19,353 reputation
12676
bio website
location Paris, France
age
visits member for 2 years, 11 months
seen 49 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


1d
answered MAC using a modified CBC mode of operation
1d
comment Is my implementation of a PRG at least intuitively secure?
Without a meticulously precise description of a PRG, one can't conclude that it is secure. Such description is not given, thus the question can't be answered; and it would probably be off-topic anyway. $\;$ Keep in mind that any experimental randomness test not tailored to the PRG tested can only invalidate the hypothesis that it is secure, NOT validate that hypothesis. An analogy: that's similar to a Fermat primality test, which can often invalidate that an integer is prime, but can never tell 1436697831295441 is not prime.
1d
comment MAC using a modified CBC mode of operation
Hint: what happens to the tag when two blocks of plaintext are exchanged?
2d
revised How do we operate IV+1?
Add LFSR variant
2d
revised How do we operate IV+1?
restrict to big-endian
2d
answered How do we operate IV+1?
2d
comment understanding the proof of knowledge
Anything in particular remains unclear after reading Wikipedia's entry on proof of knowledge? Or/and Mihir Bellare and Oded Goldreich's reference article: On Defining Proofs of Knowledge?
Jul
21
comment How much bit encryption is this DES code using?
This question is off-topic because it is mostly a programming question about a particular programming language (Java) and library. $\;$ Some of the answer lies in$$\mathtt{Cipher.getInstance("DES");\;//\;DES/ECB/PKCS5Padding\;for\;SunJCE}$$‌​which according to its own documentation limits the effective key length to 56 bits (or 55 for some attacks using DES complementation property); further, $$\mathtt{key\;=\;"ekrjtkejxr"}$$ suggests restriction to key of 8 lowercases with low-bit ignored, that is less than 30 bits of entropy.
Jul
21
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
In my first comment, read "the adversary able to mount a chosen-PLAINTEXT attack".
Jul
21
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
@RickyDemer: Yes. Adapted to the present context (with CRC instead of Hash, but that works for a hash just the same): one decides the desired Forgery, computes its CRC, builds 6zeroes||Headers||CRC||Forgery, submits that as (chosen) Data for authentication and encryption; and from the resulting cryptogram removes the first 16 bytes (including 8 bytes IV). What remains will pass verification (the first 8 bytes will be the IV).
Jul
21
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
The terminology is not quite right: CRC32 can't be used as (a weak substitute for) a MAC, for it is a keyless transformation of the message. Rather, here, it is used as (a weak substitute for) a hash in a hash-then-encrypt scheme, something which itself does not generally insure message integrity. $\;$ If the IV for the 3DES-CBC encryption is 8 random bytes prepended to the cryptogram, and the length of Data variable, and the adversary able to mount a chosen-ciphertext attacks, then such generic attacks on hash-then-CBC-encrypt work here.
Jul
18
comment Is TripleDES 168bit vulnerable to Differential Cryptanalysis?
One should not trust a table/paper where the time to enumerate all 56-bit DES key is given as 400 days at a rate intended to be realistic (the EFF cracker did that in few days in 1998).. and where for 112-bit 2keys-3DES, all other things being equal, the time is only twice that!! $\;$
Jul
18
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Added emphasis on missing point in the statement
Jul
18
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Link to current question
Jul
18
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
The method in the other answer needs adapatation if we consider that _g_ is not a generator
Jul
18
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Update per comment, and polish
Jul
18
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Update per comment
Jul
18
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Link another comment
Jul
17
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Polish, enough for now
Jul
17
comment Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
That answer was written for that early statement; and assumes $\gcd(b,p-1)$, which is not a given, and is rare for some $p$. $\;$ Also, the current statement and that comment suggest that the given $g^{ab}$ really is $g^{a\cdot b\bmod r}\bmod p$, not $g^{a\cdot b}\bmod p$ as assumed in this answer; that's usually not the same, for the statement now rules out $g^r\bmod p\;=1$.