20,345 reputation
12787
bio website
location Paris, France
age
visits member for 3 years, 2 months
seen 10 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Oct
8
comment RSA given q, p and e?
Additional hint: watch for a striking regularity in the decimal expression of the plaintext.
Oct
7
comment Is there a string that's hash is equal to itself?
@e-sushi: I tried to answer the PHP == case, but fail to find what "allows a simple if(md5($str)===$str){echo("Oops, found one: ".$str);}", even if I change this to if(md5($str)==$str)
Oct
6
comment Is there a string that's hash is equal to itself?
@Thomas: Right, but time and my answer have obsoleted your use of both in your comment :-)
Oct
6
comment Is there a string that's hash is equal to itself?
I think that the argument about left bit rotation making a solution impossible for MD5 is plain wrong.
Oct
3
comment Has there been any cryptanalysis of AES under a non-uniformly distributed key?
@Seth: If my understanding is correct, even in the hypothesis you describe, we do not know an attack better than brute force; and that holds even if we allow the attacker to define how the key is expanded (without loss of entropy). I'm not sure of that, but still turned it into a tentative answer.
Oct
2
comment How did the power measurements translate to AES Key?
It may help to read Paul Kocher, Joshua Jaffe, Benjamin Jun, Pankaj Rohatgi's Introduction to differential power analysis, in Journal of Cryptographic Engineering (2011).
Oct
2
comment Strength of MD5 in finding duplicate files
In addition: for file de-duplication, we can use MD5 with a secret initial state (or equivalently a 32-byte prefix to the hashed file) drawn randomly at initialization of the de-duplication utility. Now, despite MD5 known weaknesses, one not knowing the secret can't prepare two different files with the same hash. $\;$ Note: if the adversary could examine the hashes, it is better to use full-blown HMAC-MD5, which is nearly as efficient.
Oct
2
comment How does Blowfish avoid successful cryptanalysis?
@owlstead: Can you give reference? I am not aware of attacks on the Blowfish algorithm (rather than: implementations thereof) which would represent a sizable threat in any semi-realistic use case. For example, I can't imagine an attacker exploiting Orhun Kara and Cevat Manap's A New Class of Weak Keys for Blowfish (in proceedings of FSE 2007). I'm rather on the impression that Blowfish is a rather fine cipher except for having a 64-bit block, lack of key agility, relatively high RAM usage, and significant hardware footprint.
Oct
1
comment Small Encryption Exponent
The actual statement (see Problem 2) does not hint that padding or small exponent are relevant, so I guess Poncho hinted to the expected resolution path. $\;$ Notice that this homework is not quite past its due date + allowance; please do not post a solution before that.
Sep
30
comment Why should CAST5 and 3DES not be used for encrypting files over 4GB?
When using a 64-bit cipher in CBC mode, odds of collision after 4GiB ($k=2^{29}$ blocks) are $ϵ≈2^{65}/k^2=1/2^7=1/128$ (given that $1≪k≪2^{32}$). That's $ϵ≈1/148$ for 4GB, $ϵ≈1/8192$ for 4Gib, $ϵ≈1/9445$ for 4Gb [Reposted with fix and the whole four possible units that could be meant].
Sep
30
comment Message encrypted with a LFSR based stream cipher
@J0ker: what is meant is that for all integers $n\ge0$, the equation $x_{(n+3)} = x_{(n+2)} \oplus x_n$ holds, where $\oplus$ is exclusive-OR. You are given $x_0$, $x_1$, $x_2$, and can compute $x_3$ (with $n=0$), $x_4$ (with $n=1$), and so on, up to $x_{15}$, which is the last used term of the LFSR output (also the key of the pseudo-OTP, which really is a stream cipher).
Sep
29
comment Message encrypted with a LFSR based stream cipher
@J0ker: Yes: now you can compute the $x_i$, with $i$ from 0 to 15, which in your problem forms the output of the LFSR, which also is the key of the (pseudo) OTP. Then you can decipher the given ciphertext as you would for a regular OTP, yielding the plaintext. That's basically what you are told by mczraf in that answer.
Sep
29
comment Message encrypted with a LFSR based stream cipher
Hints: contrary to historical practice in telecommunication, assume big-endian convention when converting a sequence of 8 bits to ASCII (that is: 01001010 is \$4A thus J, not \$52 thus R). $\;$ The message itself could be understood as a provocative invitation.
Sep
29
comment Message encrypted with a LFSR based stream cipher
Likely one should read $x_{n+3} = x_{n+2} + x_n$ for $n≥0$; with the original $n≥3$ there was no way to infer $x_3$, $x_4$, $x_5$. I took the liberty to fix it.
Sep
28
comment Simpler proof of RSA's correctness
You can do without the CRT; see this answer.
Sep
24
comment Montgomery Multiplication in FPGA explanation
Perhaps a link to the document where the Montgomery Multiplication is pretty clear would help. Edit the question, select that fragment, Ctrl-L, paste link will do the trick. $\;$ As to the question: $x\bmod 2$ is the low-order bit of the binary representation of $x$; while $x\div 2$ is $x$ with that bit removed (in the context).
Sep
23
comment Is there any area where AES-CBC cannot be used ? If so, why ?
Hint: consider a large encrypted file, of which a small fraction needs to be updated.
Sep
22
comment Are there other digital certificate formats than X.509?
by any chance, do you know what European regulation (or other spec) defines the CVCs in those European passports that hold one?
Sep
19
comment Is it possible (how difficult) to find MORE than one valid RSA signature?
The answer depends on if A) signatures verifiable by different public keys count; B) the scheme is deterministic [e.g. ISO/IEC 9796-2 methods 1 and 3] or not; C) access to the private key function $x\to x^d\bmod N$ is available; D) details in the verifier definition/implementation, e.g. is $S+N$ just as valid as $S$.
Sep
18
comment What is the length of an RSA signature?
In some RSA variants, including ISO/IEC 9796-2 (with total message recovery, and the "Signature production function" rather than the more common "Alternative signature production function"), the signature is a bit string of $\lceil\log_2N\rceil-1$ bits, corresponding to (the big-endian encoding of) an integer between $1$ and $(N−3)/2$: that is $\min\big(J^s\bmod N,N-(J^s\bmod N)\big)$ where $J$ is a function of the message to sign and parameters.