12,438 reputation
11352
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 4 months
seen 10 hours ago

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:

CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


Sep
16
revised Precise meaning of various terms related to universal hash functions
fix list formatting, try to make the question less "homeworky"
Sep
13
comment Zero knowledge proof of possession of key
Ps. An obvious solution would be for Alice to calculate a commitment $Q$ to $M$ and tack it onto $C$. Technically, this doesn't prove that $C$ decrypts to $M$, but it does prove that Alice knew $M$ when she generated $C$.
Sep
13
comment Zero knowledge proof of possession of key
What's Dave's role in all this, from Alice and Bob's perspective? You say he "performs certain operations" based on $M$, but you also say that he has no contact with Alice or Bob (except, presumably, for receiving $C$ from Bob). So if Dave can't communicate the results of his "certain operations" back to Bob, why does he even need to be part of the whole system?
Sep
13
comment Can I dynamically calculate an appropriate number of iterations for PBKDF2 based on the system time, rather than using a fixed value?
@Tiran: Why not give the salt away? It's not like salts are supposed to be secret, anyway. Or, if you do want to include a "secret salt", you can always have a second KDF pass (which need not be slow) on the server with a different salt. (That's actually a good idea anyway, since you don't want to store password-equivalent tokens, like the client-side KDF output, unhashed in the database.) Really, doing key stretching on the client side is an excellent idea, it's just not very widely used yet.
Sep
11
revised Can you help me understand PFS and wPFS?
edited tags, copyedit
Sep
11
reviewed Approve How do you find a cheater in Shamir Secret Sharing?
Sep
10
awarded  Revival
Sep
9
awarded  Nice Answer
Sep
8
comment Who uses Dual_EC_DRBG?
@D.W.: I agree that the link is useful, but a summary (along with the link, of course) would IMO be even better. On one hand, the NIST table isn't exactly easy to read; on the other, it strikes me that having a summary of the current situation, as of this writing, could also be useful for future readers.
Sep
5
answered Who uses Dual_EC_DRBG?
Sep
5
reviewed Edit schnorr-signature tag wiki excerpt
Sep
5
revised schnorr-signature wiki excerpt
added 36 characters in body
Sep
5
reviewed Approve schnorr-signature tag wiki
Sep
5
revised Is there an encryption/decryption algorithm that can give two different outputs?
edited tags
Sep
5
comment Is there an encryption/decryption algorithm that can give two different outputs?
Ps. A one-time pad is the obvious trivial answer, but I assume you're looking for a practical scheme (i.e. one that doesn't require a key as long as the message).
Sep
5
comment Is there an encryption/decryption algorithm that can give two different outputs?
Related: Deniable Encryption from simple primitives, Is there a way to encrypt multiple sets of data into one result, with separate keys decrypting each set of data and maybe Encryption algorithm that produces dummy output on incorrect passwords
Sep
5
answered Is it possible to anonymize web traffic so that the IP Address cannot be determined while still being able to determine distinct IPs?
Sep
4
comment Will rehashing an SHA256 hash continually, eventually produce every possible value?
@Earlz: You could test it on a truncated version of SHA-256. Something like, say, 24 or even 32 bits ought to be doable. (Or course, this won't prove anything about the full SHA-256 behaving the same way, but it's at least illustrative.)
Sep
4
revised One-way function and $EXP$
fix spacing and line wrapping
Sep
4
revised one-way-function wiki excerpt
typo