# fgrieu

Paris, France

I'm an engineer with experience in applied cryptography, in particular in Smart Card systems.

 2h comment Slow one-way pseudorandom permutation?@D.W.: The output has to be both short, so as to be human-enterable (as a backup) after being computed by a mobile app; and collision free with high likelihood for many inputs; see the original goals which I now hope to fulfill using the method in this question. Some of the problem is that the cards have already been issued with a certain serial number, but regulatory reasons prevent to store/reuse that serial number for other purposes than the original one, and I need to transform it into another identifier, with the transformation one-way. 4h revised Slow one-way pseudorandom permutation?Adjest name per sugestion 4h comment Slow one-way pseudorandom permutation?@Ricky Demer: sold! 8h comment Why are these techniques not feasible to crack RSA?I vote to close the question as is, for: The question shows a lack of research; $d = 1/(e \operatorname{mod} \phi(n))$ does not make sense; there is not the slightest reasoning to support the bold assertion "With having $e$ and $n$, we can calculate the value of $d$"; and "factoring $d$" makes no sense. 10h comment Slow one-way pseudorandom permutation?@Dmitry Khovratovich: Several problems with that later option. (A) Some $S||R_S$ (or $Q_S$) will be dynamically added during the life of the system, after the various $K$ and $N$ have been chosen. (B) If encryption is slow, then $2^{32}$ encryptions to choose $K$ and $N$ is impractical. (C) When $s$ is above $b/2$ (former $d/2$), working $K$ and $N$ become a rarity. 10h comment Slow one-way pseudorandom permutation?@Dmitry Khovratovich: solving this reformulated, simpler question solves the former question, with perfect match of former (4), and the novelty that I explicitly want tunable encryption effort, and would like a memory size parameter in that. I'd also like assurance that the trapdoor has some argument/proof/prior research. 11h revised RSA performanceSimplify and polish 11h asked Slow one-way pseudorandom permutation? 1d revised Keyed digest function with odds of collision below the birthday bound?Generalize (2); the single answer so far still holds 1d comment Keyed digest function with odds of collision below the birthday bound?@Dmitry Khovratovich. A detail: shouldn't your $\left(X^{2^k}+X+a\right)^{-l}+X$ be $\left(X^{2^k}+X+a\right)^s+X$? 1d comment Keyed digest function with odds of collision below the birthday bound?@Dmitry Khovratovich: very nice suggestion. It seems to work fine when $s+r\le d$, which is close enough to my setup. That's provided the $P$ (or family of $P$) that you suggest really is markedly harder to invert than to compute. If see something like $F(K,S,R_S) = E_{K_n}(P_{n-1}(..(P_1(E_{K_1}(P_0(E_{K_0}(S||R_S)))))..))$ where we adjust $n$ to match the delay desired in (1), and the $K_j$ are derived from $K$. 1d comment Keyed digest function with odds of collision below the birthday bound?@RickyDemer: good catch, but easily fixed in the context, where we can use $F(K,S,R_S) = E_{K_2}(P(E_{K_1}(S,R_S)))$, where $K_1$ and $K_2$ are different extracts of $K$. 2d comment Keyed digest function with odds of collision below the birthday bound?@Richie Frame: I can't increase the size of $S$ or the entropy $r$ in $R_S$; these are pre-existing and beyond my control. 2d comment Keyed digest function with odds of collision below the birthday bound?@poncho, to answer your question more precisely: my $R_S$ (or what it is derived from) is pre-existing and thus beyond my control: actually I have a very biased $Q_S$ with $r$ bits of entropy, that I model as a uniformly random $R_S$, perhaps obtained by hashing $Q_S$. $R_S$ is essentially random, for each $S$. In the context of (3), $Q_S$ or $R_S$ is not known by the adversary. The threat/adversaries in (2) and (3) are not the same. 2d comment Keyed digest function with odds of collision below the birthday bound?@figlesquidge: $E_k(H(S||R_S))$ does not meet goal (4), for it has odds of collision equal to the birthday bound. 2d revised RSA performanceClarify 2d revised RSA performanceAnswer comment Dec 3 revised Keyed digest function with odds of collision below the birthday bound?re-polish Dec 3 comment Keyed digest function with odds of collision below the birthday bound?@figlesquidge: tried to address the issue with a change of title, making it clear we want low odds of collision Dec 3 revised Keyed digest function with odds of collision below the birthday bound?improve title