Thomas Pornin

19,082 reputation

13571

bio	website	bolet.org/~pornin
	location	Quebec City, Canada
	age	37
visits	member for	1 year, 10 months
	seen	May 17 at 22:22
stats	profile views	284

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.

	19,082 reputation	bio	website	bolet.org/~pornin	visits	member for	1 year, 10 months
13571 badges		location	Quebec City, Canada		seen	May 17 at 22:22

summary answers questions tags badges favorites bounties reputation activity

612 Actions

suggestions reviews revisions comments badges posts accepts all

Oct 12	comment	What is the recommended replacement for MD5? Of course it really depends on what you mean by "standard" hash function; but some of the SHA-3 candidates offer extension for a 160-bit output size (e.g. Shabal) and, being SHA-3 candidates, they have reasonably clear specifications with test vectors and sample implementations.
Oct 10	comment	understanding a length extension attack I imagine with my brain. That's the point of imagining: I don't have to do it for real. If I knew m, I could build the larger message. Application is given in the end of my answer: I don't know the MAC key but I can still forge a message by imagining I know it, and computing the MAC value that I would have obtained.
Oct 10	awarded	Enlightened
Oct 10	awarded	Nice Answer
Oct 9	answered	How is it possible to parallelize a hashing function to crack an iteratively hashed password?
Oct 7	answered	understanding a length extension attack
Oct 6	awarded	Enlightened
Oct 6	awarded	Nice Answer
Oct 5	awarded	Nice Answer
Oct 4	answered	Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?
Oct 3	awarded	Convention
Oct 3	comment	Is 512-bit RSA still safe for signature generation? All Windows 2000, XP and more that I have come across always had several CSP installed, including the "strong" ones. Remember that IE uses them for SSL; if a basic Windows could not do more than 512-bit RSA, IE would not be able to handle common HTTPS sites.
Oct 2	comment	Is 512-bit RSA still safe for signature generation? I seriously doubt that WinXP cannot go beyond 512 bits, especially since I have done a lot of RSA-1024 with the CSP which come with a stock Windows 2000. The "base CSP" was limited to 512 bits because of the export regulations of that time, but they were lifted near the end of the Clinton presidency.
Oct 2	answered	Calculating cycles per byte
Oct 2	comment	Could the Enigma algorithm be classified as a Feistel network? Twofish is a Feistel variant (it has a few extra elements such as word rotations, but the basic Feistel structure is there). MD5 is not even a symmetric cipher; however, it is possible to say that the core of the "compression function" in MD5 is akin to a generalized Feistel structure, albeit with the message and key swapping their roles. This kind of stretches the limits of the terminology.
Oct 2	answered	Could the Enigma algorithm be classified as a Feistel network?
Sep 27	comment	Must the order of the groups in a bilinear map be the same? @curious: there are two traditional ways to denote a group operation: as a multiplication (with "1" as neutral), or as an addition (with a "0"). To understand the analogy "pairing is like a multiplication", you have to denote all your groups with additions, so no "1", only "0". For a lot of historical reasons, pairings where first described with multiplications everywhere; then, for elliptic curves, we talk about "additions", but, still traditionally, we use multiplication for pairing results.
Sep 27	comment	Must the order of the groups in a bilinear map be the same? @curious: sorry, that's the usual confusion. In the first part of the post, I use multiplicative notation on the groups; in the second part, I use additive. With the additive notation for groups $G_1$, $G_2$ and $G_n$, that's $e(rg_1, g_2) = 0$ because $rg_1 = 0$ and $e(0,x) = 0$ by bilinearity.
Sep 27	comment	Must the order of the groups in a bilinear map be the same? @curious: because $g_1^r = 1$ (group $G_1$ has order $r$) and bilinearity implies that $e(1,x) = 1$ for all $x$.
Sep 21	awarded	Custodian