33,569 reputation
569131
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years, 6 months
seen 3 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Aug
18
awarded  Nice Answer
Aug
14
answered Why can't you decrypt an encrypted message with just the public key?
Aug
13
awarded  Nice Answer
Aug
13
answered How is SHA1 different from MD5?
Aug
12
comment linear computations over bilinear pairings
Two elements in a group are opposite to each other if their product is 1 (or their sum is 0, if you use an additive notation for the group).
Aug
12
answered linear computations over bilinear pairings
Aug
12
answered Security issues of a MAC-then-Encrypt-then-MAC approach?
Aug
11
awarded  Enlightened
Aug
11
awarded  Nice Answer
Aug
6
awarded  Nice Answer
Aug
4
comment Point addition equation in projective co ordinates
Yes, you get the same point at the end. That's the idea of non-unique coordinates: you have the choice of representation, but they all stand for the same curve point.
Aug
3
comment Is perfect-forward secrecy achieved with RSA?
One may note that SSL used to support ephemeral RSA keys. It was defined as part of the "RSA_EXPORT" cipher suites, in SSL 3.0 and TLS 1.0 (support was dropped in TLS 1.1). When an RSA_EXPORT cipher suite was chosen and the server's public key length was 513 bits or more, the server had to send a ServerKeyExchange message with a RSA key pair in it. I am not sure many SSL implementations supported it, though.
Aug
3
answered Point addition equation in projective co ordinates
Jul
15
comment Is RSA of a random nonce with no padding safe?
Using the rightmost (least significant) bits should be safe (the leftmost bits are a bit biased), but the argument is a bit more complex; using a hash function is safer.
Jul
12
awarded  Yearling
Jul
6
awarded  Pundit
Jun
19
awarded  Nice Answer
Jun
18
awarded  Enlightened
Jun
18
awarded  Nice Answer
Jun
16
comment AES VS PRNG+HASH+XOR
Well, don't forget that when you use a hash function as a stream cipher, you are actually trusting two "pieces of software": the hash function itself, and the construction which turns it into a stream cipher. Either may be subject to design and implementation weaknesses.