19,682 reputation
12779
bio website
location Paris, France
age
visits member for 3 years
seen 7 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Jul
18
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Link another comment
Jul
17
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Polish, enough for now
Jul
17
comment Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
That answer was written for that early statement; and assumes $\gcd(b,p-1)$, which is not a given, and is rare for some $p$. $\;$ Also, the current statement and that comment suggest that the given $g^{ab}$ really is $g^{a\cdot b\bmod r}\bmod p$, not $g^{a\cdot b}\bmod p$ as assumed in this answer; that's usually not the same, for the statement now rules out $g^r\bmod p\;=1$.
Jul
17
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
simplify a tad
Jul
17
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Clarify
Jul
17
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
fix a link
Jul
17
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
typo
Jul
17
answered Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Jul
17
comment How secure is using a pad (using xor) on a encrypted data, for the purpose of obfuscating/hiding the underlying encryption?
If in “The key is repeatedly used” that “key” is the same as “pad cipher”, then that “repeatedly” is the exact opposite of “one time” in the title's “one time pad”.
Jul
17
revised How long does it take to crack PBKDF2?
There are alternatives
Jul
17
comment Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
By "in group $\mathbb Z_r$" are you meaning $a$ and $b$ are in $\mathbb N$ and less than $r$, or that $a\cdot b$ is computed in that group?
Jul
17
comment Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
@curious: I can't parse what "it's" refers to in your previous comment. Rather, my bets are on the inverse $\pmod{p-1}$
Jul
17
comment How long does it take to crack PBKDF2?
@Henrick Hellström: very true. That's a possible usage of PBKDF2, not the one I had in mind with my "used to manage passwords".
Jul
17
revised How long does it take to crack PBKDF2?
deleted 9 characters in body
Jul
17
answered How long does it take to crack PBKDF2?
Jul
17
comment Attack on DSA modification with bad hash function
Write down the main equation used by the verifier for testing that $(m,r,s)$ is an acceptable signature in the weak system. The valid signature gives known values satisfying that equation. Your goal is finding $(m',r',s')$ with $m'\not\equiv m\pmod q$ which keeps the equation satisfied. What's $g^q\bmod p$? $y^q\bmod p$? What kind of changes does that allow while maintaining the equation satisfied? Perhaps replacing $s$ with $w=s^{-1}\bmod q$ in the equation (and $s'$ with $w'=s'^{-1}\bmod q$) will help you finding the appropriate changes.
Jul
17
comment Attack on DSA modification with bad hash function
Again, if for any $t$ you could forge the signature for $m′=t+m\bmod q$ in the weakened system, that would also break the real DSA [by choosing $t=H(m′)-H(m)\bmod q$ and using the same attack]. So no this does not cut it, and you need a narrower choice of $m$, of the form $m'=f(m,r,s,p,q,g,y,t)$ for some $f$; and it won't be possible to find $t$ to obtain a chosen $m'$. The mistake in the argument given is that it is assumed $s$ does not change, rather than proven that with $s$ unchanged the verification procedure will pass with the $r'$ that you propose; indeed the verification will fail.
Jul
16
comment Attack on DSA modification with bad hash function
@CGFoX: If for any $t$ you could forge the signature for $m'=t\cdot m\bmod q$ in the weakened system, that would also break the real DSA [by choosing $t=H(m')\cdot H(m)^{-1}\bmod q$ and using the same attack]. You want to exhibit a narrower class of transformations $m'=f_t(m,r,s,p,q,g,y)$ for which an acceptable signature $(r',s')$ can be forged.
Jul
16
comment Does having a known plaintext prefix weaken AES256?
As rightly answered, the answer to the question as in title and second paragraph is NO. $\;$ But suitability of counter mode can't be ascertained, for we do not know: $\;$ A) If the data ever legitimately changes, and how the counter is setup in that case; $\;$ B) If we should consider an attack model where the adversary changes the enciphered data, observes how the system then behaves when manipulating the (modified) deciphered data [e.g. error indication, or lack thereof], and deduce something about the actual clear data.
Jul
15
accepted Which version(s) of SRP are in ISO/IEC 11770-4:2006?