21,585 reputation
12990
bio website
location Paris, France
age
visits member for 3 years, 3 months
seen 1 hour ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Nov
24
comment Feistel network output if round function is the identity function
Hint: write down what (L1,R1), (L2,R2), (L3,R3) are, using the properties of XOR, sometime used to swap the content of two memory locations without using a temporary.
Nov
24
comment Inverse of a function $f_k(x) := f (x ⊕ k) ⊕ k$
Welcome to crypto.SE! I hope that I correctly used $\TeX$ to format your question (click edit to see how that's done). $\;$ Hint: is what's asked always possible? Consider the case what $f(x)$ is zero for all $x$. Now, assume you know $f_k(x)$ and $k$, have access to $f$ or $f^{-1}$, and want $x$.
Nov
24
comment Large file validation on an embedded system through hash and encryption
Can you elaborate on what you trust, and do not trust, on the embedded system? In particular is there some part of the code/data that the adversary is assumed unable to modify? To read? $\;$ Independently: can you program the system at the CPU level, or are you bound to using built-in primitives (as you would be if you could only define bytecode for a virtual machine)? Is MD5 fast enough for your purpose, or do you want something even faster (that seems possible with a Wegman-Carter hash)? And if not, is the bottleneck MD5, or reading the data?
Nov
24
comment Large file validation on an embedded system through hash and encryption
@McMurrich: what you described in above comment is a simple hash tree. As pointed by Richie Frame, it will not detect alteration of a block that was not supposed to have changed, but did (with no change of the stored hash, remaining at its former, original value, no longer matching the file content). I can't tell if that's a problem in your threat model: on one hand you trust the embedded system (when it accesses the data and compute hashes), and on the other you do not (when it comes to not changing this data).
Nov
23
comment Compact digital signature for noisy data
Yes. But unless I miss something, if we use a conventional hash, it seems the verifier will need the exact same message as the prover in order to produce (or check) the hash; thus the scheme won't be more efficient than the "generic but inefficient construction" given, I'm afraid.
Nov
23
comment Compact digital signature for noisy data
Doesn't the proposed protocols require communication from verifier to prover, contrary to the static signature scheme asked?
Nov
23
comment Mifare Classic and crypto1 algorithm
There is a detailed description in: Wee Hon Tan, Practical Attacks on the MIFARE Classic (Department of Computing Research of the Imperial College London; report, September 2009; see in particular section 4). It would be a good idea that you write an answer on your question based on that material.
Nov
23
comment Decrypt with only the cipher file and the key?
Context, how the file came to you, its name and extension (if any), whatever metadata the file system keeps, perhaps the meaning of the key itself, might help you. Also, it is not uncommon that encryption programs put some fixed value at the beginning of the file, which could give a clue as to what that program is. For example, files enciphered in the 7-zip native file format start with the two bytes 37 7A (7z). The length of the file could conclusively rule out some methods.
Nov
23
comment Why we can't implement AES 512 key size?
@owlstead: I am considering doing something about the 2011 paper; the IEEE lists itself as the publisher, the first author had an affiliation, and some papers in that IAS 2011 conference have a summary that looks fair. For the 2010 and 2014 papers, sad truth is that we can not trust publishers at face value, even those not on this list
Nov
22
comment Addition / Multiplication modulo 13
The first table is still not that of a group, but of the commutative monoid $({\mathbb Z_{13}},*)$ (hint: find the neutral element, then if every element has an inverse). Again, find the group you are working with, and check why $g=2$ is a generator by using the definition of that.
Nov
22
comment Addition / Multiplication modulo 13
The (partial) tables are for the commutative monoid $({\mathbb Z_{13_\text h}},*)$ and the Abelian group $(\mathbb Z_{13_\text h},+)$, where $13_\text h=19$, rather than for what's stated. $\;$ By definition $g$ is a generator of a finite group $(S,\circ)$ iff $g\in S$, and any $x\in S$ can be written as $x=g\circ g\circ\dots g\circ g$, for some number of terms. $\;$ Ascertain what group you are working with (including, most importantly, what the group operation is), and apply that definition.
Nov
21
comment Python. RSA common modulus attack problem
Use Extended Euclidian to compute modular inverse. That maybe what gmpy.invert does.
Nov
21
comment Hash collision using the leading 40-bits of SHA-1
Your problem seems to be that only the cmp_hashhash step is reduced to 40 bits; assuming hash.CalculateDigest is SHA-1, the function that you iterate is 160-bit, and does not enter a cycle in a reasonable time. Change steps involving hash.CalculateDigest to truncate to 40 bit (perhaps just by changing 20 to 5), and see the magic of the birthday bound.
Nov
20
comment Are all binary-additive stream ciphers reciprocal?
@whatyouhide: Welcome to crypto.SE! $\;$ Looks like you are doing fine; I do not spot that you wrote anything silly in question or comment.
Nov
20
comment Is there a way to systematically calculate the public exponent $e$ in RSA?
@Chris Peikert: Indeed. I'll edit the answer accordingly.
Nov
19
comment Is there a way to systematically calculate the public exponent $e$ in RSA?
Also: if we do hand calculation, and after checking $p\ne q$, we should use $d=e^{-1}\bmod (p-1)(q-1)/2$, or $d=e^{-1}\bmod((p-1)(q-1)/\gcd(p-1,q-1))$, or $d=e^{-1}\bmod\operatorname{lcm}(p-1,q-1)$, which are more practical formulas to compute a working $d$. Notice how $d=3^{-1}\bmod 20=7$ is easier to compute than $d=3^{-1}\bmod 40=27$ is, and $20^7\bmod55$ is much easier to compute than $20^{27}\bmod55$ is (but equal).
Nov
19
comment Is there a way to systematically calculate the public exponent $e$ in RSA?
You means $40 = 2^3\cdot5$. This method involves factoring $p-1$ and $q-1$ (and choosing a small odd factor not appearing in this factorization). By hand, this is utterly impractical for even moderate $p$ and $q$. Try it with $p=14627, q=15959$. Then compare to the method I'll add in my giant answer.
Nov
19
comment Simple encoding function mapping integers
The first integer likely is The Answer. The second likely is $\big\lfloor {18\over25}x-44\big\rfloor$ where $x$ is the input. The rest is left as an exercise to the reader.
Nov
19
comment Where have all the cypherpunks gone?
@Nils Pipenbrinck: yes, but the traffic on sci.crypt (URL: news:sci.crypt or news//:sci.crypt ) has lowered, and I now seldom read something interesting. I am 100% bought by the editing capabilities and relatively high quality of the material we get here. My main fear is about long-term archival, but that's for meta.
Nov
18
comment Java RSA/ECB/PKCS1Padding encryption with .NET
$e=2^{16}+1=65537$ (which is most usual), but it is encoded in decimal, then ASCII (giving the string "65537"), then a variant of Base64 without final =, which is byzantine. The value given for $n$ starts in the same ugly format, then (in the XXXX segment) deviates from it, thus is unusable; that might be some of your problem. $\;$ Not knowing your cryptographyService, we can't guess what's the format it wants; and that's off-topic of crypto.SE, as well at what's exactly the format output by RSACryptoServiceProvider.Encrypt (and you give no example of either).