meta user
network profile
| bio | website | bolet.org/~pornin |
|---|---|---|
| location | Quebec City, Canada | |
| age | 37 | |
| visits | member for | 1 year, 10 months |
| seen | 14 hours ago | |
| stats | profile views | 284 |
Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.
|
May 1 |
answered | Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash? |
|
Apr 27 |
awarded | Good Answer |
|
Apr 25 |
reviewed | Approve suggested edit on Tamper-proofing log files |
|
Apr 25 |
comment |
Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme @RickyDemer: TWIRL is only for the sieving step. The page claims that the sieving step is the most expensive half of factorization, which, as far as I know, is true for 512-bit integers, but quite false for 1024-bit integers. There is a paper which estimates the cost of designing then building the machine for the linear algebra step, which claims to be "under 2 millions of dollars" which I frankly don't really believe. |
|
Apr 23 |
answered | Are cryptographic hash functions perfect hash functions? |
|
Apr 23 |
answered | Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme |
|
Apr 15 |
answered | Correct way to map random number to defined range? |
|
Apr 11 |
awarded | Good Answer |
|
Apr 5 |
comment |
DSA signatures with related k and unknown payloads But hash values are not uniform modulo q; there is a slight bias (in standard DSA, the hash value is first truncated to the bit length of q, then reduced modulo q). Bleichenbacher found an attack when k is chosen with such a bias (works with 2^63 known message/signature pairs for a 160-bit q, if I remember correctly). I would not be surprised if there was a similar attack in this case. |
|
Mar 30 |
answered | Client and server using same SSL certificate - any issues? |
|
Mar 30 |
comment |
How do I unpack the x and y values from the BITSTRING in a DER ECDSA public key? Public keys are always BIT STRING in X.509; this is an historical remnant from older times, kept for the sake of backward compatibility. |
|
Mar 28 |
answered | Why are RSA key sizes almost always a power of two? |
|
Mar 25 |
comment |
How to use HMAC for large ciphertexts over TLS And also each HMAC is computed over the concatenation of the record data and a record sequence number, so that attackers may not drop, replay or reorder individual records. |
|
Mar 22 |
answered | Could a very long password theoretically eliminate the need for a slow hash? |
|
Mar 20 |
answered | Cracking an RSA with no padding and very small e |
|
Mar 18 |
answered | Efficient algorithm for remainder calculation over prime field for ECC implementation? |
|
Mar 12 |
awarded | Good Answer |
|
Mar 3 |
comment |
Why is elliptic curve cryptography not widely used, compared to RSA? That's because the operation is not exactly the same. With RSA, signature verification uses the public exponent, which can be very short (with RSA, the public exponent typical length is 16 bits, while the privat exponent is as large as the modulus). This gives a huge boost to public key operations in RSA. There's no analog with elliptic curves. |
|
Mar 3 |
comment |
Why is elliptic curve cryptography not widely used, compared to RSA? @curious: I can quote myself. But you can also make benchmarks (with OpenSSL, try openssl speed rsa2048 ecdsap224). |
|
Mar 2 |
answered | Can SRP be used with Elliptic Curves? |
