21,885 reputation
12991
bio website
location Paris, France
age
visits member for 3 years, 4 months
seen 14 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Dec
7
comment How Brittle Are LCG-Cracking Techniques?
@Thomas M. DuBuisson: interesting; if time allows I'll try translation to SAT by more primitive means, and state-of-the-art solvers. $\;$ Side note: the @ sign before a name in a comment creates a notification; the name itself does not.
Dec
7
comment How Brittle Are LCG-Cracking Techniques?
@Thomas M. DuBuisson: My intuition is that even Case 3 could be solved using Cryptol and a SAT/SMT solver, as you did in this nice answer to a much more trivial problem. $\;$ If it indeed works, that would be a very convincing demo!
Dec
7
comment Asymmetric encryptions' computational complexity
Hint: start by establishing that (for arguments of $n$ bits) the cost of the classic multiplication algorithm is $O(n^2)$ for arguments of $n$ bits; extend to $O(n^2)$ for $a\cdot b\bmod N$; then $O(n^3)$ for $x^d\bmod N$. There are faster algorithms, but they are not extremely useful in cryptography because $n$ is at most in the thousands (for RSA) or hundreds (for ECC).
Dec
6
revised DES key complementation property
improve tags
Dec
6
comment DES key complementation property
Note: By definition $\overline x$ is the bitwise complement or bitwise NOT of $x$. $\;$ Hint: assume that you can obtain the ciphertexts for two values of plaintext: an $m$ that you know [that is: you obtain $m$ and $c=\operatorname{DES}_k(m)$ ], and an $m′$ that you choose [that is: you choose $m′$ and obtain $c′=\operatorname{DES}_k(m′)$ ]. How do you choose $m′$ so that you can test (with low odds of false positive) two values of $k$ with a single DES encryption?
Dec
6
revised DES key complementation property
Fix the statement so that it makes sense
Dec
6
comment SHA1 Collisions - what about practical attacks?
@owlstead: I see no difference in principle about attacks exploiting MD5 collisions, and attacks exploiting SHA-1 collisions; feasibility is about operational details, and the cost of the search given the constraints. However MD5 is significantly more badly broken than SHA-1 is, in particular 1-block (64-byte) MD5 collisions are possible when the minimum is 2-block (128-byte) for SHA-1; and significantly constrained MD5 collisions can be built, when we do not have even a single SHA-1 collision.
Dec
6
revised SHA1 Collisions - what about practical attacks?
More references
Dec
6
revised SHA1 Collisions - what about practical attacks?
Detail how to find Na and Nb product of two primes, or deal with more primes
Dec
6
revised SHA1 Collisions - what about practical attacks?
N in the second attack must be squarefree
Dec
6
revised SHA1 Collisions - what about practical attacks?
Estimation of work involved in the second attack
Dec
6
revised SHA1 Collisions - what about practical attacks?
Polish
Dec
6
comment SHA1 Collisions - what about practical attacks?
@crypto-learner: I now give a lot more details, especially for the second example.
Dec
6
revised SHA1 Collisions - what about practical attacks?
Expand, especially the second example
Dec
5
revised Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?
Incorporated the lack of backtracking resistance in the assessement of ANSI931_AES256
Dec
5
revised SHA1 Collisions - what about practical attacks?
More details on the second example. Move the description of collision search in the first example, because it does not quite apply to the second.
Dec
5
revised SHA1 Collisions - what about practical attacks?
Polish
Dec
5
revised Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?
Update per Gilles comment
Dec
5
comment Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?
@Gilles: yes, in some uses the lack of backtracking resistance can be an issue. I semi-consciously worded the hypothesis of my endorsement so that it excludes this concern, but in retrospect should have mentioned it. You did, very well.
Dec
5
revised SHA1 Collisions - what about practical attacks?
add link; polish