12,558 reputation
11353
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 4 months
seen 59 mins ago

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

Vote for me in the Mathematics.SE 2014 moderator election!


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:

CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


Oct
27
comment Are there attacks that break collision resistance but not preimage resistance?
OK, great! I've remade the edits.
Oct
27
revised Are there attacks that break collision resistance but not preimage resistance?
rolled back to a previous revision
Oct
27
comment How can I prove/disprove that a construction yields a secure PRG?
Is the input space of your PRG really $\{0,1\}^*$? If so, what's the distribution of the inputs? (It can't be uniform, since there is no uniform distribution over $\{0,1\}^*$.)
Oct
27
revised What's the difference between the long term key and the session keys?
deleted 2 characters in body; edited tags; edited title
Oct
27
comment Are there attacks that break collision resistance but not preimage resistance?
I tried to copyedit your question, but I realized that I wasn't really sure whether you were asking for attacks that break preimage resistance but not collision resistance, or the other way around. Could you please clarify that?
Oct
27
revised Are there attacks that break collision resistance but not preimage resistance?
rolled back to a previous revision
Oct
27
revised Are there attacks that break collision resistance but not preimage resistance?
added 384 characters in body
Oct
25
comment Can you help me understand how RC4-52 is done using pen-and-paper?
Somewhat related: crypto.stackexchange.com/questions/844/…
Oct
25
revised Is there a secure cryptosystem that can be performed mentally?
edited tags
Oct
21
comment Safety when disclosing hashes of secrets used to calculate other secrets
And if you don't want to exclude the empty string, you can always, say, publish HMAC(A, "0") and return HMAC(A, "1" || B) when given B.
Oct
21
comment Safety when disclosing hashes of secrets used to calculate other secrets
That's not really a goal in the sense I meant -- it's, at best, the means of reaching some goal that you haven't told us. But fair enough -- if that's all you need, then Ricky's suggestion of using HMAC should do fine.
Oct
21
comment How vulnerable is RSA when using it to encode ~1000s of datasets with 500bytes each? How easy can the private key passphrase be hacked?
As for the second problem, what I meant is that is should be as slow as possible for an attacker to test whether a guessed password is correct. The typical way to do that is to use a deliberately slow function (such as PBKDF2) to transform the password into whatever it is that you'll actually use to verify the correctness of the password and to decrypt the encrypted RSA key (which can be the same thing -- if you use an authenticated key wrap algorithm like SIV to encrypt the RSA key, then a successful decryption means the password must be correct).
Oct
21
comment How vulnerable is RSA when using it to encode ~1000s of datasets with 500bytes each? How easy can the private key passphrase be hacked?
IMO, "password strength checkers" frequently do more harm then good: diligent and security-conscious users don't need them, and lazy users will just pick the easiest password that passes the check, leading to passwords like "pa$$w0rd" or "asdfghjkl;'1234567890". Better to tell your users how to choose good passwords, and/or provide a secure random password generator.
Oct
21
comment How does one use AES block cipher modes of operation?
This should be specified in SP 800-38A (specifically, look in Appendix B). Anyway, the usual method is to send the initial counter value with each message, and to increment the counter by 1 for every subsequent block in the message. (It's possible to leave out the initial counter value if the recipient can reliably infer it from some other data, such as a message number.) And what you seem to be forgetting is that the key is also needed for successful decryption. :)
Oct
20
awarded  Sportsmanship
Oct
20
revised Does MAC provide origin authentication? Why not just use symmetric encryption?
added 842 characters in body
Oct
20
answered How vulnerable is RSA when using it to encode ~1000s of datasets with 500bytes each? How easy can the private key passphrase be hacked?
Oct
20
comment Complexity class of an idealised version of Bitcoin's proof-of-work (hashcash)?
Without analyzing the specific hash function used, I don't see how we can even show totality. For an arbitrary hash function (or a random oracle), there's no a priori guarantee that any input hashes to a value less than $x$, although it's extremely likely that one in fact does.
Oct
20
answered Does MAC provide origin authentication? Why not just use symmetric encryption?
Oct
20
comment Safety when disclosing hashes of secrets used to calculate other secrets
What's the security goal of the overall scheme? In particular, if it's to prevent anyone else from later pretending to have known the secret before you published it, how do you plan to stop a potential pretender from simply relaying all queries to you?