23,688 reputation
23198
bio website
location Paris, France
age
visits member for 3 years, 7 months
seen 47 mins ago

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.


Feb
10
comment Prime modulus for RSA and sharing a secret?
You might be interested in Mental Poker which is similar, and states that the modulus used can be of known factorization, including prime.
Feb
7
comment How hard is it to find plaintexts whose hashes satisfy $h(a)\oplus h(b)=h(c)$?
@Hyperflame: Ah, I now see what you mean. I have changed the answer to clarify that I meant cost in units of work for a hash, and added discussion of number of (queries to an oracle implementing the) hash for an infinitely powerful adversary.
Feb
6
comment How hard is it to find plaintexts whose hashes satisfy $h(a)\oplus h(b)=h(c)$?
@Hyperflame: see first paragraph in the second part of the updated answer.
Feb
5
comment Counter Mode with a sequence of zeros bits plaintext, is it secure?
I'm at loss as to why you have both nounce and IV. $\;$ Hint: when applying whatever general formula involving variables without index ($C$, $M$, $K$, $IV$), to variables with index ($C_j$, $M_j$,..), it is crucial to think carefully for each variable if it should get an index or not.
Feb
5
comment Counter Mode with a sequence of zeros bits plaintext, is it secure?
It is necessary, but not quite sufficient, that $IV_1\ne IV_2$. For example, $IV_2=IV_1+1$ reveals $M_1$ except for its first 128 bits (assuming $M_1$ and $M_2$ are at least 128-bit). What's wanted is that the counter ranges used in the two encryptions do not overlap. Here we are told that "The IVs are independently generated", thus this situation holds with high odds, for reasonably sized messages.
Feb
4
comment How fast would a polynomial time factoring algorithm compute?
Suggestions: "what we're saying is that, as we give the algorithm increasingly large inputs, the time it takes doesn't increase more quickly than some limit. $\;$ Perhaps also, change $N$ to $n$ and $e$ to $k$ as this is more consistent with standard notation in an RSA context.
Feb
4
comment Who first published the interest of more than two prime factors in RSA?
@Robert NACIRI: I now have put the correct first name (my mistake, JJQ had given me the correct one, and details about how an early version of the paper, not published, mentioned more than two factors). $\;$ I concur with you that the interest of RSA with 3 factors as a speedup technique was known by those who cared to listen or think in 1995, perhaps earlier; but the question asks: who first published on that subject, turning that secret de polichinelle into public knowledge?
Jan
27
comment Is signing a message just encrypting it with private key?
No, proper RSA signing of a text is not as simple applying the private-key function to the (hash of a) text ("encrypting a text with private key" as questionably worded in the question). $\;$ That is not safe for many definitions of safe, including most ones used in cryptography. $\;$ For an introduction to that, see the second part of this answer, and the final reference.
Jan
24
comment Finding strong primes
Are you sure of the PKCS reference? The definition of strong prime that you give is not in PKCS#1 (at least, the current version), which would seem to be the logical place. $\;$ Also, it is quite feasible to generate a prime $p$ such that $(p-1)/2$ and $(p+1)/2$ are primes (the trick is to use a sieve of width a few times $(\log p)^3$ to keep only candidates for $p$ such that any of $p$, $(p-1)/2$ and $(p+1)/2$ are divisible by small primes; then apply a probabilistic primality test).
Jan
22
comment Why the data length is shifted 3-bit in MD4 Java implementation?
This is a basic Computer Science question, unrelated to cryptography. The left shift by 3 converts the length in octets previously accumulated by the Java code into the length in bits prescribed by the quoted text of RFC 1320, in order to form the padding.
Jan
21
comment Practical Attack on RSA
Yes, much like for yogurt.
Jan
21
comment Practical Attack on RSA
My point is that "such key length will be vulnerable at about that time" (as in "estimate for how many years a given keylength may last you", what this is about) is very different from "use that key length and you should be okay" (a safe recommendation, what keylength is about).
Jan
21
comment Practical Attack on RSA
keylength does NOT "try to estimate for how many years a given keylength may last you". Rather, it is about estimating what key length is appropriate so that one can be next to certain that at some prescribed date, brute-forcing a public key will fail (or, equivalently, about selecting a key length that conforms to prescribed standards with that aim). The former is about a best guess, the second is all about being conservative. $\;$ A decision maker has use of the former when evaluating a non-critical legacy system, and of the later for a new system.
Jan
21
comment Practical Attack on RSA
@Nayef: 768 bits was the academic factoring record by the end of 2009, and that might translate to perhaps 900 to 1000 bits nowadays (with comparable effort for some meaning of that). Where you put the bar of a "practical attack" is a matter of policy, and what risks and facts there are to consider (like, feasibility of changing an already deployed system).
Jan
20
comment Practical Attack on RSA
Check this for practical brute force attacks versus key size. $\;$ Practical attacks often are independent of key size; like, abusing a certification authority, or hacking into a computer that can use a secure device that holds the key.
Jan
16
comment How does bitmessage encryption work?
Relevant but very short on details: Jonathan Warren's Bitmessage: A Peer‐to‐Peer Message Authentication and Delivery System. $\;$ Current "official" protocol specification, but actual spec seems to be the code. $\;$ A (somewhat dated but still relevant) critic.
Jan
14
comment Factors of RSA modulus
Is there a simple proof that at least 3/4 of the possible $m$ values will result in a factorization?
Jan
13
comment The perfect way of using IV in CTR mode
A perfect way to send the IV is in clear before the ciphertext. Why use anything more complex?
Jan
9
comment Are there any known inverse hash lookups for the zero string?
This would be a first-preimage attack; I'm quite positive that we do not know a numerical answer for either MD5 or SHA-1, and I'm not aware of one for MD2 or MD4 (although there are theoretical preimage attacks on these hashes).
Jan
7
comment Sophie Germain primes and safe primes
@Tito: I (and most on this website) would rather not give direct answer to what could be homework. $\;$ Beside, you ask for 2048 and 4096-bit Sophie Germain primes in you last comment, versus 2047 and 4095-bit in the question (given that the size stated in the question is for the safe prime); so I'm sure neither of if you ask specific values for a legitimate reason, and exactly what bit size they should have.