19,936 reputation
12781
bio website
location Paris, France
age
visits member for 3 years, 1 month
seen 36 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


1h
comment Is there any area where AES-CBC cannot be used ? If so, why ?
Hint: consider a large encrypted file, of which a small fraction needs to be updated.
1d
comment Are there other digital certificate formats than X.509?
by any chance, do you know what European regulation (or other spec) defines the CVCs in those European passports that hold one?
Sep
19
comment Is it possible (how difficult) to find MORE than one valid RSA signature?
The answer depends on if A) signatures verifiable by different public keys count; B) the scheme is deterministic [e.g. ISO/IEC 9796-2 methods 1 and 3] or not; C) access to the private key function $x\to x^d\bmod N$ is available; D) details in the verifier definition/implementation, e.g. is $S+N$ just as valid as $S$.
Sep
18
comment What is the length of an RSA signature?
In some RSA variants, including ISO/IEC 9796-2 (with total message recovery, and the "Signature production function" rather than the more common "Alternative signature production function"), the signature is a bit string of $\lceil\log_2N\rceil-1$ bits, corresponding to (the big-endian encoding of) an integer between $1$ and $(N−3)/2$: that is $\min\big(J^s\bmod N,N-(J^s\bmod N)\big)$ where $J$ is a function of the message to sign and parameters.
Sep
16
comment How to calculate kinv from the given k value
Closely related to this question
Sep
16
comment Is Rabin's cryptosystem secure against known-plaintext attacks?
Is your Rabin's cryptosystem different from Rabin public-key encryption in the HAC, section 8.3? If yes, how?
Sep
12
comment Self-Convergent Hashing
What about giving a better description of that algorithm class, so that it would be recognizable? $\;$ In particular, are you meaning the algorithm hashes something including its own result, or something including its own definition in some grammar?
Sep
12
comment How can one generate pairs/triplets/…/n-ary MD5 collisions
A relevant paper (to the second part of the answer) is Joux: Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions‌​, in proceedings of CRYPTO 2004. $\;$ That's related to length extension attack, but not exactly it; rather, an extension.
Sep
6
comment What are options to compute DES retail MAC (aka ISO 9797-1 mode 3) under PKCS#11?
@poncho: Ah, I had misunderstood your comment. I'll fix that with an answer.
Sep
5
comment Base64 for a hash algorithm
It is very common to post-process a hash's result using base64, and the resulting algorithm could be considered a hash. If so, that resulting algorithm is a hash algorithm that uses Base64 in (the final phase of) the process of hashing a string. $\;$ That question has no clear-cut answer as stated.
Aug
29
comment Are there other digital certificate formats than X.509?
The title of that quote is not even wrong, as a type can't be meaningfully compared to a certificate. $\;$ And truth is: NOT all Digital Certificates are also a X.509 certificate.
Aug
29
comment Are there other digital certificate formats than X.509?
There are yet other Digital Certificate formats; see this answer
Aug
29
comment Are there other digital certificate formats than X.509?
An example of use of CVC is in the European Digital Tachograph Smart Card; see Council Regulation 3821/85 (ammended), Annex 1B, Appendix 11, section 3.3 (starting at CSM_016)
Aug
27
comment RSA was rejected by which journal?
For what D.W. refers to, see Ralph Merkle's own account
Aug
25
comment Why should I use an Initialization Vector (IV) when I have unique keys?
That's a VERY good point, I have altered my answer accordingly. I wish I had noticed that alternate answer long before!
Aug
25
comment Attacking unuauthenticated RSA
Yes, the same holds: insuring confidentiality and insuring authenticity are distinct goals, both in symmetric and asymmetric cryptography. $\;$ Is there anything in the question beyond that ?
Aug
22
comment Why does DES use exactly 16 rounds?
@Henrick Hellström: I question your statement that that there is no successful (better-than-brute-force, of course) attack against 8 round DES $\;$ This is a claimed better-than brute-force attack on DES reduced to 13 rounds, with a relatively practical variant for 10 rounds. I tend to agree with this answer.
Aug
15
comment Can you fake messages from recorded message-history?
Apologies for my original comment (and other later mess-ups), it should have been: Encrypting a message with Bob's public key only proves that it was written for Bob inasmuch as the message remains secret. I maintain that the fragment "To be sure that the message is for B, A has to encrypt it with B's public key" is wrong when for B is understood as with B interpreting the message. $\;$ The passage "To be sure that the message is from A, A has to encrypt it with his private key" uses improper terminology, but is right after changing encrypt to sign.
Aug
15
comment Can you fake messages from recorded message-history?
@Rubo77: I know that DKIM signs the message's origin, but does it sign the intended recipient(s) or otherwise protect from replay of the same message to unintended recipients? If yes, any reference to how?
Aug
15
comment Can you fake messages from recorded message-history?
@Lie Ryan: yes, what you describe would be possible; it amounts to Alice always signing messages making explicit mention of the intended recipient(s) or/and context, or/and enforcing this in the cryptogram format. That's just not part of PGP, or of the PGP wrapper that I practice.