32,416 reputation
562124
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years, 3 months
seen 7 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Mar
23
reviewed Needs Improvement One-time digital signatures
Mar
23
reviewed Excellent If PGP and GPG both follow the OpenPGP standard, are they 100% compatible in all use cases?
Mar
23
reviewed Excellent Certificate signature with SHA-1 and RSA: where do 1888 bits come from?
Mar
22
answered Is PKCS #1 v1.5 RSA encryption padding secure under these conditions?
Mar
19
comment Efficiency of computing $e(P,Q)$ Vs $g^a \pmod{p}$?
No, it is not always defined over a supersingular elliptic curve. It is defined overs "curves of low embedding degree". Supersingular curves have a low embedding degree, but are not alone in that category. However, parts of the computation must occur with elements from a field which is large enough to resist discrete logarithm (DLP, not ECDLP), and that's quite larger than what is used in normal elliptic curves (say, 1200 bits instead of 200), and that means higher computational cost.
Mar
17
comment Elliptic Curves of different forms
It is intended. In all the rest of the message, we talk about curves in $\mathbb{F}_p$ for some prime $p$. However, the Montgomery ladder has also been adapted to curves in $\mathbb{F}_{2^m}$ ("binary curves") with the same expected characteristics (efficient AND side-channel resistant), and yet the OpenSSL implementation of that ladder on binary curves turned out to leak information. This highlights the idea that having a curve amenable to leak-free implementations does not preclude the existence of an implementation which still leaks heavily.
Mar
16
answered Elliptic Curves of different forms
Mar
16
answered Question on RSA trapdoor permutation
Mar
16
answered Difference RSA keypair creation openSSL and openPGP?
Mar
12
awarded  Nice Answer
Mar
6
awarded  Necromancer
Feb
20
awarded  Enlightened
Feb
20
awarded  Nice Answer
Feb
13
awarded  Popular Question
Feb
11
awarded  Nice Answer
Feb
8
comment Is there a technique to confirm that a given large integer value is a product of two primes?
@ColeJohnson: actually the OP does not want to distinguish between prime numbers and composites (that one is easy); he wants to distinguish between composites which are the product of exactly two primes, and composites which are products of three primes or more (and for that one, we don't know of any method which is faster than actually factoring the integer, at least partially).
Feb
6
comment What is a Non-Interactive Zero Knowledge Proof?
"Zero-Knowledge" has a precise definition. This MAC protocol is not ZK (though it uses non-interactive ZK-proofs internally).
Feb
6
answered What is a Non-Interactive Zero Knowledge Proof?
Feb
5
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
Mmh... optimized Shabal should totally beat optimized SHA-256 into the dust on small ARM platforms (like 3x faster). At least so say my measures. A usual performance-killer is when the code is "too much unrolled" and does not fit in L1 cache; so some tweaking is in order. sphlib (again self-promotion) has optimized C code for many functions, and it has a "small footprint" compilation option which can help a lot on architectures with small L1 cache.
Feb
4
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
On a 32-bit ARMv6 without SIMD extensions, the fastest of the 14 "round 2" SHA-3 candidates would be Shabal, as seen in this report (disclaimer: I wrote that report, and I one of the inventors of Shabal; however, Shabal was designed to be fast on small 32-bit CPU, and it shows). Though Shabal is faster than the "finalist BLAKE", a later derivative like BLAKE2 should be competitive. As for all performance matters, this should be measured rather than speculated on.