171,063 reputation
25365577
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 4 years, 5 months
seen 7 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


12h
awarded  Enlightened
14h
awarded  Nice Answer
15h
comment Where do I get prime numbers for Diffie-Hellman? Can I use them twice?
@MaartenBodewes: I also disagree with the text that lili added, so I reverted the edit.
15h
revised Where do I get prime numbers for Diffie-Hellman? Can I use them twice?
rolled back to a previous revision
1d
awarded  Enlightened
1d
awarded  Nice Answer
1d
comment Does TLS_FALLBACK_SCSV provide blanket protection against downgrade attacks?
Because the issue is not, in fact, that it goes over one or two connections. It is not either about whether the "downgrade" is on the protocol version or not. The real issue is that all these protection mechanisms still rely on the infeasibility of breaking the handshake in real-time.
1d
answered Does TLS_FALLBACK_SCSV provide blanket protection against downgrade attacks?
1d
comment SSL3 “POODLE” Vulnerability
No. The reference to IETF in the draft and RFC 6979 is generic; it comes in "automatically" when submitting an informational RFC.
2d
awarded  Enlightened
2d
awarded  Nice Answer
2d
reviewed Approve thunderbolt tag wiki
2d
reviewed Approve registration tag wiki
2d
reviewed Approve registration tag wiki excerpt
2d
answered Managing keys generated with insufficient entropy
2d
awarded  Guru
May
20
awarded  Good Answer
May
20
comment What is Logjam and how do I prevent it?
When I talk about modulus size, I really mean the numerical size: modulus p has size k bits if it is greater than 2^(k-1) and lower than 2^k. Of course, any implementation can fail to do things properly.
May
20
awarded  Nice Answer
May
20
comment What is Logjam and how do I prevent it?
In fact, the ability to reuse breaking efforts for other DH instances with the same modulus implies a lot of interesting mathematical work (which was published before this attack); and there is the small point that, contrary to FREAK, that new attack does not require the use an implementation bug. However, the basic concept is the same: when client and server are OK with using very weak crypto, they get what they deserve.