31,736 reputation
560119
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years, 1 month
seen 10 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Apr
22
answered Burn after read algorythm. Software verification on compromised environment. Software smart card
Apr
22
answered “Fine grain Cross-VM Attacks on Xen and VMware are possible” and OpenSSL 0.9.7
Apr
22
answered Use cases for CMAC vs. HMAC?
Apr
22
reviewed Approve suggested edit on
Apr
22
reviewed Approve suggested edit on
Apr
19
answered Is there a reason that the N value in scrypt is limited to powers of two?
Apr
15
comment Can ECDSA signatures be safely made “deterministic”?
RFC are immutable; once published they never change.
Apr
14
awarded  Nice Answer
Apr
14
awarded  diffie-hellman
Apr
13
comment Perfect Forward Secrecy in TLS
The "RSA" in "DH-RSA" qualifies the public key of the CA which issued the server's certificate. From the point of view of the client, a "DH-RSA" cipher suite means: "I want the server to have a certificate with a DH public key, and I am ready to use RSA to validate that certificate". This was supposed to be used in case a server had several DH certificates, signed with either RSA-based or DSA-based CA: the server would then choose the certificate for which the client had relevant support. This has never worked well in practice (but everybody does RSA anyway).
Apr
13
answered Perfect Forward Secrecy in TLS
Apr
12
answered Is there an algorithm to check if an elliptic curve is secure?
Apr
10
awarded  Nice Answer
Apr
5
answered Wrong Test Vector for HKDF with HMAC-SHA256
Apr
3
comment Should we MAC-then-encrypt or encrypt-then-MAC?
@Clément: the confusion comes from the widespread (but wrong) habit of calling MAC "signatures". In fact MAC and signatures are very different things used in very different contexts. Sign-then-encrypt protocols also use a distinct encryption key for each message, which nullifies all padding oracle attacks; and the signature is meant to serve as proof (e.g. in a trial), so it MUST be applied on the plaintext message. In MAC+encrypt contexts, the same symmetric key is often reused, and there is no "proof" requirement.
Apr
2
reviewed Approve suggested edit on double-encryption tag wiki excerpt
Apr
2
reviewed Approve suggested edit on double-encryption tag wiki
Mar
30
answered How is the curve equation used in ECC?
Mar
28
answered Alert protocol in TLS
Mar
27
comment Difference between lightweight, online and low memory Authenticated Encryption schemes
One may also note that there are "semi-online" schemes where the size of the input (but not the contents) must be known from start (e.g. CCM).