19,756 reputation
12779
bio website
location Paris, France
age
visits member for 3 years
seen 5 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Aug
29
comment Are there other digital certificate formats than X.509?
The title of that quote is not even wrong, as a type can't be meaningfully compared to a certificate. $\;$ And truth is: NOT all Digital Certificates are also a X.509 certificate.
Aug
29
comment Are there other digital certificate formats than X.509?
There are yet other Digital Certificate formats; see this answer
Aug
29
comment Are there other digital certificate formats than X.509?
An example of use of CVC is in the European Digital Tachograph Smart Card; see Council Regulation 3821/85 (ammended), Annex 1B, Appendix 11, section 3.3 (starting at CSM_016)
Aug
27
comment RSA was rejected by which journal?
For what D.W. refers to, see Ralph Merkle's own account
Aug
25
comment Why should I use an Initialization Vector (IV) when I have unique keys?
That's a VERY good point, I have altered my answer accordingly. I wish I had noticed that alternate answer long before!
Aug
25
comment Attacking unuauthenticated RSA
Yes, the same holds: insuring confidentiality and insuring authenticity are distinct goals, both in symmetric and asymmetric cryptography. $\;$ Is there anything in the question beyond that ?
Aug
22
comment Why does DES use exactly 16 rounds?
@Henrick Hellström: I question your statement that that there is no successful (better-than-brute-force, of course) attack against 8 round DES $\;$ This is a claimed better-than brute-force attack on DES reduced to 13 rounds, with a relatively practical variant for 10 rounds. I tend to agree with this answer.
Aug
15
comment Can you fake messages from recorded message-history?
Apologies for my original comment (and other later mess-ups), it should have been: Encrypting a message with Bob's public key only proves that it was written for Bob inasmuch as the message remains secret. I maintain that the fragment "To be sure that the message is for B, A has to encrypt it with B's public key" is wrong when for B is understood as with B interpreting the message. $\;$ The passage "To be sure that the message is from A, A has to encrypt it with his private key" uses improper terminology, but is right after changing encrypt to sign.
Aug
15
comment Can you fake messages from recorded message-history?
@Rubo77: I know that DKIM signs the message's origin, but does it sign the intended recipient(s) or otherwise protect from replay of the same message to unintended recipients? If yes, any reference to how?
Aug
15
comment Can you fake messages from recorded message-history?
@Lie Ryan: yes, what you describe would be possible; it amounts to Alice always signing messages making explicit mention of the intended recipient(s) or/and context, or/and enforcing this in the cryptogram format. That's just not part of PGP, or of the PGP wrapper that I practice.
Aug
15
comment Implementation Attacks on Hashes
Why the close votes?
Aug
11
comment Currently i am doing decryption for RSA encoding and i face some problem with it
@Thor: I question your Textbook RSA is the clue. $\;$ Textbook (aka naked) RSA is quite safe when used to encipher random $k$-bit data and $e\cdot k>5\log_2N$, which should be the case here.
Aug
11
comment Currently i am doing decryption for RSA encoding and i face some problem with it
$\log_2(N)\approx 1023.034$. $\;$ Usual RSA key generation algorithms for 1024-bit $N$ generate $p$ and $q$ uniformly randomly in range $[2^{1023/2}\dots2^{1024/2}]$, and thus have odds of generating a $N=p\cdot q$ that close to $2^{1023}$ rather low (like 1/5000). In an exercise, that may not be a coincidence. Perhaps this hints at some way to factor $N$. Any context, like: a recent/related lesson/text was about Fermat factoring?
Aug
10
comment Format of NONCE in Initialization Vector (IV)
@owlstead: I'm OK with you change. However, using an UID as IV can be bad: in CBC mode, if the UID is predictable, encryption can be broken under CPA; in CTR mode, if consecutive UIDs differ only in the same low bits that are changed by counting, some keystream is reused. $\;$ In my opinion, the simplest (thus often the best) is: if the key is used for a single session, use implicit zero IV; otherwise use a random IV.
Aug
6
comment A way around digital signatures?
Any wrong with two symmetric keys K0 K1, with K0 known to A and B only, and K1 shared between A B C; and protecting messages with two MACs with these keys, except when originating from C which uses K1 only?
Aug
1
comment Reasons for Chinese SM2 Digital Signature Algorithm
Part 1 (out of 4) of the 2010 Chinese standard defining SM2 algorithms is published here, and some of it is understandable when automatically translated. $\;$ Could no find part 2 on SM2 signature. $\;$ Jing Xu & Dengguo Feng's Comments on the SM2 Key Exchange Protocol is a claimed attack on part 3.
Jul
31
comment Rainbow table for DES with all-zero plaintext?
You are considering $k$ chains of length $k$; why are these parameters taken to be the same? Is it next to optimum? $\;$ Also: is the distinguished point technique useful with rainbow tables?
Jul
31
comment How can rainbow tables be used for a dictionary attack?
Welcome to CSE! I see no fundamental confusion in the question, where it is asked if NTLM passwords are hashed; which you answer by the negative. $\;$ Note: I took the liberty to embed the links, including the one you struggled with. This is conveniently done with the Hyperlink button of the edit window, or Ctrl-L; also, <a>http://foo.bar</a> or [text](http://foo.bar) works (the later is usable in comments too). While editing an answer, the preview let you see what it will look like, including hyperlinks.
Jul
29
comment Rainbow table for DES with all-zero plaintext?
I read there are two canonical improvements to that: $\;$ 1) Rivest's distinguished points, iterating encrypt-then-truncate starting from a point in some subset of the keyspace (e.g. with some 16 bits at zero) until reaching such subset, for a modest but welcome reduction in memory requirement; and $\;$ 2) rainbow tables, which seem to originate in: Philippe Oechslin's Making a Faster Cryptanalytic Time-Memory Trade-Off, in proceedings of Crypto 2003.
Jul
29
comment Rainbow table for DES with all-zero plaintext?
M. E. Hellman, A Cryptanalytic Time-Memory Tradeoff, IEEE Trans. on Info. Theory, Vol. 26, July 1980, pp. 401-406. $\;$ At least that one is relatively straightforward! It does not use what otus's answer and comment describes as the rainbow improvement, and I wonder how much that improves the time-memory tradeoff.