16,933 reputation
12266
bio website
location Paris, France
age
visits member for 2 years, 8 months
seen 15 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


10h
comment How can I decode a Hill Cipher without a key?
There's a comma missing after the first 0, and perhaps some other parts of the statement (as is, by an entropy argument, it seems plausible that several keys could match).
10h
comment Impact of block algorithms parameters on entropy level
I know no accepted formal or even informal definition of "entropy level of a cryptogram". Can you define precisely what that means to you, or/and why you care about it?
10h
comment State of the art RSA key generation
@dddavidee: I removed that part because it contained a serious error. The B1 parameter (maximum size of the second largest prime in p) is extremely critical for both the runtime and the odds that a factor is found. The parameters in the reference I quoted and successfully reproduced leads to a fast runtime, but odds of finding a 352-bit random prime p VERY much lower than what I estimated. It will take me time to sort this out.
10h
asked How secure would HMAC-SHA3 be?
18h
revised State of the art RSA key generation
Remove bogus estimates
19h
revised State of the art RSA key generation
Report on experiment. Remove my endorsement until I can justify it.
19h
comment Let N be known and d such that 3d = 1 mod phi(n)
Read Dan Boneh's Twenty Years of Attacks on the RSA Cryptosystem.
20h
comment Questions about adding 0s to the key in HMAC and how it compares to SHAd
Why disallow a key to be the same size as the block size, when that's safe, as well as simpler and more efficient than the alternative? --- The burden of proof WAS on the authors of HMAC; they made a proof/security argument, then improved it, I linked to both versions: that's an "analysis proving the security of HMAC when the Message portion is known" (it can even be iteratively chosen). One of the proof's hypothesis is a hash with a Merkle–Damgård struture, and I do not know if (much less how) it can be adapted to SHA-3.
21h
comment Questions about adding 0s to the key in HMAC and how it compares to SHAd
The whole point of using HMAC is that we have mathematical demonstrations that it is secure if the compression function of the Merkle–Damgård hash is. So the above what if hypothesis could only occur for some Merkle–Damgård hashes, not for HMAC in general. Now if you believe that SHA-256 is rigged in a way that makes HMAC-SHA-256 weak, the burden of proof should be on your side (by Russell's teapot argument).
22h
comment Will hashing over and over eventually give the same hash?
See Random Mapping Statistics; and this related answer.
23h
comment Questions about adding 0s to the key in HMAC and how it compares to SHAd
HMAC is NIST-endorsed, but I have no indication that its claimed inventors M. Bellare, R. Canetti, and H. Krawczyk) are affiliated to the NSA. Again, HMAC aims at a security level against key search equal to its output size, and thus does not need a wider key. There is not indication that it would much increase practical security: if a 256-bit random key can be found, we should fear that a 512-bit one can be found by similar means (which can't be key brute-force key search) with marginally more effort.
1d
comment How can compute execution time for generate key AES algorithm?
This question is off-topic because it is about programming, not cryptography. Also, a cursory review does not show any attempt to time the key generation.
1d
comment Security of RSA for paranoids with padding?
@Rick Demer: Are you proposing the following: with the random oracle instantiated as a hash $H$, we generate a random $r$ of $\kappa-1$ (or $\gamma$) bits, send $r^e\bmod N$, it is deciphered back into $r$ using the private key; and you suggest to use as a shared key $H(N||r)$ or $H((N\cdot(N-1))/2+r)$ rather than just $H(r)$? --- I see why it can only be safer, but neither a specific attack prevented by that, nor a security argument we can make thanks to that. What I had in mind when an adversary can obtain many public keys was only about the risk that one of the many $N$ could be factored.
1d
comment Security of RSA for paranoids with padding?
@Ricky Demer: I have trouble understanding your comment above. Is it referencing a setting where an adversary can obtain many public keys, or something else? What pair?
1d
revised Security of RSA for paranoids with padding?
Link to related answer
1d
revised State of the art RSA key generation
Further limit my endorsment.
1d
revised State of the art RSA key generation
Quote the relevant part of FIPS 186-4; make my endorsement falsifiable.
1d
revised State of the art RSA key generation
Polish
1d
revised State of the art RSA key generation
Polish
1d
revised State of the art RSA key generation
Polish