22,324 reputation
12992
bio website
location Paris, France
age
visits member for 3 years, 5 months
seen 41 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Jan
27
comment Is signing a message just encrypting it with private key?
No, proper RSA signing of a text is not as simple applying the private-key function to the (hash of a) text ("encrypting a text with private key" as questionably worded in the question). $\;$ That is not safe for many definitions of safe, including most ones used in cryptography. $\;$ For an introduction to that, see the second part of this answer, and the final reference.
Jan
24
comment Finding strong primes
Are you sure of the PKCS reference? The definition of strong prime that you give is not in PKCS#1 (at least, the current version), which would seem to be the logical place. $\;$ Also, it is quite feasible to generate a prime $p$ such that $(p-1)/2$ and $(p+1)/2$ are primes (the trick is to use a sieve of width a few times $(\log p)^3$ to keep only candidates for $p$ such that any of $p$, $(p-1)/2$ and $(p+1)/2$ are divisible by small primes; then apply a probabilistic primality test).
Jan
22
comment Why the data length is shifted 3-bit in MD4 Java implementation?
This is a basic Computer Science question, unrelated to cryptography. The left shift by 3 converts the length in octets previously accumulated by the Java code into the length in bits prescribed by the quoted text of RFC 1320, in order to form the padding.
Jan
21
comment Practical Attack on RSA
Yes, much like for yogurt.
Jan
21
comment Practical Attack on RSA
My point is that "such key length will be vulnerable at about that time" (as in "estimate for how many years a given keylength may last you", what this is about) is very different from "use that key length and you should be okay" (a safe recommendation, what keylength is about).
Jan
21
comment Practical Attack on RSA
keylength does NOT "try to estimate for how many years a given keylength may last you". Rather, it is about estimating what key length is appropriate so that one can be next to certain that at some prescribed date, brute-forcing a public key will fail (or, equivalently, about selecting a key length that conforms to prescribed standards with that aim). The former is about a best guess, the second is all about being conservative. $\;$ A decision maker has use of the former when evaluating a non-critical legacy system, and of the later for a new system.
Jan
21
comment Practical Attack on RSA
@Nayef: 768 bits was the academic factoring record by the end of 2009, and that might translate to perhaps 900 to 1000 bits nowadays (with comparable effort for some meaning of that). Where you put the bar of a "practical attack" is a matter of policy, and what risks and facts there are to consider (like, feasibility of changing an already deployed system).
Jan
20
comment Practical Attack on RSA
Check this for practical brute force attacks versus key size. $\;$ Practical attacks often are independent of key size; like, abusing a certification authority, or hacking into a computer that can use a secure device that holds the key.
Jan
16
comment How does bitmessage encryption work?
Relevant but very short on details: Jonathan Warren's Bitmessage: A Peer‐to‐Peer Message Authentication and Delivery System. $\;$ Current "official" protocol specification, but actual spec seems to be the code. $\;$ A (somewhat dated but still relevant) critic.
Jan
14
comment Factors of RSA modulus
Is there a simple proof that at least 3/4 of the possible $m$ values will result in a factorization?
Jan
13
comment The perfect way of using IV in CTR mode
A perfect way to send the IV is in clear before the ciphertext. Why use anything more complex?
Jan
9
comment Are there any known inverse hash lookups for the zero string?
This would be a first-preimage attack; I'm quite positive that we do not know a numerical answer for either MD5 or SHA-1, and I'm not aware of one for MD2 or MD4 (although there are theoretical preimage attacks on these hashes).
Jan
7
comment Sophie Germain primes and safe primes
@Tito: I (and most on this website) would rather not give direct answer to what could be homework. $\;$ Beside, you ask for 2048 and 4096-bit Sophie Germain primes in you last comment, versus 2047 and 4095-bit in the question (given that the size stated in the question is for the safe prime); so I'm sure neither of if you ask specific values for a legitimate reason, and exactly what bit size they should have.
Jan
5
comment Are there cryptographic hash functions which do not have any collisions?
@Thomas, a nitpick: pers FIPS 186-4, the input domain of SHA-256 (widely acknowledged to be a cryptographic hash function) is bitstrings of less than $2^{64}$ bits, which is a large but not infinite domain.
Jan
5
comment Performance bottlenecks in Paillier encryption
@absinthe: if there is such trick, I don't know it.
Jan
4
comment Transforming a key into a seed with the most entropy
To turn a password into a key, you need to perform key stretching using a Password-Based Key Derivation Function. Examples (from passable to good) are PBKDF2, BCrypt, and Scrypt. Anything lesser (like a hash) will be terribly vulnerable to password guessing. $\;$ (update) Turns out Giles just said it!
Jan
2
comment How much extra information is in an RSA public key?
Uh, no. All 2048-bit primes have the same size in ASN.1: '02' for int, '82 01 01' for the 257-byte size, '00' for sign, followed by 256 bytes with the value, starting with a byte in range '80..FF'. Also the question is about public keys, which contain a large composite $n$, and $e$ which often is prime but needs not be.
Jan
2
comment Smart Card - Entropy during on-board public key generation
All modern microprocessor Smart Cards ICs have a built-in true Random Number Generator. See this and this for information on the related test procedures.
Dec
31
comment What is the SSL private key file format?
@neubert: ah, now I see why 30 is the ASN.1 sequence tag; and 02 is int. $\;$ Thanks for that!
Dec
31
comment What is the SSL private key file format?
If the encoding is per RFC3447 appendix C: I wonder you go from this to the first byte 30 of the bytestring? I never managed to get that part!