20,345 reputation
12787
bio website
location Paris, France
age
visits member for 3 years, 2 months
seen 1 hour ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


2h
comment Use case of RSA CRT
More reasons, especially in Smart Cards: $\;$ a) It is slightly involved to derive the CRT key $(p,q,dp,dp,qInv)$ from $(n,d)$, which may be the specified form for key injection. $\;$ b) If all we know is that the key is per PKCS#1 and $N$ is $k$-bit, $p$ might still be much more than $k/2$ bits, so perhaps for some keys it does not fit the available hardware well and CRT gives no time savings. $\;$ c) As mentioned in answer, the CRT form of the key requires more space, about +75% more since $(N,e)$ needs to be available in order to check the result as a countermeasure against fault attacks.
7h
comment Crypto (mainly binary
This is squarely off-topic. And there is not enough data, and most importantly context, to determine what this encoding is.
1d
comment Operation which needs much computing power to be created, but just a little to be solved?
@stereo_: What's "a crypto CTF" in your comment about the use case? $\;$ Does a Proof-of-Work system combined to adding the plaintext in clear to the problem fits your needs? If not, why? Note: answer that my clarifying your question (hopefully, you can use the edit button).
1d
comment A simulation for the BB84 quantum key distribution protocol
Duplicate of Quantum key distribution simulation
2d
comment Small Prime Difference in RSA
@mikeaso: Your technique makes $(p-q)/2$ guesses. $\;$ I initially thought it was equivalent to the Fermat factorization method (see Wikipedia or MathWorld), but the later makes about $(p-q)^2\over8\sqrt n$ guesses, which can be MUCH less. With $n=2189284635403183$ (such that $p-q=18)$, your technique makes $9$ guesses, Fermat's only $1$. With the similarly sized $n=2189283205227561$ (such that $p-q=40040)$, your technique makes $20020$ guesses, Fermat's only $5$.
2d
comment I need to know number of encryption/decryption operations?
Hint, assuming 4DES with independent keys: minimally adapt a simple technique that works with 3DES, leaving the part dealing with the first two rounds unchanged. $\;$ For the best theoretical complexity of breaking 3DES with independent keys, see Stefan Lucks: Attacking Triple Encryption in proceedings of FSE 1998, which has it less than $2^{112}$ DES operations. $\;$ Notice that strictly speaking, $O(2^{112})$ is the same as $O(1)$, and thus best avoided.
2d
comment What is the use of Mersenne Primes in cryptography
Addtion: If $2^n-1$ is prime, it becomes easier to ascertain that the feedback of a LFSR of order $n$ makes it maximum-length: it is then enough to show that the LFSR loops after $2^n-1$ steps, which is easy (otherwise, we would also need to show that it does not loops after $2^n-1\over p$ steps for each prime divisor $p$ of $2^n-1$). $\;$ That observation is not so useful, though: LFSR by themselves are poor keystream generators (we need to combine them, see the ASG).
Oct
22
comment Small Prime Difference in RSA
@ddddavidee: as far as I can tell, the only difference is that your $l$ is mikeazo's $\frac{p-q}2$
Oct
21
comment Small Prime Difference in RSA
It is correct that "The difference between $p$ and $q$ should not be small"; however, under the assumption that $p$ and $q$ are randomly seeded and appropriately large for cryptographic use, odds are entirely negligible that the difference between $p$ and $q$ is dangerously small. So much that the (often mandated) check that$|p-q|$ is above some limit really is useful only as an additional check that said assumptions hold, and to reassure those who do not trust math.
Oct
21
comment What's algorithm encryption ?Twofish or AES
Either obtain the key, or use coin throw. Anything better would be a break of either AES or Twofish.
Oct
21
comment To prove $r_2$ is a uniformly at random value in $Z_n$, where $r_2=r_1 . m$
@user153465: indeed, to answer Question 1 by the affirmative, we need to replace arbitrary value in $Z_n$ with random in $Z_n$ (as Poncho did), or chosen in $Z^*_n$ without knowledge of the factorization of $n$ (as I did). $\;$ Question 2 as currently worded is not answerable by yes or no until both this and secure are better defined.
Oct
21
comment To prove $r_2$ is a uniformly at random value in $Z_n$, where $r_2=r_1 . m$
Rephrased without a question mark: $\;$ Show that if $m$ has a multiplicative inverse in $Z^*_n$, then $f: r_1\to f(r_1)=r_2=r_1\cdot m\bmod n$ is an injection from $Z^*_n$ to itself. $\;$ Show that if an $m$ chosen in $Z^*_n$ without knowledge allowing the factorization of $n$ had sizable odds of having no multiplicative inverse, it would be easy to factor $n$. $\;$ Conclude about what we can safely assume about $f$ (noticing $Z^*_n$ is a finite set); then about what that implies for $r_2$ if $r_1$ is uniformly random.
Oct
21
comment To prove $r_2$ is a uniformly at random value in $Z_n$, where $r_2=r_1 . m$
I hope Got is in the past tense. $\;$ My hint allows an easy proof. Find it, and you'll be able to solve many similar exercises.
Oct
21
comment To prove $r_2$ is a uniformly at random value in $Z_n$, where $r_2=r_1 . m$
Hint: What is the condition making $f: r_1\to f(r_1)=r_2=r_1\cdot m\bmod n$ a bijection over $Z^*_n$? $\;$ And how likely is that condition assuming $m$ is defined without knowledge allowing the factorization of $n$?
Oct
20
comment Serpent 256bit key wrong round keys
The Serpent Proposal, top of page 7 defines $w_{−8}\dots w_{−1}$. That allows applying $w_i=(w_{i-8}\oplus w_{i-5}\oplus w_{i-3}\oplus w_{i-1}\oplus\phi\oplus i)\lll 11$ including for $i=0\dots 7$. $\;$ Please fix the question accordingly, and tell us if any issue remains. $\;$ Also: use $\TeX$, that's easy! Your formula is written $w_i=(w_{i-8}\oplus w_{i-5}\oplus w_{i-3}\oplus w_{i-1}\oplus\phi\oplus i)\lll 11$.
Oct
18
comment What is the history of recommended RSA key sizes?
[reposted with correction] As of the embedded world: one of two RSA keys with 321-bit public modulus has been used by French banks as global keys for static issuing certificates of credit/debit Smart Cards, well after the end of the 20th century (but are phased out now). See references in the third bullet point of this answer. The lowest routinely used nowadays is more like 1024-bit (e.g. European tachograph cards).
Oct
17
comment How secure would HMAC-SHA3 be?
@Richie Frame: the Keccak submission (and NIST slides I just added) seem to use the bitrate $r$ as block size, without the at least as large as $c$ condition that you suggest. I am without informed opinion.
Oct
17
comment What is the history of recommended RSA key sizes?
One data point: the original (1974) RSA paper said: "We recommend that $n$ be about 200 digits long." That was about 664 bits.
Oct
17
comment Compare two approaches for cracking RSA key
@Samuel Judson: for the first part, you have the right order of magnitude, but a) the number of 1536-bit primes is about half of what you estimate; b) what's the lowest possible value for the highest of the two primes? That allows another significant reduction. $\;$ For the second part, you have given an order of magnitude of the effort involved in generating the key. The question asks to turn this into a factorization method for the key at hand, without assuming prior knowledge of the password. $\;$ Side hint: the part of the answer reading "We'll have to do this twice" is wrong.
Oct
16
comment Are LFSRs enough for this?
I now have a tentative conjecture about a safe setup, with the colluding players never consecutive, and separated by $h$ honest ones.