19,682 reputation
12779
bio website
location Paris, France
age
visits member for 3 years
seen 9 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


1d
awarded  Popular Question
Aug
17
awarded  Yearling
Aug
15
awarded  Nice Answer
Aug
15
comment Can you fake messages from recorded message-history?
Apologies for my original comment (and other later mess-ups), it should have been: Encrypting a message with Bob's public key only proves that it was written for Bob inasmuch as the message remains secret. I maintain that the fragment "To be sure that the message is for B, A has to encrypt it with B's public key" is wrong when for B is understood as with B interpreting the message. $\;$ The passage "To be sure that the message is from A, A has to encrypt it with his private key" uses improper terminology, but is right after changing encrypt to sign.
Aug
15
comment Can you fake messages from recorded message-history?
@Rubo77: I know that DKIM signs the message's origin, but does it sign the intended recipient(s) or otherwise protect from replay of the same message to unintended recipients? If yes, any reference to how?
Aug
15
comment Can you fake messages from recorded message-history?
@Lie Ryan: yes, what you describe would be possible; it amounts to Alice always signing messages making explicit mention of the intended recipient(s) or/and context, or/and enforcing this in the cryptogram format. That's just not part of PGP, or of the PGP wrapper that I practice.
Aug
15
revised Can you fake messages from recorded message-history?
Add note
Aug
15
answered Can you fake messages from recorded message-history?
Aug
15
comment Implementation Attacks on Hashes
Why the close votes?
Aug
11
comment Currently i am doing decryption for RSA encoding and i face some problem with it
@Thor: I question your Textbook RSA is the clue. $\;$ Textbook (aka naked) RSA is quite safe when used to encipher random $k$-bit data and $e\cdot k>5\log_2N$, which should be the case here.
Aug
11
comment Currently i am doing decryption for RSA encoding and i face some problem with it
$\log_2(N)\approx 1023.034$. $\;$ Usual RSA key generation algorithms for 1024-bit $N$ generate $p$ and $q$ uniformly randomly in range $[2^{1023/2}\dots2^{1024/2}]$, and thus have odds of generating a $N=p\cdot q$ that close to $2^{1023}$ rather low (like 1/5000). In an exercise, that may not be a coincidence. Perhaps this hints at some way to factor $N$. Any context, like: a recent/related lesson/text was about Fermat factoring?
Aug
10
comment Format of NONCE in Initialization Vector (IV)
@owlstead: I'm OK with you change. However, using an UID as IV can be bad: in CBC mode, if the UID is predictable, encryption can be broken under CPA; in CTR mode, if consecutive UIDs differ only in the same low bits that are changed by counting, some keystream is reused. $\;$ In my opinion, the simplest (thus often the best) is: if the key is used for a single session, use implicit zero IV; otherwise use a random IV.
Aug
6
comment A way around digital signatures?
Any wrong with two symmetric keys K0 K1, with K0 known to A and B only, and K1 shared between A B C; and protecting messages with two MACs with these keys, except when originating from C which uses K1 only?
Aug
2
revised Is perfect-forward secrecy achieved with RSA?
Incorporate some of CodesInChaos's comment
Aug
1
revised Is perfect-forward secrecy achieved with RSA?
Mention the public key used to verify the signature
Aug
1
revised Is perfect-forward secrecy achieved with RSA?
Polish
Aug
1
revised Is perfect-forward secrecy achieved with RSA?
start from general and apply to RSA
Aug
1
answered Is perfect-forward secrecy achieved with RSA?
Aug
1
comment Reasons for Chinese SM2 Digital Signature Algorithm
Part 1 (out of 4) of the 2010 Chinese standard defining SM2 algorithms is published here, and some of it is understandable when automatically translated. $\;$ Could no find part 2 on SM2 signature. $\;$ Jing Xu & Dengguo Feng's Comments on the SM2 Key Exchange Protocol is a claimed attack on part 3.
Jul
31
revised Rainbow table for DES with all-zero plaintext?
Use m rather than k as the width of the input of F, to avoid conflict with answers using k for another purpose