30,836 reputation
557114
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years
seen 10 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Nov
8
comment How much would it cost in U.S. dollars to brute force a 256 bit key in a year?
The bit about a quantum computer with 14 qubits being able to "try all combinations of 14 bits in one operation" is incorrect. It is a very tempting assumption (a view of quantum computers as zillions of computers all running in parallel through the magic of quantum), but it is wrong -- otherwise, a QC with 256 qubits could break a 256-bit key in time 1. QC does offer (theoretically) a performance boost on exhaustive search, but not to that point: it can reduce a space of size $N$ to $\sqrt{N}$ (hence 256-bit key search with a QC should be as hard as 128-bit "normal" key search).
Nov
8
comment How much would it cost in U.S. dollars to brute force a 256 bit key in a year?
There is something wrong with the figures above. If a "machine" can do $10^{14}$ decryptions per second (a very optimistic figure, by the way), this translates to about $3.2*10^{21}$ decryptions per year, not $3.6*10^{55}$. There is a lost factor of $10^{34}$ here -- also known as "sixteen billions of billions of billions of billions of billions of billions of billions of billions of billions of billions".
Nov
8
answered How much would it cost in U.S. dollars to brute force a 256 bit key in a year?
Nov
8
answered How key materials are generated in SSL V3 from master secret
Nov
7
answered What is the purpose of four different secrets shared by client and server in SSL/TLS?
Nov
4
comment How does one measure the decrease in security, if any, of RC4 when mapping to a specific range of values?
The best you can hope for, security wise, is that the generator of values in the 0..35 range is indistinguishable from uniformly random values, and the reduction you propose will get you that, assuming that you use a cryptographically secure source of bytes -- i.e. a source indistinguishable from uniformly random bytes. There is no "reduction in security". There is a kind of reduction in performance, in that you use up, on average, a bit more than 8 bits of RC4 output to get a value which fits in less than 6 bits.
Nov
3
answered How does one measure the decrease in security, if any, of RC4 when mapping to a specific range of values?
Nov
2
comment Threshold Secret sharing - How to create a shared secret from pre existing secret parts?
That's the point. If you use Shamir's scheme, you get a whole new set of secret values to store (which I call $v_i$); but that storage can be a public shared disk (as opposed to, say, a smartcard per participant) because each participant already has a secret value $x_i$ and can use it as a symmetric key to encrypt his $v_i$.
Nov
1
reviewed Approve suggested edit on Threshold Secret sharing - How to create a shared secret from pre existing secret parts?
Nov
1
answered Threshold Secret sharing - How to create a shared secret from pre existing secret parts?
Oct
31
reviewed Approve suggested edit on Why would you expect to find a collision in a hash function after approximately $\sqrt{n}$ hashes?
Oct
31
answered Is Blowfish strong enough for VPN encryption?
Oct
31
revised Why can't one implement bcrypt in Cuda?
added 155 characters in body
Oct
30
awarded  Enlightened
Oct
30
awarded  Nice Answer
Oct
30
awarded  Nice Answer
Oct
28
reviewed Approve suggested edit on What is a hard-core predicate?
Oct
28
answered What is a hard-core predicate?
Oct
28
revised Why would you expect to find a collision in a hash function after approximately $\sqrt{n}$ hashes?
added 167 characters in body
Oct
27
answered Why would you expect to find a collision in a hash function after approximately $\sqrt{n}$ hashes?