28,863 reputation
453109
bio website bolet.org/~pornin
location Quebec City, Canada
age 38
visits member for 2 years, 9 months
seen 20 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


1d
comment Can ECDSA signatures be safely made “deterministic”?
RFC are immutable; once published they never change.
Apr
13
comment Perfect Forward Secrecy in TLS
The "RSA" in "DH-RSA" qualifies the public key of the CA which issued the server's certificate. From the point of view of the client, a "DH-RSA" cipher suite means: "I want the server to have a certificate with a DH public key, and I am ready to use RSA to validate that certificate". This was supposed to be used in case a server had several DH certificates, signed with either RSA-based or DSA-based CA: the server would then choose the certificate for which the client had relevant support. This has never worked well in practice (but everybody does RSA anyway).
Apr
3
comment Should we MAC-then-encrypt or encrypt-then-MAC?
@Clément: the confusion comes from the widespread (but wrong) habit of calling MAC "signatures". In fact MAC and signatures are very different things used in very different contexts. Sign-then-encrypt protocols also use a distinct encryption key for each message, which nullifies all padding oracle attacks; and the signature is meant to serve as proof (e.g. in a trial), so it MUST be applied on the plaintext message. In MAC+encrypt contexts, the same symmetric key is often reused, and there is no "proof" requirement.
Mar
27
comment Difference between lightweight, online and low memory Authenticated Encryption schemes
One may also note that there are "semi-online" schemes where the size of the input (but not the contents) must be known from start (e.g. CCM).
Mar
19
comment Efficiency of computing $e(P,Q)$ Vs $g^a \pmod{p}$?
No, it is not always defined over a supersingular elliptic curve. It is defined overs "curves of low embedding degree". Supersingular curves have a low embedding degree, but are not alone in that category. However, parts of the computation must occur with elements from a field which is large enough to resist discrete logarithm (DLP, not ECDLP), and that's quite larger than what is used in normal elliptic curves (say, 1200 bits instead of 200), and that means higher computational cost.
Mar
17
comment Elliptic Curves of different forms
It is intended. In all the rest of the message, we talk about curves in $\mathbb{F}_p$ for some prime $p$. However, the Montgomery ladder has also been adapted to curves in $\mathbb{F}_{2^m}$ ("binary curves") with the same expected characteristics (efficient AND side-channel resistant), and yet the OpenSSL implementation of that ladder on binary curves turned out to leak information. This highlights the idea that having a curve amenable to leak-free implementations does not preclude the existence of an implementation which still leaks heavily.
Feb
8
comment Is there a technique to confirm that a given large integer value is a product of two primes?
@ColeJohnson: actually the OP does not want to distinguish between prime numbers and composites (that one is easy); he wants to distinguish between composites which are the product of exactly two primes, and composites which are products of three primes or more (and for that one, we don't know of any method which is faster than actually factoring the integer, at least partially).
Feb
6
comment What is a Non-Interactive Zero Knowledge Proof?
"Zero-Knowledge" has a precise definition. This MAC protocol is not ZK (though it uses non-interactive ZK-proofs internally).
Feb
5
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
Mmh... optimized Shabal should totally beat optimized SHA-256 into the dust on small ARM platforms (like 3x faster). At least so say my measures. A usual performance-killer is when the code is "too much unrolled" and does not fit in L1 cache; so some tweaking is in order. sphlib (again self-promotion) has optimized C code for many functions, and it has a "small footprint" compilation option which can help a lot on architectures with small L1 cache.
Feb
4
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
On a 32-bit ARMv6 without SIMD extensions, the fastest of the 14 "round 2" SHA-3 candidates would be Shabal, as seen in this report (disclaimer: I wrote that report, and I one of the inventors of Shabal; however, Shabal was designed to be fast on small 32-bit CPU, and it shows). Though Shabal is faster than the "finalist BLAKE", a later derivative like BLAKE2 should be competitive. As for all performance matters, this should be measured rather than speculated on.
Feb
4
comment Is MD5 second-preimage resistant when used only on FIXED length messages?
Actually BLAKE was the SHA-3 finalist; BLAKE2 (both 'b' and 's' variants) are an ulterior proposal. But yes, this is a valid idea, on the basis that "it cannot be worse than MD5 for security".
Feb
3
comment Is 80 bits of key size considered safe against brute force attacks?
The law is still exponential, but not x8 every three years, rather x4 every three years (so 12 or 13 key bits for 20 years, not 20 bits).
Jan
28
comment Three-way hash collision
Three choices of size $n$ means $n^3$ but order does not matter (triplet $(a,b,c)$, $(a,c,b)$, $(b,a,c)$... are identical) so you have to divide by $3!$, which happens to be equal to $6$.
Jan
22
comment Can I use my random IV (for AES) as a salt for PBKDF2?
The problem with the IV in TLS 1.0 (demonstrated a few years ago "in the wild", i.e. as a Youtube video of a Javascript-based attack, under the name "BEAST") was not that the attacker knew the IV, but that the attacker knew the IV before choosing the data which gets encrypted (in a chosen-plaintext attack context). In TLS 1.1 a new IV is generated for each record, and it is in the record, so the attacker can see it all right, but only after having chosen the data, which disables the attack.
Jan
16
comment Password hashing in /etc/shadow
It is in the original article, and is not explained. They might have described the source orally, during the presentation (I was not there).
Dec
23
comment Solve a Modular Exponentiation
This solving method would take an awful lot of time, because the size of $k$ is several thousands of bits (the correct value of $k$ exists, but finding it that way would take billions of times the age of the Universe).
Dec
22
comment Efficiency of computing $e(P,Q)$ Vs $g^a \pmod{p}$?
Any statement on performance is relative to hardware and implementation characteristics and usage conditions, and thus may vary quite a lot. As I said, "don't try to read too much in that figure".
Dec
18
comment What is the difference between CSPRNG and PRNG?
Initial seed for a CSPRNG must come from something "which the attacker cannot know". Usually, this is "true randomness" extracted from hardware event. Typically, the system takes the time (down to the nanosecond, using the CPU cycle counter) at which hardware interrupts occurs, concatenates all these time values, and hashes the lot. Something similar occurs in the CSPRNG provided by usual operating systems (/dev/urandom on Linux, CryptGenRandom() on Windows...).
Dec
18
comment Multi-party encryption algorithm
Well, you do not need to renew the group key if someone merely exits. You need to renew the group key only when you want a former group member to become unable to read subsequent messages -- i.e. not really when someone decides to get some sleep; you renew the key when you want to evict a group member. This should be as frequent as banning/kicking participants (i.e. quite rare).
Dec
16
comment Advantages of bilinear map
Yes, that's it: no known way with currently known pairings and curve types.