fgrieu

9,839 reputation

1237

bio	website
	location	Paris, France
	age
visits	member for	1 year, 9 months
	seen	yesterday
stats	profile views	93

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.

	9,839 reputation	bio	website		visits	member for	1 year, 9 months
1237 badges		location	Paris, France		seen	yesterday

summary answers questions tags badges favorites bounties reputation activity

603 Comments

suggestions reviews revisions comments badges posts accepts all

May 3	comment	encrypt message with one digest 0-9 instead of 01-26 To make things more concrete: if the plaintext is `Y` or `N`, and the attacker knows that, the adversary can deciper the ciphertext with certainty: any of `NOPQRSTUVW` means `N`, any of `YZABCDEFGH` means `Y`.
May 2	comment	Is it worth applying a MAC on data in a HSM? @Rick Demer: $k_r=\operatorname{Hash}(k_s\|\|k_m)$ is in D.W.'s answer. $k_r=\operatorname{HMAC}(\operatorname{key}=k_m,\operatorname{message}=k_s)$ is my attempt to slightly strengthen that under the assumption that pairs $(k_s,k_r)$ leak (as hypothesized by D.W.). I do not see how that is worse than $k_r=\operatorname{AES}(\operatorname{key}=k_m,\operatorname{data}=k_s)$, except if $\operatorname{HMAC}$ was more vulnerable than $\operatorname{AES}$ to side channel attacks. In the attack model, $k_r$ and $k_m$ are both equally secret, thus everything envisonned for $k_r$ (except XOR) is fine.
May 2	comment	Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash? @Claudio Floreani: I changed the definition of G to match my understanding of your (now deleted) comment transcribed in my earlier edit. Also: I think "..there isn't a reverse function *H'(d,r)=s" should be "..there isn't a reverse function H'(d)=s*", to reflect that r is somewhat embedded in d.
May 2	comment	Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash? I think that the remaining x was an artifact, now removed, of a partial correction that I made to the question following comments by the author (one of which is now deleted). Please see the reworded question, and accept my apologies for the improper edit.
May 1	comment	Is it worth applying a MAC on data in a HSM? +1 for pointing the difficulty at defining the right protocol to be implemented by the HSM. Also: indeed, $k_r=\operatorname{Hash}(k_s\|\|k_m)$, or $k_r=\operatorname{HMAC}(\operatorname{key}=k_m,\operatorname{message}=k_s)$ can help.
May 1	comment	Is it worth applying a MAC on data in a HSM? @Ricky Demer: thanks for pointing an earlier inversion of $k_s$ and $k_m$ in my text.
May 1	comment	Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash? I incorporated the above changes in the question. Also: the restriction of having the same s for d and d' does not match the usual threat model, where an adversary can choose any password she wants; in which case, if she is in a position to inject some d' of her liking, she can simply compute *d'=H(s',r')* for an s' of her choice, and whatever r' (possibly r) she can benefit from.
May 1	comment	toy hash algorithm Another good example of a practically used "check value" which is not a secure hash is the IBAN "mod 97" checksum. Giving an IBAN (for a fictional bank) passing this test, and asking for two similar ones (same fictional bank and format) passing this test and differing only by rotation of 3 consecutive digits might be a good exercise (bonus points if none of the digits is a 7).
May 1	comment	Book Didactic Security Notions Asking for references, especially with this broad a scope, seems off-topic to me. See the FAQ
May 1	comment	Is it worth applying a MAC on data in a HSM? Is "each record on the HSM" stored in the HSM, or in the host (initialy enciphered by the HSM, deciphered on demand)? The later is often used to increase the apparent capacity of the HSM; it makes a MAC of the data more useful. Also: what about power loss during update of the HSM (or the host, if that's where "record on the HSM" are)? Also: do you assume the memory used for records is error-free, perhaps except for power loss during write?
Apr 29	comment	Secure order preserving hash function It is impossible to build a public (key-less) hash function that is order-preserving and first-preimage resistant. Problem is, it is possible to quickly find the preimage by dichotomy.
Apr 29	comment	Secure order preserving hash function $OPHF(x):x\mapsto x\|\|\operatorname{SHA-256}(x)$ is order-preserving, and second-preimage resistant. It is not first-preimage resistant, though.
Apr 24	comment	Chain several RSA encryptions without increasing the message size The question now clarifies that potentially different public keys are used at each encryption step, requiring some care in the choice of the public keys, and making the fast decryption technique in this answer inapplicable.
Apr 24	comment	Patterns in primes, listing? See this one.
Apr 23	comment	Security of tokenization of plain text conversations - cryptanalysis The position of the company has been clarified: these images are from a demo, not the real thing. They claim not to implement 1:1 mapping or ECB mode in any customer deployment. I maintain my previous comment as worded.
Apr 22	comment	Prove that textbook RSA is susceptible to a chosen ciphertext attack @mikeazo: It is indeed the same user, as shown by following the link pajamas, then mathematics, which leads to the other identity. The question is fine, only worded in more mathematical than cryptographic terms, and a bit obviously basic homework or exercise, but showing some effort.
Apr 22	comment	Correct way to truncate data to a range @chew socks: These two graphs look about right for the number of times a particular byte is reached (not 32-bit values or range [0..99999]). The spiky aspect comes from [a] joining points using lines for consecutive byte values (rather than just a cloud of points); [b] zooming-in on the band where most points are. If you draw that kind of graph, preferably without lines, for `output=(rnd32()&0x1FFFF)%100000`, computed for enough values, you will see a defect clearly.
Apr 21	comment	Triple-DES Brute Force A proof would be nice. Keith W. Campbell, and Michael J. Wiener have shown that DES is not a Group, a related result. I wonder if one implies the other.
Apr 21	comment	Prove that textbook RSA is susceptible to a chosen ciphertext attack Only textbook RSA is susceptible to chosen ciphertext attack; RSA as actually used is not. Your technique works at least in the first branch where $\gcd(N,y)=1$, though you should clarify that the adversary submits $\hat y$ for decryption, thus obtains $\hat x$, then deduces $x$; and there are other options to the attacker giving a much wider choice of $\hat y$, using knowledge of $e$. For other cases, I duno what "the zero divisor associated to $\hat x$" is, and there are attacks requiring no query.
Apr 21	comment	Is encrypting a single 128 bit block with AES ECB “safe” Indeed, public key encryption is usually randomized. But then it does not match the "encrypted value of the block (is) to be consistent between encryptions" nor support the "check if a value already exists by just comparing the uniqueness of the cipherText" requirements worded in the question.