23,618 reputation
23198
bio website
location Paris, France
age
visits member for 3 years, 7 months
seen 6 hours ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Mar
15
comment Why does consecutive permutations or consecutive substitutions not enhance security?
I disagree with the answer, which as written would allow to wrongly conclude that 3DES is no safer than DES, on the grounds that 3DES is 3 times DES performed in sequence and is a permutation (or substitution) since DES is one. $\;$ Also I'm reading the question as about the different assertion that iterating the same permutation (or substitution) does not increase security (which is wrong).
Mar
15
comment RSA key pair generation and FIPS 140-2, 186-4
@user1563721: sorry, I pass at interpreting FIPS 140-2 rules applied to PKCS#11 certified tokens to guess what form of private key export remains possible.
Mar
13
comment Key exchange using hash function
In (b), Alice generates a public/private key pair and sends the public key to Bob by email; Bob chooses a symmetric key k; Bob encrypts k using Alice's public key and sends the cryptogram to Alice by email; Alice deciphers that using her private key and thus gets k. That's how Alice and Bob share the symmetric key k, in the absence of attack. $\;$ In (d), Bob additionally reads H'(k) to Alice over the phone.
Mar
13
comment Of what use is my code for finding prime numbers of a certain size?
In Mathematica, RandomPrime[{$i_\text{min}$,$i_\text{max}$}] gives a pseudorandom prime number in the range {$i_\text{min}$,$i_\text{max}$}.
Mar
10
comment Encryption scheme that allows compare ciphertexts based on the clear text
I re-tagged that question as about order-preserving encryption. This answer might help.
Mar
10
comment Fault encryption attack on RSA
Do we have any information about what bit is changed, in particular if it lies in the public exponent, or the public modulus?
Mar
10
comment what is the current actual budget - as of 2015 - needed to build a DES breaker machine?
+1 for RIVYERA, which previously had not blipped on my radar.
Mar
9
comment How do SignRecover and VerifyRecover work?
@sfallahdoost: I added my references; I admit they are not crystal clear, and some of implementing PKCS#11 requires experience in the field.
Mar
6
comment Is there a format preserving cryptographically secure hash?
@sashank: If $P\to C=E_K(P)$ is a block cipher of 128-bit block size and key size assimilated to a random oracle implementing a random permutation for each $K$ (e.g. AES-128), then $P\to H(P)=E_P(P)$ is a plausible 128-bit hash that preserves the length of the original string. I'm reading Ricky Demer's comment as using something on that tune.
Mar
5
comment Find the prime factorization in the DLP
For the question "If we know what $x$, $g$ and $h$ are, is it possible for us to know what $p$ and $q$ are?", I doubt there is a positive answer $\;$ However another interesting question is: "If we knew a method to find $x$ such that $ g^x\equiv h\pmod N$ given $(g,h)$, would it be possible for us to know what $p$ and $q$ are?"
Mar
5
comment How difficult is it to get a key using simple XOR
Even more precisely, that "algorithm" is fine if and only if: for each of the 256 bit ranks, the bit of that rank in at least one of the random values cannot be guessed by an attacker.
Mar
4
comment Is CBC theoretically harder to brute force when compared with ECB?
Hint: Bruteforce enumerates the possible keys and checks each one (by procedures different in ECB and CBC); how many keys are expected to be tested in each case? What's the hardest step in each check? $\;$ Note: I think you want to assume known plaintext (and known ciphertext, but that one is always assumed in crypto); and perhaps something about the plaintext to allow ECB to be bruteforced.
Mar
3
comment Power analysis and exponentiation by squaring
Hint: execute exp-by-squaring instrumented by printing a S each time x2 is computed (computation of either two last lines) and a M each time x * is computed (computation of last line). See how what's printed relates to n.
Mar
3
comment How to compare between two cryptographic algorithms in terms of security?
Algorithm security can't be reliably compared on the basis of their result (a value), even for multiple known (or chosen) inputs. Examining results sometime allows to conclude that an algorithm is insecure, not that it is secure
Mar
1
comment How does $g$ being a generator imply Diffie-Hellman's correctness?
Right: the choice of $g$ is immaterial to Alice and Bob obtaining the same shared key. However the choice of $g$ matters to the diversity of that key, thus its security. For example, $g=1$ would imply that the shared key is always $1$, and that's not at all secure. $g$ being a generator ensures that the shared key can take any value in $[1\dots p]$, as (somewhat tersely) explained in that other answer.
Feb
28
comment How does knowing the factorization of N can help to obtain the secret?
The CRT (and the appropriate conditions on $p$, $q$: that $p$ divides $N$, $q$ divides $N$, $\gcd(p,q)=1$) gives you that $x=a^2\bmod N$ if and only if $x=a^2\bmod p$ and $x=a^2\bmod q$. Now you need to solve these two equations, and walk back to $N$.
Feb
27
comment How does knowing the factorization of N can help to obtain the secret?
I won't deprive you from the benefit of doing your homework. $\;$ Hint: establish that if $N$ is prime, it is possible to solve $x=a^2\bmod N$ for $a$ (that's the modular square root problem). Now, assume the factorization of $N$ is available, and use the Chineese Remainder Theorem (at first, handle the case of $N$ not divisible by the square of a prime).
Feb
24
comment RSA Key composition
Montgomery arithmetic's main advantages are 1) Quotient estimation is easier 2) Estimated quotient is always right, thus not exceptional case is needed, which is great from the perspective of resisting timing attacks (but beware of other timing dependencies during the extra steps) 3) It's slightly easier to perform multiplication and reduction without a wide intermediary result than with natural arithmetic. $\;$ But it does NOT significantly lower the multiplications of elementary words, or the size of operands, compared to natural arithmetic; and does NOT pay for the public-key operation.
Feb
24
comment RSA Key composition
@haster8558: In many hardware implementations of RSA using CRT, the recombination after exponentiation is performed in software, and still does not dominate the execution time. CRT may actually significantly reduce silicon requirement for a given public modulus size, since all quantities manipulated in the time-critical part are only half as wide as in regular RSA (assuming balanced primes as in FIPS 186-4); that will be the case if there's hardware to make modular multiplication over the full modulus width. $\;$ Another design choice will be using Montgomery arithmetic, or regular one.
Feb
24
comment RSA Key composition
Right. Notice that for RSA signature verification, $e$ can be small ($3$ or $65537$) and software on a modern 32-bit CPU (rather than anything done in VHDL) is typically adequately fast. In either case you want signature padding, e.g. RSASSA-PKCS1-V1_5 or RSASSA-PSS or ISO/IEC 9796-2, which is almost exclusively done in software, except for the hashing part.