28,863 reputation
453109
bio website bolet.org/~pornin
location Quebec City, Canada
age 38
visits member for 2 years, 9 months
seen 6 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Feb
8
comment Is there a technique to confirm that a given large integer value is a product of two primes?
@ColeJohnson: actually the OP does not want to distinguish between prime numbers and composites (that one is easy); he wants to distinguish between composites which are the product of exactly two primes, and composites which are products of three primes or more (and for that one, we don't know of any method which is faster than actually factoring the integer, at least partially).
Feb
6
comment What is a Non-Interactive Zero Knowledge Proof?
"Zero-Knowledge" has a precise definition. This MAC protocol is not ZK (though it uses non-interactive ZK-proofs internally).
Feb
6
answered What is a Non-Interactive Zero Knowledge Proof?
Feb
5
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
Mmh... optimized Shabal should totally beat optimized SHA-256 into the dust on small ARM platforms (like 3x faster). At least so say my measures. A usual performance-killer is when the code is "too much unrolled" and does not fit in L1 cache; so some tweaking is in order. sphlib (again self-promotion) has optimized C code for many functions, and it has a "small footprint" compilation option which can help a lot on architectures with small L1 cache.
Feb
4
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
On a 32-bit ARMv6 without SIMD extensions, the fastest of the 14 "round 2" SHA-3 candidates would be Shabal, as seen in this report (disclaimer: I wrote that report, and I one of the inventors of Shabal; however, Shabal was designed to be fast on small 32-bit CPU, and it shows). Though Shabal is faster than the "finalist BLAKE", a later derivative like BLAKE2 should be competitive. As for all performance matters, this should be measured rather than speculated on.
Feb
4
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
Actually BLAKE was the SHA-3 finalist; BLAKE2 (both 'b' and 's' variants) are an ulterior proposal. But yes, this is a valid idea, on the basis that "it cannot be worse than MD5 for security".
Feb
3
answered Is MD5 second-preimage resistant when used only on FIXED length messages?
Feb
3
comment Is 80 bits of key size considered safe against brute force attacks?
The law is still exponential, but not x8 every three years, rather x4 every three years (so 12 or 13 key bits for 20 years, not 20 bits).
Feb
3
answered Is 80 bits of key size considered safe against brute force attacks?
Feb
3
answered Reason for difference in assumptions for practical private-key and public-key crypto
Jan
29
awarded  Nice Answer
Jan
28
comment Three-way hash collision
Three choices of size $n$ means $n^3$ but order does not matter (triplet $(a,b,c)$, $(a,c,b)$, $(b,a,c)$... are identical) so you have to divide by $3!$, which happens to be equal to $6$.
Jan
22
comment Can I use my random IV (for AES) as a salt for PBKDF2?
The problem with the IV in TLS 1.0 (demonstrated a few years ago "in the wild", i.e. as a Youtube video of a Javascript-based attack, under the name "BEAST") was not that the attacker knew the IV, but that the attacker knew the IV before choosing the data which gets encrypted (in a chosen-plaintext attack context). In TLS 1.1 a new IV is generated for each record, and it is in the record, so the attacker can see it all right, but only after having chosen the data, which disables the attack.
Jan
21
awarded  Revival
Jan
20
answered How can I implement the elliptic curve MOV attack myself?
Jan
18
answered What was the problem in the SSL version 2.0?
Jan
17
answered Implementation of modular arithmetic?
Jan
16
comment Password hashing in /etc/shadow
It is in the original article, and is not explained. They might have described the source orally, during the presentation (I was not there).
Jan
16
answered Password hashing in /etc/shadow
Jan
15
awarded  Nice Answer