19,936 reputation
12784
bio website
location Paris, France
age
visits member for 3 years, 1 month
seen 54 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


6h
comment Why should CAST5 and 3DES not be used for encrypting files over 4GB?
When using a 64-bit cipher in CBC mode, odds of collision after 4GiB ($k=2^{29}$ blocks) are $ϵ≈2^{65}/k^2=1/2^7=1/128$ (given that $1≪k≪2^{32}$). That's $ϵ≈1/148$ for 4GB, $ϵ≈1/8192$ for 4Gib, $ϵ≈1/9445$ for 4Gb [Reposted with fix and the whole four possible units that could be meant].
10h
revised Message encrypted with a LFSR based stream cipher
rolled back to a previous revision
10h
revised Message encrypted with a LFSR based stream cipher
+ changed to ⊕
10h
comment Message encrypted with a LFSR based stream cipher
@J0ker: what is meant is that for all integers $n\ge0$, the equation $x_{(n+3)} = x_{(n+2)} \oplus x_n$ holds, where $\oplus$ is exclusive-OR. You are given $x_0$, $x_1$, $x_2$, and can compute $x_3$ (with $n=0$), $x_4$ (with $n=1$), and so on, up to $x_{15}$, which is the last used term of the LFSR output (also the key of the pseudo-OTP, which really is a stream cipher).
21h
comment Message encrypted with a LFSR based stream cipher
@J0ker: Yes: now you can compute the $x_i$, with $i$ from 0 to 15, which in your problem forms the output of the LFSR, which also is the key of the (pseudo) OTP. Then you can decipher the given ciphertext as you would for a regular OTP, yielding the plaintext. That's basically what you are told by mczraf in that answer.
1d
comment Message encrypted with a LFSR based stream cipher
Hints: contrary to historical practice in telecommunication, assume big-endian convention when converting a sequence of 8 bits to ASCII (that is: 01001010 is \$4A thus J, not \$52 thus R). $\;$ The message itself could be understood as a provocative invitation.
1d
revised Message encrypted with a LFSR based stream cipher
Beautify, fix obvious error, and retag
1d
comment Message encrypted with a LFSR based stream cipher
Likely one should read $x_{n+3} = x_{n+2} + x_n$ for $n≥0$; with the original $n≥3$ there was no way to infer $x_3$, $x_4$, $x_5$. I took the liberty to fix it.
1d
comment Simpler proof of RSA's correctness
You can do without the CRT; see this answer.
Sep
27
comment Calculate the avalanche effect
Reading the text again, the "128 bits" and/or "8 bits" fragments of the statement are either wrong (my guess), or a trap. Also, in the example, the structure of "If without.. and when.. Therefore" is illogical. $\;$ This seems to be a wrong exam problem statement; these occur, and are a serious nuisance.
Sep
27
comment Calculate the avalanche effect
@Mark Jue: my guess is that your answer is wrong for at least one of several reasons: trusting the 128 in the statement; considering the difference at each round, rather than how this evolves from round to round; considering all rounds; computing "avalanche effect" (however that's precisely defined) from a single example. $\;$ Again, STATE THE DEFINITION GIVEN.
Sep
27
comment Calculate the avalanche effect
There is an obvious error in the example: 012468aceeca86420 and 12468aceeca86420 represent the very same 64 bits; I guess 012468aceeca86420 is intended to be 02468aceeca86420. $\;$ Hint: state the precise definition of avalanche in the course, and the answer (or lack thereof) should be readily apparent. $\;$ Be careful about if that definition allows computing avalanche from a single example, as in this problem.
Sep
26
awarded  Popular Question
Sep
24
awarded  Autobiographer
Sep
24
comment Montgomery Multiplication in FPGA explanation
Perhaps a link to the document where the Montgomery Multiplication is pretty clear would help. Edit the question, select that fragment, Ctrl-L, paste link will do the trick. $\;$ As to the question: $x\bmod 2$ is the low-order bit of the binary representation of $x$; while $x\div 2$ is $x$ with that bit removed (in the context).
Sep
23
awarded  Popular Question
Sep
23
comment Is there any area where AES-CBC cannot be used ? If so, why ?
Hint: consider a large encrypted file, of which a small fraction needs to be updated.
Sep
22
comment Are there other digital certificate formats than X.509?
by any chance, do you know what European regulation (or other spec) defines the CVCs in those European passports that hold one?
Sep
19
comment Is it possible (how difficult) to find MORE than one valid RSA signature?
The answer depends on if A) signatures verifiable by different public keys count; B) the scheme is deterministic [e.g. ISO/IEC 9796-2 methods 1 and 3] or not; C) access to the private key function $x\to x^d\bmod N$ is available; D) details in the verifier definition/implementation, e.g. is $S+N$ just as valid as $S$.
Sep
18
comment What is the length of an RSA signature?
In some RSA variants, including ISO/IEC 9796-2 (with total message recovery, and the "Signature production function" rather than the more common "Alternative signature production function"), the signature is a bit string of $\lceil\log_2N\rceil-1$ bits, corresponding to (the big-endian encoding of) an integer between $1$ and $(N−3)/2$: that is $\min\big(J^s\bmod N,N-(J^s\bmod N)\big)$ where $J$ is a function of the message to sign and parameters.