21,585 reputation
12990
bio website
location Paris, France
age
visits member for 3 years, 3 months
seen 3 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Aug
29
comment How can I take advantage of repeated patterns in non random RSA prime factors?
@Hans Stricker: knowing integer $n$, that $n=p\cdot q$ with $p$ and $q$ unknown primes in range$[2^{1023/2}\dots2^{1024/2}]$, and the integer $\bar p=\lfloor p/2^{512-160}\rfloor$, find $p$. Perhaps it is possible to assume that $\lfloor p/2^{512-320}\rfloor$ falls into a relatively short list of known possible values; that could help tremendously.
Aug
29
comment The security of an encrypt-and-MAC
@hunter: related to that other question, but different since keys are not reused, and thus with a different answer. This is fine in theory, but utterly impractical as anything involving the One-Time-Pad, and anything assuming not reusing a MAC key (here k2) without a definition of how new keys are established.
Aug
29
comment How to hash a list of multiple items?
Indeed, the mapping of parameters to hash input must be reversible. A usual solution is $H(\operatorname{len}(param1)||param1|| \operatorname{len}(param2)||param2|| \operatorname{len}(param3)||param3)$ where $\operatorname{len}$ produce an output of either fixed size, or is otherwise reversible. Also there's ASN.1
Aug
27
comment Why no swapping block in the last round of DES?
Work it out from FIPS46-3, pages 8-12. Note: a few implementations do have a final swap, but canceled by hiding another in the final permutation.
Aug
26
comment Is there a public key encryption scheme with optimal key size?
That explains why the discrete logarithm problem in a finite cyclic group has an asymptotic security / public key size ratio of at most $1/2$, when the PK is $g^x$ for some random $x$. It can't be generalized to any cryptosystem in such group. I am not sure for any public key cryptosystem in such group: why would not it be possible to devise such cryptosystem where the public key has some representation in $0.9\cdot\log_2(n)$ bits? Just like we have RSA variants with public key about $\log_2(n)/2$ bits with (near demonstrably) no loss of security, perhaps even $\log_2(n)/3$ bits.
Aug
26
comment Is there a public key encryption scheme with optimal key size?
I have other serious reservations on Understanding Cryptography beyond its ECC chapter. It is often imprecise, like it defines cryptography as "the science of secret writing with the goal of hiding the meaning of a message", leaving no room where message integrity fits in the picture of cryptology drawn in the intro; and it fails to mention countless security-critical facts, like in the section on CBC-MAC that this MAC is unsafe when the message size is allowed to vary.
Aug
26
comment Is there a public key encryption scheme with optimal key size?
I do not see an answer to the (very interesting and hard) question, nor an inventory of the (compressed) public key size vs security level for various known public key encryption (or signature) schemes. Also there is no discussion on why the private key can be reduced to the point of defining the security level, while the public key can't. I find the ECC chapter in "Understanding Cryptography" a fair introduction to ECC cryptography, but it is not explaining enough for my taste.
Aug
24
comment Is size Q equal to size SHA(Q)?
"The elliptic curve" is undefined, and very relevant. "Size (of) Q" can have several interpretations, for there are several means to define a point on an elliptic curve. No hash form the SHA family is 128-bit.
Aug
24
comment Is there a public key encryption scheme with optimal key size?
@owlstead: Absolutly. That's why (compact representation of) the public key is the appropriate metric.
Aug
24
comment Is there a public key encryption scheme with optimal key size?
It should be clarified how "key size" is defined in the context of Public Key encryption. I think the interesting metric is the bit size of the most compact representation known for the public key (if that was private key bit size: it is trivial to turn a PK encryption scheme into a scheme with security $O(2^k)$ for a private key of $k$ bit: use that key to seed a PRNG, define the private key operation as including derivation of the original system's private key).
Aug
24
comment Does CBC encryption of a hash provide authenticity?
@Ricky Demer: yes, there must be something after $M_c$. I have now made that $M_d$ explicit. Hope this is clear now, and thanks for the comments.
Aug
24
revised Does CBC encryption of a hash provide authenticity?
Expand. Add example of attack, and of weaker conditions allowing an attack.
Aug
24
comment Does CBC encryption of a hash provide authenticity?
@Ricky Demer: I fail to see why there would be a constraint on the size of $M_x$. There is indeed a constraint on the size of $M_c$, which is met by including $\operatorname{Padding}(M_b||M_x||H(M_b||M_x))$ at the end of $M_c$.
Aug
23
revised Does CBC encryption of a hash provide authenticity?
added 7 characters in body
Aug
23
answered Does CBC encryption of a hash provide authenticity?
Aug
22
comment what kind of hash function can provide a short hash and be collision resistant?
@Ricky Demer: I see a problem with using a randomized hash in this (and some other) contexts: the added random needs to be known to the verifier, and thus moved alongside the data; that eats on our 16-char allowance. Although the random does not need to be trusted by the verifier to the same degree as the hash/condensate, this is still an issue. Of course the random could be replaced by some function of the data, but then we are really making a two-pass hash in hope to improve its collision-resistance.
Aug
22
comment what kind of hash function can provide a short hash and be collision resistant?
@Ricky Demer: you have an awk's eye.
Aug
22
revised what kind of hash function can provide a short hash and be collision resistant?
Fix miscount in encoding string.
Aug
19
reviewed Approve suggested edit on nist tag wiki
Aug
17
awarded  Yearling