22,354 reputation
12992
bio website
location Paris, France
age
visits member for 3 years, 5 months
seen 4 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Nov
4
revised Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?
Extend from $e=3$ to any small odd $e>2$
Nov
4
comment Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?
It is unusual to consider safe primes (primes that are two times a prime plus one) in an RSA context (encryption or signature per PKCS#1, signature per ANSI X9.31, ISO/IEC 9796-2, FIPS 186). Some standards, including ANSI X9.31 and FIPS 186-4, still insist to use strong primes (not safe primes) at the 1024-bit modulus level, and this is not entirely unreasonable.
Nov
4
comment Matrix key exchange
Is $M$ reused across multiple executions of the protocol? If yes, is the adversary assumed to know $K$ from previous iterations of the protocol?
Nov
4
revised Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?
Take into account DrLecter's comment
Nov
4
answered Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?
Nov
4
comment Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?
This is correct, but unrelated to the question.
Nov
4
comment RSA 896 vs 1024 vs 2048 in Javascript?
@owlstead: ah, I had missed that generating a private key. That could explain the worse-than-cubic runtime, which I could not explain from the source code which does bigint "by hand" in JavaScript.
Nov
1
revised What is the recommended replacement for MD5?
Update to account for the break of RIPEMD-128
Oct
31
reviewed Close A simple block cipher based on the SHA-256 hash function
Oct
31
revised Attacking 2DES efficiently
[Edit removed during grace period]
Oct
31
revised Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?
edited tags
Oct
31
comment Attacking 2DES efficiently
Unless I err: odds that the last call for the first iteration was with G and for the second iteration with H is $1/4$; but odds that the last call for the first iteration was with a different function than the second is $1/2$, and that seems to be what really matters.
Oct
31
comment Attacking 2DES efficiently
This works, and might score well for homework, unless the $2^{45}$ is deliberately misleading. But this is vastly more costly than collision-based search as outlined in this other answer, in term of block cipher operations, memory used, and memory accesses.
Oct
31
comment Attacking 2DES efficiently
It would help to state that $G(x)$ [resp. $H(y)$] is encryption [resp. decryption] with key $x$ [resp. $y$] of plaintext [resp. ciphertext] of one known plaintext/ciphertext pair; and that $G$ and $H$, thus $Q$, behave as random functions, justifying the likely existence of a cycle short enough to be found. I wonder what the expected number of block cipher executions is to exhibit a $(x,y)$ candidate in a DES context, and how using some memory could help. A detail: some or vice versa seems needed to reach the stated probability of $1/2$ rather than $1/4$.
Oct
24
awarded  public-key
Oct
20
revised How can one calculate the estimated RSA key life based on Moore's law?
Fix the name of Gordon Earle Moore
Oct
20
comment How can one calculate the estimated RSA key life based on Moore's law?
Unfortunately this answer links to a Wikipedia page with an incorrect formula: it confuses the number of bits of a number and its natural logarithm; and it misses an $o(1)$ term. The correct formula is here.
Oct
18
awarded  Revival
Oct
18
revised Order of cascaded ciphers
Update following Hunter's question
Oct
17
reviewed Approve Does encrypting a hash of the message yield a secure MAC?