13,720 reputation
11458
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 7 months
seen Mar 24 at 1:45

I'm not really a cryptographer, I just play one on the Internet. ;-)

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:

CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


Mar
10
answered Known plaintext, unknown 128 bit block cipher
Mar
10
reviewed Leave Open Known plaintext, unknown 128 bit block cipher
Mar
10
reviewed Close Fault encryption attack on RSA
Mar
10
revised Reusing the random exponent for ElGamal encryption with different plaintexts
more detailed title, fix spelling of ElGamal, improved math formatting, misc. copyedits
Mar
4
answered Which characters to take into account when calculating unicity distance?
Mar
4
comment Is CBC theoretically harder to brute force when compared with ECB?
You're talking about a scenario where the attacker can obtain many messages encrypted with different keys, and only needs to break one key, right? I agree, ECB is (slightly) weaker than CBC in that case, at least as long as the IVs for CBC are properly chosen (i.e. unpredictable by the attacker).
Mar
4
comment AES mode scheme feedback
For the second part, see crypto.stackexchange.com/questions/3229/…
Mar
4
comment Koblitz encoding a message to a point, what is the “associated auxiliary base parameter”?
That said, I took a closer look at the Kodali & Sarma paper to see which EC cryptosystem they're actually using, and I couldn't make any sense of it -- it looks as if they're effectively just running a symmetric Caesar cipher over an elliptic curve (after first doing ECDH key agreement). If so, that still makes absolutely no sense to me; it's not semantically secure, and anyway they'd be much better off just feeding the ECDH secret (computed over a secure curve, not the tiny one they seem to be using) to a KDF and using it to key a standard symmetric cipher, like normal people do.
Mar
4
comment Koblitz encoding a message to a point, what is the “associated auxiliary base parameter”?
Yeah, sorry, ignore that bit about padding, that was basically a brain fart. I was thinking (if I may use the word) about RSA-like schemes, but EC schemes (like the related discrete logarithm based schemes) generally don't need it, because they have their randomization built in.
Mar
4
revised Koblitz encoding a message to a point, what is the “associated auxiliary base parameter”?
remove the red herring about padding
Mar
3
revised One-one correspondance complete function
10 = 1010_2
Mar
3
revised Koblitz encoding a message to a point, what is the “associated auxiliary base parameter”?
added 116 characters in body; edited title
Mar
3
answered Koblitz encoding a message to a point, what is the “associated auxiliary base parameter”?
Mar
3
revised Performing differential cryptanalysis for randomly generated S-boxes
copyedit
Mar
3
comment Predicting Google Authenticator OTP Codes
I think this question would need a lot of editing to be a good question for Crypto.SE. For one thing, it definitely needs to lose the "infinite amount of time" part: almost every cryptosystem is trivially breakable by an attacker with infinite computing time. The real question is, can it be broken by a feasible attacker bound by the known laws of physics? In any case, given the age of the question and the lack of attention it has received, I've simply voted to close it.
Mar
3
revised What is the advantage of using the socialist millionaire protocol to authenticate vs HMACing some random number?
improve latex formatting, add stepwise protocol description, misc. copyedits
Mar
3
revised What is the advantage of using the socialist millionaire protocol to authenticate vs HMACing some random number?
improve latex formatting
Mar
3
comment Vigenere ciphers : Need help for math analysis
On a tangent, the method you describe appears to be equivalent to the autokey cipher (a form of which was actually described in the writings of Blaise de Vigenère, unlike the cipher nowadays commonly bearing his name).
Mar
3
reviewed Reviewed Alternative sources of random numbers
Mar
3
reviewed Leave Open How to choose the integer m in the general number field sieve (GNFS)?