23,723 reputation
23199
bio website
location Paris, France
age
visits member for 3 years, 7 months
seen 3 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Apr
2
comment Cryptographic system with double keys with reversible order
@tylo: Your remark is correct for the IND-CPA game played for public-key encryption, where encryption of chosen plaintext is always possible, and unstated. But for symmetric encryption, the textbook IND-CPA game allows the adversary to obtain a ciphertext for chosen plaintext before the challenge phase (at the price, in the deterministic encryption game, of not choosing it later on). I expanded my sketch to a full proof. Initially it was for deterministic encryption, but with minor tweaks it seems I have now proven that no symmetric scheme (including probabilistic) can provide commutativity!
Apr
2
comment How do I create a short signature? (e.g. less than 100 bytes)
Regarding $\text{SFLASH}$: even its third variation $\text{SFLASH}^\text{v3}$ stands seriously broken. I am unaware of a fourth try. $\text{SFLASH}^\text{v3}$ was accepted by Nessie, but $\text{QUARTZ}$ was not, with the comment that it "does not meet our security requirements for the submitted parameters", I think on the grounds of this paper, perhaps that one too.
Apr
1
comment Entropy test for AES Key Schedule
For a very graphic illustration of a cold boot attack, see there
Apr
1
comment Can a commutative block cipher be indistinguishable from a random permutation, for fixed key?
@D.W.: In the definition of my new question, I leave it to an omnipotent referee to choose a random commutative cipher, and I do not see a problem with this: among the $(|S|!)^{|K|}$ ciphers with message space $S$ and keyspace $K$, some subset is commutative, and the hypothetical referee can pick a random element in that subset. BTW I fail to determine how many elements this subset has, even roughly.
Apr
1
comment Can a commutative block cipher be indistinguishable from a random permutation, for fixed key?
@poncho: I think that I see how to make a variant of Pohlig-Hellman Exponentiation Cipher secure under known-plaintext while keeping commutativity, so that's not my question. I essentially add a fixed pseudo-random permutation on block input, its inverse on block output. However it inherits properties beyond what a commutative cipher is bound to have. I have a reworded question here.
Mar
31
comment Can a commutative block cipher be indistinguishable from a random permutation, for fixed key?
That's very true! I used that very argument in the beginning of my answer linked to the question, but failed to apply it!! I need to find a different wording of the question, on the tune of: "indistinguishable from a random set of permutations with the commutativity property". I lean towards making that a different question, though.
Mar
31
comment How is the curve equation used in ECC?
Thomas Pornin's related answer might also be of interest.
Mar
31
comment Testing hardware random number generators?
A related answer.
Mar
29
comment How is the curve equation used in ECC?
You want info on Elliptic Curve Cryptography (not cryptology); let me Google that for you.
Mar
29
comment Cryptographic system with double keys with reversible order
@modchan: I found the name (and updated the answer). See also that answer for another suitable algorithm (SRA, which is about the same with $p$ replaced by $n$ of factorization shared between the parties).
Mar
28
comment Is differential calculus related to RSA?
A good reason why the simple answer is no (to the question): calculus is about mostly continuous functions, when cryptography deals with discrete function only.
Mar
27
comment If PGP and GPG both follow the OpenPGP standard, are they 100% compatible in all use cases?
There are several other subtle hurdles, including: not-so-old-and-still-around versions of GPG insist to require installation of a plugin to handle the IDEA block cipher, required for compatibility with cryptograms generated by PGP when old-format keys are used with default (or at least common) options. Fortunately, the IDEA patent has expired and GPG (starting end of 2012) comes with IDEA built-in.
Mar
27
comment Near preimages, applicable to Bitcoin?
Actually, Bitcoin mining seems closer to requiring to find $X$ such that $\text{SHA-256}(\text{SHA-256}(X))<\text{target}$ (I have the details fuzzy); so the function to attack is not $\text{SHA-256}$, but rather $\text{SHA-256}^2$. In any case, I know no attack, even theoretical, on even (full) $\text{SHA-256}$.
Mar
24
comment Is it true that for RSA with no padding, the length of data must be equal to the length of key?
@user3100783: I only partially agree: even without padding, when enciphering a random bit string of $n-1$ bits, the plaintext can be changed in predictable ways because of unpadded RSA's malleability only in very specific ways, related to the multiplicative properties of RSA; it is not like the adversary can change a bit here or there by messing with the ciphertext. We can build use cases where it is better for the adversary to take advantage of the genuine RSA ciphertext, than it is to craft another one from scratch (with fully chosen plaintext), but they tend to be artificial.
Mar
24
comment Is it true that for RSA with no padding, the length of data must be equal to the length of key?
@user3100783: The padding check will fail if the enciphered data has been accidentally modified (with overwhelming odds for RSAES-OAEP, still quite likely for RSAES-PKCS1-v1_5). But that's NOT a security feature! One who wants to alter the enciphered data without being detected can do it trivially (just encipher whatever you want the deciphered thing to be); remember the adversary knows anything public, thus including the public key!
Mar
24
comment How secure is the AES master key if Round Keys are found
This looks like homework, that's why I let you find the answer. Hint: Examine how the round keys are computed from the master key. Also, check how hardware implementations find the round keys during decryption. Read the rationale for AES, section 7.5.
Mar
24
comment Generating Random Primes
Here is an approach to select a random prime nearly free of bias. Say that for some $a,b$ with $2≤a≪b$ we want a random prime $p$ with $a≤p<b$. Pick a random $s$ with $0<s<b-a$ until $\gcd(s,b-a)=1$. Pick a random $t$ with $0≤t<b-a$. Use for $p$ the first prime among the $p_i=(i⋅s+t)\bmod(b-a)+a$. Simple variants can be made to select prime $p$ such that $p-1$ has a big known prime factor $s$, or/and such that $p+1$ has another big known prime factor, see e.g. FIPS 186-4 section B.3.6.
Mar
24
comment Entropy when iterating cryptographic hash functions
@StephenTouset: Or, more simply said: truncating the output of a PRF yields a PRF. Notice that as worded now, the question truncates the output of SHA-256, at each use, effectively building a 128-bit hash. Initially, the question truncated the input of SHA-256. There is a simple reduction form the initial question to the current one: first truncation reduces to 128 bit of entropy, then there are a number of 128-bit hashes, then a final SHA-256 that is almost entropy-preserving.
Mar
21
comment SHA-224 Purpose
@ntkskml: I frown at not vulnerable: the adversary trying an obvious modification of a length extension attack has odds of success $n/2^{32}$ with $n$ attempts.
Mar
21
comment SHA-224 Purpose
@TruthSerum: No! Half the length of a 3DES key would be 96 or 84 bit, depending on if you count parity or not. It is more like 224 is twice the the base-two logarithm of an estimation of the number of operations in the best known attack for 3DES, assuming unlimited memory.