes in Paillier cryptosystem is mandate for security reasons?
22h
comment Public key encryption without ciphertext expansion
By a counting argument, strictly non-expanding public-key encryption is bound to be deterministic, hence vulnerable to verification of a successful guess of the plaintext. So at least, it is not applicable to encryption of small or otherwise guessable fields, such as gender, or first name. For the rest, follow Ricky Demer's link.
22h
comment About the Algebraic Normal Form (ANF) of S-Box in DES
KP stands for Known Plaintext(/Ciphertext pairs); the more are available to an attacker, the easier are the attacks. $\;$ XL is eXtended Linearization as discussed here. $\;$ XLS stands for eXtended Sparse Linearization. $\;$ I can't discuss these in a comment about a largely unrelated question.
1d
revised RSA CRT modulo reduction
Better reference to fault injection
1d
revised RSA CRT modulo reduction
Mention the special case when p divides x
1d
answered RSA CRT modulo reduction
1d
comment What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
@Ruggero: I have added reference to your question, and quote that I interpret as suggesting the attack(s) do not apply to protocols doing straight ECDH; I'm seeking clarification of this.
1d
revised What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
Add a quote
1d
revised What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
Mention related question
1d
revised What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
edited title
1d
asked What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
1d
comment About the Algebraic Normal Form (ANF) of S-Box in DES
If you are interested in most compact algebraic representations of DES S-boxes (which is not stated in the question, and why I made a comment rather than an answer), the best result is reportedly in the source code of john-the-ripper, I believe buried in the macros S1..S8 in john-1.8.0.tar.gz.tar file src/x86-64.S.
1d
revised About the Algebraic Normal Form (ANF) of S-Box in DES
fix typo
1d
comment About the Algebraic Normal Form (ANF) of S-Box in DES
Compact representation of DES S-boxes indeed has been studied, starting (AFAIK) with Eli Biham's A fast new DES implementation in software (1997, in proceedings of the fourth FSE conference). See also Matthew Kwan's website and paper Reducing the Gate Count of Bitslice DES (2000, IACR eprint archive). I can't tell how the form in the question ranks.
1d
revised About the Algebraic Normal Form (ANF) of S-Box in DES
Texify
2d
comment Interpretation of the results of NIST (p)NRG suite
As explained in the answer, the test passed. However, be aware that this is not a good indication (much less proof) that the (p)RNG tested is cryptographically strong; nor that it is correctly implemented. These tests can (only) catch some grossly inadequate RNGs, some implementations errors (hardware or software), and (normal) imperfections in TRNGs. For an illustration of why your three p-values of 0.025, 0.027, and 0.029 are not alarming, there's an obligatory XKCD.
2d
comment Cryptographic Dilemma
Any relation with the "Foundations-of-hashing dilemma", a term used by Phillip Rogaway in Formalizing Human Ignorance: Collision-Resistant Hashing without the Keys (in proceedings of VietCrypt 2006, revised and free version here)?
2d
comment Why cbc-mac is a secure mac with psudo-random but not random IV?
In the first sentence of the question: $\;$ a) is Pseudo-Random Function taken as public member of a PRFF in its standard meaning? $\;$ b) What is the input of the PRF, and is it known to / chosen by the adversary? $\;$ c) is the output of the PRF the IV of a CBC-MAC variant?
Oct
27
comment RSA CRT modulo reduction
What you wrote in comment is true, but does not satisfactorily answer your question. Fermat's Little Theorem goes a long way towards that; use it to prove that $\forall x\not\equiv0\pmod p, x^d\equiv x^{d_p}\pmod p$. $\;$ Also, notice that you do not HAVE to compute $d_p$ and $d_q$ the way you do; $d_p=d_q=d$ will also work, albeit with much less savings compared to regular modular exponentiation.