12,438 reputation
11352
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 4 months
seen 6 hours ago

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

Vote for me in the Mathematics.SE 2014 moderator election!


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:

CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


Sep
4
comment Will rehashing an SHA256 hash continually, eventually produce every possible value?
@Earlz: You could test it on a truncated version of SHA-256. Something like, say, 24 or even 32 bits ought to be doable. (Or course, this won't prove anything about the full SHA-256 behaving the same way, but it's at least illustrative.)
Sep
4
revised One-way function and $EXP$
fix spacing and line wrapping
Sep
4
revised one-way-function wiki excerpt
typo
Sep
4
comment Using one-way hash functions as the encryption method
As for your other questions above: 1) SHA-512 only has 512 bits of internal state, so it can't store more entropy than that anyway. Up to that limit, the last 512 bits of the ciphertext should contain all the entropy in the key and message put together, so you don't really need any more. 2) If you increase the attacker's workload by a factor of 8 (he has to try up to 8 hashes to find the right one), that's equivalent to 3 bits of extra strength ($2^3 = 8$). 3) Yes, encrypt-then-MAC is generally better, but the "SIV trick" (using the MAC of the plaintext as an IV) wouldn't work with it.
Sep
4
comment Using one-way hash functions as the encryption method
Bob could send both two separate keys to Alice, but generally, secure key distribution is the hard part of symmetric-key encryption. If Bob can send, say, 1024 key bits to Alice, they're better off using it all as $K_1$, and deriving $K_2$ from it as I suggested, than they'd be splitting it into two 512-bit keys. As for key reuse, yes, both keys can be reused for multiple messages. The important part in the modified scheme is that $K_1$ is only used to HMAC plaintext, while $K_2$ is only user to HMAC ciphertext. That's why two keys are needed.
Sep
3
revised one-way-function wiki description
rewrite
Sep
3
revised one-way-function wiki excerpt
rewrite
Sep
3
wiki created key-reuse description
Sep
3
wiki created key-reuse excerpt
Sep
3
revised Using one-way hash functions as the encryption method
oops, the original scheme was broken if used without a nonce; fix it!
Sep
3
comment Using one-way hash functions as the encryption method
For each word, I suggested HMACing the previous 16 bytes (i.e. 512 bits) of the ciphertext (i.e. the part of the ciphertext encoding the previous word). You could HMAC more of the preceding ciphertext, but there's no real advantage to it. As for the hash and the key length, hiding the choice of the hash only adds at most a few bits of strength. That hardly makes up for the fact that it makes the security of your scheme harder to study. And you can use a longer key if you want, but 128 bits is enough to thwart any plausible brute force attacks using computers based on known physics.
Sep
3
revised Using one-way hash functions as the encryption method
added 243 characters in body
Sep
3
answered Using one-way hash functions as the encryption method
Sep
3
comment Using one-way hash functions as the encryption method
@jj57: Having an Enigma machine just tells you how the scheme works, not what key was used to encrypt a given message. A modern, secure encryption scheme would not have been affected in any way by an attacker obtaining an encryption device, or even a detailed schematic of one. See Kerckhoffs' principle for details.
Sep
3
revised Self-expiring symmetric keys, or: cryptography in absence of secure deletion
edited tags
Sep
3
revised Any problems with this secure time synchronization scheme?
edited tags
Sep
3
revised What is the progress on the MIT LCS35 Time Capsule Crypto-Puzzle?
edited tags
Sep
3
revised Time Capsule cryptography?
edited tags
Sep
3
wiki created timed-release description
Sep
3
wiki created timed-release excerpt