16,773 reputation
12266
bio website
location Paris, France
age
visits member for 2 years, 8 months
seen 15 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Mar
31
comment How is the curve equation used in ECC?
Thomas Pornin's related answer might also be of interest.
Mar
31
comment Testing hardware random number generators?
A related answer.
Mar
29
comment How is the curve equation used in ECC?
You want info on Elliptic Curve Cryptography (not cryptology); let me Google that for you.
Mar
29
comment Cryptographic system with double keys with reversible order
@modchan: I found the name (and updated the answer). See also that answer for another suitable algorithm (SRA, which is about the same with $p$ replaced by $n$ of factorization shared between the parties).
Mar
28
comment Is differential calculus related to RSA?
A good reason why the simple answer is no (to the question): calculus is about mostly continuous functions, when cryptography deals with discrete function only.
Mar
28
comment Does repeated hashing create a PRF?
What's described is not a function (or a family of functions), for there is nothing suggesting what the input of this function would be (we must also guess for the output). With no proper function, there's no Pseudo Random Function (Familly). IF we define that missing input to be the iteration index, use the full hash as output, and make the initial value what parameterizes the PRF, the question is answerable (and answered in the first comment). If we define the output to be a subset of the full hash (assumed a PRF), we might get a PRF (depending on width of input, output, and hash).
Mar
27
comment If PGP and GPG both follow the OpenPGP standard, are they 100% compatible in all use cases?
There are several other subtle hurdles, including: not-so-old-and-still-around versions of GPG insist to require installation of a plugin to handle the IDEA block cipher, required for compatibility with cryptograms generated by PGP when old-format keys are used with default (or at least common) options. Fortunately, the IDEA patent has expired and GPG (starting end of 2012) comes with IDEA built-in.
Mar
27
comment Near preimages, applicable to Bitcoin?
Actually, Bitcoin mining seems closer to requiring to find $X$ such that $\text{SHA-256}(\text{SHA-256}(X))<\text{target}$ (I have the details fuzzy); so the function to attack is not $\text{SHA-256}$, but rather $\text{SHA-256}^2$. In any case, I know no attack, even theoretical, on even (full) $\text{SHA-256}$.
Mar
24
comment Is it true that for RSA with no padding, the length of data must be equal to the length of key?
@user3100783: I only partially agree: even without padding, when enciphering a random bit string of $n-1$ bits, the plaintext can be changed in predictable ways because of unpadded RSA's malleability only in very specific ways, related to the multiplicative properties of RSA; it is not like the adversary can change a bit here or there by messing with the ciphertext. We can build use cases where it is better for the adversary to take advantage of the genuine RSA ciphertext, than it is to craft another one from scratch (with fully chosen plaintext), but they tend to be artificial.
Mar
24
comment Is it true that for RSA with no padding, the length of data must be equal to the length of key?
@user3100783: The padding check will fail if the enciphered data has been accidentally modified (with overwhelming odds for RSAES-OAEP, still quite likely for RSAES-PKCS1-v1_5). But that's NOT a security feature! One who wants to alter the enciphered data without being detected can do it trivially (just encipher whatever you want the deciphered thing to be); remember the adversary knows anything public, thus including the public key!
Mar
24
comment How secure is the AES master key if Round Keys are found
This looks like homework, that's why I let you find the answer. Hint: Examine how the round keys are computed from the master key. Also, check how hardware implementations find the round keys during decryption. Read the rationale for AES, section 7.5.
Mar
24
comment Generating Random Primes
Here is an approach to select a random prime nearly free of bias. Say that for some $a,b$ with $2≤a≪b$ we want a random prime $p$ with $a≤p<b$. Pick a random $s$ with $0<s<b-a$ until $\gcd(s,b-a)=1$. Pick a random $t$ with $0≤t<b-a$. Use for $p$ the first prime among the $p_i=(i⋅s+t)\bmod(b-a)+a$. Simple variants can be made to select prime $p$ such that $p-1$ has a big known prime factor $s$, or/and such that $p+1$ has another big known prime factor, see e.g. FIPS 186-4 section B.3.6.
Mar
24
comment Entropy when iterating cryptographic hash functions
@StephenTouset: Or, more simply said: truncating the output of a PRF yields a PRF. Notice that as worded now, the question truncates the output of SHA-256, at each use, effectively building a 128-bit hash. Initially, the question truncated the input of SHA-256. There is a simple reduction form the initial question to the current one: first truncation reduces to 128 bit of entropy, then there are a number of 128-bit hashes, then a final SHA-256 that is almost entropy-preserving.
Mar
21
comment SHA-224 Purpose
@ntkskml: I frown at not vulnerable: the adversary trying an obvious modification of a length extension attack has odds of success $n/2^{32}$ with $n$ attempts.
Mar
21
comment SHA-224 Purpose
@TruthSerum: No! Half the length of a 3DES key would be 96 or 84 bit, depending on if you count parity or not. It is more like 224 is twice the the base-two logarithm of an estimation of the number of operations in the best known attack for 3DES, assuming unlimited memory.
Mar
21
comment What is difference among eavesdropper attack, multiple message attack and CPA attack?
@figlesquidge: The answer you point does not cover the distinction between eavesdropper attack and multiple messages attack (or even mention these terms), at least for the sense I suggest for that in my answer (single versus multiple use of key). Also the definition given there for Known Ciphertext Attack does not match any standard game (that I know), which clearly is the context of the question; and for sure it does not match the game in the question, where the adversary chooses the plaintexts of the eavesdropper attack.
Mar
21
comment Why is DDH not hard over $\mathbb{Z}^*_p$?
If the question is: " Why is Diffie-Hellman key exchange not hard over $\mathbb{Z}^{*}_p$ ? ", hint: Check what your definition for hard asks for the expected cost of attack as a function of $\log p$, and the expected running time of algorithms to solve the DLP, such as Index calculus and GNFS.
Mar
21
comment Why is DDH not hard over $\mathbb{Z}^*_p$?
@user2771151: My reading is that the title and body of the question do not match! A distinguisher for the Decisional Diffie–Hellman problem over $\mathbb{Z}^*_p$ can be built from DrLecter's remark, but that does not break Diffie-Hellman key exchange over $\mathbb{Z}^*_p$, especially if $(p-1)/2$ is prime and $p$ is wide enough (thousands bits).
Mar
21
comment Entropy when iterating cryptographic hash functions
I asked the question on math.se, with reference to this answer.
Mar
20
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
HMAC_SHA256(message,key) has a security proof; we do not have a ready-made one for SHA256(key1+message+key2). That's quite an argument. That said, for reasons similar to HMAC_SHA256, SHA256(key1+message+key2) intuitively seems quite strong: there's a key1 initially, making collision hard; then a final key2, further increasing security. However the lack of alignment to block boundary in SHA256(key1+message+key2) makes it quite hard to devise a proof.