21,585 reputation
12990
bio website
location Paris, France
age
visits member for 3 years, 3 months
seen 7 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Feb
18
comment Partially-known-plaintext attack of a stream cipher based on modular arithmetic
@Joel Seah: write down the relation between Plaintext, Ciphertext, and $K$, implied by your (slightly improper) use of one time pad in the original question (that I changed to stream cipher). What does that imply for the the first and second 1024-bit blocks of Plaintext/Ciphertext/$K$? And what are the first and second 1024-bit blocks of $K$?
Feb
18
comment Block Cipher vs Stream Cipher in Web Application
A nitpick: I fail to see how the CBC mode of operation of a block cipher can be classified as a stream cipher, which to me implies a linear relation between plaintext and ciphertext for a given key. CTR and OFB have this property, ECB and CBC do not, CFB has it only locally. I upvoted nevertheless.
Feb
17
comment Block Ciphers and (Non-)Generic Attacks
@figlesquidge: For block ciphers in normal use cases, all birthday attacks that come to mind require a massive dictionary of at least plaintext or ciphertext blocks. For hashes, or artificial attacks on block ciphers such a finding $(x,y)$ with $x\oplus E(x)=y\oplus E(y)$, birthday attacks without massive dictionary are possible, using cycling.
Feb
17
comment Block Ciphers and (Non-)Generic Attacks
@figlesquidge: thanks for the improvement! Any rework, update, correction.. of my answers is always welcome.
Feb
17
comment Partially-known-plaintext attack of a stream cipher based on modular arithmetic
@Joel Seah: I'm suggesting that you derive $F(r)$; not that you find $r$, which would be a hard problem, known as the Discrete Logarithm Problem.
Feb
17
comment Partially-known-plaintext attack of a stream cipher based on modular arithmetic
Hint: Can you find $F(r)$? Then $F(2\cdot r)$? Then solve this problem?
Feb
17
comment IV/Nonce in CTR&GCM mode of operation
I suggest changing the question to: "Up to what limit (number of plaintexts, length of that, acceptable residual risk..), and subject to what condition(s), is it OK to use the same key for encrypting plain-texts in authenticated encryption (GCM), or confidential only encryption (CTR), if we use random IV to encrypt each plain-text?". That makes an answer more useful, falsifiable, and significantly more difficult.
Feb
17
comment Block Ciphers and (Non-)Generic Attacks
@David Brower: Yes. Many birthday attacks assume a dictionary.
Feb
17
comment IV/Nonce in CTR&GCM mode of operation
Yes, random IV works for a wide-enough block cipher like AES, and a practical definition of unlimited, and the TRNG used is working properly. Like, you encipher $n$ 16-byte blocks, and are content with a residual risk of $2^{-128+2\log_2 n}$ (that is for short messages; risk is appreciably lower for long messages).
Feb
16
comment Simplified Fiat-Shamir example generates wrong output
"y^2 equals (x * v^e) % n" should be "$y^2\equiv x\cdot v^e\pmod n$", written here as $y^2\equiv x\cdot v^e\pmod n$, which does hold. That's because 441 - 4 is a multiple of 437, or/and because 441 % 437 == 4
Feb
16
comment RSA: What happens to restrictions of plaintext n, dependent on p and q?
@user1885518: Please: (A) Clarify the question. "What happens to restrictions of plaintext n" does not make sense to me (same for "what happens to $n$"). Should that be "What happens to restrictions on plaintext $x$"; or "what happens to restrictions on $m$ such that any $x\in\{0\dots m-1\}$ can be a plaintext?". (B) Make the question self-contained (I can't understand German, used in video reference). (C) Quote some authoritative source using $\Phi$ (\Phi) for Euler's totient, not $\varphi$ (\varphi) as Knuth, your video, and others, or $\phi$ (\phi) as the original RSA article.
Feb
15
comment “SHA-256” vs “any 256 bits of SHA-512”, which is more secure?
@Pacerier: There is no SHA-512/512, that's called SHA-512. SHA-512 and SHA-512/256 (and all SHA-512/xxx) differ in initialization value, and to which length the 512-bit result is truncated. All SHA-512(/xxx) share the same round constants.
Feb
14
comment Encrypting firmware with AES and no IV
The title says "Encrypting firmware". The question is about AES CBC "used to ensure the integrity of the firmware". These are radically different goals, please clarify. An IV or substitute is useful for the first, not the second.
Feb
14
comment gnupg: display digest of key
This question is off-topic because it is about using a cryptographic program
Feb
14
comment Why was ISO10126 Padding Withdrawn?
@roe: known plaintext is to be assumed anyway in the context of use of the ISO 10126 standards; therefore there can't be much danger is adding a little more. On the other hand there IS danger in sending nobody-cared-to-check-what-exactly out in the wild.
Feb
14
comment RSA with composite numbers
I have located that article by Boneh in an archived copy of CryptoBytes Volume 5, No. 1 Winter/Spring 2002: Fast Variants of RSA. It does discuss Multi-factor RSA.
Feb
13
comment RSA with composite numbers
Quadratic Sieve or Number Field Sieve are NOT helped by 3 or more factors. Elliptic Curve factoring and several other methods are. That's how Multiprime RSA gets parameterized: the number of primes is made such that it just bridges the gap between GNFS and Elliptic Curve.
Feb
13
comment RSA with composite numbers
@Nate Eldredge: note that I only report this caveat. I agree with you that it does not make much sense: it is NOT necessary for RSA to work, for the definition of that considered in the current question; and any small prime factor is bad from the standpoint of security.
Feb
13
comment Perfect Forward Secrecy with Pre-shared Key
@ultramancool: that leaves you with my last point as the only practical concern among those I gave.
Feb
13
comment RSA: What happens to restrictions of plaintext n, dependent on p and q?
I think that you want to revise your third point. With $p=q$ prime, RSA no longer works for messages that are non-zero multiples of $p$. Also, the relation between $e$ and $d$ to make these work for the other messages becomes $e\cdot d\equiv 1\pmod{(p−1)}$. And in the second point, you need $p$ and $q$ coprime and squarefree in order to avoid restrictions on message. Finally, considerations on security arising from how $p$ and $q$ are chosen are explicitly out of the question's scope, see the butlast paragraph in the question.