21,895 reputation
12991
bio website
location Paris, France
age
visits member for 3 years, 4 months
seen 4 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Nov
27
comment Small Encryption Exponent
@codeomnitrix: I scratched my head and failed to see how Coppersmith's method (also here) could help in your other question as it originally stood; but the modified one is very different!
Nov
26
comment RSA OAEP: prevention of partial decryption of ciphertexts
Quick hint: contrast to the scheme attacked in this reference, and its reference 2.
Nov
26
comment Minimum number of independent trials needed to detect a bias
That seems to be the correct order of magnitude. Statisticians have more precise evaluations, taking into account the confidence level that we want in the conclusions. We are talking about a Chi-squared test with one degree of freedom. There are also methods to decide dynamically if we can stop the test or continue, for given confidence levels or reaching the wrong conclusions.
Nov
26
comment Maximum length in bits of the product n=pq
@cryptoclk: the maximum size indeed is 2048 bits; the answer I commented reaches the correct numeric answer to the question, but puts that in a formally incorrect statement (notice total is not the same as maximum).
Nov
26
comment Maximum length in bits of the product n=pq
@pushpen.paul: NextPrime[2^1023]-2^1023 is 1555 according to WolframAlpha
Nov
26
comment Maximum length in bits of the product n=pq
The assertion the total number of bits after multiplication will be 2*1024 is incorrect; counterexample: $p=q=2^{1023}+1155$.
Nov
25
comment Small Encryption Exponent
@codeomnitrix: the assignment in this question was intended to be solvable in one iteration of the Fermat factoring method; that is, the simple 4 steps in this answer. That may be worth trying in your case (especially if there is any hint that the factors are very close, or mention of the method); and perhaps the full Fermat factoring.
Nov
25
comment what are multi-primes and how are they different from semiprimes?
The patent, and more generally history of multi-prime RSA, are described in this question
Nov
24
comment Less known hash functions producing 128 bit hash
Have you tried RIPEMD and RIPEMD-128? They where not in the reference that you give as at the time you posted. Also, truncation of wider hashes are common. And a MAC with hard-coded key is common, and indistinguishable from a custom hash, even with a reverse-engineering of the code.
Nov
24
comment Building a pad for OTP on-the-fly with Diffie-Hellman
@Guut Boy: I was thinking of OTP with XOR, which is usually implied; and DH in $\mathbb Z_p^*$, again a default assumption. $\;$ I do agree that for $a$ random and chosen independently of $b$, and $g$ a generator of a suitable multiplicative group, $(g^a)^b$ is computationally indistinguishable from random.
Nov
24
comment Building a pad for OTP on-the-fly with Diffie-Hellman
@Guut Boy: The question states "protocol would be as hard as breaking DH (discrete logarithm)", which is wrong even if we ignore the minor issue that breaking the DH problem might be easier than breaking the discrete logarithm problem. The issue is that reference to "discrete logarithm" makes it clear "DH" means the DH problem, not the DH protocol (because there is no discrete logarithm protocol). And the proposed protocol (as well as the DH protocol) is trivially broken by MiTM, when the DH problem is not.
Nov
24
comment Inverse of a function $f_k(x) := f (x ⊕ k) ⊕ k$
@user3646249: bijective means that any element of the destination set has exactly one way to be reached; that's at most one way for injective, and at least one way for surjective. A bijection is a bijective function, an injection is an injective function, a surjection is a surjective function.
Nov
24
comment Building a pad for OTP on-the-fly with Diffie-Hellman
@Guut Boy: when working modulus $p$, the $j$-th high bit of the outcome of DH key exchange has a bias, in the order of $2^{-j}$; so you need to ignore enough high bits (or use a post-processing like a hash) in order to get practical security even if you do not consider MiTM attacks. $\;$ And of course neither DH, nor the proposed system, is secure against MiTM attacks. $\;$ (Notice the use of @ so that you are notified of the comment).
Nov
24
comment Efficient proof of knowledge using Wegman-Carter hash
@Ricky Demer: I guess you are suggesting that the challenge is (the seed of) some random prime $N$, and the response $M\bmod N$. That seems to works with odds of forgery $2^{-\log_2(N)}$ if $N<log_2(m)\log_2(\log(m))$ where $m$ is the bit size of $M$, or something on that tune; but I doubt this can be made computationally competitive. Using a smooth $N$ can be more efficient (by using the CRT) but is less secure, because an adversary might pre-compute $M$ modulo small primes, then discard $M$.
Nov
24
comment Inverse of a function $f_k(x) := f (x ⊕ k) ⊕ k$
Welcome to crypto.SE! I hope that I correctly used $\TeX$ to format your question (click edit to see how that's done). $\;$ Hint: is what's asked always possible? Consider the case what $f(x)$ is zero for all $x$. Now, assume you know $f_k(x)$ and $k$, have access to $f$ or $f^{-1}$, and want $x$.
Nov
24
comment Large file validation on an embedded system through hash and encryption
Can you elaborate on what you trust, and do not trust, on the embedded system? In particular is there some part of the code/data that the adversary is assumed unable to modify? To read? $\;$ Independently: can you program the system at the CPU level, or are you bound to using built-in primitives (as you would be if you could only define bytecode for a virtual machine)? Is MD5 fast enough for your purpose, or do you want something even faster (that seems possible with a Wegman-Carter hash)? And if not, is the bottleneck MD5, or reading the data?
Nov
24
comment Large file validation on an embedded system through hash and encryption
@McMurrich: what you described in above comment is a simple hash tree. As pointed by Richie Frame, it will not detect alteration of a block that was not supposed to have changed, but did (with no change of the stored hash, remaining at its former, original value, no longer matching the file content). I can't tell if that's a problem in your threat model: on one hand you trust the embedded system (when it accesses the data and compute hashes), and on the other you do not (when it comes to not changing this data).
Nov
23
comment Compact digital signature for noisy data
Yes. But unless I miss something, if we use a conventional hash, it seems the verifier will need the exact same message as the prover in order to produce (or check) the hash; thus the scheme won't be more efficient than the "generic but inefficient construction" given, I'm afraid.
Nov
23
comment Compact digital signature for noisy data
Doesn't the proposed protocols require communication from verifier to prover, contrary to the static signature scheme asked?
Nov
23
comment Mifare Classic and crypto1 algorithm
There is a detailed description in: Wee Hon Tan, Practical Attacks on the MIFARE Classic (Department of Computing Research of the Imperial College London; report, September 2009; see in particular section 4). It would be a good idea that you write an answer on your question based on that material.