20,283 reputation
12786
bio website
location Paris, France
age
visits member for 3 years, 2 months
seen 56 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


May
16
comment SHA-1:Is there any mathematical result that gives us the minimum number of 1's in a 160-bit SHA-1 hash output?
Additional hint: build (perhaps with a spreadsheet or short program) a Pascal Triangle of appropriate size (perhaps filling it with odds rather than raw number of possibilities); then sum the appropriate terms.
May
15
comment Increased CRC collision probability when adding bits to input message
Indeed, if version 2 was using a different polynomial than V1, there would be collisions between CRC for V1 and V2. I address this issue in the fourth paragraph of my answer.
May
13
revised Increased CRC collision probability when adding bits to input message
typo
May
13
revised Increased CRC collision probability when adding bits to input message
Expand, fix
May
12
answered Increased CRC collision probability when adding bits to input message
May
9
revised CBC-MAC , fixed length, all blocks returned
typo
May
7
comment What's the difference between AES and earlier block ciphers?
@Smit Johnth: Other common operating modes (CFB, OFB, CTR) have the same vulnerability: constant plaintext is correlated to lower odds of collision between ciphertext blocks, and that may be a concern for (nowadays) practical data sizes and 64-bit block ciphers. The best fix is to use a wider block cipher (kludges are possible with CBC and CFB; e.g. add the block index to each plaintext bock).
May
7
comment Are digital signatures secure for signing lots of small messages?
Perhaps make that any good digital signature algorithm; some standards have been lacking in this respect; e.g; ISO/IEC 9796 (better known as ISO/IEC 9796-1) which was withdrawn following attacks, and ISO/IEC 9796-2 which has a more or less serious vulnerability in its original (and most used) mode.
May
7
comment RSA leak bits to factor N
Very nice question, that stands not fully answered!! An observation: leaking 1 more bit can only help any well-tuned algorithm by a factor of at most 2 (otherwise, we could use that to construct a better algorithm). Therefore, for N of a size making it borderline factorisable (or equivalently, low k), the optimal solution can not be hinting a mediocre algorithm (like any improvement of Fermat factoring). The problem may have different solutions depending on how much N is above the state of the factoring art.
May
7
comment RSA leak bits to factor N
Are you thinking at hinting an Elliptic Curve factoring algorithm? Seems promising, for EC factoring is very near the best factorization algorithm around. Could you elaborate?
May
6
comment Is there any strong enough pen-and-paper or mind cipher?
I think that the suggestion to use RC4-52 in this answer can be made reasonably secure, and practicable with a deck of card by a trained operator. Devil is in the details, in particular the key and nounce/salt setup. I add that much less than 52 symbols should be used for plain and ciphertext, and keystream outside that range should be discarded (I conjecture it strengthen the keystream generator significantly).
May
6
revised What's the difference between AES and earlier block ciphers?
Fix advantage
May
5
awarded  Excavator
May
5
revised New PRG from old
Beautify
May
5
comment how much is secure to encrypt a password using itself (as encryption key) for storing it on a unsecure media?
Is this homework? There's a tag for that. Hint: how much CPU.time would it take to find the password using an implementation of AES based on this, assuming the password is the first one described here? Compare with proper use of scrypt.
May
5
comment Is there any strong enough pen-and-paper or mind cipher?
The OTP is a perfectly strong encryption system, simple enough to be performed with pen and paper, but is neither a cipher by some theoretical definitions thereof; and is not practical, for the pad is hard to generate, impossible to remember, and hard to conceal.
May
5
answered What's the difference between AES and earlier block ciphers?
May
5
revised What length should the padding be when encrypting or signing with RSA?
Added that padding must be verified in signature verification
May
5
comment What length should the padding be when encrypting or signing with RSA?
@ispiro: Yes padding is right (added it in the answer). The simplest: use a standard signature and verification library implementing RSASSA of PKCS#1, or ISO/IEC 9796-2. If you want to roll your own implementation (which makes some sense for copy protection), you can still use a standard scheme. You will be very much on the safe side w.r.t. signature forgery doing as in a)&b) in your comment above, baring implementation mistakes (in particular: the verifier MUST check both the signed message/computer-id, and the deterministic random-like portion of the padding obtained from that).
May
5
revised What length should the padding be when encrypting or signing with RSA?
Added padding