13,536 reputation
33272
bio website paul-ebermann.tumblr.com
location Berlin, Germany
age
visits member for 3 years, 4 months
seen 2 hours ago

Don't fear to edit my posts: even if I have more reputation than you, I do make mistakes.

I'm now also a Moderator Pro Tempore (= until the first elections) at Cryptography Stack Exchange: feel free to come around and ask some cryptography questions.


My personal name is spoken as /ˈpawlo/ (IPA), in English this would be written similar to Powlo, I think (i.e. the vowels are ow and o), with an accent on the before-last syllable (which is the first in this case). It's the Esperanto form of my given name.

The photo shows my shadow, taken at night. My camera sometimes seems to forget all the other frequencies and only stores the green ones.

My current main private programming project is the game of fencing, an online abstract turn based strategy game. Implemented as a Java applet, using git as a version control system.


Some more links:


Nov
18
comment Is it possible to determine a PGP public key from encrypted data?
@Ricky I have to concur to e-sushi's comment ... could you write at least some excerpt of that answer here, maybe with some emphasis on the crypto-related stuff?
Nov
10
comment Opinion on my idea for storing credit cards securely
Welcome to Cryptography Stack Exchange. How would a user "provide his private key"? I guess usual users can memorize their credit card data easier than they can memorize a private key.
Nov
7
comment Crypto-Compression Algorithms?
@Habib: The size of the message space doesn't change by compression, assuming you are using lossless compression (i.e. compression which can be reverted). You just change the encoding of it to a form which is on average shorter.
Nov
2
comment How to figure out the size of the output of a cryptographic checksum function
Welcome to Cryptography Stack Exchange. It looks like your question is actually to be answered in exercise 20 – the text before it doesn't really explain it.
Oct
12
comment Block Cipher Modes
@DrLecter actually, with CBC you can parallelize the decryption, just not the encryption.
Oct
6
comment What does “nonlinear mapping” mean?
Welcome to Cryptography Stack Exchange. After your edit, it seems that we only can say "yes" or "no" (and I would say "yes"). Maybe you could move the answering part (after the sentence "I'm not sure if I understand this correct") into an actual answer?
Oct
6
comment Is there a string that's hash is equal to itself?
A rotation itself doesn't prevent things mapping to itself, e.g. (on a byte-level) rotating 11111111 by any amount still gives 11111111.
Oct
6
comment Skein or Keccak stream cipher construction
The stream cipher part is essentially counter mode with a hash function.
Sep
30
comment Homomorphic encryption based on XOR
yes, typo (now fixed). Yes, but the "field of order $2^q$" doesn't have the same addition (or multiplication) as the ring $\mathbb Z/_{2^q \mathbb Z}$, so you shouldn't talk about "$\bmod 2^q$" here. (It is now clearer after your edit.)
Sep
30
comment Homomorphic encryption based on XOR
(Actually, $x + y \bmod 2^q$ is not the same operation as $x \oplus y$ for $q > 1$.
Sep
30
comment Homomorphic encryption based on XOR
But for $p = 2^q$, we have $(a \oplus d) \oplus (b \oplus d) = (a \oplus b) \neq (a \oplus b) \oplus d$ – or do you want to define $x \boxplus y := x \oplus y \oplus d$?
Sep
28
comment Why does key generation take an input $1^k$, and how do I represent it in practice?
Why can't we select the $n^{\text {th}}$ circuit with the usual binary form of $n$?
Sep
13
comment Last Round in DES
You can incorporate the last swap into the final permutation.
Sep
12
comment Are there cryptographic hash functions with homomorphic properties?
Yes, "homomorphic" property is the right word.
Sep
12
comment Why are we advising PKI if we know that quantum computers will break them?
You have some mixup of the terms here. Also, how do you know what the future of quantum computing is?
Sep
7
comment Change Salt when Changing Password?
If there is an internal attacker (like a rouge sysop in a bigger team – not enough to change the software, but with access to the password database – or simply stolen backups), it might be feasible to have several breaches in sequence, which might not even be noticed.
Sep
6
comment Bit padding instead of PKCS#5 padding
Wouldn't the attack work just the same with partial bytes? If I understand right, this attack works by manipulating the previous ciphertext block which is XORed after decrypting, and you can manipulate it by individual bits just the same as by full bytes.
Aug
20
comment A patched SHA1 attempt for password verification
Collision resistance is not what you should worry about for password hashes, preimage resistance is the point.
Jul
27
comment CSPRNG that cannot be used as random extractor
I guess for a PRNG you usually have a short input and longer output, while in a randomness extractor it is the other way around. That might be the key point of difference.
Jul
27
comment True Random Number Generator by milliseconds per keystroke (TRNG-Kms)
@xorcoder Please refrain from insulting other members of this site (or anyone at all). I don't see anything wrong with owlstead's answer. I deleted your comments.