20,345 reputation
12787
bio website
location Paris, France
age
visits member for 3 years, 2 months
seen 2 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Dec
9
revised Slow one-way pseudo-random permutation?
Fully remove trapdoor, which was misused
Dec
9
revised Slow one-way pseudo-random permutation?
Fully remove trapdoor, which was misused
Dec
9
revised Slow one-way pseudo-random permutation?
Fix bound for $m$; polish
Dec
9
answered Slow one-way pseudo-random permutation?
Dec
8
comment Slow one-way pseudo-random permutation?
I do not see how "The ease of decryption part can be solved with using a non invertible MDS matrix", while keeping MatrixMultiply(state) or/and the whole transformation a permutation.
Dec
7
comment Slow one-way pseudo-random permutation?
If we alternate encryption and application of the same $f$, we no longer have an injection. To keep an injection, we would need 1 extra bit for each layer, thus I can have only few ones. Thus the one-wayness will plummet when I slow the forward direction. That would not occur if we had a one-way (aka trapdoor) true permutation at hand.
Dec
6
comment Slow one-way pseudo-random permutation?
@D.W.: The output has to be both short, so as to be human-enterable (as a backup) after being computed by a mobile app; and collision free with high likelihood for many inputs; see the original goals which I now hope to fulfill using the method in this question. Some of the problem is that the cards have already been issued with a certain serial number, but regulatory reasons prevent to store/reuse that serial number for other purposes than the original one, and I need to transform it into another identifier, with the transformation one-way.
Dec
6
revised Slow one-way pseudo-random permutation?
Adjest name per sugestion
Dec
6
comment Why are these techniques not feasible to crack RSA?
I vote to close the question as is, for: The question shows a lack of research; $d = 1/(e \operatorname{mod} \phi(n))$ does not make sense; there is not the slightest reasoning to support the bold assertion "With having $e$ and $n$, we can calculate the value of $d$"; and "factoring $d$" makes no sense.
Dec
6
comment Slow one-way pseudo-random permutation?
@Dmitry Khovratovich: Several problems with that later option. (A) Some $S||R_S$ (or $Q_S$) will be dynamically added during the life of the system, after the various $K$ and $N$ have been chosen. (B) If encryption is slow, then $2^{32}$ encryptions to choose $K$ and $N$ is impractical. (C) When $s$ is above $b/2$ (former $d/2$), working $K$ and $N$ become a rarity.
Dec
6
comment Slow one-way pseudo-random permutation?
@Dmitry Khovratovich: solving this reformulated, simpler question solves the former question, with perfect match of former (4), and the novelty that I explicitly want tunable encryption effort, and would like a memory size parameter in that. I'd also like assurance that the trapdoor has some argument/proof/prior research.
Dec
6
revised RSA performance
Simplify and polish
Dec
6
asked Slow one-way pseudo-random permutation?
Dec
5
revised Keyed digest function with odds of collision below the birthday bound?
Generalize (2); the single answer so far still holds
Dec
5
comment Keyed digest function with odds of collision below the birthday bound?
@Dmitry Khovratovich. A detail: shouldn't your $\left(X^{2^k}+X+a\right)^{-l}+X$ be $\left(X^{2^k}+X+a\right)^s+X$?
Dec
5
comment Keyed digest function with odds of collision below the birthday bound?
@Dmitry Khovratovich: very nice suggestion. It seems to work fine when $s+r\le d$, which is close enough to my setup. That's provided the $P$ (or family of $P$) that you suggest really is markedly harder to invert than to compute. If see something like $F(K,S,R_S) = E_{K_n}(P_{n-1}(..(P_1(E_{K_1}(P_0(E_{K_0}(S||R_S)))))..))$ where we adjust $n$ to match the delay desired in (1), and the $K_j$ are derived from $K$.
Dec
5
comment Keyed digest function with odds of collision below the birthday bound?
@RickyDemer: good catch, but easily fixed in the context, where we can use $F(K,S,R_S) = E_{K_2}(P(E_{K_1}(S,R_S)))$, where $K_1$ and $K_2$ are different extracts of $K$.
Dec
3
comment Keyed digest function with odds of collision below the birthday bound?
@Richie Frame: I can't increase the size of $S$ or the entropy $r$ in $R_S$; these are pre-existing and beyond my control.
Dec
3
comment Keyed digest function with odds of collision below the birthday bound?
@poncho, to answer your question more precisely: my $R_S$ (or what it is derived from) is pre-existing and thus beyond my control: actually I have a very biased $Q_S$ with $r$ bits of entropy, that I model as a uniformly random $R_S$, perhaps obtained by hashing $Q_S$. $R_S$ is essentially random, for each $S$. In the context of (3), $Q_S$ or $R_S$ is not known by the adversary. The threat/adversaries in (2) and (3) are not the same.
Dec
3
comment Keyed digest function with odds of collision below the birthday bound?
@figlesquidge: $E_k(H(S||R_S))$ does not meet goal (4), for it has odds of collision equal to the birthday bound.