281 reputation
17
bio website stephenharris.info
location Edinburgh, United Kingdom
age 25
visits member for 1 year, 9 months
seen Jan 21 at 15:45

Mathematics PhD student at the University of Edinburgh with a (geeky) passion for anything coding related.

I've recently created a new WordPress Event management plugin, Event Organiser.


Jun
27
awarded  Yearling
Sep
21
awarded  Custodian
Sep
9
suggested suggested edit on Is it safe to use file's hash as IV?
Aug
19
awarded  Commentator
Aug
19
comment Cryptanalysing Affine cipher
You have $a$, and you have values for $x$ and $c$. Solve for $b$. This question would be more appropriate at Maths SE.
Aug
19
awarded  Citizen Patrol
Aug
17
awarded  Critic
Aug
16
answered Can I use PBKDF2 for authentication and decryption?
Aug
16
comment What is the actual difference between security through obscurity and true encryption?
That's is a very good point - but its hard to quantify how difficult it is for an attacker to obtain the algorithm. They could reverse engineer/blackmail/buy/steal it. Keeping the algorithm secret is a good thing to do - but the security of commmunication should rely solely on the key. If you're using a potentially vulnerable algorithm just to keep it secret that's risky. Also SCAs are often the result of poor implementation - if you're doing it right - an attacker knowing the algorithm shouldn't be a concern.
Aug
16
comment PBKDF2 and salt
@Eyal - could you ask this as another question? Based on this memo (section 3), I believe you can just use PBKDF2 to produces a (let's say) 256-bit key, and split that into 2 keys of 128-bits one used for MAC & the other encryption. But I'd like to know what others think. Or do you mean use it generate a key and also a hash for password storage? In any case, I think this is worth a new question.
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
In terms of a cryptographic system I would say the risks of potential vulnerabilities in a encryption method out weigh the benefits of keeping that method secret and out of the scrutiny of peer review (unless you're the NSA / GCHQ...). Sure obscurity can make a lazy attacker's life more difficult - but in the context of the question - it would probably make the encryption less secure. You can add obscurity by not announcing how you encrypt data - but you shouldn't rely on it as if it were security.
Aug
14
comment What is the actual difference between security through obscurity and true encryption?
But would the keyspace be larger than say, 2^128, and more importantly, are all locations equally probable? Would all locations be equally safe? If I also know something about who/what is creating these methods, I might also gleam information from that too. In the end, methods won't be truly random so won't have the same properties as a key.
Aug
14
reviewed Approve suggested edit on What is the actual difference between security through obscurity and true encryption?
Aug
14
answered What is the actual difference between security through obscurity and true encryption?
Aug
10
comment Why can't the IV be predictable when its said it doesn't need to be a secret?
Actually we're just measuring the probability of different things :) - I was looking at the probability of the next IV clashing.
Aug
10
answered Why can't the IV be predictable when its said it doesn't need to be a secret?
Aug
10
comment Why can't the IV be predictable when its said it doesn't need to be a secret?
Would random IVs in CTR be safe? With random IVs there is potential of a repeat (after M messages this would occur with probability $M2^{-128}$). Granted this pretty negligible - by why risk it? As you mention predictability in CTR is fine.
Aug
9
answered PBKDF2 and salt
Aug
9
comment Relative security of a Vigenère cipher
With sufficient ciphertext, statistical analysis can also reveal the key length. Further analysis on each block can potentially reveal each letter in the key regardless of whether or not they are random.
Jun
29
comment Expectation Value of the Index of Coincidence
A random variable is a map from a probability space to a space of 'outcomes'. $IC$ is a probability. The $IC_{expected}$ is the probability that two letters taken from the alphabet match and depends on the statistical characteristics of the language. You compare this with the calculated $IC$ (which is a ratio of number of matches to number of pairings). You then use the above formula to solve for $t$. This gives an estimate for the period used.