19,408 reputation
12676
bio website
location Paris, France
age
visits member for 2 years, 11 months
seen 2 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


4h
comment Rainbow table for DES with all-zero plaintext?
In addition of things I do not grasp with rainbow tables (see updated question): why the $\oplus i$ term?
12h
comment Understanding Lattice based cryptosystem
@pushpen.paul: It seems that the Wikipedia entry, or/and for this or that example it cites, is enough to answer what makes lattice based system strong? with: for many, the hardness of the Closest Vector Problem in some appropriate lattice. Perhaps, state this and ask for more, e.g. what the CVP is, or why it is believed to be secure even with quantum computers?
14h
comment Compression function to guarantee randomness of one time pads?
A bziped file starts 42h 5Ah; not good for a keystream! There are a lot of other redundancy, including markers of compression settings, and at least one error detection code. More generally, for many existing compression algorithms, the output is distinguishable from random even if the input is not; often, the distinguisher can simply be: decompresses without error.
Jul
24
comment Calculating periodicity of a pseudo random number generator (Middle-square method)
This question is squarely off-topic on crypto.SE because it is about a non-cryptographic Random Number Generator.
Jul
24
comment Reordering non-block-aligned parts with DES in ECB mode
Yes, with the assumption of a known plaintext block common to enough instances of the problem to make a precomputation worthwile, what you are describing is feasible. However that does not apply in the situation of the question: there is no indication of multiple instances, and I see no hope to find an existing rainbow table that applies, for we need a different table for each known plaintext block.
Jul
23
comment Secure way to store fixed size string of digits
Define "securely". $\;$ You want to achieve confidentiality, but what about integrity, and high insurance of availability despite hardware mishaps? $\;$ When you need the data, is it for the purpose of testing if some string is that 9-digit string, or do you need to retrieve that value? $\;$ If you can retrieve that 9-digit string value, and the adversary can't, what can the system use to differentiate you from the adversary? $\;$ What is it reasonable to believe an attacker can/can't do on your system?
Jul
23
comment RSA with modulus n=p²q
@bmm6o: Ah right, I had missed that.
Jul
23
comment Which algorithm do you recommend for practical use to generate unique passwords for each website?
Many sites have password requirements than make the "Turn the site secret into a usable password" step non-trivial, and hard to get right; like (I'm not making that up): At least 15 characters. Contains CAPITAL Letters. Contains SMALL letters. Contains either special characters or numbers (e.g. / , *, @, #, $, or 1, 2, 3 etc.). $\;$ Typically that spec is imprecise, often hard to get or/and existing in different versions, and more often than not wrong (e.g. here, the system actually allows both special characters and numbers, and I'm not even sure that it does not require that).
Jul
23
comment RSA with modulus n=p²q
The potential saving is actually greater than for multiprime RSA with 3 primes, because there are only 2 expensive modexp to perform, rather than 3. On the other hand, the modified CRT is quite a bit unusual.$\;$ Note: To get the paper, a click on "download chapter" on the page you link works for me; and then I can save the PDF (I believe, legally); that's a fortunate consequence of the IACR copyright policy.
Jul
23
comment RSA with modulus n=p²q
@Ricky Demer: I fail to see why the restriction to coprime $j$ and $k$. $\;$ That $\gcd$ trick is nice!
Jul
23
comment Reordering non-block-aligned parts with DES in ECB mode
A rainbow table to crack DES encryption, really? If you maintain that assertion, give us details!! Absent these, I consider this is a serious confusion.
Jul
22
comment MAC using a modified CBC mode of operation
@mikeaso: thanks for the much needed correction!
Jul
22
comment Is my implementation of a PRG at least intuitively secure?
We can tell you the exact opposite: there is not (and can't be) a test, using a PRG as a black box, that can give a useful indication that a PRG is secure; much less a proof. The best a test does is tell that a PRG is not secure. Existing tests of CSPRNGs are designed to catch faulty implementations, or badly misguided (more often than not, both).
Jul
22
comment Is my implementation of a PRG at least intuitively secure?
Without a meticulously precise description of a PRG, one can't conclude that it is secure. Such description is not given, thus the question can't be answered; and it would probably be off-topic anyway. $\;$ Keep in mind that any experimental randomness test not tailored to the PRG tested can only invalidate the hypothesis that it is secure, NOT validate that hypothesis. An analogy: that's similar to a Fermat primality test, which can often invalidate that an integer is prime, but can never tell 1436697831295441 is not prime.
Jul
22
comment MAC using a modified CBC mode of operation
Hint: what happens to the tag when two blocks of plaintext are exchanged?
Jul
21
comment understanding the proof of knowledge
Anything in particular remains unclear after reading Wikipedia's entry on proof of knowledge? Or/and Mihir Bellare and Oded Goldreich's reference article: On Defining Proofs of Knowledge?
Jul
21
comment How much bit encryption is this DES code using?
This question is off-topic because it is mostly a programming question about a particular programming language (Java) and library. $\;$ Some of the answer lies in$$\mathtt{Cipher.getInstance("DES");\;//\;DES/ECB/PKCS5Padding\;for\;SunJCE}$$‌​which according to its own documentation limits the effective key length to 56 bits (or 55 for some attacks using DES complementation property); further, $$\mathtt{key\;=\;"ekrjtkejxr"}$$ suggests restriction to key of 8 lowercases with low-bit ignored, that is less than 30 bits of entropy.
Jul
21
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
In my first comment, read "the adversary able to mount a chosen-PLAINTEXT attack".
Jul
21
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
@RickyDemer: Yes. Adapted to the present context (with CRC instead of Hash, but that works for a hash just the same): one decides the desired Forgery, computes its CRC, builds 6zeroes||Headers||CRC||Forgery, submits that as (chosen) Data for authentication and encryption; and from the resulting cryptogram removes the first 16 bytes (including 8 bytes IV). What remains will pass verification (the first 8 bytes will be the IV).
Jul
21
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
The terminology is not quite right: CRC32 can't be used as (a weak substitute for) a MAC, for it is a keyless transformation of the message. Rather, here, it is used as (a weak substitute for) a hash in a hash-then-encrypt scheme, something which itself does not generally insure message integrity. $\;$ If the IV for the 3DES-CBC encryption is 8 random bytes prepended to the cryptogram, and the length of Data variable, and the adversary able to mount a chosen-ciphertext attacks, then such generic attacks on hash-then-CBC-encrypt work here.