19,403 reputation
12676
bio website
location Paris, France
age
visits member for 2 years, 11 months
seen 1 hour ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Dec
3
comment Keyed digest function with odds of collision below the birthday bound?
@Richie Frame: I can't increase the size of $S$ or the entropy $r$ in $R_S$; these are pre-existing and beyond my control.
Dec
3
comment Keyed digest function with odds of collision below the birthday bound?
@poncho, to answer your question more precisely: my $R_S$ (or what it is derived from) is pre-existing and thus beyond my control: actually I have a very biased $Q_S$ with $r$ bits of entropy, that I model as a uniformly random $R_S$, perhaps obtained by hashing $Q_S$. $R_S$ is essentially random, for each $S$. In the context of (3), $Q_S$ or $R_S$ is not known by the adversary. The threat/adversaries in (2) and (3) are not the same.
Dec
3
comment Keyed digest function with odds of collision below the birthday bound?
@figlesquidge: $E_k(H(S||R_S))$ does not meet goal (4), for it has odds of collision equal to the birthday bound.
Dec
3
comment Keyed digest function with odds of collision below the birthday bound?
@figlesquidge: tried to address the issue with a change of title, making it clear we want low odds of collision
Nov
28
comment How do you construct a practical full-domain hash function?
Full Domain Hash practice that I'm aware of includes RSASSA-PSS as in PKCS#1v2; and ISO/IEC 9796-2 schemes 2 and 3 (which use an ad-hoc mask generation function that concatenate several fixed-width hashes).
Nov
22
comment How to put the hash of a PDF file in the PDF file?
Kudos for giving an answer to the question as worded, and sorry that I initially missed that.
Nov
21
comment Are there any protocols that are truly secure from active and passive MITM attacks?
@user31425: A standard method to establish Alice's trust in Bob's public key is that Bob reads aloud a hash of his public key in front of Alice (it then does not mater how the aledged public key reached Alice: she can check it using the trusted hash). But if Alice neither has or had any channel from the real Bob to her, assumed safe from alteration; nor trust a third party; then there is no method for her to establish a secure channel with Bob. Proof: assume there's a method; anyone can apply it just as Bob, and will succeed to impersonate as Bob to Alice.
Nov
19
comment A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt
One theoretical issue with the construction is that a weakness in PBKDF2 could affect scrypt, since scrypt heavily uses PBKDF2 internally. As of practice, the password is much more likely to leak in other ways than a theoretical attack on scrypt; e.g. eavesdropping, reuse of the same password on another system, very poor password choice allowing brute force attack.
Nov
15
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
@SDL: In cryptography, "k*64 machine instructions" does not count as "hard to compute" for any 64-bit k.
Nov
14
comment Blinding twice in RSA
Thinking about it again, yes than should work when $n_1\le n_2$ as suggested by DrLecter, with two separate unblinding steps using $n_2$ then $n_1$. When cascading signatures, there is a standard trick to make that work with $n_1/2\le n_2\le 2n_1$: replace signature $s_1=m_1^{e_1}\bmod n_1$ with $\hat s_1=\min(s_1,n_1-s_1)$, which is such that $\hat s_1<n_2$, but still allows recovering $m_1$ from $\hat s_1$, as either $\hat s_1^{e_1}\bmod n_1$ or $n_1-(\hat s_1^{e_1}\bmod n_1)$, assuming parity of $m_1$ is fixed; the same can work here.
Nov
14
comment Blinding twice in RSA
Your math is good when $n_1=n_2$; when not, all hells break loose.
Nov
8
comment Are there any protocols that are truly secure from active and passive MITM attacks?
No!! A shared secret is definitely NOT necessary to protect against MITM!! Trusted public information (public keys), and corresponding non-shared secrets (private keys) is enough, thanks to public key cryptography.
Nov
7
comment Understanding elliptic curve encryption
$1=y^2\pmod 5$ IS a confusion in notation. Use either $1\equiv y^2\pmod 5$ or $1=y^2\bmod 5$, the former meaning that $y^2-1$ is a multiple of $5$, the later that the remainder of the division of $y^2$ by $5$ is $1$. Notice that $6\equiv y^2\pmod 5$ is true, but $6=y^2\bmod 5$ is false.
Nov
6
comment CBC-MAC forging textbook question
CBC-MAC(x || y $\oplus$ t) = t' is to be read as CBC-MAC(x ||(y $\oplus$ t)) = t' with t right-padded with enough zeros to match the length of y .
Nov
4
comment Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?
It is unusual to consider safe primes (primes that are two times a prime plus one) in an RSA context (encryption or signature per PKCS#1, signature per ANSI X9.31, ISO/IEC 9796-2, FIPS 186). Some standards, including ANSI X9.31 and FIPS 186-4, still insist to use strong primes (not safe primes) at the 1024-bit modulus level, and this is not entirely unreasonable.
Nov
4
comment Matrix key exchange
Is $M$ reused across multiple executions of the protocol? If yes, is the adversary assumed to know $K$ from previous iterations of the protocol?
Nov
4
comment Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?
This is correct, but unrelated to the question.
Nov
4
comment RSA 896 vs 1024 vs 2048 in Javascript?
@owlstead: ah, I had missed that generating a private key. That could explain the worse-than-cubic runtime, which I could not explain from the source code which does bigint "by hand" in JavaScript.
Oct
31
comment Attacking 2DES efficiently
Unless I err: odds that the last call for the first iteration was with G and for the second iteration with H is $1/4$; but odds that the last call for the first iteration was with a different function than the second is $1/2$, and that seems to be what really matters.
Oct
31
comment Attacking 2DES efficiently
This works, and might score well for homework, unless the $2^{45}$ is deliberately misleading. But this is vastly more costly than collision-based search as outlined in this other answer, in term of block cipher operations, memory used, and memory accesses.