20,283 reputation
12786
bio website
location Paris, France
age
visits member for 3 years, 2 months
seen 11 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Oct
17
revised How secure would HMAC-SHA3 be?
Add reference to NIST slides
Oct
17
comment What is the history of recommended RSA key sizes?
One data point: the original (1974) RSA paper said: "We recommend that $n$ be about 200 digits long." That was about 664 bits.
Oct
17
revised Database row level encryption scheme
Expand per comment
Oct
17
comment Compare two approaches for cracking RSA key
@Samuel Judson: for the first part, you have the right order of magnitude, but a) the number of 1536-bit primes is about half of what you estimate; b) what's the lowest possible value for the highest of the two primes? That allows another significant reduction. $\;$ For the second part, you have given an order of magnitude of the effort involved in generating the key. The question asks to turn this into a factorization method for the key at hand, without assuming prior knowledge of the password. $\;$ Side hint: the part of the answer reading "We'll have to do this twice" is wrong.
Oct
16
revised Are LFSRs enough for this?
Better explain the origin of the conjectured security bound.
Oct
16
revised Are LFSRs enough for this?
My conjecture is only tentative!
Oct
16
comment Are LFSRs enough for this?
I now have a tentative conjecture about a safe setup, with the colluding players never consecutive, and separated by $h$ honest ones.
Oct
16
revised Are LFSRs enough for this?
A try at a condition that would insure an adversary can't succeed
Oct
15
comment Is there any existing cipher capable of scaling from a 1 bit key up to a one-time-pad?
The criteria that given ciphertext and $b$-bit key, $2^b$ distinct plaintexts are possible $\;$ a) Can not be reached at all for key/plaintext ratio above 1, even though that is considered in the question. $\;$ b) Is NOT enough to give a useful level of confidentiality for other ratio (proof: consider encryption by XOR with key padded with zeroes up to plaintext length); that criteria can however be a compatible addition to more standard security criteria, at least if we allow about $2^b$ possible distinct plaintexts.
Oct
15
comment Is there any existing cipher capable of scaling from a 1 bit key up to a one-time-pad?
Note that the one-time-pad is not a cipher, by the modern definition, which requires key size to be fixed for arbitrary or much larger plaintext size. $\;$ I know no existing algorithm answering the question. It seems feasible to build one from existing primitives, but exactly what would be the desired security criteria?
Oct
15
revised Database row level encryption scheme
Security CAN be lower if a human is allowed to choose the pass-phrase; add AES-GCM
Oct
15
revised Database row level encryption scheme
Expand
Oct
15
answered Database row level encryption scheme
Oct
15
comment Encrypted read-only message queue
Also: because RSA allows fast signature verification, it is a good candidate for the signature from an efficiency standpoint if reading and forwarding with integrity verification largely predominates writing/signing. If signature size overhead is an issue, RSA signature with message recovery can help reduce the signature overhead (e.g. to 34 bytes with ISO/IEC 9796-2 scheme 3 using SHA-256, with encrypted message of at least 222 bytes and 2048-bit RSA). $\;$ AES-CTR encryption/decryption is fast, and its size overhead is limited to the IV (e.g. 10 bytes for a counter to $2^{80}$).
Oct
15
comment Encrypted read-only message queue
Yes. The key for encrypting and decrypting the messages can (and should) be that of a symmetric algorithm, e.g. AES-CTR with suitably random or sequential IV, and known to groups 1 and 2. $\;$ Signing should be on the enciphered data, using an asymmetric signature algorithm (e.g. RSA with PKCS#1v2 signature padding), with the private key known to members of group 1, and the public key known to all (as implied by its name). $\;$ Everyone (except possibly from group 3) should verify signature of enciphered data manipulated.
Oct
15
revised Are LFSRs enough for this?
Polish, better distinguishing ticket and value on ticket.
Oct
15
comment Are LFSRs enough for this?
@mpr: I tried to address your comments in the answer, including generalizing to $m$ consecutive colluding players. $\;$ Notice that I have made no statement whatsoever about when we are safe, thus have not answered the question asked in the above comment.
Oct
15
revised Are LFSRs enough for this?
Generalize the initial exposition to m collusing players, and improve the bound; polish.
Oct
15
revised Are LFSRs enough for this?
Comment on nature of the uncertainty
Oct
15
revised Are LFSRs enough for this?
Polish, discuss 2/3 of colluding players