meta user
network profile
| bio | website | bolet.org/~pornin |
|---|---|---|
| location | Quebec City, Canada | |
| age | 37 | |
| visits | member for | 1 year, 10 months |
| seen | 2 days ago | |
| stats | profile views | 284 |
Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.
|
Apr 25 |
comment |
Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme @RickyDemer: TWIRL is only for the sieving step. The page claims that the sieving step is the most expensive half of factorization, which, as far as I know, is true for 512-bit integers, but quite false for 1024-bit integers. There is a paper which estimates the cost of designing then building the machine for the linear algebra step, which claims to be "under 2 millions of dollars" which I frankly don't really believe. |
|
Apr 5 |
comment |
DSA signatures with related k and unknown payloads But hash values are not uniform modulo q; there is a slight bias (in standard DSA, the hash value is first truncated to the bit length of q, then reduced modulo q). Bleichenbacher found an attack when k is chosen with such a bias (works with 2^63 known message/signature pairs for a 160-bit q, if I remember correctly). I would not be surprised if there was a similar attack in this case. |
|
Mar 30 |
comment |
How do I unpack the x and y values from the BITSTRING in a DER ECDSA public key? Public keys are always BIT STRING in X.509; this is an historical remnant from older times, kept for the sake of backward compatibility. |
|
Mar 25 |
comment |
How to use HMAC for large ciphertexts over TLS And also each HMAC is computed over the concatenation of the record data and a record sequence number, so that attackers may not drop, replay or reorder individual records. |
|
Mar 3 |
comment |
Why is elliptic curve cryptography not widely used, compared to RSA? That's because the operation is not exactly the same. With RSA, signature verification uses the public exponent, which can be very short (with RSA, the public exponent typical length is 16 bits, while the privat exponent is as large as the modulus). This gives a huge boost to public key operations in RSA. There's no analog with elliptic curves. |
|
Mar 3 |
comment |
Why is elliptic curve cryptography not widely used, compared to RSA? @curious: I can quote myself. But you can also make benchmarks (with OpenSSL, try openssl speed rsa2048 ecdsap224). |
|
Feb 14 |
comment |
Can one reduce the size of ECDSA-like signatures? @D.W.: as far as I know, DSA was designed that way specifically to be sufficiently "different" from Schnorr's signature scheme, to avoid patent issues: see this. So chances are that there is no immediate formal connection between the two. |
|
Feb 10 |
comment |
How to bring little changes in DES algorithm We can do any change we want; just about anything will keep on encrypting and decrypting. The hard part is to make a secure algorithm. |
|
Feb 3 |
comment |
ECDH VS. DH benchmarking in JAVA What's strange is that my own EC code, written in pure Java, takes about 1 ms for such an operation, on the NIST P-224 curve. This might be a case of sloppy coding, which is surprising since Sun themselves wrote the EC code for OpenSSL, and they invented Java, so chances are that they know what they are doing. |
|
Nov 30 |
comment |
Exhausting the entropy of a hash function There are details. There are also online dictionary attacks, which are performed against the live target server, without knowing the hash value. Specific preimage resistance of the hash function is irrelevant for that. But if the attacker knows the hash value, then yes, there is no need, even academic, to push the password entropy beyond the preimage resistance of the hash function. |
|
Nov 23 |
comment |
Mapping between subgroups and the integers $q$ is a prime so it is odd ($2$ is the only even prime). Therefore $q = 2k+1$ for some integer $k$. So, $p = 2q+1 = 4k+3$, which means that $p = 3 \mod 4$. Whe computing modulo a prime $p$ which is equal to 3 modulo 4, $-1$ is not a quadratic residue, so $x$ and $-x$ cannot be both quadratic residues (but one of them necessarily is). |
|
Oct 25 |
comment |
What is the “Random Oracle Model” and why is it controversial? @quantumSoup: well, it would be a true random oracle -- assuming that it has access to a source of truly random numbers (when we use radioactive decay, we must trust physicists for it; and obtaining uniform output is hard, especially if we do not trust hash functions for doing their job properly). And, of course, the "infinite storage" part can imply some practical issues. |
|
Oct 24 |
comment |
A discrete-log-like problem, with matrices: given $A^k x$, find $k$ In the $m\times m$ case, you just need one of the $x_j$ for $1 \lt j \leq m$ to be non-zero, to solve for $k$. To make it hard (i.e. equivalent to DL), all of the $x_j$ (except $x_1$) must be zero. |
|
Oct 15 |
comment |
Increase number of rounds for SPN and Feistel ciphers @marluh: slowing down both the attacker and the defender by the same factor is not good security. We do it with password hashing because we know not how to do better, but we really prefer when the attacker is slowed down exponentially -- and that's what happens with a larger key. A 128-bit key is enough to defeat brute force utterly (by a large margin) so slowing down produces no tangible security gain: if the system gets broken, it won't be through brute force. However, slowing down has quite tangible drawbacks (namely, things go slower for the defender, too). |
|
Oct 12 |
comment |
What is the recommended replacement for MD5? Of course it really depends on what you mean by "standard" hash function; but some of the SHA-3 candidates offer extension for a 160-bit output size (e.g. Shabal) and, being SHA-3 candidates, they have reasonably clear specifications with test vectors and sample implementations. |
|
Oct 10 |
comment |
understanding a length extension attack I imagine with my brain. That's the point of imagining: I don't have to do it for real. If I knew m, I could build the larger message. Application is given in the end of my answer: I don't know the MAC key but I can still forge a message by imagining I know it, and computing the MAC value that I would have obtained. |
|
Oct 3 |
comment |
Is 512-bit RSA still safe for signature generation? All Windows 2000, XP and more that I have come across always had several CSP installed, including the "strong" ones. Remember that IE uses them for SSL; if a basic Windows could not do more than 512-bit RSA, IE would not be able to handle common HTTPS sites. |
|
Oct 2 |
comment |
Is 512-bit RSA still safe for signature generation? I seriously doubt that WinXP cannot go beyond 512 bits, especially since I have done a lot of RSA-1024 with the CSP which come with a stock Windows 2000. The "base CSP" was limited to 512 bits because of the export regulations of that time, but they were lifted near the end of the Clinton presidency. |
|
Oct 2 |
comment |
Could the Enigma algorithm be classified as a Feistel network? Twofish is a Feistel variant (it has a few extra elements such as word rotations, but the basic Feistel structure is there). MD5 is not even a symmetric cipher; however, it is possible to say that the core of the "compression function" in MD5 is akin to a generalized Feistel structure, albeit with the message and key swapping their roles. This kind of stretches the limits of the terminology. |
|
Sep 27 |
comment |
Must the order of the groups in a bilinear map be the same? @curious: there are two traditional ways to denote a group operation: as a multiplication (with "1" as neutral), or as an addition (with a "0"). To understand the analogy "pairing is like a multiplication", you have to denote all your groups with additions, so no "1", only "0". For a lot of historical reasons, pairings where first described with multiplications everywhere; then, for elliptic curves, we talk about "additions", but, still traditionally, we use multiplication for pairing results. |
