13,332 reputation
bio website paul-ebermann.tumblr.com
location Berlin, Germany
visits member for 3 years, 2 months
seen 4 hours ago

Don't fear to edit my posts: even if I have more reputation than you, I do make mistakes.

I'm now also a Moderator Pro Tempore (= until the first elections) at Cryptography Stack Exchange: feel free to come around and ask some cryptography questions.

My personal name is spoken as /ˈpawlo/ (IPA), in English this would be written similar to Powlo, I think (i.e. the vowels are ow and o), with an accent on the before-last syllable (which is the first in this case). It's the Esperanto form of my given name.

The photo shows my shadow, taken at night. My camera sometimes seems to forget all the other frequencies and only stores the green ones.

My current main private programming project is the game of fencing, an online abstract turn based strategy game. Implemented as a Java applet, using git as a version control system.

Some more links:

comment Last Round in DES
You can incorporate the last swap into the final permutation.
comment Are there cryptographic hash functions with homomorphic properties?
Yes, "homomorphic" property is the right word.
comment Why are we advising PKI if we know that quantum computers will break them?
You have some mixup of the terms here. Also, how do you know what the future of quantum computing is?
comment Change Salt when Changing Password?
If there is an internal attacker (like a rouge sysop in a bigger team – not enough to change the software, but with access to the password database – or simply stolen backups), it might be feasible to have several breaches in sequence, which might not even be noticed.
comment Bit padding instead of PKCS#5 padding
Wouldn't the attack work just the same with partial bytes? If I understand right, this attack works by manipulating the previous ciphertext block which is XORed after decrypting, and you can manipulate it by individual bits just the same as by full bytes.
comment A patched SHA1 attempt for password verification
Collision resistance is not what you should worry about for password hashes, preimage resistance is the point.
comment CSPRNG that cannot be used as random extractor
I guess for a PRNG you usually have a short input and longer output, while in a randomness extractor it is the other way around. That might be the key point of difference.
comment True Random Number Generator by milliseconds per keystroke (TRNG-Kms)
@xorcoder Please refrain from insulting other members of this site (or anyone at all). I don't see anything wrong with owlstead's answer. I deleted your comments.
comment Leak-proof protocol: is such a thing possible?
How would using scrypt in any way reduce the leakage rate? I can see it reducing the encryption rate, but this would not really help.
comment What exactly does a key do?
@Wad: yes, one of the 26 keys (the "shifting by 0" one) would be a weak key, which doesn't change anything. If you are encrypting only a single letter, then this is just a valid key as all other ones.
comment Attacks on AES-128 (ECB) based on some knowledge of plaintext
What are your security goals with your protocol?
comment Associative standard cryptographic hash function
Are restrictions on $a$ and $b$ allowed (like a fixed size or such)?
comment How come Shamir Secret Sharing uses Lagrange interpolation?
What does "computational complexity" mean here? These are the same polynomials, just written differently.
comment What algorithm would give the shortest ciphertext for very short plaintexts?
@tylo counter mode by itself doesn't provide any authentication, so an intercepting attacker who guesses the right plaintext can substitute an arbitrary different one.
comment Is HMAC needed for a SHA-3 based MAC?
There are MAC schemes based on SHA-3 which don't do the nested hashing of HMAC, but please don't call them "HMAC".
comment which of these is more secure (bcrypt vs srp)
Your answer explains why HTTPS is to be considered not secure enough, though it doesn't answer the question at all, which is whether SRP or a double bcrypt is better.
comment Familiar key signing over video call
@Jonhoo thanks for the note, I fixed them.
comment Are those RSA keys flawed?
Just to emphasize: Don't use these specific keys for anything now. If the private key was published, anyone could try it and break your cipher/signature.
comment How can I make a message into a blocks for NTRU?
I suppose the responses to How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext? apply here just as well.
comment Does the secret key used in AES have to prime?
Please note that RSA doesn't use prime keys, but (usually) semi-prime ones (which are a product of two primes).