19,936 reputation
12781
bio website
location Paris, France
age
visits member for 3 years, 1 month
seen 51 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Aug
29
comment Are there other digital certificate formats than X.509?
There are yet other Digital Certificate formats; see this answer
Aug
29
comment Are there other digital certificate formats than X.509?
An example of use of CVC is in the European Digital Tachograph Smart Card; see Council Regulation 3821/85 (ammended), Annex 1B, Appendix 11, section 3.3 (starting at CSM_016)
Aug
27
comment RSA was rejected by which journal?
For what D.W. refers to, see Ralph Merkle's own account
Aug
25
comment Why should I use an Initialization Vector (IV) when I have unique keys?
That's a VERY good point, I have altered my answer accordingly. I wish I had noticed that alternate answer long before!
Aug
25
revised Why should I use an Initialization Vector (IV) when I have unique keys?
Oups! We can (and do) live with no IV when unique keys are used, but that does make some attacks less difficult.
Aug
25
comment Attacking unuauthenticated RSA
Yes, the same holds: insuring confidentiality and insuring authenticity are distinct goals, both in symmetric and asymmetric cryptography. $\;$ Is there anything in the question beyond that ?
Aug
22
comment Why does DES use exactly 16 rounds?
@Henrick Hellström: I question your statement that that there is no successful (better-than-brute-force, of course) attack against 8 round DES $\;$ This is a claimed better-than brute-force attack on DES reduced to 13 rounds, with a relatively practical variant for 10 rounds. I tend to agree with this answer.
Aug
19
awarded  Popular Question
Aug
17
awarded  Yearling
Aug
15
awarded  Nice Answer
Aug
15
comment Can you fake messages from recorded message-history?
Apologies for my original comment (and other later mess-ups), it should have been: Encrypting a message with Bob's public key only proves that it was written for Bob inasmuch as the message remains secret. I maintain that the fragment "To be sure that the message is for B, A has to encrypt it with B's public key" is wrong when for B is understood as with B interpreting the message. $\;$ The passage "To be sure that the message is from A, A has to encrypt it with his private key" uses improper terminology, but is right after changing encrypt to sign.
Aug
15
comment Can you fake messages from recorded message-history?
@Rubo77: I know that DKIM signs the message's origin, but does it sign the intended recipient(s) or otherwise protect from replay of the same message to unintended recipients? If yes, any reference to how?
Aug
15
comment Can you fake messages from recorded message-history?
@Lie Ryan: yes, what you describe would be possible; it amounts to Alice always signing messages making explicit mention of the intended recipient(s) or/and context, or/and enforcing this in the cryptogram format. That's just not part of PGP, or of the PGP wrapper that I practice.
Aug
15
revised Can you fake messages from recorded message-history?
Add note
Aug
15
answered Can you fake messages from recorded message-history?
Aug
15
comment Implementation Attacks on Hashes
Why the close votes?
Aug
11
comment Currently i am doing decryption for RSA encoding and i face some problem with it
@Thor: I question your Textbook RSA is the clue. $\;$ Textbook (aka naked) RSA is quite safe when used to encipher random $k$-bit data and $e\cdot k>5\log_2N$, which should be the case here.
Aug
11
comment Currently i am doing decryption for RSA encoding and i face some problem with it
$\log_2(N)\approx 1023.034$. $\;$ Usual RSA key generation algorithms for 1024-bit $N$ generate $p$ and $q$ uniformly randomly in range $[2^{1023/2}\dots2^{1024/2}]$, and thus have odds of generating a $N=p\cdot q$ that close to $2^{1023}$ rather low (like 1/5000). In an exercise, that may not be a coincidence. Perhaps this hints at some way to factor $N$. Any context, like: a recent/related lesson/text was about Fermat factoring?
Aug
10
comment Format of NONCE in Initialization Vector (IV)
@owlstead: I'm OK with you change. However, using an UID as IV can be bad: in CBC mode, if the UID is predictable, encryption can be broken under CPA; in CTR mode, if consecutive UIDs differ only in the same low bits that are changed by counting, some keystream is reused. $\;$ In my opinion, the simplest (thus often the best) is: if the key is used for a single session, use implicit zero IV; otherwise use a random IV.
Aug
6
comment A way around digital signatures?
Any wrong with two symmetric keys K0 K1, with K0 known to A and B only, and K1 shared between A B C; and protecting messages with two MACs with these keys, except when originating from C which uses K1 only?