Ilmari Karonen

6,291 reputation

725

bio	website	vyznev.net
	location	Helsinki, Finland
	age
visits	member for	1 year, 9 months
	seen	May 12 at 7:27
stats	profile views	90

I'm not really a cryptographer, I just play one on the internet.

Seriously, I'm just a programmer and mathematician interested in puzzles and information security. I don't have any kind of formal crypto training, but I've picked up a few things here and there over the years. Topics I'm particularly interested in include protocol design and analysis, classical ciphers and information-theoretically secure crypto techniques such as one time pads and secret sharing schemes.

Please consider any (original) code I post to Stack Overflow (and other Stack Exchange sites) to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.

	6,291 reputation	bio	website	vyznev.net	visits	member for	1 year, 9 months
725 badges		location	Helsinki, Finland		seen	May 12 at 7:27

summary answers questions tags badges favorites bounties reputation activity

658 Actions

suggestions reviews revisions comments badges posts accepts all

Dec 25	answered	Families of public/private keys in elliptic curve cryptography
Dec 24	comment	How does one design a traffic analysis resistant protocol? (continued) About the best you can do is make that information as useless as you can, by making the server/network so widely used that just connecting to it tells little to anyone (which is really only tangentially related to crypto). Of course, you can also try to mask the message traffic as something else (as I believe e.g. TOR tries to look like HTTPS), but that's quite hard to do reliably.
Dec 24	comment	How does one design a traffic analysis resistant protocol? You're always going to leak some information about contact patterns. If you have a central server, an eavesdropper will know you connected to the server. If you have a distributed network, an eavesdropper will know you connected to the network.
Dec 23	comment	How does one design a traffic analysis resistant protocol? Yes, the trusted server is there as a simplification. If you don't trust anyone else, but do trust the people you're talking with, you could always have one of them act as the server (or even spread the load around in various ways). If you don't even wholly trust your conversation partners, things get tricky. However, in any case designing a robust and scalable distributed IM system is complicated enough even without throwing crypto into the mix.
Dec 23	revised	How does one design a traffic analysis resistant protocol? added 2721 characters in body
Dec 23	answered	How does one design a traffic analysis resistant protocol?
Dec 22	answered	Does this block cipher mode allow for decryption?
Dec 21	revised	ElGamal Signature Scheme: Recovering the key when reusing randomness added 1138 characters in body
Dec 21	revised	ElGamal Signature Scheme: Recovering the key when reusing randomness deleted 10 characters in body
Dec 21	answered	ElGamal Signature Scheme: Recovering the key when reusing randomness
Dec 20	answered	Can I determine if a user has the wrong symmetric encryption key?
Dec 20	revised	ElGamal Signature Scheme: Recovering the key when reusing randomness improve formatting
Dec 20	suggested	suggested edit on ElGamal Signature Scheme: Recovering the key when reusing randomness
Dec 16	comment	Creating a hash of XOR'd blocks I first thought it might've been supposed to be $h(m)=H(M_1)\oplus H(M_2)\oplus\dotsb\oplus H(M_\ell)$, where $H$ is a PRF, but that's not preimage resistant either. (You need to hash about as many random blocks as there are bits in the output and do some linear algebra to get first preimages, but that's a negligible amount of work.)
Dec 16	comment	How to choose a padding mode with AES All padding schemes leak some information about the length of the plaintext (unless all possible plaintexts are shorter than one padding block), None just leaks more of it. One should also beware padding oracle attacks; the best way to avoid them is to encrypt-then-MAC, but in any case it's a good idea not to try to verify the validity of padding.
Dec 16	revised	How safe is it to derive MAC key from a hashed password? added 1350 characters in body
Dec 16	answered	How safe is it to derive MAC key from a hashed password?
Dec 16	revised	How do you find a cheater in Shamir Secret Sharing? added 511 characters in body
Dec 16	answered	How do you find a cheater in Shamir Secret Sharing?
Dec 15	revised	RSA: If n=35, show that e will equal d improve formatting