16,783 reputation
12266
bio website
location Paris, France
age
visits member for 2 years, 8 months
seen 8 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


2d
comment Security of permutation cipher
Among many weaknesses: if $i$ and $j$ are in any segment where only the first permutation changed (including at least $i<255$ and $j<255$), then $c_i=c_j\Longleftrightarrow p_i+i≡p_j+j\pmod{256}$. E.g. "FED" encodes to 3 identical bytes.
2d
comment Is it possible to crack any MD5 hash?
Your question is not answerable: there is no private key in a hash. Also, it is expected that there are several messages that can give any given hash. As pointed by Poncho in the next comment, there is hope if you want the short message that gave this MD5.
2d
revised Turning a cipher into a hashing function
Tone down my endorsement
2d
revised Turning a cipher into a hashing function
Update the answer to state points in its motivating question, which is not the present one.
2d
comment How can I convert numbers into prime numbers?
You state without reference "Universal hashing gives high density of primes with high probability". I fail to see why, and doubt it. And I fail to see why it would matter, for the input of the universal hash is prime in your method, not the output. -- Trying $p$ until $f(p)=h(x)$ is expected to require $2^{w-1}$ steps where $w$ is the output width of $h$, and thus impractical. -- The method outlined by CodesInChaos seems just fine to me.
2d
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
Sorry I thought a map was bijective by definition (my math vocabulary in English is less than perfect). I stand corrected.
2d
comment How can I convert numbers into prime numbers?
Addition: the Rabin-Miller probabilistic primality tests has cost in $\mathcal O(\log(n)^3)$ (with the straightforward multiplication algorithm and vanishingly low odds of letting a composite creep).
Apr
15
comment Block cipher and parity of permutation
We do not care to construct a WIDE block cipher with an odd permutation; however this is sometime done in the context of Format Preserving Encryption with small block size.
Apr
15
comment Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
So the successful attacks on AES-256 invalidates arguments/proof of security based on an ideal cipher model, but do not translate into a direct attack that we know, right? -- About the attack explored in your answer: is the ability for the designer of the hash to choose the $IV$ a significant advantage over what users can do: try $M_0$ at random until the resulting $H_1$ has the desired property? And can you detail what's achieved after hypothetically managing to get $IV$ or $H_1$ to the right value?
Apr
15
revised Why does HMAC need a fixed length padding?
Remove a complex and perhaps wrong argument
Apr
15
awarded  Nice Question
Apr
15
comment Security of RSA for paranoids with padding?
@Ricky Demer: Yes. SPAKE/ALIKE use something reminiscent (the padded message is random then used to build AES-128 keys, concatenated with the encryption of zero with such a key). See the slides, they are interesting.
Apr
15
revised Security of RSA for paranoids with padding?
Cleanup and repolish
Apr
15
accepted Attack of an RSA signature scheme using PKCS#1 v1.5 encryption padding
Apr
15
revised Attack of an RSA signature scheme using PKCS#1 v1.5 encryption padding
Fix per remark
Apr
15
revised Security of RSA for paranoids with padding?
Clarify
Apr
15
revised Security of RSA for paranoids with padding?
Fix link to SPAKE article, polish
Apr
15
revised Security of RSA for paranoids with padding?
Back from the grave with a better and more general question
Apr
15
revised Why does HMAC need a fixed length padding?
Answer the other part of the question, as asked in comment
Apr
14
revised Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
Emphasize the Kelsey and Schneier paper.