13,720 reputation
11458
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 7 months
seen 22 hours ago

I'm not really a cryptographer, I just play one on the Internet. ;-)

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:

CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


Mar
28
comment How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
... Essentially, this holds whenever the ciphertext we're trying to decrypt is longer than the unicity-distance of the cipher.
Mar
28
comment How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
@RenéG: If there are only $2^{24}$ possible keys, as in the question above, the it's very unlikely that any of those keys would, just by chance, decrypt an 11-byte ciphertext to "black white". (The details depend on the cipher, but for, say, a modern additive stream cipher, the probability of this happening is about one in $2^{64}$, or about one in 18 quintillion (= billion billion).) Indeed, since there are far fewer than $2^{64}$ 11-character combinations of English words, it's extremely unlikely that a wrong key would decrypt your ciphertext to anything that looks like English.
Mar
21
comment Is it safe to prefix the a key with a known value?
@CodesInChaos: I would. HMAC does have its quirks (like the ability to easily construct equivalent keys of different length), but it's still a secure MAC with keys of any length (even if the nominal security level is capped by the hash output length), as long as they have enough entropy to resist brute force attacks. (That said, if you're using multiple HMAC keys derived from each other, you should probably ensure that they're all the same length, or otherwise that they cannot be equivalent. Using a proper KDF to derive your keys from a single master key is generally enough.)
Mar
19
comment Deciphering text encrypted with a changing cipher
@Paŭlo: Specifically, it's equivalent to the rarely used shift-register variant of CFB, where the encryption unit is smaller than a full cipher block. There are security proofs for that variant, too, although the IV requirements are slightly stricter. (Also, just noticed that my link was broken; fixed.)
Mar
16
comment decrypt a saml 2.0 response having aes 128 and rsa
The modulus and exponent together make up an RSA public key. You're right, you presumably don't need them for decryption, but at least you can check that they match the private key you have.
Mar
14
comment How do you break encryption on a message?
Your questions seems really broad, perhaps too broad to be answered well on a Q&A site like this. What you really need is an introductory book on cryptography and cryptanalysis. Here's a few choices to get you started.
Mar
12
comment Beginner question about secure communication with one user using DES
Is that really the exact question asked? I suppose the users could implement a Diffie-Hellman key exchange, if that's allowed, and then derive a DES (or better yet, triple-DES) key from the DH result. But without some kind of a prior shared secret (or asymmetric key pair), there's no way for the users to know they're talking with each other, and not with some middle-man.
Mar
12
comment Implementing modular reductions (n*n)
Reduce modulo $n$, subtract remainder from input, divide by $n$, reduce again? You now effectively have the last two base-$n$ digits of the input.
Mar
11
comment Repair AES-128 decrypted file
Can you tell us the exact openssl command you used? In particular, which cipher mode did you use, and did you use a salt?
Mar
11
comment Encrypt-then-MAC: Do I need to authenticate the IV?
Congrats for hitting the Hot Network Questions list, by the way. :)
Mar
11
comment Is the 1st Encrypted Block Less Secure Than Subsequent Ones?
Related: crypto.stackexchange.com/questions/5421/…
Mar
11
comment Composing two one-way functions such that the result is not a one-way function
Ps. If you really must have two distinct one-way functions, you could always, say, use $1^{n/2}$ instead of $0^{n/2}$ for one of them.
Mar
11
comment Is $f(x)\oplus x$ a one-way function?
Just FYI, I borrowed your construction for a (community wiki) answer to a related question.
Mar
10
comment Encryption scheme that allows compare ciphertexts based on the clear text
I've voted to close this as a duplicate (since the literal answer to your question is basically "this is called order-preserving encryption"), but +1 for a well-asked question.
Mar
10
comment Known plaintext, unknown 128 bit block cipher
Ps. Related, possibly duplicate: crypto.stackexchange.com/questions/997/…
Mar
10
comment Key length requirement in a simple XOR implementation
Yes, it should work, because of the % klen part. (Exercise: what does that part actually do?) You could've also simply tried it yourself on some test data. (In any case, I'm voting to close this question as off topic, since it's really more about basic programming rather than cryptography. It would be a better fit for Stack Overflow.)
Mar
10
comment Known plaintext, unknown 128 bit block cipher
Alas, the one thing the paper does not seem to include is any kind of demonstration that their method actually works. In fact, for modern block ciphers with the same block size, I can fairly confidently assert that it doesn't -- if it did, the authors would be famous. (They do suggest that their program may also use side channel information, so it's somewhat plausible that it could e.g. be able to distinguish DES from Blowfish based on the time needed to encrypt a message; but that'll only work if such timing information is actually available.)
Mar
4
comment Is CBC theoretically harder to brute force when compared with ECB?
You're talking about a scenario where the attacker can obtain many messages encrypted with different keys, and only needs to break one key, right? I agree, ECB is (slightly) weaker than CBC in that case, at least as long as the IVs for CBC are properly chosen (i.e. unpredictable by the attacker).
Mar
4
comment AES mode scheme feedback
For the second part, see crypto.stackexchange.com/questions/3229/…
Mar
4
comment Koblitz encoding a message to a point, what is the “associated auxiliary base parameter”?
That said, I took a closer look at the Kodali & Sarma paper to see which EC cryptosystem they're actually using, and I couldn't make any sense of it -- it looks as if they're effectively just running a symmetric Caesar cipher over an elliptic curve (after first doing ECDH key agreement). If so, that still makes absolutely no sense to me; it's not semantically secure, and anyway they'd be much better off just feeding the ECDH secret (computed over a secure curve, not the tiny one they seem to be using) to a KDF and using it to key a standard symmetric cipher, like normal people do.