Ilmari Karonen

6,341 reputation

725

bio	website	vyznev.net
	location	Helsinki, Finland
	age
visits	member for	1 year, 10 months
	seen	Jun 14 at 14:08
stats	profile views	91

I'm not really a cryptographer, I just play one on the internet.

Seriously, I'm just a programmer and mathematician interested in puzzles and information security. I don't have any kind of formal crypto training, but I've picked up a few things here and there over the years. Topics I'm particularly interested in include protocol design and analysis, classical ciphers and information-theoretically secure crypto techniques such as one time pads and secret sharing schemes.

Please consider any (original) code I post to Stack Overflow (and other Stack Exchange sites) to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.

	6,341 reputation	bio	website	vyznev.net	visits	member for	1 year, 10 months
725 badges		location	Helsinki, Finland		seen	Jun 14 at 14:08

summary answers questions tags badges favorites bounties reputation activity

656 Actions

suggestions reviews revisions comments badges posts accepts all

Apr 17	answered	How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
Apr 17	comment	Most frequently used digital signature schemes in the recent years I suspect this question may be hard to answer without narrowing the context down a bit, since digital signatures are used for so many purposes. Something like, say, "most frequently used signature algorithms for SSL/TLS certificates" might be easier to find a factual answer to.
Apr 16	revised	Deterministic nonces in CTR mode added 529 characters in body
Apr 16	answered	Deterministic nonces in CTR mode
Apr 15	comment	Is it possible to build an unfair noisy channel from 1 out of 2 oblivious transfer I was going to give an answer based on Rabin's oblivious transfer, but I realized that your question is somewhat underspecified. In particular, does the receiver want to learn $b$, or do they not care which bit they learn? Is it acceptable for the sender to sometimes know which bit the receiver will get? And is it acceptable for the receiver to sometimes obtain proof that the bit they received is indeed $b$? (I'd guess the answers to be "yes", "no" and "maybe", but I'd like to confirm that.)
Apr 15	comment	Is it possible to build an unfair noisy channel from 1 out of 2 oblivious transfer If I'm reading your definition of a "fair channel" correctly, there's no need for oblivious transfer (or any transfer) to implement one: the receiver can just choose a random bit, which will be equal to $b$ with probability 1/2 and equal to its complement otherwise. If that's correct, I wonder what use such a "channel" might be; if it's not, please clarify your post.
Apr 15	answered	Simple xor cipher extension
Apr 15	reviewed	Approve suggested edit on Simple xor cipher extension
Apr 14	revised	What “Tag Length” should be used for the EAX MAC? added 422 characters in body
Apr 14	answered	What “Tag Length” should be used for the EAX MAC?
Apr 11	revised	Can we use elliptic curve cryptography in wireless sensors? trim irrelevant tags
Apr 11	answered	Brute forcing Cardan grille
Apr 10	revised	DIfferent inner and outer hash functions for NIST Recommended HMAC? nicer latex formatting
Apr 10	answered	DIfferent inner and outer hash functions for NIST Recommended HMAC?
Apr 10	comment	Brute forcing Cardan grille An obvious upper bound is $2^{n^2}$, but it's hard to say anything more specific without knowing more details about the system. For example, do you know how many holes the grille has? And may a given letter in the message be visible through the grille in more than one orientation? (If yes, that means you have to strike out letters you've already used when decoding a message.)
Apr 9	revised	Is there a hash algorithm that is slow to calculate but relatively fast to check? added 507 characters in body
Apr 9	answered	Is there a hash algorithm that is slow to calculate but relatively fast to check?
Apr 9	comment	Does encrypting twice using the same block cipher produce a security weakness? @Jalaj, poncho: It's worth pointing out, however, that encrypting any two messages with the same RC4 key is unsafe. This is why, when using RC4 with long-term keys, the actual encryption key is normally derived from the long-term key and a unique per-message nonce using a suitable KDF. When used that way, double encryption with RC4 is completely safe.
Apr 9	comment	Is AES restricted to only 64 characters for the key/password? @rezx: I was tempted to point you to the Simple English Wikipedia, but to be honest, the corresponding article in the standard English Wikipedia is much better. See the "Key choice" section in particular.
Apr 9	comment	Is AES restricted to only 64 characters for the key/password? @rezx: Somewhat tangentially, that quote from the TrueCrypt version history does not exactly fill me with confidence, since it shows a misunderstanding of how HMAC works. The effective key length of HMAC is limited by the internal state size of the hash, which for SHA-1 is 160 bits. As the output length of SHA-1 is also 160 bits, it makes no noticeable difference whether the key is fed through the hash before use or not. The extra hashing pass just serves to distill the entropy of a long passphrase down to a more compact key string.