168,508 reputation
25353565
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 4 years, 4 months
seen 4 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


1d
answered If the public key can't be used for decrypting something encrypted by the private key, then how do digital signatures work?
1d
awarded  Enlightened
1d
awarded  Nice Answer
1d
awarded  Nice Answer
2d
answered Where does the GSM A5 key come from? Why isn't DH used?
Apr
24
awarded  Good Answer
Apr
23
answered Buffer Overflow with Big Endian architecture
Apr
23
answered Does reboot clear RAM?
Apr
22
awarded  Enlightened
Apr
22
comment Why can't you work backwards with public key to decrypt a message?
If you want "authoritative" sources, have a look at this site. In particular, application of ECRYPT II's equations (from their last available yearly report, which appears to be from 2012...) leads to RSA-2048 being "equivalent" to a 103-bit symmetric algorithm.
Apr
22
comment Why can't you work backwards with public key to decrypt a message?
There are various bodies that try to do estimates of how RSA key sizes compare to symmetric keys. Ultimately, there is not a single answer since we are comparing distinct kind of algorithms (for symmetric key cracking, RAM does not count; while it counts a lot for integer factorization). Equivalence for RSA thus ranges between about 100 and 112 bits, depending on whom you ask and what you consider to be a "unit" operation. "107" derived from the raw application of the complexity of the General Number Field Sieve.
Apr
22
awarded  Nice Answer
Apr
22
awarded  Good Answer
Apr
22
comment Why can't you work backwards with public key to decrypt a message?
It is a metaphor for the front row of a breadth-first exploration of a graph that represents the encryption system expressed as a finite-state automaton.
Apr
22
awarded  Nice Answer
Apr
22
answered Why can't you work backwards with public key to decrypt a message?
Apr
22
awarded  Good Answer
Apr
20
comment Should I use a Certificate Revocation List?
@supercat: ah, you are talking about using the key itself (i.e. certificate owner revokes it, not its issuing CA) ? Then that's another subject; this is not the X.509 model (where revocation is done by who signed the certificate, i.e. the CA). Note that when a user's laptop his stolen, the private key must be considered as compromised and the user no longer has access to the private key, thus precluding any attempt at self-revocation (if it was supported by X.509, which it is not).
Apr
20
comment Should I use a Certificate Revocation List?
@supercat: it turns out that the answer to your questions is "no", but it is a tricky one. It turns out (it was discovered in 2005) that given a signature value, it is possible to create a new key pair that matches that signature value over an arbitrary message m (not necessarily the one the signature s was computed over), and without knowing the private key that was used to produce s in the first place. See this article.
Apr
20
answered Linux kernel entropy - does it matter to /dev/urandom and what is a minimum?