31,716 reputation
560119
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years, 1 month
seen yesterday

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Dec
9
answered Why are the random exponents so much bigger in the Socialist Millionaire protocol versus Diffie-Hellman key exchange?
Dec
7
comment Random oracle model proofs and programmability
@dira: it depends on the context. The proof ends up saying: "attacker's advantage is no more than $X$ when up to $q$ queries to the oracle are allowed". If the oracle is public (it is a hash function), then $q$ may be quite high; limit is on the computational power (e.g. $q = 2^{128}$). When the oracle is private, each query is part of an active attack, so it makes sense to disallow $q$ higher than some sensible value.
Dec
7
answered Random oracle model proofs and programmability
Dec
7
answered Cracking plain RSA without private key
Dec
6
comment Are there two-way encryption algorithms that include a work factor?
@OliverS: ah, well, the usual problem of inferring the "right question". An attacker trying to guess the encryption key itself will not be impaired by the bcrypt work factor, but by the whole "guessing a 128-bit random key" being downright unfeasible. So I am responding to the sensible question, which is: assuming that the source secret value is amenable to guessing (i.e. is from a much smaller space), how do we secure that in the context of symmetric encryption, with a work factor as bcrypt does ? And the answer is: well, use bcrypt, it works for that too.
Dec
6
comment Are there two-way encryption algorithms that include a work factor?
@OliverS: you cannot brute force a random 128-bit key; that would require way more force than is available on Earth. If brute force is doable, then it must operate on the input of bcrypt -- so bcrypt has to be used.
Dec
6
answered Are there two-way encryption algorithms that include a work factor?
Dec
2
comment Is HMAC-DRBG or Hash-DRBG stronger?
To be precise: HMAC-DRBG is not weaker than Hash-DRBG. We have no indication that Hash-DRBG is weak in any way, and you cannot be strictly stronger than that. Yet we have good reasons to believe that HMAC-DRBG cannot be weaker than Hash-DRBG (an attack against HMAC-DRBG would probably work just as well against Hash-DRBG).
Dec
1
reviewed Approve suggested edit on What is the appropriate public key encryption for secure coin flipping?
Dec
1
reviewed Approve suggested edit on What is the property of RSA where N=e?
Dec
1
answered Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?
Dec
1
answered What is the appropriate public key encryption for secure coin flipping?
Nov
30
revised Software implementation of a commutative cipher?
edited tags
Nov
30
reviewed Approve suggested edit on Software implementation of a commutative cipher?
Nov
29
answered Are there any specific requirements for the function $F$ in a Feistel cipher?
Nov
28
answered Where is the proof of security of Diffie's cipher?
Nov
28
reviewed Approve suggested edit on How much would it cost in U.S. dollars to brute force a 256 bit key in a year?
Nov
27
revised How can one show that an ElGamal-like signature verification scheme is valid?
added 1 characters in body
Nov
27
answered How can one show that an ElGamal-like signature verification scheme is valid?
Nov
26
answered Verilog simulation of Data Encryption Standard