32,406 reputation
562124
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years, 3 months
seen 8 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Aug
12
answered linear computations over bilinear pairings
Aug
12
answered Security issues of a MAC-then-Encrypt-then-MAC approach?
Aug
11
awarded  Enlightened
Aug
11
awarded  Nice Answer
Aug
6
awarded  Nice Answer
Aug
4
comment Point addition equation in projective co ordinates
Yes, you get the same point at the end. That's the idea of non-unique coordinates: you have the choice of representation, but they all stand for the same curve point.
Aug
3
comment Is perfect-forward secrecy achieved with RSA?
One may note that SSL used to support ephemeral RSA keys. It was defined as part of the "RSA_EXPORT" cipher suites, in SSL 3.0 and TLS 1.0 (support was dropped in TLS 1.1). When an RSA_EXPORT cipher suite was chosen and the server's public key length was 513 bits or more, the server had to send a ServerKeyExchange message with a RSA key pair in it. I am not sure many SSL implementations supported it, though.
Aug
3
answered Point addition equation in projective co ordinates
Jul
15
comment Is RSA of a random nonce with no padding safe?
Using the rightmost (least significant) bits should be safe (the leftmost bits are a bit biased), but the argument is a bit more complex; using a hash function is safer.
Jul
12
awarded  Yearling
Jul
6
awarded  Pundit
Jun
19
awarded  Nice Answer
Jun
18
awarded  Enlightened
Jun
18
awarded  Nice Answer
Jun
16
comment AES VS PRNG+HASH+XOR
Well, don't forget that when you use a hash function as a stream cipher, you are actually trusting two "pieces of software": the hash function itself, and the construction which turns it into a stream cipher. Either may be subject to design and implementation weaknesses.
Jun
16
answered AES VS PRNG+HASH+XOR
Jun
15
answered TLS - sharing 1792 bits of unidirectional keys
Jun
15
revised Trial divisions before Miller-Rabin checks?
added 666 characters in body
Jun
15
answered Trial divisions before Miller-Rabin checks?
Jun
12
comment which of these is more secure (bcrypt vs srp)
@owlstead: there are two distinct points: 1. we don't want to store on the server something which is "password equivalent"; 2. the complete processing, from the password to whatever is stored on the server, must be proper "password hashing" with iterations and salts. You can have that with PBKDF2(password) computed on the client side, and SHA-256(PBKDF2(password)) stored on the server. That way, the server-side operation is very fast, and stealing the server's database still does not grant easy entry.