21,280 reputation
12989
bio website
location Paris, France
age
visits member for 3 years, 3 months
seen 1 hour ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Nov
5
comment RC4 encryption/ decryption with hashing
the attack rebuilds RC4's keystream generator output over the length of M+H, then process M'+H' where H' is the hash of M'. Truly truncating M'is thus feasible. Your idea of building a compressed M' with uncompressed meaning bigger than that of M is the best option in the other direction.
Nov
4
comment Why to try get key out of white box crypto? How can one protect WBC itself?
Yes. One possible motivation for WBC was to make different White Boxes embedding an identifier, behaving the same for many inputs, otherwise leaking the identifier (when input or output has a key and/or identifier-dependent characteristic). If such a White Box is cloned, and it is possible to interrogate clones, it is possible to determine which White Box was cloned. For pay TV, the White Box could be a Smart Card, and the manufacturer of the Smart Card reasonably held liable for the huge damage to the TV networks. Rather, Smart Cards became excellent Black Boxes.
Nov
4
comment RC4 encryption/ decryption with hashing
not aligned with best practices is an understatement! H is apparently here in an attempt to authenticate the message; but it does not if M is predictable by the attacker (known plaintext): it is trivial to forge a cryptogram deciphering to any apparently authentic message M' an attacker may wish, with the restriction that M' is no longer than M.
Nov
4
comment Timing Attack on OpenSSL by Brumley
Welcome to Crypto.se! Notice how easy it is to use $\TeX$ for formulas (just edit your question to see how it is done).
Nov
3
comment Showing that $2^{N-1}\equiv1\pmod N$ when $N=2^p-1$ for prime $p$
We are left wondering why the statement restricts to odd $p$, since this fine proof applies to $p=2$ just as well. $\;$ I'm raised on writing $(2^p)^k\equiv 1^k\equiv 1\pmod N$ using \pmod, or $(2^p)^k\bmod N=1$ using \bmod.
Nov
3
comment Is XCBC where k2 and k3 might be the identical, secure?
I guess the referenced paper is John Black and Phillip Rogaway's CBC MACs for Arbitrary-Length Messages: The Three-Key Constructions (in proceedings of Crypto 2000, or 2003 version). $\;$ If we draw key randomly, the system is secure, because keys 2 and 3 are identical with infinitesimal odds. I think a more practically interesting question is: Is the system secure if we derive two keys K1 and K2 randomly, and set K3=K2.
Nov
3
comment Security of RSA with $\gcd(pq, (p-1)(q-1))\ne 1$
Ah yes I now see the idea. So we need an even $k$ with a large prime factor. And we are left wondering if that's good enough.
Nov
3
comment Security of RSA with $\gcd(pq, (p-1)(q-1))\ne 1$
Thinking about it again, $q-1$ is bound to have a high prime factor (that's $p$); is not that sufficient to guard against Pollard's $p−1$ algorithm on the $q$ side, even if $k$ is smooth?
Nov
3
comment Simplest code for 64-bit block RSA-like encryption/decryption and key generation
You mention I'd like to cipher a certain data so that nobody beside me could create such ciphered data. RSA, when used to encipher, has the reverse property: anyone can encipher, only you can decipher. RSA can also be used to sign, so that only you can sign a message, anyone can verify the signature. In both cases, the cryptogram is at least (about) 1024-bit for something safe against hackers (but possibly not the NSA). There are signature systems with much shorter signature, e.g. BLS, but that won't be few lines of C.
Nov
1
comment Show that the equal difference property exits for a modified DES encryption system
On this website, basic $\TeX$ is easy as $E_K(A)\oplus E_K(B)=E_K(C)\oplus E_K(D)$. I often use this reference card, and a lot of it works. $\;$ Hint for 1: break down $A$ and $B$ as bit strings, apply definition of $S$, and watch the desired property unfold. $\;$ For 2: Break 16-bit strings into two 8-bit ones (not individual bits); perhaps, evaluate the Exclusive-OR of what's on both sides of the equality, and simplify until you get zero; use result in 1, associativity+commutativity of $⊕$, and that $\forall X, X⊕X=0$.
Nov
1
comment AES— Brute force attack versus Known plain text attack
Please try using $\TeX$ as I have done for and shown to you (nicely writing a formula helps, at least me, in understanding what it conveys); and refrain from dumping homework (sometime basic) without a convincing indication that you tried to solve it.
Nov
1
comment How can a good pseudo-random number generator be made?
Depends on goals. $\;$ For conformance to industry standards and speed on modern CPUs with AES in hardware, the AES-CTR recommendation of that answer is good. $\;$ For performance or security in other CPUs, I like the first comment. $\;$ For a CSPRNG with internals suitable for visualization, I would consider Trivium.
Nov
1
comment How can a good pseudo-random number generator be made?
The question mentions use in a synchronous stream cipher, and interschool science competition; this, and topicality on Crypto.SE, implies cryptographic considerations matter. By the answer's admission, it rules out the Mersenne Twister.
Nov
1
comment Security of RSA with $\gcd(pq, (p-1)(q-1))\ne 1$
I'm truly glad that you have found and explained me another way to find $p$ given $k$, which is original, very interesting, and perhaps could be useful in some way!
Nov
1
comment Security of RSA with $\gcd(pq, (p-1)(q-1))\ne 1$
Kudos for the number-theoretic method to find $p$ given $k$; I only considered solving for $p$ the second-degree equation: $k⋅p^2+p=n$, perhaps just as $p=\lfloor\sqrt{n/k}\rfloor$ followed by a check that this divides $n$. $\;$ I agree with everything except perhaps the sentence ending in security is at least questionable; I really don't know for sure!
Oct
30
comment Public key encryption without ciphertext expansion
By a counting argument, strictly non-expanding public-key encryption is bound to be deterministic, hence vulnerable to verification of a successful guess of the plaintext. So at least, it is not applicable to encryption of small or otherwise guessable fields, such as gender, or first name. For the rest, follow Ricky Demer's link.
Oct
30
comment About the Algebraic Normal Form (ANF) of S-Box in DES
KP stands for Known Plaintext(/Ciphertext pairs); the more are available to an attacker, the easier are the attacks. $\;$ XL is eXtended Linearization as discussed here. $\;$ XLS stands for eXtended Sparse Linearization. $\;$ I can't discuss these in a comment about a largely unrelated question.
Oct
29
comment What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
@Ruggero: I have added reference to your question, and quote that I interpret as suggesting the attack(s) do not apply to protocols doing straight ECDH; I'm seeking clarification of this.
Oct
29
comment About the Algebraic Normal Form (ANF) of S-Box in DES
If you are interested in most compact algebraic representations of DES S-boxes (which is not stated in the question, and why I made a comment rather than an answer), the best result is reportedly in the source code of john-the-ripper, I believe buried in the macros S1..S8 in john-1.8.0.tar.gz.tar file src/x86-64.S.
Oct
29
comment About the Algebraic Normal Form (ANF) of S-Box in DES
Compact representation of DES S-boxes indeed has been studied, starting (AFAIK) with Eli Biham's A fast new DES implementation in software (1997, in proceedings of the fourth FSE conference). See also Matthew Kwan's website and paper Reducing the Gate Count of Bitslice DES (2000, IACR eprint archive). I can't tell how the form in the question ranks.