Stephen Touset

1,251 reputation

215

bio	website	touset.org
	location	San Francisco, CA
	age	29
visits	member for	7 months
	seen	47 mins ago
stats	profile views	14

Cyclist. Rubyist.

	1,251 reputation	bio	website	touset.org	visits	member for	7 months
215 badges		location	San Francisco, CA		seen	47 mins ago

summary answers questions tags badges favorites bounties reputation activity

235 Actions

suggestions reviews revisions comments badges posts accepts all

Feb 14	comment	Use of CBC-AES-256 to encrypt usernames What is the threat model? Specifically, what kinds of attacks are you trying to protect against? Usernames are generally considered to be public information.
Feb 13	comment	Why is OCB-AES mode not becoming a standard for authenticated encryption? OCBv1 didn't allow for associated data, but it was introduced in OCBv2.
Feb 11	comment	Attack XOR encryption of binary data compressed by zlib with known key length (very short key) Check out the DEFLATE stream format. Long story short, the first bit is going to be a $1$, and the next two bits are highly likely to be a $10$. That'll get you somewhere, at least.
Feb 6	comment	Why does the recommended key size between symmetric and assymetric encryption differ greatly? Edited reply to fix.
Feb 6	revised	Why does the recommended key size between symmetric and assymetric encryption differ greatly? added 31 characters in body
Feb 5	comment	How to check the strength of an encryption algorithm? Furthermore, by the wording of your question, it appears likely that you may have designed and implemented your own algorithm. If this is the case, it is a virtual certainty that your algorithm is trivially breakable.
Feb 5	comment	How to check the strength of an encryption algorithm? @SamuelMedhat Imagine if you'd gone into an aviation forum and asked, "How can I check if the plane I've built is airworthy and reliable?" This type of question is something that needs to be considered before building the system, not after.
Feb 5	comment	Why does the recommended key size between symmetric and assymetric encryption differ greatly? @fgrieu I used Wikipedia's article on integer factorization.
Feb 5	revised	Why does the recommended key size between symmetric and assymetric encryption differ greatly? deleted 4 characters in body
Feb 5	revised	Why does the recommended key size between symmetric and assymetric encryption differ greatly? added 35 characters in body
Feb 5	comment	Why does the recommended key size between symmetric and assymetric encryption differ greatly? Yes, sorry, that was a mistake on my part overloading $n$ to mean both the bit length of keys as well as the modulus. It's been fixed.
Feb 5	revised	Why does the recommended key size between symmetric and assymetric encryption differ greatly? deleted 4 characters in body
Feb 4	answered	Why does the recommended key size between symmetric and assymetric encryption differ greatly?
Feb 4	comment	AES CBC with fixed or predictable IV, what are the risks? I'd just like to add that CBC isn't just "not great" at providing integrity protection. It doesn't provide integrity protection at all. It is in many cases a simple process of simple trial and error for an attacker to insert whatever he/she wants into a CBC-encrypted string.
Feb 2	comment	Commutativity of keyed hashes You are rolling your own crypto. Please stop. Use a purpose-designed password hashing algorithm like bcrypt.
Jan 30	comment	How to best obtain bit sequences from throwing normal dice? You could always discard die rolls corresponding to 4 and 5. Then each die roll produces two bits of entropy.
Jan 30	comment	Question about use of IV in this cipher Based on his comment replies, OP still seems intent on encrypting his IVs. I merely wanted to reiterate the point. He is going through a lot of complicated effort for little gain.
Jan 30	comment	Question about use of IV in this cipher But you should note that encrypting the IV is wholly unnecessary. There is zero requirement for the IV to be secret.
Jan 30	comment	Question about use of IV in this cipher It's difficult to understand what you're even trying to accomplish. You're doing a lot of extremely complex things and I'm not sure there's necessarily a reason. Can you edit your post to include what it is exactly you're trying to do?
Jan 26	comment	Theoretical pi-based stream cipher Nothing we've not all been guilty of at some point. Regardless, it was absolutely worth pointing out.