32,406 reputation
562124
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years, 3 months
seen 1 hour ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Dec
31
answered Why not use an algorithm's code rather than data itself for one time pads?
Dec
31
awarded  Nice Answer
Dec
28
answered AESManaged Trade Compliance Issue in United States
Dec
28
revised AESManaged Trade Compliance Issue in United States
grammar and spelling
Dec
27
reviewed Approve suggested edit on Inverses in Truncated Polynomial Rings
Dec
26
answered Including a “purpose” designation in a digital signature
Dec
25
comment What is the relation between Discrete Log, Computational Diffie-Hellman and Decisional Diffie-Hellman?
Just for completion, pairing-based cryptography is about using specially crafted elliptic curves where DL and CDH are assumed difficult, but DDH is easy. So we have some quite plausible reasons to believe that CDH is strictly harder than DDH (or so we fervently hope, at least).
Dec
19
answered Is EKE attackable by a brute-force password search?
Dec
18
awarded  Necromancer
Dec
9
answered Is it safe to store initial counter value for AES-CTR alongside with ciphertext?
Dec
9
answered Why are the random exponents so much bigger in the Socialist Millionaire protocol versus Diffie-Hellman key exchange?
Dec
7
comment Random oracle model proofs and programmability
@dira: it depends on the context. The proof ends up saying: "attacker's advantage is no more than $X$ when up to $q$ queries to the oracle are allowed". If the oracle is public (it is a hash function), then $q$ may be quite high; limit is on the computational power (e.g. $q = 2^{128}$). When the oracle is private, each query is part of an active attack, so it makes sense to disallow $q$ higher than some sensible value.
Dec
7
answered Random oracle model proofs and programmability
Dec
7
answered Cracking plain RSA without private key
Dec
6
comment Are there two-way encryption algorithms that include a work factor?
@OliverS: ah, well, the usual problem of inferring the "right question". An attacker trying to guess the encryption key itself will not be impaired by the bcrypt work factor, but by the whole "guessing a 128-bit random key" being downright unfeasible. So I am responding to the sensible question, which is: assuming that the source secret value is amenable to guessing (i.e. is from a much smaller space), how do we secure that in the context of symmetric encryption, with a work factor as bcrypt does ? And the answer is: well, use bcrypt, it works for that too.
Dec
6
comment Are there two-way encryption algorithms that include a work factor?
@OliverS: you cannot brute force a random 128-bit key; that would require way more force than is available on Earth. If brute force is doable, then it must operate on the input of bcrypt -- so bcrypt has to be used.
Dec
6
answered Are there two-way encryption algorithms that include a work factor?
Dec
2
comment Is HMAC-DRBG or Hash-DRBG stronger?
To be precise: HMAC-DRBG is not weaker than Hash-DRBG. We have no indication that Hash-DRBG is weak in any way, and you cannot be strictly stronger than that. Yet we have good reasons to believe that HMAC-DRBG cannot be weaker than Hash-DRBG (an attack against HMAC-DRBG would probably work just as well against Hash-DRBG).
Dec
1
reviewed Approve suggested edit on What is the appropriate public key encryption for secure coin flipping?
Dec
1
reviewed Approve suggested edit on What is the property of RSA where N=e?