20,345 reputation
12787
bio website
location Paris, France
age
visits member for 3 years, 2 months
seen 34 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Oct
1
answered Small Encryption Exponent
Oct
1
comment Small Encryption Exponent
The actual statement (see Problem 2) does not hint that padding or small exponent are relevant, so I guess Poncho hinted to the expected resolution path. $\;$ Notice that this homework is not quite past its due date + allowance; please do not post a solution before that.
Sep
30
awarded  Explainer
Sep
30
comment Why should CAST5 and 3DES not be used for encrypting files over 4GB?
When using a 64-bit cipher in CBC mode, odds of collision after 4GiB ($k=2^{29}$ blocks) are $ϵ≈2^{65}/k^2=1/2^7=1/128$ (given that $1≪k≪2^{32}$). That's $ϵ≈1/148$ for 4GB, $ϵ≈1/8192$ for 4Gib, $ϵ≈1/9445$ for 4Gb [Reposted with fix and the whole four possible units that could be meant].
Sep
30
revised Message encrypted with a LFSR based stream cipher
rolled back to a previous revision
Sep
30
revised Message encrypted with a LFSR based stream cipher
+ changed to ⊕
Sep
30
comment Message encrypted with a LFSR based stream cipher
@J0ker: what is meant is that for all integers $n\ge0$, the equation $x_{(n+3)} = x_{(n+2)} \oplus x_n$ holds, where $\oplus$ is exclusive-OR. You are given $x_0$, $x_1$, $x_2$, and can compute $x_3$ (with $n=0$), $x_4$ (with $n=1$), and so on, up to $x_{15}$, which is the last used term of the LFSR output (also the key of the pseudo-OTP, which really is a stream cipher).
Sep
29
comment Message encrypted with a LFSR based stream cipher
@J0ker: Yes: now you can compute the $x_i$, with $i$ from 0 to 15, which in your problem forms the output of the LFSR, which also is the key of the (pseudo) OTP. Then you can decipher the given ciphertext as you would for a regular OTP, yielding the plaintext. That's basically what you are told by mczraf in that answer.
Sep
29
comment Message encrypted with a LFSR based stream cipher
Hints: contrary to historical practice in telecommunication, assume big-endian convention when converting a sequence of 8 bits to ASCII (that is: 01001010 is \$4A thus J, not \$52 thus R). $\;$ The message itself could be understood as a provocative invitation.
Sep
29
revised Message encrypted with a LFSR based stream cipher
Beautify, fix obvious error, and retag
Sep
29
comment Message encrypted with a LFSR based stream cipher
Likely one should read $x_{n+3} = x_{n+2} + x_n$ for $n≥0$; with the original $n≥3$ there was no way to infer $x_3$, $x_4$, $x_5$. I took the liberty to fix it.
Sep
28
comment Simpler proof of RSA's correctness
You can do without the CRT; see this answer.
Sep
26
awarded  Popular Question
Sep
24
awarded  Autobiographer
Sep
24
comment Montgomery Multiplication in FPGA explanation
Perhaps a link to the document where the Montgomery Multiplication is pretty clear would help. Edit the question, select that fragment, Ctrl-L, paste link will do the trick. $\;$ As to the question: $x\bmod 2$ is the low-order bit of the binary representation of $x$; while $x\div 2$ is $x$ with that bit removed (in the context).
Sep
23
awarded  Popular Question
Sep
23
comment Is there any area where AES-CBC cannot be used ? If so, why ?
Hint: consider a large encrypted file, of which a small fraction needs to be updated.
Sep
22
comment Are there other digital certificate formats than X.509?
by any chance, do you know what European regulation (or other spec) defines the CVCs in those European passports that hold one?
Sep
19
comment Is it possible (how difficult) to find MORE than one valid RSA signature?
The answer depends on if A) signatures verifiable by different public keys count; B) the scheme is deterministic [e.g. ISO/IEC 9796-2 methods 1 and 3] or not; C) access to the private key function $x\to x^d\bmod N$ is available; D) details in the verifier definition/implementation, e.g. is $S+N$ just as valid as $S$.
Sep
18
comment What is the length of an RSA signature?
In some RSA variants, including ISO/IEC 9796-2 (with total message recovery, and the "Signature production function" rather than the more common "Alternative signature production function"), the signature is a bit string of $\lceil\log_2N\rceil-1$ bits, corresponding to (the big-endian encoding of) an integer between $1$ and $(N−3)/2$: that is $\min\big(J^s\bmod N,N-(J^s\bmod N)\big)$ where $J$ is a function of the message to sign and parameters.