19,926 reputation
12781
bio website
location Paris, France
age
visits member for 3 years, 1 month
seen 2 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Apr
11
comment Signature schemes for underpowered devices (8bit microcontroller)
@brunosmmm: There is a huge difference: a secret key gives no security when it gets known, and it is almost impossible to keep a secret with a standard CPU, because of debug and factory testing features like JTAG, goofs, and side channels; when by contrast nothing needs to be kept secret when using a public key for integrity verification. We are back to the beginning of my answer. These things apply to almost any embedded device, regardless of CPU power, and should really be asked in a different question.
Apr
10
comment Signature schemes for underpowered devices (8bit microcontroller)
@brunosmmm: or there is a simpler, thus perhaps better, possibility: assume the genuine owner's public key is injected in the slave once when new, and stored in Flash.
Apr
10
comment Signature schemes for underpowered devices (8bit microcontroller)
@brunosmmm: your new comment is far from the original problem (no more underpowered devices). For a detailed answer I suggest a separate question. In short: this can be solved by a classic PKI, with a hierarchy of long-term keys, rooted to a manufacturer key in every device. E.g. the manufacturer issues a certificate that a given device (identified by serial number) was sold to the the holder of the private key matching a certain public key. Similar to certificates in Annex 1B, appendix 11 of that
Apr
10
revised Signature schemes for underpowered devices (8bit microcontroller)
typo, word on distributed factoring
Apr
10
revised Signature schemes for underpowered devices (8bit microcontroller)
typo
Apr
10
revised Signature schemes for underpowered devices (8bit microcontroller)
Updates 5: RAM constraints, how chain of certificates are broken, under/over-size of RSA modulus
Apr
10
comment AES+CTR+HMAC Encryption and Authentication on an Arduino
@Carl: Yes, spot on.
Apr
9
revised Signature schemes for underpowered devices (8bit microcontroller)
Add data on what the clock of the 8051 is; add data on 68HC11; update 4 with guestimate on S08
Apr
9
comment AES+CTR+HMAC Encryption and Authentication on an Arduino
Both encrypt-then-(H)MAC-including-IV and hash-then-encrypt provide integrity in an adversarial setup. Neither encrypt-then-append-hash nor encrypt-then-(H)MAC-except-IV provide that.
Apr
9
revised Signature schemes for underpowered devices (8bit microcontroller)
Expand per a comment.
Apr
9
revised Using salted hash as password for easy memorization without reuse?
Update per comment.
Apr
9
answered Using salted hash as password for easy memorization without reuse?
Apr
9
revised “Weaknesses” in SHA-256d?
Fix the tests at steps 5. and 6.
Apr
9
comment How do I generate decryption keys for the IDEA algorithm from the 128 bit key?
For computation of the modular inverse, try this. The rest is straightforward.
Apr
9
comment “Weaknesses” in SHA-256d?
I disagree with the presentation made in this answer of the consequences of the (extremely relevant) paper quoted (save for the "Avoiding the distinguisher" part). In particular, "$2^{n/4}$ queries" does not follow from the paper, and is misleading. Either one sticks to the standard definition of "Distinguishing from a random oracle" and the number of queries remains $O(2^{n/2})$; or one uses "Differentiability from a random oracle" as in the paper, and the attacker's effort is $O(1)$. See my reading.
Apr
9
revised “Weaknesses” in SHA-256d?
Sketch of standard proof
Apr
9
revised “Weaknesses” in SHA-256d?
Expand, reference to Bitcoin
Apr
9
revised Signature schemes for underpowered devices (8bit microcontroller)
Expand
Apr
9
comment Signature schemes for underpowered devices (8bit microcontroller)
@jug: In my former comment (now mostly moved in the answer) I probably misunderstood what you meant by "Montgomery multiplication (without transformations)". I'm not aware of a standard signature scheme where the verifier can use Montgomery arithmetic without the initial and final preprocessing, but it likely could be done, and yes that would somewhat simplify the code (but still give little speedup). Any pointer?
Apr
9
revised Signature schemes for underpowered devices (8bit microcontroller)
Add link to IC data sheet