175,913 reputation
27376588
bio website bolet.org/~pornin
location Quebec City, Canada
age 40
visits member for 4 years, 6 months
seen 2 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Jun
27
awarded  sha
Jun
26
awarded  Nice Answer
Jun
25
awarded  Great Answer
Jun
24
awarded  Necromancer
Jun
22
comment What specific padding weakness does OAEP address in RSA?
Yes, the attack results in the decryption of one encrypted message, i.e., in a SSL context, the "pre-master secret" for one connection, resulting in decryption of that connection (actually, all connections that use the same SSL session).
Jun
21
reviewed Approve Does verifying identity by positions in passwords mean passwords are stored unhashed?
Jun
21
answered Aes encryption algorithm life time
Jun
17
awarded  Enlightened
Jun
17
awarded  Nice Answer
Jun
17
comment Should I change the password of my password manager regurlarly?
If the password is breakable, then regular change improves security only if the change occurs before the attacker loses patience and moves on to something else. I.e. it makes things better if you change the password every hour, but hardly if you change it every three months.
Jun
17
answered Why isn't there a certificate revocation request standard?
Jun
17
answered Should I change the password of my password manager regurlarly?
Jun
17
answered Are Keystroke and Click Loggers Legal?
Jun
17
reviewed Approve Are Keystroke and Click Loggers Legal?
Jun
17
answered Can I convert a public key to a private key?
Jun
16
comment Can an embedded CRL be trusted?
The concept for that in *AdES is the "grace period": you use two timestamps, one on the signed object, then another one on the whole archive after, say, one week. The grace period is supposed to be sufficiently long that any compromise would have been detected in the mean time (if you prefer, the "grace period" represents a limit on how far back in time a CA may revoke a certificate retroactively).
Jun
16
answered Can an embedded CRL be trusted?
Jun
16
answered Assuming proper creation, encryption, and storage, how is a breach/leak of a hash worriesome?
Jun
16
awarded  Great Answer
Jun
15
revised Recommended # of iterations when using PKBDF2-SHA256?
Fixed speed estimate; added a paragraph on DoS.