21,585 reputation
12990
bio website
location Paris, France
age
visits member for 3 years, 3 months
seen 4 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Nov
19
comment Is there a way to systematically calculate the public exponent $e$ in RSA?
You means $40 = 2^3\cdot5$. This method involves factoring $p-1$ and $q-1$ (and choosing a small odd factor not appearing in this factorization). By hand, this is utterly impractical for even moderate $p$ and $q$. Try it with $p=14627, q=15959$. Then compare to the method I'll add in my giant answer.
Nov
19
comment Where have all the cypherpunks gone?
@Nils Pipenbrinck: yes, but the traffic on sci.crypt (URL: news:sci.crypt or news//:sci.crypt ) has lowered, and I now seldom read something interesting. I am 100% bought by the editing capabilities and relatively high quality of the material we get here. My main fear is about long-term archival, but that's for meta.
Nov
18
comment Malicious DH groups
It is not clear if you want $p$ to be a 2048-bit safe prime (meaning $q=(p-1)/2$ is 2047-bit prime); or $p$ to be prime with $p-1$ divisible by a much smaller prime $q$ of specified size, e.g. 256-bit. The two are exclusive. In either case, the question is interesting, and I can't answer. $\;$ Also, it might not be quite the same to be able to solve the DLP, and break some protocol that is no safer than the DLP is.
Nov
18
comment special public keys and modulo n
@ChesterL: For 1, enumerate your knowns (I count 5 of them) and unknown, and what relations you have between these. Then notice that if you know $x^i\bmod n$, $x^j\bmod n$, and $n,i,j$, then you can efficiently compute $x^{a\cdot i+b\cdot j}\bmod n$ for any integers $a$ and $b$, including negative. $\;$ You might want to write down an answer to your own question.
Nov
18
comment special public keys and modulo n
@ChesterL: In 1, you are talking about textbook RSA (also discussed here), where the plaintext is enciphered without prior transformation. In RSA as actually used, random padding is used, see PKCS#1; among many other things, its guards against what you are tasked to find. $\;$ In 2, you are talking about multi-prime RSA.
Nov
17
comment Key generation in Digital Signature Algorithm
One issue with the proposed algorithm is that the $p$ generated will often be $3071$- bit rather than $3072$-bit, a stated requirement. Also, as pointed by Henrick Hellström, if you want DSA per the U.S. Department of Commerce's book, then appendix A.1 is a must; also, following that procedure ensures the parameters are not cooked in some way; $p$ and $q$ essentially become nothing-up-my-sleeve‌​.
Nov
17
comment Why we can't implement AES 512 key size?
@Richie Frame: yes; on the other hand, odds of collisions for 100 billion devices each doing a million sessions are less than one in 68000; and good luck to detect (much less exploit) that device 12345678901 used the same key in its 654321th session as device 23456789012 did in its 765432th session; something tells me there are more serious threats lurking.
Nov
16
comment Block cipher to encrypt 8 bytes/64 bits - Use 64 or 128 bit cipher?
If you use a block cipher in ECB mode, the same plaintext will always lead to the same ciphertext, allowing to detect if the same plaintext is sent twice, which is against the security goals assigned to a cipher, and why good block ciphers operating modes use IVs. $\;$ Also: it would not be the first time when "requested to encrypt" should be understood as also requested to protect against malicious alteration. $\;$ Before choosing the block size of the cipher, find your goals, and what cipher or/and MAC or/and authenticated encryption you want to use.
Nov
16
comment What is the most computationally efficient way of generating pseudo-random permutations?
@user44353: You have found my intend! I fixed the typos that you kindly pointed. I'll provide a reference implementation in C and test values when time allows.
Nov
15
comment Why we can't implement AES 512 key size?
I have edited the answer to tone down the appreciation of AES-128 security. Still, if we re-key AES-128 every millisecond for thirty years, that's less than $2^{40}$ keys, and odds of hitting the same key twice are less than $2^{-49}$, an acceptable risk. However, if the same known plaintext gets enciphered with every key (as in CTR mode with zero rather than random IV), odds of finding one of the key with $2^{80}$ encryptions and searches in 16TB of data are $2^{-7}$, slightly worrying.
Nov
14
comment Why we can't implement AES 512 key size?
The paper that you found is vacuous to the point of being funny. The reference to an "ISO 3297:2007 Certified Organization" should act as a snake-oil warning, for this standard only defines the numbering of publications.
Nov
14
comment How can CBC-MAC be secure when message length is fixed?
The title of the question looks wrong to me; nearest logical substitute: How can CBC-MAC be secure only when message length is fixed?
Nov
13
comment Strange MAC algorithm
Somewhat related to this question. $\;$ Independently: knowing MD5(k||m) allows computing MD5(k||m||m'||m") for m' a certain known function of m and the length of k (with m' at least 9 bytes or 65 bits), and freely chosen m".
Nov
13
comment AES with weak keys
Yes. An easy statistical calculation shows that if for $j$ increasing from $0$ to $13$ we try the $128!/(128-j)!/j!$ keys with $j$ zero bits and $128-j$ one bits (using encryption of some known plaintext), we'll find a key with odds about $59.6\%$, and less than $2^{57.8}$ AES encryptions. With $j$ up to $8$, our chances to find a key are still a fair $9.7\%$, with effort less than $2^{40.5}$ encryptions. With $j$ up to $5$, $0.93\%$, with effort less than $2^{28.1}$.
Nov
12
comment Permutation parity after cycle-walking
@poncho: You are absolutely right! I misinterpreted the argument given in that answer into the (incorrect): any reversible transformation leaving at least 1 bit of the state unchanged is even. What's correct is: any transformation leaving at least 1 bit of the state unchanged and without influence on the other bits is even.
Nov
12
comment Permutation parity after cycle-walking
@poncho: I think you mean addition of a key as wide as the state, which does give balanced parity. Replacing XOR with modular addition in the combination of the round function output and half state does not.
Nov
11
comment How to perform frequency analysis of a substitution cipher using a Base64 alphabet
[Revised] Hint: How many letters, when present as first (resp. third, fourth, sixth) position of the plaintext generate a U (resp. O R S) in first (resp. fourth, fifth, eighth) position of the Base64? How does the expected frequency of letters in plaintext translate to expect frequency in first, fourth.. (resp third, sixth..) letter of the Base64? What about digrams in third and fourth, sixth and seventh.. position in plaintext and relation to digrams in fourth and fiveth, eighth and nineth.. position in the Base64?
Nov
11
comment How to perform frequency analysis of a substitution cipher using a Base64 alphabet
Note: UlVORk9SWU9VUkxJRkU= can't lead to k9U9VUJx=RWUOSkVUklR by character substitution. For example, the four U in the original are substituted with the different k, R, Oand l.
Nov
11
comment How big an RSA key is considered secure today?
@j.p. My article is about academic factorization records, and predates the article that you quote, which AFAIK did not lead to actual and public implementations. But yes, I will mention it.
Nov
11
comment How big an RSA key is considered secure today?
@Lembik: the curve would grow faster than linear (but, at least in the 2000 region, slower than what I show).