29,153 reputation
453109
bio website bolet.org/~pornin
location Quebec City, Canada
age 38
visits member for 2 years, 9 months
seen 12 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


14h
comment Use cases for CMAC vs. HMAC?
Beware: MD hash functions like SHA-1 are built out of a block cipher, but with the data as key, which apparently allows for better bandwidth. At least we can empirically notice that the SHA-3 competition yielded algorithms which are quite faster than all AES candidates on the same hardware. Even AES-based SHA-3 candidates (e.g. ECHO) turned out to be quite faster than AES itself on the same machine.
16h
answered Burn after read algorythm. Software verification on compromised environment. Software smart card
18h
answered “Fine grain Cross-VM Attacks on Xen and VMware are possible” and OpenSSL 0.9.7
19h
answered Use cases for CMAC vs. HMAC?
22h
reviewed Approve suggested edit on heartbleed tag wiki
22h
reviewed Approve suggested edit on heartbleed tag wiki excerpt
Apr
19
answered Is there a reason that the N value in scrypt is limited to powers of two?
Apr
15
comment Can ECDSA signatures be safely made “deterministic”?
RFC are immutable; once published they never change.
Apr
14
awarded  Nice Answer
Apr
14
awarded  diffie-hellman
Apr
13
comment Perfect Forward Secrecy in TLS
The "RSA" in "DH-RSA" qualifies the public key of the CA which issued the server's certificate. From the point of view of the client, a "DH-RSA" cipher suite means: "I want the server to have a certificate with a DH public key, and I am ready to use RSA to validate that certificate". This was supposed to be used in case a server had several DH certificates, signed with either RSA-based or DSA-based CA: the server would then choose the certificate for which the client had relevant support. This has never worked well in practice (but everybody does RSA anyway).
Apr
13
answered Perfect Forward Secrecy in TLS
Apr
12
answered Is there an algorithm to check if an elliptic curve is secure?
Apr
10
awarded  Nice Answer
Apr
5
answered Wrong Test Vector for HKDF with HMAC-SHA256
Apr
3
comment Should we MAC-then-encrypt or encrypt-then-MAC?
@Clément: the confusion comes from the widespread (but wrong) habit of calling MAC "signatures". In fact MAC and signatures are very different things used in very different contexts. Sign-then-encrypt protocols also use a distinct encryption key for each message, which nullifies all padding oracle attacks; and the signature is meant to serve as proof (e.g. in a trial), so it MUST be applied on the plaintext message. In MAC+encrypt contexts, the same symmetric key is often reused, and there is no "proof" requirement.
Apr
2
reviewed Approve suggested edit on double-encryption tag wiki excerpt
Apr
2
reviewed Approve suggested edit on double-encryption tag wiki
Mar
30
answered How is the curve equation used in ECC?
Mar
28
answered Alert protocol in TLS