12,133 reputation
11251
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 2 months
seen yesterday

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

I started programming (in AmigaBASIC) when I was 10 years old. Nowadays, I'm most comfortable using Perl, C and JavaScript. I know Java and PHP too, but I can't really say I like them. I also know some Python, but not as much as I'd like.


CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:


May
24
comment Common password derivation function for different encryption methods
However, if you need more key material simply because you need multiple keys (say, a MAC key and an encryption key, and maybe something else too), then PBKDF2+HKDF with a 256-bit hash is perfectly fine. Or you could always use SHA-512 to widen the "bottleneck" to 512 bits.
May
24
comment Common password derivation function for different encryption methods
It kind of depends on why you want that much key material. If it's because you think a 256-bit key is too short to be secure, then, indeed, you should not have a 256-bit bottleneck in your KDF. (But if you really think someone could brute-force a 256-bit keyspace, then you obviously know something the rest of us don't. Also, considering that key-stretching rarely adds more than 30 bits of entropy, where are you getting a password with over 226 bits of entropy from?)
May
24
comment Common password derivation function for different encryption methods
For some strange reason, if you ask PBKDF2 for more than one hash output block's worth of key material, it repeats the whole key-stretching process several times. This severely slows down the key derivation for legitimate users, whereas attackers typically don't suffer at all (since they only need to derive one output block to confirm their guess). PBKDF2+HKDF doesn't have that issue.
May
23
comment Which tamper-protection algorithm provides the shortest output?
... Hence, we just slapped a MAC onto any serialized data items, without any associated data; if users wanted to poke into the HTML code and replace one serialized string with another, that was fine with us, as long as we knew they couldn't pwn the server by feeding in some serialized code and telling the deserializer to overwrite a common library function with it.
May
23
comment Which tamper-protection algorithm provides the shortest output?
@D.W.: Also worth noting is that, sometimes, you might not care about replay attacks: for example, I once worked on an in-house web app framework that supported passing arbitrary serialized data structures as hidden variables. On the framework level, we did not care about replay or pick-and-mix attacks -- those, if they were an issue, would be checked for at the application level. But we did want to stop untrusted data from going into the deserialization library, since it wasn't designed with security in mind, and had "features" that allowed e.g. arbitrary code execution. ...
May
23
comment Which tamper-protection algorithm provides the shortest output?
... A convenient feature of SIV mode, in this regard, is that it can take a tuple of strings as associated data, rather than just a single string, so you don't have to worry about details like unambiguous encoding.
May
23
comment Which tamper-protection algorithm provides the shortest output?
@D.W.: Good point, although it really goes beyond algorithm choice, and into threat modelling. The general answer, with an AEAD algorithm, is to pass any extra (meta)data, which you want to tie the protected data to, into the algorithm as Associated Data. This might include e.g. a form ID, a timestamp, the user ID and any other hidden fields on the form. Note that all of those effectively become integrity-protected too: the authentication tag will only match if all of them are unchanged (although an attacker might still be able replace all of them, together, with an earlier set of values).
May
22
reviewed Close encryption and decryption time for RSA-crt in java?
May
22
reviewed Leave Open Common password derivation function for different encryption methods
May
22
comment Common password derivation function for different encryption methods
+1. Also, if you might need more than 256 bits of key material, consider using PBKDF2+HKDF (i.e. use PBKDF2 to derive one hash output block's worth of bits, then feed that into the expansion stage of HKDF as the PRK input).
May
21
answered Which tamper-protection algorithm provides the shortest output?
May
15
revised RSA private exponent primality
deleted 24 characters in body; edited title
May
9
revised Size of p in ElGamal cryptosystem?
correct spelling of ElGamal, texify, grammar
May
9
revised Why is Triple DES not vulnerable to meet in the middle attacks?
deleted 181 characters in body
May
9
revised Why is Triple DES not vulnerable to meet in the middle attacks?
texify, misc. copyedits
May
8
comment Decrypt a public encrypted message and Sign a signature, how the math is different?
@CodesInChaos: I think this could actually be a pretty good "FAQ" question, and your comment, with some embellishment (e.g. compare RSA signing with RSA encryption and DSA / ElGamal signing with ElGamal encryption), could make a good answer for it. I may try to write one later, unless someone else does it first.
May
5
comment Difference between a nonce and IV
Related, but less specific question: crypto.stackexchange.com/questions/3965/…
May
4
comment How do I produce a stream of secure random numbers from AES-Counter mode?
@owlstead: I'm not aware of any attacks for $E_K(K)$, but there's definitely an attack for, say, $E_K(D_K(0))$.
Apr
30
answered Can XEX or XTS modes be used with only one tweak?
Apr
30
answered Why is Triple DES not vulnerable to meet in the middle attacks?