19,756 reputation
12779
bio website
location Paris, France
age
visits member for 3 years
seen 23 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Dec
13
comment Implement deniable encryption with AES/RSA
@Max13: so as your goal we come up with is: (a) the ciphertext is indistinguishable from random (and in particular it can not be detected that the cryptosystem was used); and (b) trying to decipher with the wrong private key gives no error and a random plaintext. Neither is implied by the other.
Dec
13
comment Implement deniable encryption with AES/RSA
@nightcracker: Can you clarify what is meant by "previously captured communication was yours" in the definition you give of deniable encryption, in a public-key context?
Dec
13
comment Implement deniable encryption with AES/RSA
@Max13: your definition leaves open the possibility for the interceptor to detect that your cryptosystem has likely been used; I was trying to excludes that.
Dec
13
comment Implement deniable encryption with AES/RSA
Thanks for the pointer. That's a VERY recent legislative change (3 days), not even fully enacted (could only locate a draft (petite loi), and this comment by the promoters of the text.
Dec
13
comment Implement deniable encryption with AES/RSA
Why is your definition of plausible deniability that handling the wrong private key allows decryption without error, with random plaintext? I think that a better definition would be: an adversary without the private key can't distinguish the ciphertext from random. Also: can you point to the (French) "law which has just been voted"? I see nothing recent listed here or ici
Dec
12
comment File Hash of Encrypted File
I suggest adding at the beginning something simple like: "The short answer is NO: you will not obtain identical ciphertext files from the same plaintext files encrypted on two different runs of a decent public-key file-encrypting program; their hash will not coincide.", with later justification that decent public-key file-encrypting programs use hybrid encryption.
Dec
12
comment iterated discrete log problem
If the real question is about index calculus, why is there a reference to Schnorr groups? Or does a variant of index calculus work on these?
Dec
12
comment Do test vectors ensure a cipher is free of backdoors?
@pg1989: That weak GOST S-boxes is certainly a possibility. But can you quote a convincing source that it has been done?
Dec
11
comment Slow one-way pseudo-random permutation?
Indeed, the security gap that I can get with my $P$ is minimal (@D.W. has a better ballpark figure for it than I dare conjecture); the only satisfying aspect in my construction is that said security gap remains nearly stable with the number of rounds $c_1$, and decreases less than proportionally to $c_0$. If only we had an Elliptic Curve analog.. [justification for $m$ now in answer; improved the remaining of the present comment].
Dec
11
comment Do test vectors ensure a cipher is free of backdoors?
@CodesInChaos: AES exploitable related-key weaknesses are theoretical for now; at least as I interpret this answer. Backdoors (such as the one in your former comment) are far from theoretical.
Dec
10
comment Slow one-way pseudo-random permutation?
@K.G.: there must some typo in "Let $p$ be a prime such that $p+1$ is twice a prime, $p−1$ is not divisible by $3$", for only $p=3$ and $p=5$ are solutions.
Dec
10
comment Slow one-way pseudo-random permutation?
@K.G.: The curve you suggest seems to be as in that answer to a question asking to map points on a curve to (a range of consecutive) integers. That answer says that the discrete log on this curve reduces to the discrete log on $GF(p^2)$. Is that correct?
Dec
8
comment Slow one-way pseudo-random permutation?
I do not see how "The ease of decryption part can be solved with using a non invertible MDS matrix", while keeping MatrixMultiply(state) or/and the whole transformation a permutation.
Dec
7
comment Slow one-way pseudo-random permutation?
If we alternate encryption and application of the same $f$, we no longer have an injection. To keep an injection, we would need 1 extra bit for each layer, thus I can have only few ones. Thus the one-wayness will plummet when I slow the forward direction. That would not occur if we had a one-way (aka trapdoor) true permutation at hand.
Dec
6
comment Slow one-way pseudo-random permutation?
@D.W.: The output has to be both short, so as to be human-enterable (as a backup) after being computed by a mobile app; and collision free with high likelihood for many inputs; see the original goals which I now hope to fulfill using the method in this question. Some of the problem is that the cards have already been issued with a certain serial number, but regulatory reasons prevent to store/reuse that serial number for other purposes than the original one, and I need to transform it into another identifier, with the transformation one-way.
Dec
6
comment Why are these techniques not feasible to crack RSA?
I vote to close the question as is, for: The question shows a lack of research; $d = 1/(e \operatorname{mod} \phi(n))$ does not make sense; there is not the slightest reasoning to support the bold assertion "With having $e$ and $n$, we can calculate the value of $d$"; and "factoring $d$" makes no sense.
Dec
6
comment Slow one-way pseudo-random permutation?
@Dmitry Khovratovich: Several problems with that later option. (A) Some $S||R_S$ (or $Q_S$) will be dynamically added during the life of the system, after the various $K$ and $N$ have been chosen. (B) If encryption is slow, then $2^{32}$ encryptions to choose $K$ and $N$ is impractical. (C) When $s$ is above $b/2$ (former $d/2$), working $K$ and $N$ become a rarity.
Dec
6
comment Slow one-way pseudo-random permutation?
@Dmitry Khovratovich: solving this reformulated, simpler question solves the former question, with perfect match of former (4), and the novelty that I explicitly want tunable encryption effort, and would like a memory size parameter in that. I'd also like assurance that the trapdoor has some argument/proof/prior research.
Dec
5
comment Keyed digest function with odds of collision below the birthday bound?
@Dmitry Khovratovich. A detail: shouldn't your $\left(X^{2^k}+X+a\right)^{-l}+X$ be $\left(X^{2^k}+X+a\right)^s+X$?
Dec
5
comment Keyed digest function with odds of collision below the birthday bound?
@Dmitry Khovratovich: very nice suggestion. It seems to work fine when $s+r\le d$, which is close enough to my setup. That's provided the $P$ (or family of $P$) that you suggest really is markedly harder to invert than to compute. If see something like $F(K,S,R_S) = E_{K_n}(P_{n-1}(..(P_1(E_{K_1}(P_0(E_{K_0}(S||R_S)))))..))$ where we adjust $n$ to match the delay desired in (1), and the $K_j$ are derived from $K$.