16,923 reputation
12266
bio website
location Paris, France
age
visits member for 2 years, 8 months
seen 37 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Apr
9
answered Will repeated rounds of SHA-512 provide random numbers?
Apr
9
comment Will repeated rounds of SHA-512 provide random numbers?
Strictly speaking, the sequence is not uniformly distributed: it will ultimately enter a cycle (that's expected after roughly $2^{256}$ hashes), and it is extremely unlikely that the mean number of $1$ in this cycle is exactly $1/2$, a requirement for any uniformly distributed ultimately cyclic sequence.
Apr
9
comment Is Chaocipher a secure cipher under ciphertext-only attack?
Because the key is relatively large [ $2\log_2(26!)>176\text{ bits}$ ], and since the cipher is not trivially bad, a ciphertext-only attack can only be carried with significant amount of ciphertext corresponding to redundant plaintext. If we consider there is 2 bit/letter of exploitable redundancy in English text, and IF the cipher was perfect, we would need about 90-letter ciphertext to have any hope of solving it. Are there large Chaocipher challenges around? (or course it is easy to make some).
Apr
9
comment Convert m-Sequence into a de Bruijn Sequence
@William Hird: If you are ready to change algorithm, rather than venture in something new and untested, there's A5/1 with longer LFSRs, which borrows from the ASG, and remains quite simple to implement; and the three Profile 2 (HW) eSTREAM ciphers. Of these, I like Trivium, because it is flexible enough to be either a) compact and fast in hardware; b) very fast in hardware; c) reasonably fast in software.
Apr
9
revised RSA: Letting $p$ and $q$ have different bit-size
Precise statement of the requirement against Fermat factoring in X9.31 and FIPS 186
Apr
9
revised RSA: Letting $p$ and $q$ have different bit-size
Warn against a software variant of the Bellcore attack
Apr
8
comment Convert m-Sequence into a de Bruijn Sequence
@William Hird: FOUR options: A) using a LFSR, see note 2; B) Just do it: with seventeen 4-inputs NOR gates and four 4-input NAND gates you make a 64-inputs NOR gate with only 3 of the lowest delays logic offers (perhaps 84 CMOS pairs); C) the counter trick of note 0, but its main purpose is to lower the transistor count when using MANY stages. Oh, BTW, 63 stages is not cryptographically strong, I'm afraid. D) Or get away of the ASG, use Trivium; its uses much less gates than the ASG, and has no long propagation delay.
Apr
8
revised Convert m-Sequence into a de Bruijn Sequence
Add Note 0
Apr
8
comment Convert m-Sequence into a de Bruijn Sequence
@William Hird: Does the drawing help? Assuming $x^{63}+x+1$ is primitive (or equivalently $x^{63}+x^{62}+1$), you need a 62-input NOR gate with inputs the outputs 1 thru 62 (assuming the feedback goes at the input of 1); and one XOR gate inserted in the feedback, with the other input the output of the NOR.
Apr
8
revised Convert m-Sequence into a de Bruijn Sequence
Add drawing
Apr
8
revised Convert m-Sequence into a de Bruijn Sequence
Add drawing
Apr
8
revised Convert m-Sequence into a de Bruijn Sequence
Polish
Apr
8
comment What's wrong with this “order-preserving MAC” function?
1) If there's a key, why is called a hash rather than a MAC? 2) In while R = random_bytes is = a test? If yes, what is R? If no, what is the loop condition? 3) Does 0 ≤ H(N) - K - StepSize*N < StepSize hold for any N? If yes, a single example pair N,H(N) allows to compute N within 1 from H(N) for any N, seemingly contradicting a natural goal of a hash (preimage-resistance); and this gets worse with more example pairs.
Apr
8
revised Convert m-Sequence into a de Bruijn Sequence
More notes
Apr
8
revised Convert m-Sequence into a de Bruijn Sequence
Reword; us the existing ASG tag.
Apr
8
revised Convert m-Sequence into a de Bruijn Sequence
Explain how to build a circuit for a de Bruijn Sequence
Apr
8
revised RSA Key Generation Parameters - public exponent, certainty, string-to-key count
Final note
Apr
8
revised RSA Key Generation Parameters - public exponent, certainty, string-to-key count
Comment 4 vs 5
Apr
8
revised RSA Key Generation Parameters - public exponent, certainty, string-to-key count
Illustrate of how to use the tables. Actual odds are lower.
Apr
8
revised Why are Fortuna entropy pools reset after a reseed?
balance parenthesis; clarify the other argument