19,408 reputation
12676
bio website
location Paris, France
age
visits member for 2 years, 11 months
seen 1 hour ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Jun
29
revised Does collision resistance imply (or not) second-preimage resistance?
Fix notation
Jun
28
revised Does collision resistance imply (or not) second-preimage resistance?
Summary
Jun
28
answered Does collision resistance imply (or not) second-preimage resistance?
Jun
27
revised Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)
added 1 character in body
Jun
27
revised Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)
Details on how the message is broken-up in ISO/IEC 9796-2
Jun
27
revised Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)
Give correctness and security requirements for partial message recovery. Reword description of ISO/IEC 9796-2
Jun
27
revised Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)
Link to more recent version of the European Digital Tachograph consolidated specification
Jun
27
revised Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)
Avoid notation clash by using k for the security thresold.
Jun
27
revised Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)
Add security bound. Mention ISO/IEC 9796-3, EMSR1/2/3 of P1363a.
Jun
26
comment Convert m-Sequence into a de Bruijn Sequence
@e-sushi: You are looking for x=x>>1^0x8016&-(x&1); to implement the Galois LFSR $x^{16}+x^{14}+x^{13}+x^{11}+1$. This form allows using any polynomial of degree $\mathtt{n}$, if x is at least $\mathtt{n}$ bits, by changing a single constant. The constant is obtained by removing the term $x^\mathtt{n}$ from the poly, and ORing 1<<(n-1-k) for each $x^\mathtt{k}$ term, including 1<<(n-1) for the $1$ term of the poly. E.g. 0x8016 is 1<<(16-1-14)|1<<(16-1-13)|1<<(16-1-11)|1<<(16-1). By contrast, in the formula of this answer (using the Fibonacci construct), each term adds to the code.
Jun
26
revised What are the methods to construct a primitive binary nonlinear feedback shift register (NLFSR)?
Comment on (lack of) security
Jun
26
revised What are the methods to construct a primitive binary nonlinear feedback shift register (NLFSR)?
There's a solution! And it points to a whole class of others!
Jun
26
comment Is it possible to get better randomness by using multiple PRNGs?
@Stephen Touset: Yes, and in my comment above I'm also making that assumption of seed independence past the first sentence. The rest is to stress that such assumption is NOT enough to ensure that the XOR of the PRNGs behaves at least as well as the worst of the originals in a particular practical test intended to assert a PRNG's quality.
Jun
26
comment Is it possible to get better randomness by using multiple PRNGs?
@Stephen Touset: that's true in an information-theoretic sense, and only with the critical assumption that the PRNGs are seeded from independent sources. However it is possible to devise (bad) PRNGs that individually have output in any particular run indistinguishable from random, but which XOR has horrible properties, even when both are seeded with true random. A trivial example is two identical CSPRNGs modified to entirely ignore their seed input; but it is possible to extend this to make the generators pass many, perhaps any fixed test.
Jun
26
revised Convert m-Sequence into a de Bruijn Sequence
x must be unsigned
Jun
26
revised Convert m-Sequence into a de Bruijn Sequence
Add softwware implementation
Jun
26
revised What are the methods to construct a primitive binary nonlinear feedback shift register (NLFSR)?
Move details to related answer
Jun
24
revised What are the methods to construct a primitive binary nonlinear feedback shift register (NLFSR)?
Give a NLFSR with period 2^n
Jun
24
comment Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)
In an EMV context, yes $m\equiv n\equiv 0\pmod 8$ holds, because (for $m$) all messages are bytes, and (for $n$) public modulus has size multiple of 8 (and even 32, perhaps 64) by some (AFAIK unwritten) rule, as demonstrated (AFAIK, only) by the fact that EMV's ISO/IEC 9796-2 padding starts with '6A' (yes that's circular). However, $n\equiv 0\pmod 8$ does NOT hold in a PKCS#1 context. Messages with a number of bits not multiple of 8 are a rarity, but ISO/IEC 9796-2 also covers that.
Jun
24
revised Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)
Improve description of ISO/IEC 9796-2 scheme 1 signature verification