33,206 reputation
566129
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years, 5 months
seen 7 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Jan
11
comment Feedback on rolling my own entropy gatherer
@DavidSchwartz: that's exactly how /dev/urandom works on FreeBSD: it blocks until a big enough seed has been obtained, and then never after. Linux's /dev/urandom is broken in that respect (it will accept to output data before having obtained enough bytes) but Linux distributions fix that by recording at each boot a random seed in a file, which will be used upon next boot. As for gathering additional entropy afterwards, it does not harm, as long as it is cheap (not gathering extra entropy being always, by definition, the cheapest option).
Jan
10
comment Feedback on rolling my own entropy gatherer
@JimMcKeeth: never ! A 256-bit random seed is good enough until the end of times -- the end of your times, that is, including your grandchildren's grandchildren. That's what computational indistinguishability is about: 300 years of computation with all the world's computers are not enough to get it through. In practice, a PRNG needs a new seed upon boot and until next time the machine is shut off.
Jan
10
answered Feedback on rolling my own entropy gatherer
Jan
10
answered Would it be secure to use random numbers from random.org in a cryptographic solution?
Jan
10
comment RSA cracking: The same message is sent to two different people problem
Note that such "cracking" entails using RSA without padding (so it is not "the" RSA, only the core mathematical operation, but known to have a number of weaknesses), and also that Smith and Jones share the same modulus, which means that they have the "same" private key (at least they both know the factorization of the modulus, so they can compute each other's private key). That's not a realistic situation.
Jan
9
awarded  Nice Answer
Jan
8
revised group-theory wiki description
added 454 characters in body
Jan
8
answered DES Crack simulation
Jan
7
reviewed Approve blowfish tag wiki excerpt
Jan
7
reviewed Approve blowfish tag wiki
Jan
7
wiki created group-theory description
Jan
6
answered Is it possible to create an easy to use encryption/decryption method that will never be comprimised?
Jan
6
reviewed Approve Obtaining the key length from the ciphertext of an auto-encipher
Jan
5
reviewed Approve How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?
Jan
5
comment Cycle attack on RSA
@EmilioFerrucci: for the general intuition, consider a prime $u$, and a prime $v$ which divides $u-1$. Write $w = (u-1)/v$. Values $x$ with an order which is not a multiple of $v$ are such that $x^w = 1 \pmod u$ (because $x^{u-1} = 1 \pmod u$). So these $x$ are solutions to a polynomial of degree $w$ in a field (integers modulo $u$); thus, there can be no more than $w$ of them, and $w/u \approx 1/v$. Here, we work modulo $p-1$ which is not prime, but the same general principle applies.
Jan
5
answered Cycle attack on RSA
Jan
2
reviewed Approve
Jan
1
awarded  Nice Answer
Jan
1
awarded  Enlightened
Dec
31
answered Related-key attacks on AES