32,806 reputation
565127
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years, 4 months
seen 1 hour ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Nov
14
answered How many of primitive point on the elliptic curve?
Nov
14
awarded  Enlightened
Nov
14
awarded  Nice Answer
Nov
13
awarded  Enlightened
Nov
13
awarded  Nice Answer
Nov
6
answered Zero Knowledge Example using discrete log
Nov
5
awarded  Enlightened
Nov
5
awarded  Nice Answer
Nov
2
revised Openssl & RSA : how many public exponents are possible?
added 1826 characters in body
Nov
2
comment Openssl & RSA : how many public exponents are possible?
@owlstead: if you use RSA without a proper padding procedure, then it is malleable, and this is easier to exploit if $e$ is small. However, the issue there is not a small $e$, but lack of proper padding.
Oct
24
comment AES-GCM Disadvantage
One may add a performance issue: the not-too-slow implementations of GCM use tables that exhaust L1 caches on small architectures (like the 32-bit Mips found in cheap home routers). It has been reported that on such systems, EAX mode outperforms GCM.
Oct
23
comment Interpretation of the results of NIST (p)NRG suite
Here it is the other way round. Usually, in statistics, you want to detect a non-random effect (e.g. a correlation between a specific gene mutation and a given illness), so you want a small p-value, that would mean "no way this is pure luck, there must be some correlation". Here we really don't want correlations or biases, so we want big p-values.
Oct
23
answered Interpretation of the results of NIST (p)NRG suite
Oct
21
awarded  Nice Answer
Oct
17
answered MD5 update functions
Oct
8
awarded  Enlightened
Oct
8
awarded  Nice Answer
Oct
7
awarded  Nice Answer
Sep
30
awarded  Explainer
Sep
18
comment What is the length of an RSA signature?
That trick can be extended; e.g. you can skip a complete byte (8 bits) if the verifier is ready to compute 256 RSA verifications, while it is trying to guess the missing bits. Maybe more importantly, in ISO/IEC 9796-2, part of the signed data can be embedded "for free" in the signature, so while the signature value has size $n$ bits (or $n-1$ with the trick you describe), the overhead implied by the presence of the signature can be substantially smaller, depending on the situation.