meta user
network profile
| bio | website | stephenharris.info |
|---|---|---|
| location | Edinburgh, United Kingdom | |
| age | 25 | |
| visits | member for | 11 months |
| seen | Apr 1 at 19:17 | |
| stats | profile views | 1 |
Mathematics PhD student at the University of Edinburgh with a (geeky) passion for anything coding related.
I've recently created a new WordPress Event management plugin, Event Organiser.
|
Sep 21 |
awarded | Custodian |
|
Sep 9 |
suggested | suggested edit on Is it safe to use file's hash as IV? |
|
Aug 19 |
awarded | Commentator |
|
Aug 19 |
comment |
Cryptanalysing Affine cipher You have $a$, and you have values for $x$ and $c$. Solve for $b$. This question would be more appropriate at Maths SE. |
|
Aug 19 |
awarded | Citizen Patrol |
|
Aug 17 |
awarded | Critic |
|
Aug 16 |
answered | Can I use PBKDF2 for authentication and decryption? |
|
Aug 16 |
comment |
What is the actual difference between security through obscurity and true encryption? That's is a very good point - but its hard to quantify how difficult it is for an attacker to obtain the algorithm. They could reverse engineer/blackmail/buy/steal it. Keeping the algorithm secret is a good thing to do - but the security of commmunication should rely solely on the key. If you're using a potentially vulnerable algorithm just to keep it secret that's risky. Also SCAs are often the result of poor implementation - if you're doing it right - an attacker knowing the algorithm shouldn't be a concern. |
|
Aug 16 |
comment |
PBKDF2 and salt @Eyal - could you ask this as another question? Based on this memo (section 3), I believe you can just use PBKDF2 to produces a (let's say) 256-bit key, and split that into 2 keys of 128-bits one used for MAC & the other encryption. But I'd like to know what others think. Or do you mean use it generate a key and also a hash for password storage? In any case, I think this is worth a new question. |
|
Aug 14 |
comment |
What is the actual difference between security through obscurity and true encryption? In terms of a cryptographic system I would say the risks of potential vulnerabilities in a encryption method out weigh the benefits of keeping that method secret and out of the scrutiny of peer review (unless you're the NSA / GCHQ...). Sure obscurity can make a lazy attacker's life more difficult - but in the context of the question - it would probably make the encryption less secure. You can add obscurity by not announcing how you encrypt data - but you shouldn't rely on it as if it were security. |
|
Aug 14 |
comment |
What is the actual difference between security through obscurity and true encryption? But would the keyspace be larger than say, 2^128, and more importantly, are all locations equally probable? Would all locations be equally safe? If I also know something about who/what is creating these methods, I might also gleam information from that too. In the end, methods won't be truly random so won't have the same properties as a key. |
|
Aug 14 |
reviewed | Approve suggested edit on What is the actual difference between security through obscurity and true encryption? |
|
Aug 14 |
answered | What is the actual difference between security through obscurity and true encryption? |
|
Aug 10 |
comment |
Why can't the IV be predictable when its said it doesn't need to be a secret? Actually we're just measuring the probability of different things :) - I was looking at the probability of the next IV clashing. |
|
Aug 10 |
answered | Why can't the IV be predictable when its said it doesn't need to be a secret? |
|
Aug 10 |
comment |
Why can't the IV be predictable when its said it doesn't need to be a secret? Would random IVs in CTR be safe? With random IVs there is potential of a repeat (after M messages this would occur with probability $M2^{-128}$). Granted this pretty negligible - by why risk it? As you mention predictability in CTR is fine. |
|
Aug 9 |
answered | PBKDF2 and salt |
|
Aug 9 |
comment |
Relative security of a Vigenère cipher With sufficient ciphertext, statistical analysis can also reveal the key length. Further analysis on each block can potentially reveal each letter in the key regardless of whether or not they are random. |
|
Jun 29 |
comment |
Expectation Value of the Index of Coincidence A random variable is a map from a probability space to a space of 'outcomes'. $IC$ is a probability. The $IC_{expected}$ is the probability that two letters taken from the alphabet match and depends on the statistical characteristics of the language. You compare this with the calculated $IC$ (which is a ratio of number of matches to number of pairings). You then use the above formula to solve for $t$. This gives an estimate for the period used. |
|
Jun 28 |
awarded | Teacher |
