19,682 reputation
12779
bio website
location Paris, France
age
visits member for 3 years
seen 1 hour ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Dec
12
comment iterated discrete log problem
If the real question is about index calculus, why is there a reference to Schnorr groups? Or does a variant of index calculus work on these?
Dec
12
comment Do test vectors ensure a cipher is free of backdoors?
@pg1989: That weak GOST S-boxes is certainly a possibility. But can you quote a convincing source that it has been done?
Dec
11
comment Slow one-way pseudo-random permutation?
Indeed, the security gap that I can get with my $P$ is minimal (@D.W. has a better ballpark figure for it than I dare conjecture); the only satisfying aspect in my construction is that said security gap remains nearly stable with the number of rounds $c_1$, and decreases less than proportionally to $c_0$. If only we had an Elliptic Curve analog.. [justification for $m$ now in answer; improved the remaining of the present comment].
Dec
11
comment Do test vectors ensure a cipher is free of backdoors?
@CodesInChaos: AES exploitable related-key weaknesses are theoretical for now; at least as I interpret this answer. Backdoors (such as the one in your former comment) are far from theoretical.
Dec
10
comment Slow one-way pseudo-random permutation?
@K.G.: there must some typo in "Let $p$ be a prime such that $p+1$ is twice a prime, $p−1$ is not divisible by $3$", for only $p=3$ and $p=5$ are solutions.
Dec
10
comment Slow one-way pseudo-random permutation?
@K.G.: The curve you suggest seems to be as in that answer to a question asking to map points on a curve to (a range of consecutive) integers. That answer says that the discrete log on this curve reduces to the discrete log on $GF(p^2)$. Is that correct?
Dec
8
comment Slow one-way pseudo-random permutation?
I do not see how "The ease of decryption part can be solved with using a non invertible MDS matrix", while keeping MatrixMultiply(state) or/and the whole transformation a permutation.
Dec
7
comment Slow one-way pseudo-random permutation?
If we alternate encryption and application of the same $f$, we no longer have an injection. To keep an injection, we would need 1 extra bit for each layer, thus I can have only few ones. Thus the one-wayness will plummet when I slow the forward direction. That would not occur if we had a one-way (aka trapdoor) true permutation at hand.
Dec
6
comment Slow one-way pseudo-random permutation?
@D.W.: The output has to be both short, so as to be human-enterable (as a backup) after being computed by a mobile app; and collision free with high likelihood for many inputs; see the original goals which I now hope to fulfill using the method in this question. Some of the problem is that the cards have already been issued with a certain serial number, but regulatory reasons prevent to store/reuse that serial number for other purposes than the original one, and I need to transform it into another identifier, with the transformation one-way.
Dec
6
comment Why are these techniques not feasible to crack RSA?
I vote to close the question as is, for: The question shows a lack of research; $d = 1/(e \operatorname{mod} \phi(n))$ does not make sense; there is not the slightest reasoning to support the bold assertion "With having $e$ and $n$, we can calculate the value of $d$"; and "factoring $d$" makes no sense.
Dec
6
comment Slow one-way pseudo-random permutation?
@Dmitry Khovratovich: Several problems with that later option. (A) Some $S||R_S$ (or $Q_S$) will be dynamically added during the life of the system, after the various $K$ and $N$ have been chosen. (B) If encryption is slow, then $2^{32}$ encryptions to choose $K$ and $N$ is impractical. (C) When $s$ is above $b/2$ (former $d/2$), working $K$ and $N$ become a rarity.
Dec
6
comment Slow one-way pseudo-random permutation?
@Dmitry Khovratovich: solving this reformulated, simpler question solves the former question, with perfect match of former (4), and the novelty that I explicitly want tunable encryption effort, and would like a memory size parameter in that. I'd also like assurance that the trapdoor has some argument/proof/prior research.
Dec
5
comment Keyed digest function with odds of collision below the birthday bound?
@Dmitry Khovratovich. A detail: shouldn't your $\left(X^{2^k}+X+a\right)^{-l}+X$ be $\left(X^{2^k}+X+a\right)^s+X$?
Dec
5
comment Keyed digest function with odds of collision below the birthday bound?
@Dmitry Khovratovich: very nice suggestion. It seems to work fine when $s+r\le d$, which is close enough to my setup. That's provided the $P$ (or family of $P$) that you suggest really is markedly harder to invert than to compute. If see something like $F(K,S,R_S) = E_{K_n}(P_{n-1}(..(P_1(E_{K_1}(P_0(E_{K_0}(S||R_S)))))..))$ where we adjust $n$ to match the delay desired in (1), and the $K_j$ are derived from $K$.
Dec
5
comment Keyed digest function with odds of collision below the birthday bound?
@RickyDemer: good catch, but easily fixed in the context, where we can use $F(K,S,R_S) = E_{K_2}(P(E_{K_1}(S,R_S)))$, where $K_1$ and $K_2$ are different extracts of $K$.
Dec
3
comment Keyed digest function with odds of collision below the birthday bound?
@Richie Frame: I can't increase the size of $S$ or the entropy $r$ in $R_S$; these are pre-existing and beyond my control.
Dec
3
comment Keyed digest function with odds of collision below the birthday bound?
@poncho, to answer your question more precisely: my $R_S$ (or what it is derived from) is pre-existing and thus beyond my control: actually I have a very biased $Q_S$ with $r$ bits of entropy, that I model as a uniformly random $R_S$, perhaps obtained by hashing $Q_S$. $R_S$ is essentially random, for each $S$. In the context of (3), $Q_S$ or $R_S$ is not known by the adversary. The threat/adversaries in (2) and (3) are not the same.
Dec
3
comment Keyed digest function with odds of collision below the birthday bound?
@figlesquidge: $E_k(H(S||R_S))$ does not meet goal (4), for it has odds of collision equal to the birthday bound.
Dec
3
comment Keyed digest function with odds of collision below the birthday bound?
@figlesquidge: tried to address the issue with a change of title, making it clear we want low odds of collision
Nov
28
comment How do you construct a practical full-domain hash function?
Full Domain Hash practice that I'm aware of includes RSASSA-PSS as in PKCS#1v2; and ISO/IEC 9796-2 schemes 2 and 3 (which use an ad-hoc mask generation function that concatenate several fixed-width hashes).