22,305 reputation
12992
bio website
location Paris, France
age
visits member for 3 years, 5 months
seen 4 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Mar
4
comment Is Dropbox's hashing method cryptographically secure?
Are you sure what's done amounts to a 160-bit hash that is the concatenation of (32-bit) CRC32 and (128-bit) MD5? Any pointer or evidence? Also, do you know (or have information that could help to determine) if, in the use made of that, the required property is collision resistance, or preimage resistance? That's of paramount importance, for MD5 is not cryptographically secure w.r.t. collision resistance, but largely remains so w.r.t. preimage resistance.
Mar
3
comment Example of second preimage attack
What's wrong with "toggle the $i+1$-th bit in the fifth word" in my comment, or $m_4\gets m_4\oplus\text{0x400000}$ in the paper's 4.4, which is how $M'$ is obtained from $M$?
Mar
3
comment NTRU crypto from unseen.is; myth busting help
@Stephen Touset: I can't point any publication about a symmetric cipher with 4096-bit key. However for many ciphers (AES, DES..) it is standard practice to consider separately key expansion (generating subkeys independent of plaintext); and the rest, which is in some attacks modeled as a random key as wide as the subkeys are. So arguably, that variant of AES-256 (with 1920-bit key) is somewhat studied. yAES defined as AES with 31 rounds and no key expansion would be a 4096-bit cipher, at least as strong in a random-key setup as AES-256 is (but horribly vulnerable to related-key attacks).
Mar
3
comment Is it meaningful to consider the leakage of master key of KGC?
@Ricky Demer: great stuff (that I'll need time to study); perhaps this should be added to your answer, that I now start to understand.
Mar
2
comment If $G'(s)=G(s0^{|s|})$ and $G$ is a PRNG, is $G'$ necessarily a PRNG?
I attempted the same editing, but wondered if $s0$ is meant to be $s_0$, or something else; and in either case those come from nowhere and I fail to parse the question.
Mar
2
comment NTRU crypto from unseen.is; myth busting help
Add facts to the question (like the NTRU variant and parameters, what TRNG is used for user and session key generation, the working of the mysterious xAES, the protocols..) and you'll get up-votes. Or just point any falsifiable and outrageously wrong statement on the website, and I'll answer. Scoop, I've just found such statement, I'll add it in the question!
Mar
2
comment NTRU crypto from unseen.is; myth busting help
@user3244085: ah, and since you point an answer to a question about long keys (that I also answered): using a 4096-bit RSA key is fine practice (for a long term key or/and to damp down paranoia); using a 4096-bit (key? block? do we even know?) for a symmetric block cipher is pointless (as far as we know), but could be harmless.
Mar
2
comment NTRU crypto from unseen.is; myth busting help
@user3244085: Your "public crypto is always bad" and "longer is better" seems to use quotes around paraphrase put without some slightly redeeming context. Perhaps "if it's publicly available, it's cracked" was referring to an implementation on a platform unable to resit key leakage, and if it's used in the sense of as soon as the code. Saying "believed to be resistant to even quantum computing attacks" may be useless, but is not snake oil. It would be fine to discuss if the 4096-bit key xAES is ridiculous or fair, if you (or someone else) could describe it, say by reverse-engineering.
Mar
1
comment Is it meaningful to consider the leakage of master key of KGC?
@DrLecter: Yes, but there is also the option to zeroize some portion of the KGC private key after each use (like: what remains consists of the user private keys not already distributed for all possible IDs, as generated initially from a master KGC private key, zeroized after this use; with a size problem when IDs are arbitrary and meaningful). Note that my use of zeroized in my answer refers to whatever users entitled to some IDs actually got from the KGC (in other words, a user's private key or some equivalent).
Mar
1
comment Derive both MAC and AES keys from same PBKDF2?
@CodesInChaos: Do you base your recommendation (not to derive more than the natural output size directly from PBKDF2) primarily on considerations of performance with some impact on security by way of allowing less iterations for a given effort, as pointed in this answer; or do you have some other consideration in mind?
Mar
1
comment NTRU crypto from unseen.is; myth busting help
@rath: CipherCloud pretended to achieve some goals that classic crypto does not achieve, making these claims falsifiable to some degree. Here, I see (pun intended) on the website, or question, no claimed achievement that's out of reach of standard crypto; no description of the AES-256 replacement with 4096-bit key (thus we can't reason about if it is good or bad); no clue about which variant of NTRU is used, with what parameters, in what protocol (I do see a non-disastrous rationale for NTRU, involving resistance to Quantum Computers and speed of user-side private-key generation).
Mar
1
comment NTRU crypto from unseen.is; myth busting help
Quoting our FAQ: " Cryptography Stack Exchange is for asking questions about the mathematics and properties of cryptographic systems, their analysis ("cryptanalysis") and subsidiary topics that generally make up cryptology, such as random number generation. ". The present question is more about reading between the lines of commercial (rather than mathematical) text, trying to spot something that obviously does not hold water. I consider the question off-topic until it points a falsifiable claim .
Mar
1
comment NTRU crypto from unseen.is; myth busting help
An archive of the website shows an aspect (now gone) of the early intentions: " For those desiring more security, we offer a Premium service which will feature One Time Pad. This classic encryption doesn't use repetitive math formulas and the key is the same length (or longer) than the message. [..] because it uses a different technique to hide your message, it's very powerful and considered immune to cryptanalysis even today. We're making it even simpler to use this powerful way to encrypt your messages. "
Feb
28
comment Example of second preimage attack
A very general sketch of the attack: we want a second preimage of some message starting in $M$ (of sixteen 32-bit words). By using the procedure in the paper's 4.3 (with reference to other parts), we check if $M$ is weak for some $i$. If yes, which has odds $2^{-56}$, all there is to do to find the second preimage is toggle the $i+1$-th bit in the fifth word of our original message. Section 4.4 explain how to find a message such that this procedure works, with $M$ Hamming-close to any prescribed $M_0$ we want. In the paper $M_0$ was chosen with all bits set, that seems arbitrary.
Feb
28
comment Find out which keying option is being used in Triple DES?
@poncho: Yes, under a random even permutation model for DES, my idea just can't work. That's bad for plausibility that the cycle structure could allow a distinguisher. An indispensable experimental preliminary would be to investigate if the cycle structure of single-DES (with external canceling of final swap) is distinguishable from that for a random (even) permutation for at least a wide class of keys; starting with "weak" (resp."semi-weak") keys, for which each round (or pair or round) is the same permutation, giving a little meat to the possibility that it shows in the cycle structure.
Feb
28
comment Find out which keying option is being used in Triple DES?
@AnotherTest & poncho: What about quasi-exhaustively tabulating the length of cycles, and trying to derive a distinguisher from that? Conceivably, having 2 identical permutations in the 2-keys setup could show in the cycle structure. The attack scenario could be semi-realistic in some rare setups. At least the effort for building experimental data is feasible; by keeping information for distinguished points only (like, 30 high bits fixed), moderate memory (2GB) is enough. It is entirely conjectural that a distinguisher could be built from cycle structure, even between 1-key and the rest.
Feb
28
comment Does it make sense to have a 4000 bit long key?
Can't agree with " Yes, it's practical ". Do we live in a world with the same human capabilities?
Feb
27
comment Example of second preimage attack
The new GOST paper claims a " complexity of about $2^{225}$ evaluations of the compression function "; I suggest you ponder what that number means in term of time for the hardware you have. The MD4 paper allows a concrete implementation of a program that accepts any file matching some simple constraint on how it starts, and quickly spits a different file with the same MD4 hash, as verifiable with a reference MD4 implementation. With the first implementation strategy that I suggested, the program is dead simple. A file editor like HxD can even be used to perform the attack without coding.
Feb
27
comment Decode message $m = p * q$, where $p ^ 5 \bmod N$, $q ^ 5 \bmod N$ and $N$ are known
@Ricky Demer: A solution for $p^5\bmod N=3$, $q^5\bmod N=3$, $N=6$ is $p=9$, $q=3$, leading to $m=27$. In this particular case, $m=9+18\cdot k$ for $k\in\mathbb Z$. Sorry for so many iterations of this comment before I finally remove much incorrect stuff about the general case, and fix that simple one.
Feb
26
comment Decode message $m = p * q$, where $p ^ 5 \bmod N$, $q ^ 5 \bmod N$ and $N$ are known
I find this puzzle incredibly rich: some theoretical aspects of it are hard; and by changing the numerical values, we can vary the techniques required to solve it, and the difficulty. If the source of the puzzle is published, I want to read it!