12,328 reputation
11352
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 3 months
seen Nov 20 at 10:54

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

I started programming (in AmigaBASIC) when I was 10 years old. Nowadays, I'm most comfortable using Perl, C and JavaScript. I know Java and PHP too, but I can't really say I like them. I also know some Python, but not as much as I'd like.


CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:


Sep
13
comment Zero knowledge proof of possession of key
Ps. An obvious solution would be for Alice to calculate a commitment $Q$ to $M$ and tack it onto $C$. Technically, this doesn't prove that $C$ decrypts to $M$, but it does prove that Alice knew $M$ when she generated $C$.
Sep
13
comment Zero knowledge proof of possession of key
What's Dave's role in all this, from Alice and Bob's perspective? You say he "performs certain operations" based on $M$, but you also say that he has no contact with Alice or Bob (except, presumably, for receiving $C$ from Bob). So if Dave can't communicate the results of his "certain operations" back to Bob, why does he even need to be part of the whole system?
Sep
13
comment Can I dynamically calculate an appropriate number of iterations for PBKDF2 based on the system time, rather than using a fixed value?
@Tiran: Why not give the salt away? It's not like salts are supposed to be secret, anyway. Or, if you do want to include a "secret salt", you can always have a second KDF pass (which need not be slow) on the server with a different salt. (That's actually a good idea anyway, since you don't want to store password-equivalent tokens, like the client-side KDF output, unhashed in the database.) Really, doing key stretching on the client side is an excellent idea, it's just not very widely used yet.
Sep
11
revised Can you help me understand PFS and wPFS?
edited tags, copyedit
Sep
11
reviewed Approve suggested edit on How do you find a cheater in Shamir Secret Sharing?
Sep
10
awarded  Revival
Sep
9
awarded  Nice Answer
Sep
8
comment Who uses Dual_EC_DRBG?
@D.W.: I agree that the link is useful, but a summary (along with the link, of course) would IMO be even better. On one hand, the NIST table isn't exactly easy to read; on the other, it strikes me that having a summary of the current situation, as of this writing, could also be useful for future readers.
Sep
5
answered Who uses Dual_EC_DRBG?
Sep
5
reviewed Edit suggested edit on schnorr-signature tag wiki excerpt
Sep
5
revised schnorr-signature wiki excerpt
added 36 characters in body
Sep
5
reviewed Approve suggested edit on schnorr-signature tag wiki
Sep
5
revised Is there an encryption/decryption algorithm that can give two different outputs?
edited tags
Sep
5
comment Is there an encryption/decryption algorithm that can give two different outputs?
Ps. A one-time pad is the obvious trivial answer, but I assume you're looking for a practical scheme (i.e. one that doesn't require a key as long as the message).
Sep
5
comment Is there an encryption/decryption algorithm that can give two different outputs?
Related: Deniable Encryption from simple primitives, Is there a way to encrypt multiple sets of data into one result, with separate keys decrypting each set of data and maybe Encryption algorithm that produces dummy output on incorrect passwords
Sep
5
answered Is it possible to anonymize web traffic so that the IP Address cannot be determined while still being able to determine distinct IPs?
Sep
4
comment Will rehashing an SHA256 hash continually, eventually produce every possible value?
@Earlz: You could test it on a truncated version of SHA-256. Something like, say, 24 or even 32 bits ought to be doable. (Or course, this won't prove anything about the full SHA-256 behaving the same way, but it's at least illustrative.)
Sep
4
revised One-way function and $EXP$
fix spacing and line wrapping
Sep
4
revised one-way-function wiki excerpt
typo
Sep
4
comment Using one-way hash functions as the encryption method
As for your other questions above: 1) SHA-512 only has 512 bits of internal state, so it can't store more entropy than that anyway. Up to that limit, the last 512 bits of the ciphertext should contain all the entropy in the key and message put together, so you don't really need any more. 2) If you increase the attacker's workload by a factor of 8 (he has to try up to 8 hashes to find the right one), that's equivalent to 3 bits of extra strength ($2^3 = 8$). 3) Yes, encrypt-then-MAC is generally better, but the "SIV trick" (using the MAC of the plaintext as an IV) wouldn't work with it.