19,757 reputation
12779
bio website
location Paris, France
age
visits member for 3 years
seen 7 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Jul
8
revised How is this affine function a pair wise independent permutation?
Polish
Jul
8
answered How is this affine function a pair wise independent permutation?
Jul
8
revised How is this affine function a pair wise independent permutation?
Added definition requested
Jul
8
revised How is this affine function a pair wise independent permutation?
Exact quote (based on the preprint)
Jul
8
comment How is this affine function a pair wise independent permutation?
Are you reading the actual paper, or what appears to be the Nov 1997 preprint, which does contain (nearly) the sentence now in the second paragraph of the question?
Jul
8
comment An unpredictable PRG is secure (Theorem Yao'82)
I think a proof sketch using contraposition might go: Assume $G$ is not a secure PRG. There is thus an algorithm that breaks $G$. Define $G_i$ which substitutes true random to bits at position $j\ge i$. The same algorithm breaks $G_n$ (since that's $G$) but not $G_0$ (since that's random). So there must be a $i$ such that it breaks $G_{i+1}$ but not $G_i$. Now you can build a predictor for position $i$.
Jul
7
answered Adi Shamir's secret database of all primes
Jul
7
comment Generate Finite Field power of g
Explaining the $(0010)$ notation could come earlier in the response. Kudos for the rest.
Jul
7
comment Adi Shamir's secret database of all primes
That database is to cryptography venues what the Dahu is to French summer camps. Also see the answers to this. $\;$ The three other 'future work' items in the presentation are in the same vein.
Jul
4
comment Getting 88bytes cipher output from 48bytes input in AES
The paper considers that a block cipher's output is wider than its input, likely because the authors confused with some mode of operation of a block cipher complete with IV and padding; that's both for DES and AES.
Jul
4
comment In symmetric searchable encryption are the algorithms public?
In an academic cryptographic context, any algorithm is assumed public (except in specific domains like code obfuscation); that's the second of Kerckhoffs's principles.
Jul
4
comment Is SipHash cryptographically secure?
Ah, yes, that's an excellent reason.
Jul
4
comment Is SipHash cryptographically secure?
Why say "fast"? It only blurs the (valid) argument IMHO. $\;$ +1 for the remark that SipHash could still be a cryptographically strong MAC.
Jul
3
comment Is SHA256 good enough to shrink a key?
No objection...
Jul
3
comment Determine LFSR phase quickly?
If the primitive $P$ of degree $k$ of the generator is not sparse or otherwise unfit, I trust you that we can massage $S/E\equiv x^N\pmod P$ into $A\equiv B^N\pmod Q$, where $Q$ is any primitive polynomial we see fit, and polynomials $A$ and $B$ somehow follow (I fail to tell exactly how, though). We can then solve $A\equiv x^{N_A}\pmod Q$ and $B\equiv x^{N_B}\pmod Q$, and then have $N\equiv N_A-N_B\pmod{2^k-1}$. So at worse, the cost for arbitrary $P$ is twice the cost for any $Q$ we see fit, plus whatever the cost of changing from $S/E\equiv x^N\pmod P$ to $A\equiv B^N\pmod Q$ is.
Jul
3
comment Determine LFSR phase quickly?
I still wonder what the best (known) algorithm is (it seems possible that an algorithm for characteristic 2 beats a general algorithm for small characteristics); its runtime and memory requirements; and how much its runtime depends on $P$ (is it harder for a random primitive $P$ than e.g. the primitive $P$ with lowest possible $P(2)$?
Jul
3
comment Math to replace s-boxes - Good or bad idea?
I can think of $\;$ Pros: simplicity; speed; no cache-induced timing dependency. $\;$ Cons: the outcome does not have all desirable S-box security properties so more rounds are needed, and its hard to tell if that's like two more or twice more rounds; multiplication is not constant-time on many architectures (e.g. low-end ARM).
Jul
3
revised Does collision resistance imply (or not) second-preimage resistance?
Extended the summary
Jul
3
comment Does collision resistance imply (or not) second-preimage resistance?
@Dingo13: Hopefully, the updated answer will address your comments, and clarify why the paper and its definitions are consistent with: collision-resistance implies second-premimage-resistance; and only shows that an extender that CONSERVES the collision-resistance level of the original may not CONSERVE the second-premimage-resistance level of the original.
Jul
3
comment Determine LFSR phase quickly?
That discrete log algorithm has a name: baby-step/giant step. Yes you can make the cost of searching in the table constant; that can make the algorithm $\mathcal O(2^{n/2})$, but not better. $\;$ There are much betters algorithms, as in Poncho's answer.