16,808 reputation
12266
bio website
location Paris, France
age
visits member for 2 years, 8 months
seen 2 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Apr
8
revised “Weaknesses” in SHA-256d?
More positive and hopefully clear conclusion.
Apr
8
revised “Weaknesses” in SHA-256d?
Reference to PRF in the conclusion
Apr
8
revised “Weaknesses” in SHA-256d?
End with a statement of failure.
Apr
8
revised “Weaknesses” in SHA-256d?
Expand
Apr
8
answered “Weaknesses” in SHA-256d?
Apr
6
comment What data is saved in RSA private key?
This answer looks erroneous to me. $e=1$ gives no security. $e=2$ is not RSA. From memory, and this, $e$ in OpenSSL can't be more than 65537 without breaking compatibility with some implementations, and is almost always 65537 (lower value are not FIPS-conformant). Also from memory, and that, the private key is usually in full PKCS#1 format, including dP, dQ, qInv. Also the right equation (at least in PKCS#1) is $d⋅e≡1\pmod{\operatorname{lcm}(p-1,q-1)}$.
Apr
5
comment How fast can a wrong decryption key be detected using ECC?
Do you have the public key? This would let you detect that the (private) decryption key is invalid, without even the message. Otherwise: what ECC encryption scheme is used?
Apr
5
comment Understanding one-way hash functions construction
You have to tone down your hopes: AFAIK, there is no method around to construct practical hash functions that demonstrably pass "game tests", unless we start from something (like a block cipher) assumed to pass similar "game tests". Classic constructions are the Merkle–Damgård construction and variants‌​; see the HAC. A more modern one is the sponge construction.
Apr
3
comment What are advantages of using a HMAC over RSA with SHA-1 hashes?
Advantages of HMAC are speed, as stated in the fine answers; and small size of the authenticating token (128 bits or even much less, vs at least 1024 bits). The obvious drawback of HMAC is that one needs a secret to verify that token.
Apr
3
comment “Weaknesses” in SHA-256d?
@Nemo: Samuel Neves remark is that ability to find $m$ and $m'$ of the same length with $\operatorname{SHA-256}(m)=\operatorname{SHA-256}(m')$, allows to trivially find a short padding $p$ such that for any suffix $K$, $\operatorname{SHA-256d}(m||p||K)=\operatorname{SHA-256d}(m'||p||K)$. It could be a problem if SHA-256 was broken (which is: not any soon); and one used a BadMac defined as $\operatorname{BadMac}(K,m)=\operatorname{SHA-256d}(m||K)$, rather than a good MAC such as HMAC.
Mar
28
comment Assymetric password encryption - Viable? Which algorithm?
Hybrid encryption is usually not used to encipher a public or private key, and I am not proposing that. An hybrid encryption scheme enciphers sizable data payload (here: the passwords) using a symmetric cryptosystem, which secret key is enciphered using public key crypto (possibly: once for each recipient, here each server). The total size is that of all the passwords, plus one constant-size cryptogram for each recipient with distinct key. The secret key is recovered by each recipient. It can be cached in RAM. Decryption of the passwords can occur on demand. Refinements allow password updates.
Mar
28
comment Why are RSA key sizes almost always a power of two?
@Joe Zeng: That's not what I meant. In my original answer, the "later" you quote referred to considerations on word/storage unit size. This creates much more marked steps than the (relatively smooth) addition of an extra squaring step, because the later depends on the number of bits in the exponent, which is not bound to be a multiple of something, and is typically a little less than $n$.
Mar
28
revised Why are RSA key sizes almost always a power of two?
"below"->"next paragraph" to avoid confusion with a nearby "below"
Mar
28
revised Why are RSA key sizes almost always a power of two?
later->below
Mar
28
comment Solving hard problems in $\mathbb Z_{p}^{*}$ when $\mathbb p$ is close to $\mathbb 2^{n}$
@Samuel Neves: the rule of thumb you conjecture (I noted the use of perhaps) also applies to composite $N$, and would allow use of $N=2^n-c$ with $c\approx2^{n/5}$ for $n\ge1024$ with no significant security loss in RSA. That has practical applications: appreciably faster implementation of $x\mapsto x^e\bmod N$ (and as an aside more compact public key without use of an arbitrary value). Can you quote other sources of that rule of thumb?
Mar
28
revised Why are RSA key sizes almost always a power of two?
Spelling
Mar
28
answered Why are RSA key sizes almost always a power of two?
Mar
27
comment one-time pad key related attack
@lanc: One can not logically deduce from my previous comment that anything involving pad/key reuse is safe. For many definitions of safe, reusing the same pad/key for another random message is unsafe. For example, the adversary can test if the two random messages are identical, by testing if the two ciphertext are identical. There are situations where that may be important, e.g. if the message is one bit linked to some physical action.
Mar
27
comment one-time pad key related attack
In cryptography, it is standard practice to assume the plaintext of one message (or/and some of the plaintext) gets known. That leaks the OTP's pad for the corresponding plaintext. If that pad was reused, it would no longer protect the confidentiality of the message it combines to. That applies to any plaintext, including random.
Mar
27
comment How to choose between AES-CCM and AES-GCM for storage volume encryption
@CodesInChaos: why do you think GCM "feels very fragile"? My chief reservation about it is that it is not widely implemented yet, and that makes it next to impossible to use in some contexts (e.g. Java Card Classic).