23,773 reputation
23199
bio website
location Paris, France
age
visits member for 3 years, 7 months
seen 1 hour ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


1h
comment What is the probability of the sum of elements in $\mathbb{Z}_{N^2}^*$ to be multiplicatively inverted?
I know what it is to have a multiplicative inverse$\mod N^2$ ; but what's having a multiplicative inverse$\mod\mathbb{Z}_{N^2}^*$ ? $\;$ Assuming the first is meant, the probability is $0$ if the given set is empty (the sum is $0$ which is not invertible), $1$ if it has a single element (since it is invertible), $\varphi(N^2)/N^2$ for large set (where the sum is for all purposes random).
5h
comment During electronic voting, how does one hide the choice from Voting device?
The hypothesis "none of the authorities collude with the device" is one we'd want to eliminate; we'd want any cheating by colluding authorities to be detectable. $\;$ The voting system where paper ballots, put in opaque envelopes, put in transparent sealed urns, are publicly counted at each voting place, and the results hierarchically added and published, is the best one I know. Paper and plexiglass do not collude with anyone, an observer has good chance to detect a local fraud, and can verify that results s/he verified are properly published and added, and trust other observers do the same.
6h
comment Is there any pattern in points on EC?
The Elliptic Curves used in cryptography have a public equation, e.g. $y^2=x^3+ax+b$ with $x,y$ the coordinate of points on the curve, and $a,b$ public constants, with all arithmetic in $\mathbb Z_p$ for some public constant prime $p$. The equation allows easily determining if a point of given coordinates $x,y$ is on the curve, or not. There are so many points that one can't make a list of all the points, for practical parameters. However it is still possible to determine ("count") how many points there are. $\;$ Is that what you are asking?
7h
comment The effect of truncated hash on entropy
@user40602: the definition of entropy rate that I know is for a process; what would it be in the context of the question? $\;$ If that process is: generate a 128-bit random string and output its SHA-256 (resp. SHA-256 truncated to 128-bit), its entropy rate is $\approx128$ (resp. $\approx127.173$) bit per output symbol.
15h
comment Is there an existing authorative definition of the cryptographic term 'pepper'
I've never met the second usage, of pepper as forgotten salt. I can imagine it occurring accidentally when the salt is lost or becomes somewhat ambiguous. But I can't imagine that designed-in, for it seems to have no advantage whatsoever compared to bumping iteration count.
16h
comment The effect of truncated hash on entropy
There has been a negative vote; please suggest how this answer could be improved.
1d
comment Stacked LFSR - why not used?
@H. Circlebeach: you have not defined your scheme fully: it is unclear if at each step, 2 or 33 LFSRs are stepped, and by how many bit steps; what are the polynomials; and how the initial state is chosen. $\;$ Whatever these details, once they are known, there's a trivial attack: enumerate the possible states of the selector LFSR (that's only $2^{32}$ possibilities), and check that hypothesis against known keystream, focusing on the most-often selected of the 32 other LFSRs. Finding state and predicting future output from 1024 bytes of past output would require minutes.
Mar
27
comment The effect of truncated hash on entropy
@D.W.: given your long-running interest in entropy loss by iterated hashing, you might like this which solves the question for the first iteration (asymptotically, and in practice). Also, it shows we can numerically explore the first few iterations, and the reference I cite gives estimates.
Mar
27
comment The effect of truncated hash on entropy
@Stephen Touset: if your split a string of independent random bits (with even distribution, or at least the same distribution for all bits), then the entropy spreads evenly. However if the bits are correlated, the sum of the entropy in each half can be greater that the original entropy. In the extreme example of a two-bit string where the first bit is drawn by coin toss, and the second bit decided as the opposite of the first, there's one bit of entropy in the whole string, in the first bit, and in the second bit.
Mar
27
comment Collision attacks on digital signatures
@René G: it is intractable to factor the 2048-bit product of two unknown random 1024-bit primes; however there is sizable hope to factor a random 2048-bit integer with moderate effort.
Mar
26
comment The effect of truncated hash on entropy
The reasoning that keeping half the bits keeps half of the entropy is wrong, because the 256 bits of the hash of a 128-bit string are far from random. There is marginally less entropy in the hash truncated to 128 bits than there is in the 256-bit hash. Analogy: if you take the 2-bit hash that hashes 0 to 01 and 1 to 10, there's 1 bit of entropy in the output for random input. Truncate that to the first bit, and you still have 1 bit of entropy in its output.
Mar
26
comment The effect of truncated hash on entropy
Related to this. It does not change the problem that you use a 256-bit hash truncated to 128 bits, or a 128-bit hash. The entropy is slightly reduced from the original 128 bits, because of the collisions in the 128-bit hash; there are almost no collisions in the 256-bit hash.
Mar
26
comment Can machine learning analyze random number generator?
Are you asking if machine learning could analyze THE OUTPUT of a (P)RNG? Or if machine learning could analyze THE DEFINITION of a PRNG?
Mar
25
comment Cycles in SHA256
First statement is wrong.
Mar
25
comment RSA weak padding
Your $f(x)=(1+2^8+2^{16}+2^{24})\times x=K\times x$ is restricted to $x$ an at-most-8-bit element of $\mathbb N$, and has $K$ and $f(x)$ in $\mathbb N$, is not it?
Mar
25
comment RSA weak padding
Or more simply, find distinct $w$,$y$,$z$ each $\in[0,2^8-1]$ and not equal to $x$ with $x\cdot y=z\cdot w$; which is easy except if $x$ is prime an at least $131$.
Mar
25
comment Hash function such that fx(hash(s1),hash(s2)) = hash(concat(s1,s2))
@cygnusv: I have used $\pi$ to come up with a nothing-up-my-sleeves prime $p$. Any irrational mathematical constant will do, with some adjustments to the integers in the expression of $p$.
Mar
25
comment Hash function such that fx(hash(s1),hash(s2)) = hash(concat(s1,s2))
Right. Your solution becomes closer to mine, and simpler, which is a virtue; however it is more prone to collisions for messages differing by few bytes, in particular changing the two bytes 0100 to 00DF, 0101 to 00E0 etc, in any string, leaves its hash unchanged.
Mar
25
comment Hash function such that fx(hash(s1),hash(s2)) = hash(concat(s1,s2))
Is it $h(s)=\big(\sum_{i=0}^{n-1}s_i \cdot 31^{n-1-i}\big)\bmod 2^b$, for $b=32$? If so, we have a severe risk of collision after a mere $100,000$ strings of identical length. Also you need to somewhat embed $l_2$ into $h_2$.
Mar
24
comment feistel structure? why decryption is so easy with reverse order of subkey
Hint: Prove by induction that any sequence of reversible operations is reversible. $\;$ Apply.