31,001 reputation
557114
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years
seen 18 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Mar
16
answered Question on RSA trapdoor permutation
Mar
16
answered Difference RSA keypair creation openSSL and openPGP?
Mar
12
awarded  Nice Answer
Mar
6
awarded  Necromancer
Feb
20
awarded  Enlightened
Feb
20
awarded  Nice Answer
Feb
13
awarded  Popular Question
Feb
11
awarded  Nice Answer
Feb
8
comment Is there a technique to confirm that a given large integer value is a product of two primes?
@ColeJohnson: actually the OP does not want to distinguish between prime numbers and composites (that one is easy); he wants to distinguish between composites which are the product of exactly two primes, and composites which are products of three primes or more (and for that one, we don't know of any method which is faster than actually factoring the integer, at least partially).
Feb
6
comment What is a Non-Interactive Zero Knowledge Proof?
"Zero-Knowledge" has a precise definition. This MAC protocol is not ZK (though it uses non-interactive ZK-proofs internally).
Feb
6
answered What is a Non-Interactive Zero Knowledge Proof?
Feb
5
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
Mmh... optimized Shabal should totally beat optimized SHA-256 into the dust on small ARM platforms (like 3x faster). At least so say my measures. A usual performance-killer is when the code is "too much unrolled" and does not fit in L1 cache; so some tweaking is in order. sphlib (again self-promotion) has optimized C code for many functions, and it has a "small footprint" compilation option which can help a lot on architectures with small L1 cache.
Feb
4
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
On a 32-bit ARMv6 without SIMD extensions, the fastest of the 14 "round 2" SHA-3 candidates would be Shabal, as seen in this report (disclaimer: I wrote that report, and I one of the inventors of Shabal; however, Shabal was designed to be fast on small 32-bit CPU, and it shows). Though Shabal is faster than the "finalist BLAKE", a later derivative like BLAKE2 should be competitive. As for all performance matters, this should be measured rather than speculated on.
Feb
4
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
Actually BLAKE was the SHA-3 finalist; BLAKE2 (both 'b' and 's' variants) are an ulterior proposal. But yes, this is a valid idea, on the basis that "it cannot be worse than MD5 for security".
Feb
3
answered Is MD5 second-preimage resistant when used only on FIXED length messages?
Feb
3
comment Is 80 bits of key size considered safe against brute force attacks?
The law is still exponential, but not x8 every three years, rather x4 every three years (so 12 or 13 key bits for 20 years, not 20 bits).
Feb
3
answered Is 80 bits of key size considered safe against brute force attacks?
Feb
3
answered Reason for difference in assumptions for practical private-key and public-key crypto
Jan
29
awarded  Nice Answer
Jan
28
comment Three-way hash collision
Three choices of size $n$ means $n^3$ but order does not matter (triplet $(a,b,c)$, $(a,c,b)$, $(b,a,c)$... are identical) so you have to divide by $3!$, which happens to be equal to $6$.