19,756 reputation
12779
bio website
location Paris, France
age
visits member for 3 years
seen 18 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Apr
9
revised Signature schemes for underpowered devices (8bit microcontroller)
Expand
Apr
9
comment Signature schemes for underpowered devices (8bit microcontroller)
@jug: In my former comment (now mostly moved in the answer) I probably misunderstood what you meant by "Montgomery multiplication (without transformations)". I'm not aware of a standard signature scheme where the verifier can use Montgomery arithmetic without the initial and final preprocessing, but it likely could be done, and yes that would somewhat simplify the code (but still give little speedup). Any pointer?
Apr
9
revised Signature schemes for underpowered devices (8bit microcontroller)
Add link to IC data sheet
Apr
9
revised Signature schemes for underpowered devices (8bit microcontroller)
More references, fix overhead size for small commands
Apr
9
revised Signature schemes for underpowered devices (8bit microcontroller)
Answer an Rabin with 160-bit key
Apr
9
answered Signature schemes for underpowered devices (8bit microcontroller)
Apr
8
comment Given a certain entrophy per character, how long should a passphrase be to guarantee key strength?
Always check the units. In your formula $(128/4.7)\cdot 1.5$, that is (128) bit, over (4.7) bit-per-char, times (1.5) bit-per-char; that is bit, when you want chars. Therefore, your formula must be wrong. Hint: try to find a formula that passes this test from the first sentence in your own question.
Apr
8
revised “Weaknesses” in SHA-256d?
typo
Apr
8
revised “Weaknesses” in SHA-256d?
More positive and hopefully clear conclusion.
Apr
8
revised “Weaknesses” in SHA-256d?
Reference to PRF in the conclusion
Apr
8
revised “Weaknesses” in SHA-256d?
End with a statement of failure.
Apr
8
revised “Weaknesses” in SHA-256d?
Expand
Apr
8
answered “Weaknesses” in SHA-256d?
Apr
6
comment What data is saved in RSA private key?
This answer looks erroneous to me. $e=1$ gives no security. $e=2$ is not RSA. From memory, and this, $e$ in OpenSSL can't be more than 65537 without breaking compatibility with some implementations, and is almost always 65537 (lower value are not FIPS-conformant). Also from memory, and that, the private key is usually in full PKCS#1 format, including dP, dQ, qInv. Also the right equation (at least in PKCS#1) is $d⋅e≡1\pmod{\operatorname{lcm}(p-1,q-1)}$.
Apr
5
comment How fast can a wrong decryption key be detected using ECC?
Do you have the public key? This would let you detect that the (private) decryption key is invalid, without even the message. Otherwise: what ECC encryption scheme is used?
Apr
5
comment Understanding one-way hash functions construction
You have to tone down your hopes: AFAIK, there is no method around to construct practical hash functions that demonstrably pass "game tests", unless we start from something (like a block cipher) assumed to pass similar "game tests". Classic constructions are the Merkle–Damgård construction and variants‌​; see the HAC. A more modern one is the sponge construction.
Apr
3
comment What are advantages of using a HMAC over RSA with SHA-1 hashes?
Advantages of HMAC are speed, as stated in the fine answers; and small size of the authenticating token (128 bits or even much less, vs at least 1024 bits). The obvious drawback of HMAC is that one needs a secret to verify that token.
Apr
3
comment “Weaknesses” in SHA-256d?
@Nemo: Samuel Neves remark is that ability to find $m$ and $m'$ of the same length with $\operatorname{SHA-256}(m)=\operatorname{SHA-256}(m')$, allows to trivially find a short padding $p$ such that for any suffix $K$, $\operatorname{SHA-256d}(m||p||K)=\operatorname{SHA-256d}(m'||p||K)$. It could be a problem if SHA-256 was broken (which is: not any soon); and one used a BadMac defined as $\operatorname{BadMac}(K,m)=\operatorname{SHA-256d}(m||K)$, rather than a good MAC such as HMAC.
Mar
28
comment Assymetric password encryption - Viable? Which algorithm?
Hybrid encryption is usually not used to encipher a public or private key, and I am not proposing that. An hybrid encryption scheme enciphers sizable data payload (here: the passwords) using a symmetric cryptosystem, which secret key is enciphered using public key crypto (possibly: once for each recipient, here each server). The total size is that of all the passwords, plus one constant-size cryptogram for each recipient with distinct key. The secret key is recovered by each recipient. It can be cached in RAM. Decryption of the passwords can occur on demand. Refinements allow password updates.
Mar
28
comment Why are RSA key sizes almost always a power of two?
@Joe Zeng: That's not what I meant. In my original answer, the "later" you quote referred to considerations on word/storage unit size. This creates much more marked steps than the (relatively smooth) addition of an extra squaring step, because the later depends on the number of bits in the exponent, which is not bound to be a multiple of something, and is typically a little less than $n$.