meta user
network profile
| bio | website | vyznev.net |
|---|---|---|
| location | Helsinki, Finland | |
| age | ||
| visits | member for | 1 year, 9 months |
| seen | May 12 at 7:27 | |
| stats | profile views | 90 |
I'm not really a cryptographer, I just play one on the internet.
Seriously, I'm just a programmer and mathematician interested in puzzles and information security. I don't have any kind of formal crypto training, but I've picked up a few things here and there over the years. Topics I'm particularly interested in include protocol design and analysis, classical ciphers and information-theoretically secure crypto techniques such as one time pads and secret sharing schemes.
Please consider any (original) code I post to Stack Overflow (and other Stack Exchange sites) to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.
|
Apr 30 |
comment |
Why does key generation take an input $1^k$, and how do I represent it in practice? Related: What does the expression $1^n$ mean as a function argument? |
|
Apr 29 |
comment |
Secure order preserving hash function @curious: Full semantic security with OPE is impossible anyway, and, technically, being able to efficiently recover plaintexts using an encryption oracle doesn't break the alternative security definition suggested by Boldyreva et al. It still makes the system rather useless in situations where such oracle access is possible. |
|
Apr 29 |
comment |
Parallelizing AES GCM in BouncyCastle @Thomas: For GCM, that kind of shoehorning might just be possible, depending on the exact API provided by the library. In particular, it's almost possible to break a message into pieces, encrypt each piece with GCM mode and assemble the results into a valid GCM encryption of the whole message; there are just a few pesky little interface details, like the restrictive IV processing, that can get in the way. Still, even if possible, it's not easy and definitely counts as using the interface in a way it was not meant to be used. |
|
Apr 29 |
comment |
Secure order preserving hash function @curious: Yes. As the paper you linked to notes at the end of section 1, order-preserving encryption is useless if the attacker has access to an encryption oracle. |
|
Apr 29 |
comment |
Secure order preserving hash function @curious: If I can choose a string and ask you for its hash, then the attacks still works. Even if I can only ask whether the hash of my string is less than the hash of your string, that's still enough information for this attack. |
|
Apr 29 |
revised |
Secure order preserving hash function edited tags |
|
Apr 29 |
answered | Secure order preserving hash function |
|
Apr 29 |
answered | what is the difference between Scrypt and PBKDF2 |
|
Apr 29 |
comment |
Counter Mode: static IV but different keys ...or maybe Does AES-CTR require an IV for any purpose other than distinguishing identical inputs? |
|
Apr 27 |
awarded | Necromancer |
|
Apr 27 |
comment |
Attacking historical ciphers methodology The Hill cipher isn't exactly unbreakable either. (Mind you, that question concerns a known-plaintext attack, but you could always do crib-dragging. Actually, it might be possible to use frequency analysis and linear algebra for a direct ciphertext-only attack... need to think about that a bit more.) |
|
Apr 27 |
answered | implementing long term archive encryption |
|
Mar 30 |
comment |
Using encryption schemes for identification I think you need to define your attack scenario a bit more precisely. In particular, can the attacker impersonate B to A? If so, they can carry out a straightforward MITM attack by just using the real B as an oracle. If not, why do you even need an authentication protocol? |
|
Mar 22 |
comment |
What is the difference between a hash and a permutation? @Nik: While there are various definitions of what constitutes a hash function, I don't think your example would qualify under most of them. Certainly it's not a hash function in the sense we usually use in cryptography. Still, you do have a point: if we restrict our hash to a set of inputs equal to its set of possible outputs, the thus restricted function could be a permutation. Most cryptographic hashes still won't be, though. |
|
Mar 22 |
answered | What is the difference between a hash and a permutation? |
|
Mar 5 |
comment |
is AES secure for java application licensing Digital signatures are a form of public key cryptography (but they don't generally involve encryption, although some algorithms such as RSA can be used for both). Their advantage in your situation is that the software only needs to contain the public half of the keypair, which can be used to verify signatures but not to create new ones. Of course, distributing a modified copy is still possible, but considerably less convenient for the cracker than simply distributing keys to unmodified copies. |
|
Mar 5 |
answered | is AES secure for java application licensing |
|
Mar 2 |
comment |
Why is CAMELLIA suddenly so widely used? @CodesInChaos: Indeed, this seems like a silly reason, given the existence of SSLHonorCipherOrder and similar options for other servers. Still, +1 to Jumbogram for figuring out the reason, even if it's silly. |
|
Mar 1 |
revised |
How to solve the reverse of an equation that uses MOD? copyedit |
|
Mar 1 |
reviewed | Approve suggested edit on How is CipherCloud doing homomorphic encryption? |
