685 reputation
219
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 4 months
seen Mar 27 at 12:08

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


May
1
answered Practical necessity of semantic security under chosen plain text attack (CPA) in CBC mode
Nov
24
comment Is a book cipher provably secure?
Interesting. Given an attacker with moderate resources (i.e. one that doesn't have access to the entire world's literature) it seems that it would be secure as long as the pages, lines and letter offsets were chosen with reasonably random distribution.
Nov
24
comment Is a RSA-signature of some identifying data a safe way to implement a license key?
@MichaelKjörling - I misunderstood the intent of your response. The product ID is designed to identify the use of a particular license on a particular machine. A fresh re-install on the same machine with the same key and exact same hardware will not produce the same ID, because it's considered a separate install of that license. On a mass license, however, the product ID will be the same regardless of the hardware it runs on. Using the product ID of the OS as a basis for any security mechanism is flawed at best.
Nov
24
revised Is a book cipher provably secure?
edited title
Nov
24
revised Is a book cipher provably secure?
typo
Nov
24
asked Is a book cipher provably secure?
Nov
24
comment Is HTTPS secure if someone snoops the initial handshake?
Just keep in mind that tools like sslstrip can be used to perform a man-in-the-middle attack. The user will see a standard http:// page instead of a https:// page. This isn't due to any vulnerability in the crypto, it's just a problem with how the HTTP protocol works. HTTP Strict Transport Security seems to be a patch for this though: tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-03
Nov
24
comment Security of simple xor and s-box cipher?
Hmm, do we compute each $S[x]$ for $x$ on the fly, using some function $f$, rather than "caching" the entire $S$ field in an array somewhere?
Nov
24
comment Security of simple xor and s-box cipher?
@PaŭloEbermann - Thanks for the extra explanation. This is mainly as a hobby; I'm not exactly trying to produce the next AES. I understand most of the mathematical principles behind crypto, but I was never taught any formal notation, which can make things a little awkward. I learn fast, though! :)
Nov
24
comment Security of simple xor and s-box cipher?
Wow. This answer is precisely what I was looking for. The only part I don't quite get is the S-box section - are you implying that a $S[x]$ is meant to exist for every $n$-bit $x$, where $n$ is the block size? Wouldn't this result in ludicrously sized S-boxes? I know you mentioned something about huge S-boxes that can't fit in the universe (yay for the $10^{89}$ particle limit!) but I'm not sure how this works practically.
Nov
24
comment Desirable S-box properties
Could you explain criteria R5 and R7, please? And is criteria R2 essentially "No S[x] must exist for x where the result is a rotation of x, e.g. 01010010 -> 10010100"?
Nov
24
comment Is a RSA-signature of some identifying data a safe way to implement a license key?
@MichaelKjörling - The motherboard and hard disk serial numbers are unique to each item, not unique to the product or brand. Using WMI you can query Win32_BIOS for SerialNumber on the first instance (there should only be one), which will give you the serial number of the BIOS device. You can do the same with Win32_Baseboard.SerialNumber, which gives you the serial number of the motherboard. You can grab WMI Explorer from here to take a look around: ks-soft.net/hostmon.eng/wmi/index.htm
Nov
23
comment Security of simple xor and s-box cipher?
Same issues for all the stuff like $E : K \times M \to M$. It's completely opaque to me without a description.
Nov
23
comment Security of simple xor and s-box cipher?
Buh? Any chance you could clear up your explanation to avoid use of stuff like $\mathbb{Z}_m$, or at least explain the meaning of them? I'm not versed in such formal notation. I didn't understand a single part of anything you typed in LaTeX.
Nov
23
comment Security of simple xor and s-box cipher?
@Ninefingers - I've removed the S-box specific stuff and added a link.
Nov
23
revised Security of simple xor and s-box cipher?
deleted 241 characters in body
Nov
23
comment Security of simple xor and s-box cipher?
@Ninefingers - I was happy with it the way it was, but the responses relied heavily on my original question, so I put the original implementation back. Wasn't sure what else to do. Feel free to revert.
Nov
23
comment Security of simple xor and s-box cipher?
Yes, it splits each block and each round key into 16 blocks of 16 bits, then computes $S[M \oplus k]$ for each of those blocks. It might technically be described as a 16-bit block size and 256 rounds, with each round key being a subsection of the actual key.
Nov
23
comment Security of simple xor and s-box cipher?
For every single block there are 16 rounds, i.e. $C_n = M_n$, then loop $C_n = S[K_r \oplus C_n]$ for $r = 0 \to 15$ for each block $n$.
Nov
23
comment Security of simple xor and s-box cipher?
@EthanHeilman - Done.