31,901 reputation
561120
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years, 2 months
seen 11 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Dec
19
answered Is EKE attackable by a brute-force password search?
Dec
18
awarded  Necromancer
Dec
9
answered Is it safe to store initial counter value for AES-CTR alongside with ciphertext?
Dec
9
answered Why are the random exponents so much bigger in the Socialist Millionaire protocol versus Diffie-Hellman key exchange?
Dec
7
comment Random oracle model proofs and programmability
@dira: it depends on the context. The proof ends up saying: "attacker's advantage is no more than $X$ when up to $q$ queries to the oracle are allowed". If the oracle is public (it is a hash function), then $q$ may be quite high; limit is on the computational power (e.g. $q = 2^{128}$). When the oracle is private, each query is part of an active attack, so it makes sense to disallow $q$ higher than some sensible value.
Dec
7
answered Random oracle model proofs and programmability
Dec
7
answered Cracking plain RSA without private key
Dec
6
comment Are there two-way encryption algorithms that include a work factor?
@OliverS: ah, well, the usual problem of inferring the "right question". An attacker trying to guess the encryption key itself will not be impaired by the bcrypt work factor, but by the whole "guessing a 128-bit random key" being downright unfeasible. So I am responding to the sensible question, which is: assuming that the source secret value is amenable to guessing (i.e. is from a much smaller space), how do we secure that in the context of symmetric encryption, with a work factor as bcrypt does ? And the answer is: well, use bcrypt, it works for that too.
Dec
6
comment Are there two-way encryption algorithms that include a work factor?
@OliverS: you cannot brute force a random 128-bit key; that would require way more force than is available on Earth. If brute force is doable, then it must operate on the input of bcrypt -- so bcrypt has to be used.
Dec
6
answered Are there two-way encryption algorithms that include a work factor?
Dec
2
comment Is HMAC-DRBG or Hash-DRBG stronger?
To be precise: HMAC-DRBG is not weaker than Hash-DRBG. We have no indication that Hash-DRBG is weak in any way, and you cannot be strictly stronger than that. Yet we have good reasons to believe that HMAC-DRBG cannot be weaker than Hash-DRBG (an attack against HMAC-DRBG would probably work just as well against Hash-DRBG).
Dec
1
reviewed Approve suggested edit on What is the appropriate public key encryption for secure coin flipping?
Dec
1
reviewed Approve suggested edit on What is the property of RSA where N=e?
Dec
1
answered Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?
Dec
1
answered What is the appropriate public key encryption for secure coin flipping?
Nov
30
revised Software implementation of a commutative cipher?
edited tags
Nov
30
reviewed Approve suggested edit on Software implementation of a commutative cipher?
Nov
29
answered Are there any specific requirements for the function $F$ in a Feistel cipher?
Nov
28
answered Where is the proof of security of Diffie's cipher?
Nov
28
reviewed Approve suggested edit on How much would it cost in U.S. dollars to brute force a 256 bit key in a year?