30,971 reputation
557114
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years
seen Jul 26 at 16:57

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Jul
15
comment Is RSA of a random nonce with no padding safe?
Using the rightmost (least significant) bits should be safe (the leftmost bits are a bit biased), but the argument is a bit more complex; using a hash function is safer.
Jun
16
comment AES VS PRNG+HASH+XOR
Well, don't forget that when you use a hash function as a stream cipher, you are actually trusting two "pieces of software": the hash function itself, and the construction which turns it into a stream cipher. Either may be subject to design and implementation weaknesses.
Jun
12
comment which of these is more secure (bcrypt vs srp)
@owlstead: there are two distinct points: 1. we don't want to store on the server something which is "password equivalent"; 2. the complete processing, from the password to whatever is stored on the server, must be proper "password hashing" with iterations and salts. You can have that with PBKDF2(password) computed on the client side, and SHA-256(PBKDF2(password)) stored on the server. That way, the server-side operation is very fast, and stealing the server's database still does not grant easy entry.
Apr
22
comment Use cases for CMAC vs. HMAC?
Beware: MD hash functions like SHA-1 are built out of a block cipher, but with the data as key, which apparently allows for better bandwidth. At least we can empirically notice that the SHA-3 competition yielded algorithms which are quite faster than all AES candidates on the same hardware. Even AES-based SHA-3 candidates (e.g. ECHO) turned out to be quite faster than AES itself on the same machine.
Apr
15
comment Can ECDSA signatures be safely made “deterministic”?
RFC are immutable; once published they never change.
Apr
13
comment Perfect Forward Secrecy in TLS
The "RSA" in "DH-RSA" qualifies the public key of the CA which issued the server's certificate. From the point of view of the client, a "DH-RSA" cipher suite means: "I want the server to have a certificate with a DH public key, and I am ready to use RSA to validate that certificate". This was supposed to be used in case a server had several DH certificates, signed with either RSA-based or DSA-based CA: the server would then choose the certificate for which the client had relevant support. This has never worked well in practice (but everybody does RSA anyway).
Apr
3
comment Should we MAC-then-encrypt or encrypt-then-MAC?
@Clément: the confusion comes from the widespread (but wrong) habit of calling MAC "signatures". In fact MAC and signatures are very different things used in very different contexts. Sign-then-encrypt protocols also use a distinct encryption key for each message, which nullifies all padding oracle attacks; and the signature is meant to serve as proof (e.g. in a trial), so it MUST be applied on the plaintext message. In MAC+encrypt contexts, the same symmetric key is often reused, and there is no "proof" requirement.
Mar
27
comment Difference between lightweight, online and low memory Authenticated Encryption schemes
One may also note that there are "semi-online" schemes where the size of the input (but not the contents) must be known from start (e.g. CCM).
Mar
19
comment Efficiency of computing $e(P,Q)$ Vs $g^a \pmod{p}$?
No, it is not always defined over a supersingular elliptic curve. It is defined overs "curves of low embedding degree". Supersingular curves have a low embedding degree, but are not alone in that category. However, parts of the computation must occur with elements from a field which is large enough to resist discrete logarithm (DLP, not ECDLP), and that's quite larger than what is used in normal elliptic curves (say, 1200 bits instead of 200), and that means higher computational cost.
Mar
17
comment Elliptic Curves of different forms
It is intended. In all the rest of the message, we talk about curves in $\mathbb{F}_p$ for some prime $p$. However, the Montgomery ladder has also been adapted to curves in $\mathbb{F}_{2^m}$ ("binary curves") with the same expected characteristics (efficient AND side-channel resistant), and yet the OpenSSL implementation of that ladder on binary curves turned out to leak information. This highlights the idea that having a curve amenable to leak-free implementations does not preclude the existence of an implementation which still leaks heavily.
Feb
8
comment Is there a technique to confirm that a given large integer value is a product of two primes?
@ColeJohnson: actually the OP does not want to distinguish between prime numbers and composites (that one is easy); he wants to distinguish between composites which are the product of exactly two primes, and composites which are products of three primes or more (and for that one, we don't know of any method which is faster than actually factoring the integer, at least partially).
Feb
6
comment What is a Non-Interactive Zero Knowledge Proof?
"Zero-Knowledge" has a precise definition. This MAC protocol is not ZK (though it uses non-interactive ZK-proofs internally).
Feb
5
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
Mmh... optimized Shabal should totally beat optimized SHA-256 into the dust on small ARM platforms (like 3x faster). At least so say my measures. A usual performance-killer is when the code is "too much unrolled" and does not fit in L1 cache; so some tweaking is in order. sphlib (again self-promotion) has optimized C code for many functions, and it has a "small footprint" compilation option which can help a lot on architectures with small L1 cache.
Feb
4
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
On a 32-bit ARMv6 without SIMD extensions, the fastest of the 14 "round 2" SHA-3 candidates would be Shabal, as seen in this report (disclaimer: I wrote that report, and I one of the inventors of Shabal; however, Shabal was designed to be fast on small 32-bit CPU, and it shows). Though Shabal is faster than the "finalist BLAKE", a later derivative like BLAKE2 should be competitive. As for all performance matters, this should be measured rather than speculated on.
Feb
4
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
Actually BLAKE was the SHA-3 finalist; BLAKE2 (both 'b' and 's' variants) are an ulterior proposal. But yes, this is a valid idea, on the basis that "it cannot be worse than MD5 for security".
Feb
3
comment Is 80 bits of key size considered safe against brute force attacks?
The law is still exponential, but not x8 every three years, rather x4 every three years (so 12 or 13 key bits for 20 years, not 20 bits).
Jan
28
comment Three-way hash collision
Three choices of size $n$ means $n^3$ but order does not matter (triplet $(a,b,c)$, $(a,c,b)$, $(b,a,c)$... are identical) so you have to divide by $3!$, which happens to be equal to $6$.
Jan
22
comment Can I use my random IV (for AES) as a salt for PBKDF2?
The problem with the IV in TLS 1.0 (demonstrated a few years ago "in the wild", i.e. as a Youtube video of a Javascript-based attack, under the name "BEAST") was not that the attacker knew the IV, but that the attacker knew the IV before choosing the data which gets encrypted (in a chosen-plaintext attack context). In TLS 1.1 a new IV is generated for each record, and it is in the record, so the attacker can see it all right, but only after having chosen the data, which disables the attack.
Jan
16
comment Password hashing in /etc/shadow
It is in the original article, and is not explained. They might have described the source orally, during the presentation (I was not there).
Dec
23
comment Solve a Modular Exponentiation
This solving method would take an awful lot of time, because the size of $k$ is several thousands of bits (the correct value of $k$ exists, but finding it that way would take billions of times the age of the Universe).