13,720 reputation
11458
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 7 months
seen 2 days ago

I'm not really a cryptographer, I just play one on the Internet. ;-)

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:

CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


2d
revised Which characters to take into account when calculating unicity distance?
edited tags
2d
wiki created unicity-distance description
2d
wiki created unicity-distance excerpt
2d
comment How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
... Essentially, this holds whenever the ciphertext we're trying to decrypt is longer than the unicity-distance of the cipher.
2d
comment How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
@RenéG: If there are only $2^{24}$ possible keys, as in the question above, the it's very unlikely that any of those keys would, just by chance, decrypt an 11-byte ciphertext to "black white". (The details depend on the cipher, but for, say, a modern additive stream cipher, the probability of this happening is about one in $2^{64}$, or about one in 18 quintillion (= billion billion).) Indeed, since there are far fewer than $2^{64}$ 11-character combinations of English words, it's extremely unlikely that a wrong key would decrypt your ciphertext to anything that looks like English.
Mar
21
comment Is it safe to prefix the a key with a known value?
@CodesInChaos: I would. HMAC does have its quirks (like the ability to easily construct equivalent keys of different length), but it's still a secure MAC with keys of any length (even if the nominal security level is capped by the hash output length), as long as they have enough entropy to resist brute force attacks. (That said, if you're using multiple HMAC keys derived from each other, you should probably ensure that they're all the same length, or otherwise that they cannot be equivalent. Using a proper KDF to derive your keys from a single master key is generally enough.)
Mar
21
answered Is it safe to prefix the a key with a known value?
Mar
19
comment Deciphering text encrypted with a changing cipher
@Paŭlo: Specifically, it's equivalent to the rarely used shift-register variant of CFB, where the encryption unit is smaller than a full cipher block. There are security proofs for that variant, too, although the IV requirements are slightly stricter. (Also, just noticed that my link was broken; fixed.)
Mar
19
answered Deciphering text encrypted with a changing cipher
Mar
19
reviewed Leave Open Deciphering text encrypted with a changing cipher
Mar
19
reviewed Satisfactory Is it possible: Derived key based on variable number of private keys?
Mar
19
reviewed Satisfactory Why are some $x$ coordinates unsuitable for an ECDSA generator point?
Mar
19
reviewed Excellent Do any stream ciphers with aperiodic keystreams exist?
Mar
19
reviewed Needs Improvement Save the last cycle in GCM GHASH calculation
Mar
19
reviewed Satisfactory Generate secure password hashes without access to PBKDF2 or bcrypt
Mar
19
reviewed Satisfactory Additional Data in AEAD (Chacha20-poly1305 libsodium)
Mar
19
reviewed Satisfactory Finding $x$'s parity in the discrete log problem
Mar
18
reviewed Satisfactory Definition of the Decryption oracle
Mar
18
reviewed Satisfactory ElGamal and Schnorr groups
Mar
18
reviewed Needs Improvement Diffie-Hellman Application