19,756 reputation
12779
bio website
location Paris, France
age
visits member for 3 years
seen 2 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Jul
21
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
@RickyDemer: Yes. Adapted to the present context (with CRC instead of Hash, but that works for a hash just the same): one decides the desired Forgery, computes its CRC, builds 6zeroes||Headers||CRC||Forgery, submits that as (chosen) Data for authentication and encryption; and from the resulting cryptogram removes the first 16 bytes (including 8 bytes IV). What remains will pass verification (the first 8 bytes will be the IV).
Jul
21
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
The terminology is not quite right: CRC32 can't be used as (a weak substitute for) a MAC, for it is a keyless transformation of the message. Rather, here, it is used as (a weak substitute for) a hash in a hash-then-encrypt scheme, something which itself does not generally insure message integrity. $\;$ If the IV for the 3DES-CBC encryption is 8 random bytes prepended to the cryptogram, and the length of Data variable, and the adversary able to mount a chosen-ciphertext attacks, then such generic attacks on hash-then-CBC-encrypt work here.
Jul
18
comment Is TripleDES 168bit vulnerable to Differential Cryptanalysis?
One should not trust a table/paper where the time to enumerate all 56-bit DES key is given as 400 days at a rate intended to be realistic (the EFF cracker did that in few days in 1998).. and where for 112-bit 2keys-3DES, all other things being equal, the time is only twice that!! $\;$
Jul
18
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Added emphasis on missing point in the statement
Jul
18
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Link to current question
Jul
18
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
The method in the other answer needs adapatation if we consider that _g_ is not a generator
Jul
18
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Update per comment, and polish
Jul
18
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Update per comment
Jul
18
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Link another comment
Jul
17
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Polish, enough for now
Jul
17
comment Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
That answer was written for that early statement; and assumes $\gcd(b,p-1)$, which is not a given, and is rare for some $p$. $\;$ Also, the current statement and that comment suggest that the given $g^{ab}$ really is $g^{a\cdot b\bmod r}\bmod p$, not $g^{a\cdot b}\bmod p$ as assumed in this answer; that's usually not the same, for the statement now rules out $g^r\bmod p\;=1$.
Jul
17
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
simplify a tad
Jul
17
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Clarify
Jul
17
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
fix a link
Jul
17
revised Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
typo
Jul
17
answered Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
Jul
17
comment How secure is using a pad (using xor) on a encrypted data, for the purpose of obfuscating/hiding the underlying encryption?
If in “The key is repeatedly used” that “key” is the same as “pad cipher”, then that “repeatedly” is the exact opposite of “one time” in the title's “one time pad”.
Jul
17
revised How long does it take to crack PBKDF2?
There are alternatives
Jul
17
comment Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
By "in group $\mathbb Z_r$" are you meaning $a$ and $b$ are in $\mathbb N$ and less than $r$, or that $a\cdot b$ is computed in that group?
Jul
17
comment Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
@curious: I can't parse what "it's" refers to in your previous comment. Rather, my bets are on the inverse $\pmod{p-1}$