20,283 reputation
12786
bio website
location Paris, France
age
visits member for 3 years, 2 months
seen 30 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Oct
3
revised Has there been any cryptanalysis of AES under a non-uniformly distributed key?
Add link to Dmitry Hhovratovich's user page
Oct
3
comment Has there been any cryptanalysis of AES under a non-uniformly distributed key?
@Seth: If my understanding is correct, even in the hypothesis you describe, we do not know an attack better than brute force; and that holds even if we allow the attacker to define how the key is expanded (without loss of entropy). I'm not sure of that, but still turned it into a tentative answer.
Oct
3
answered Has there been any cryptanalysis of AES under a non-uniformly distributed key?
Oct
2
answered What is the translation for “hash” in french?
Oct
2
comment How did the power measurements translate to AES Key?
It may help to read Paul Kocher, Joshua Jaffe, Benjamin Jun, Pankaj Rohatgi's Introduction to differential power analysis, in Journal of Cryptographic Engineering (2011).
Oct
2
revised Small Encryption Exponent
Revise hint 2, minor polish
Oct
2
comment Strength of MD5 in finding duplicate files
In addition: for file de-duplication, we can use MD5 with a secret initial state (or equivalently a 32-byte prefix to the hashed file) drawn randomly at initialization of the de-duplication utility. Now, despite MD5 known weaknesses, one not knowing the secret can't prepare two different files with the same hash. $\;$ Note: if the adversary could examine the hashes, it is better to use full-blown HMAC-MD5, which is nearly as efficient.
Oct
2
revised Small Encryption Exponent
Add another hint. Tone down the avaiability of means to factor a 384-bit number in 1995
Oct
2
comment How does Blowfish avoid successful cryptanalysis?
@owlstead: Can you give reference? I am not aware of attacks on the Blowfish algorithm (rather than: implementations thereof) which would represent a sizable threat in any semi-realistic use case. For example, I can't imagine an attacker exploiting Orhun Kara and Cevat Manap's A New Class of Weak Keys for Blowfish (in proceedings of FSE 2007). I'm rather on the impression that Blowfish is a rather fine cipher except for having a 64-bit block, lack of key agility, relatively high RAM usage, and significant hardware footprint.
Oct
1
revised Small Encryption Exponent
Adress the doomed attempt discussed in the question
Oct
1
revised Small Encryption Exponent
Polish again
Oct
1
revised Small Encryption Exponent
Polish
Oct
1
answered Small Encryption Exponent
Oct
1
comment Small Encryption Exponent
The actual statement (see Problem 2) does not hint that padding or small exponent are relevant, so I guess Poncho hinted to the expected resolution path. $\;$ Notice that this homework is not quite past its due date + allowance; please do not post a solution before that.
Sep
30
awarded  Explainer
Sep
30
comment Why should CAST5 and 3DES not be used for encrypting files over 4GB?
When using a 64-bit cipher in CBC mode, odds of collision after 4GiB ($k=2^{29}$ blocks) are $ϵ≈2^{65}/k^2=1/2^7=1/128$ (given that $1≪k≪2^{32}$). That's $ϵ≈1/148$ for 4GB, $ϵ≈1/8192$ for 4Gib, $ϵ≈1/9445$ for 4Gb [Reposted with fix and the whole four possible units that could be meant].
Sep
30
revised Message encrypted with a LFSR based stream cipher
rolled back to a previous revision
Sep
30
revised Message encrypted with a LFSR based stream cipher
+ changed to ⊕
Sep
30
comment Message encrypted with a LFSR based stream cipher
@J0ker: what is meant is that for all integers $n\ge0$, the equation $x_{(n+3)} = x_{(n+2)} \oplus x_n$ holds, where $\oplus$ is exclusive-OR. You are given $x_0$, $x_1$, $x_2$, and can compute $x_3$ (with $n=0$), $x_4$ (with $n=1$), and so on, up to $x_{15}$, which is the last used term of the LFSR output (also the key of the pseudo-OTP, which really is a stream cipher).
Sep
29
comment Message encrypted with a LFSR based stream cipher
@J0ker: Yes: now you can compute the $x_i$, with $i$ from 0 to 15, which in your problem forms the output of the LFSR, which also is the key of the (pseudo) OTP. Then you can decipher the given ciphertext as you would for a regular OTP, yielding the plaintext. That's basically what you are told by mczraf in that answer.