19,926 reputation
12781
bio website
location Paris, France
age
visits member for 3 years, 1 month
seen 1 hour ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Jul
23
comment RSA with modulus n=p²q
@bmm6o: Ah right, I had missed that.
Jul
23
comment Which algorithm do you recommend for practical use to generate unique passwords for each website?
Many sites have password requirements than make the "Turn the site secret into a usable password" step non-trivial, and hard to get right; like (I'm not making that up): At least 15 characters. Contains CAPITAL Letters. Contains SMALL letters. Contains either special characters or numbers (e.g. / , *, @, #, $, or 1, 2, 3 etc.). $\;$ Typically that spec is imprecise, often hard to get or/and existing in different versions, and more often than not wrong (e.g. here, the system actually allows both special characters and numbers, and I'm not even sure that it does not require that).
Jul
23
comment RSA with modulus n=p²q
The potential saving is actually greater than for multiprime RSA with 3 primes, because there are only 2 expensive modexp to perform, rather than 3. On the other hand, the modified CRT is quite a bit unusual.$\;$ Note: To get the paper, a click on "download chapter" on the page you link works for me; and then I can save the PDF (I believe, legally); that's a fortunate consequence of the IACR copyright policy.
Jul
23
comment RSA with modulus n=p²q
@Ricky Demer: I fail to see why the restriction to coprime $j$ and $k$. $\;$ That $\gcd$ trick is nice!
Jul
23
revised RSA with modulus n=p²q
Slightly restructure; give standard e.
Jul
23
revised RSA with modulus n=p²q
Fix a formula which was suboptimal (though only when the RNG is hopelessly broken)
Jul
23
comment Reordering non-block-aligned parts with DES in ECB mode
A rainbow table to crack DES encryption, really? If you maintain that assertion, give us details!! Absent these, I consider this is a serious confusion.
Jul
22
revised RSA with modulus n=p²q
More direct link to Fast Variants of RSA
Jul
22
comment MAC using a modified CBC mode of operation
@mikeaso: thanks for the much needed correction!
Jul
22
answered RSA with modulus n=p²q
Jul
22
comment Is my implementation of a PRG at least intuitively secure?
We can tell you the exact opposite: there is not (and can't be) a test, using a PRG as a black box, that can give a useful indication that a PRG is secure; much less a proof. The best a test does is tell that a PRG is not secure. Existing tests of CSPRNGs are designed to catch faulty implementations, or badly misguided (more often than not, both).
Jul
22
answered MAC using a modified CBC mode of operation
Jul
22
comment Is my implementation of a PRG at least intuitively secure?
Without a meticulously precise description of a PRG, one can't conclude that it is secure. Such description is not given, thus the question can't be answered; and it would probably be off-topic anyway. $\;$ Keep in mind that any experimental randomness test not tailored to the PRG tested can only invalidate the hypothesis that it is secure, NOT validate that hypothesis. An analogy: that's similar to a Fermat primality test, which can often invalidate that an integer is prime, but can never tell 1436697831295441 is not prime.
Jul
22
comment MAC using a modified CBC mode of operation
Hint: what happens to the tag when two blocks of plaintext are exchanged?
Jul
21
revised How do we compute IV+1 in CTR mode?
Add LFSR variant
Jul
21
revised How do we compute IV+1 in CTR mode?
restrict to big-endian
Jul
21
answered How do we compute IV+1 in CTR mode?
Jul
21
comment understanding the proof of knowledge
Anything in particular remains unclear after reading Wikipedia's entry on proof of knowledge? Or/and Mihir Bellare and Oded Goldreich's reference article: On Defining Proofs of Knowledge?
Jul
21
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
In my first comment, read "the adversary able to mount a chosen-PLAINTEXT attack".
Jul
21
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
@RickyDemer: Yes. Adapted to the present context (with CRC instead of Hash, but that works for a hash just the same): one decides the desired Forgery, computes its CRC, builds 6zeroes||Headers||CRC||Forgery, submits that as (chosen) Data for authentication and encryption; and from the resulting cryptogram removes the first 16 bytes (including 8 bytes IV). What remains will pass verification (the first 8 bytes will be the IV).