16,773 reputation
12266
bio website
location Paris, France
age
visits member for 2 years, 8 months
seen 7 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Apr
9
answered Rotation table for 8 round DES
Apr
9
revised Will repeated rounds of SHA-512 provide random numbers?
Use the right definition of constants
Apr
9
comment Is it possible to deduce the IV from CBC ciphered data, without knowing the key?
@Andreas: Right. Consequently, decryption of the first plaintext block is possible only with knowledge of the IV (see the bottom drawing in your link). For this reason, the IV must be part of the ciphered data. Conventionally the IV is at the beginning of the ciphered data (that's the only position allowing on-the-fly decryption that introduces no exception for the first ciphertext block). Only common exception is a CBC variant where IV is implicit, and all-zero (that is safe for single-use key).
Apr
9
revised Will repeated rounds of SHA-512 provide random numbers?
Make the assertion of security more precise, with stated odds of failure and rationale. Polish.
Apr
9
comment Is it possible to deduce the IV from CBC ciphered data, without knowing the key?
By definition of CBC, the IV constitutes the beginning of the ciphered data. Thus the only possible answer to the question in the title is yes. Nothing that I read in the body of the question or the comments let me understand what else is asked.
Apr
9
answered Will repeated rounds of SHA-512 provide random numbers?
Apr
9
comment Will repeated rounds of SHA-512 provide random numbers?
Strictly speaking, the sequence is not uniformly distributed: it will ultimately enter a cycle (that's expected after roughly $2^{256}$ hashes), and it is extremely unlikely that the mean number of $1$ in this cycle is exactly $1/2$, a requirement for any uniformly distributed ultimately cyclic sequence.
Apr
9
comment Is Chaocipher a secure cipher under ciphertext-only attack?
Because the key is relatively large [ $2\log_2(26!)>176\text{ bits}$ ], and since the cipher is not trivially bad, a ciphertext-only attack can only be carried with significant amount of ciphertext corresponding to redundant plaintext. If we consider there is 2 bit/letter of exploitable redundancy in English text, and IF the cipher was perfect, we would need about 90-letter ciphertext to have any hope of solving it. Are there large Chaocipher challenges around? (or course it is easy to make some).
Apr
9
comment Convert m-Sequence into a de Bruijn Sequence
@William Hird: If you are ready to change algorithm, rather than venture in something new and untested, there's A5/1 with longer LFSRs, which borrows from the ASG, and remains quite simple to implement; and the three Profile 2 (HW) eSTREAM ciphers. Of these, I like Trivium, because it is flexible enough to be either a) compact and fast in hardware; b) very fast in hardware; c) reasonably fast in software.
Apr
9
revised RSA: Letting $p$ and $q$ have different bit-size
Precise statement of the requirement against Fermat factoring in X9.31 and FIPS 186
Apr
9
revised RSA: Letting $p$ and $q$ have different bit-size
Warn against a software variant of the Bellcore attack
Apr
8
comment Convert m-Sequence into a de Bruijn Sequence
@William Hird: FOUR options: A) using a LFSR, see note 2; B) Just do it: with seventeen 4-inputs NOR gates and four 4-input NAND gates you make a 64-inputs NOR gate with only 3 of the lowest delays logic offers (perhaps 84 CMOS pairs); C) the counter trick of note 0, but its main purpose is to lower the transistor count when using MANY stages. Oh, BTW, 63 stages is not cryptographically strong, I'm afraid. D) Or get away of the ASG, use Trivium; its uses much less gates than the ASG, and has no long propagation delay.
Apr
8
revised Convert m-Sequence into a de Bruijn Sequence
Add Note 0
Apr
8
comment Convert m-Sequence into a de Bruijn Sequence
@William Hird: Does the drawing help? Assuming $x^{63}+x+1$ is primitive (or equivalently $x^{63}+x^{62}+1$), you need a 62-input NOR gate with inputs the outputs 1 thru 62 (assuming the feedback goes at the input of 1); and one XOR gate inserted in the feedback, with the other input the output of the NOR.
Apr
8
revised Convert m-Sequence into a de Bruijn Sequence
Add drawing
Apr
8
revised Convert m-Sequence into a de Bruijn Sequence
Add drawing
Apr
8
revised Convert m-Sequence into a de Bruijn Sequence
Polish
Apr
8
comment What's wrong with this “order-preserving MAC” function?
1) If there's a key, why is called a hash rather than a MAC? 2) In while R = random_bytes is = a test? If yes, what is R? If no, what is the loop condition? 3) Does 0 ≤ H(N) - K - StepSize*N < StepSize hold for any N? If yes, a single example pair N,H(N) allows to compute N within 1 from H(N) for any N, seemingly contradicting a natural goal of a hash (preimage-resistance); and this gets worse with more example pairs.
Apr
8
revised Convert m-Sequence into a de Bruijn Sequence
More notes
Apr
8
revised Convert m-Sequence into a de Bruijn Sequence
Reword; us the existing ASG tag.