16,883 reputation
12266
bio website
location Paris, France
age
visits member for 2 years, 8 months
seen 10 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Apr
15
awarded  Nice Question
Apr
15
comment Security of RSA for paranoids with padding?
@Ricky Demer: Yes. SPAKE/ALIKE use something reminiscent (the padded message is random then used to build AES-128 keys, concatenated with the encryption of zero with such a key). See the slides, they are interesting.
Apr
15
revised Security of RSA for paranoids with padding?
Cleanup and repolish
Apr
15
accepted Attack of an RSA signature scheme using PKCS#1 v1.5 encryption padding
Apr
15
revised Attack of an RSA signature scheme using PKCS#1 v1.5 encryption padding
Fix per remark
Apr
15
revised Security of RSA for paranoids with padding?
Clarify
Apr
15
revised Security of RSA for paranoids with padding?
Fix link to SPAKE article, polish
Apr
15
revised Security of RSA for paranoids with padding?
Back from the grave with a better and more general question
Apr
15
revised Why does HMAC need a fixed length padding?
Answer the other part of the question, as asked in comment
Apr
14
revised Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
Emphasize the Kelsey and Schneier paper.
Apr
14
comment Turning a cipher into a hashing function
There is a solution to at least the first issue (only 128-bit width) encountered when making a Merkle-Damgård hash with AES-256: a compression function proposed by Shoichi Hirose at FSE 2006. I have opened a question about if the second issue (AES-256 related-key weaknesses) is a practical concern.
Apr
14
comment Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
Yes, with AES, Miyaguchi-Preneel seems more robust: the block cipher is in a known-key setup, rather than chosen-key (Davies-Meyer) or a half-chosen-key (Hirose). However, Miyaguchi-Preneel only gives a 128-bit hash (uncomfortably narrow nowadays w.r.t. collision-resistance), and uses 128-bit blocks rather than Davies-Meyer's 256-bit, making it less efficient by a factor like 2. That would be a high performance penalty to endure if we had reasons to believe attacks exploiting AES related-key weaknesses are likely to forever have cost higher than the expected resistance to brute-force attacks.
Apr
14
comment Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
I notice that one of your paper says from a former one that it has "shown practical attacks on AES-256 in the chosen key scenario, which demonstrates that AES-256 can not serve as a replacement for an ideal cipher in theoretically sound constructions such as Davies-Meyer mode". Can you comment on that?
Apr
14
awarded  Necromancer
Apr
14
revised Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
Emphasize the size of the blocks; fix title
Apr
14
revised Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
Polish hypothesis
Apr
14
asked Are AES-256's related-key weaknesses exploitable if it is used to build a hash?
Apr
14
revised Turning a cipher into a hashing function
Fix description of Hirose construction
Apr
14
revised Turning a cipher into a hashing function
Link to a more prudent answer.
Apr
13
comment A known-plaintext attack on an LFSR-based stream cipher
Make a table with lines representatives of the successive states, with 4 values on each line: the 3 state bits of the shift register, and its input. You can find what's necessary to fill the table from the output sequence [hint: with a drawing of a Fibonacci (L)FSR, determine how the initial input of the shift register has propagated after 3 clocks]. That table defines the feedback function (which inputs are the state bits, and output is the shift register's input) fully, except for all-zero input. Verify that this function can be built as the XOR of some of its inputs, and identify theses.