16,773 reputation
12266
bio website
location Paris, France
age
visits member for 2 years, 8 months
seen 3 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


2d
comment Turning a cipher into a hashing function
There is a solution to at least the first issue (only 128-bit width) encountered when making a Merkle-Damgård hash with AES-256: a compression function proposed by Shoichi Hirose at FSE 2006. I have opened a question about if the second issue (AES-256 related-key weaknesses) is a practical concern.
2d
comment Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
Yes, with AES, Miyaguchi-Preneel seems more robust: the block cipher is in a known-key setup, rather than chosen-key (Davies-Meyer) or a half-chosen-key (Hirose). However, Miyaguchi-Preneel only gives a 128-bit hash (uncomfortably narrow nowadays w.r.t. collision-resistance), and uses 128-bit blocks rather than Davies-Meyer's 256-bit, making it less efficient by a factor like 2. That would be a high performance penalty to endure if we had reasons to believe attacks exploiting AES related-key weaknesses are likely to forever have cost higher than the expected resistance to brute-force attacks.
2d
comment Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
I notice that one of your paper says from a former one that it has "shown practical attacks on AES-256 in the chosen key scenario, which demonstrates that AES-256 can not serve as a replacement for an ideal cipher in theoretically sound constructions such as Davies-Meyer mode". Can you comment on that?
2d
awarded  Necromancer
Apr
14
revised Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
Emphasize the size of the blocks; fix title
Apr
14
revised Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
Polish hypothesis
Apr
14
asked Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
Apr
14
revised Turning a cipher into a hashing function
Fix description of Hirose construction
Apr
14
revised Turning a cipher into a hashing function
Link to a more prudent answer.
Apr
13
comment A known-plaintext attack on an LFSR-based stream cipher
Make a table with lines representatives of the successive states, with 4 values on each line: the 3 state bits of the shift register, and its input. You can find what's necessary to fill the table from the output sequence [hint: with a drawing of a Fibonacci (L)FSR, determine how the initial input of the shift register has propagated after 3 clocks]. That table defines the feedback function (which inputs are the state bits, and output is the shift register's input) fully, except for all-zero input. Verify that this function can be built as the XOR of some of its inputs, and identify theses.
Apr
13
revised Why does HMAC need a fixed length padding?
typo
Apr
13
answered Why does HMAC need a fixed length padding?
Apr
13
comment A known-plaintext attack on an LFSR-based stream cipher
Hints: In a stream cipher, $\text{ciphertext }=\text{plaintext}\oplus\text{keystream}$. Find the keystream. What is its apparent period? What is the minimum number of D flip-flops to achieve this number of states? Assume that number of D flip-flops forming a shift register with a feedback function. How are the initial state and the successive inputs related to the output sequence? Tabulate the feedback function, and check that it can be built with XOR gates, validating the assumption of a LFSR. Cross-check: is the feedback polynomial primitive, and is the period consistent with that?
Apr
13
revised Turning a cipher into a hashing function
Polish
Apr
13
awarded  Disciplined
Apr
13
reviewed Approve suggested edit on knapsack tag wiki excerpt
Apr
13
revised
RSAP in not used for signature
Apr
13
revised
Streamline
Apr
13
revised Security of RSA for paranoids with padding?
Understood Rabin's argument
Apr
13
revised
Introduce the name Unbalanced RSA. Change definition to make imbalance secondary to message of constrained size.