12,133 reputation
11251
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 2 months
seen Oct 21 at 14:55

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

I started programming (in AmigaBASIC) when I was 10 years old. Nowadays, I'm most comfortable using Perl, C and JavaScript. I know Java and PHP too, but I can't really say I like them. I also know some Python, but not as much as I'd like.


CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:


Oct
10
comment Why is TLS SRP verifier based on user name?
@nefarel: Dunno. I might mutter something about Merkle-Damgård length extension attacks, or about provable reducibility to the PRF-ness of the SHA1 compression function, but honestly I have no real idea. It looks sort of like a clumsy imitation of HMAC, but since the folks who designed SRP are pretty smart cryptographers, presumably it's a clever imitation of HMAC, I just don't know exactly how or why. That might make an interesting question in itself.
Sep
25
comment Why are we advising PKI if we know that quantum computers will break them?
Practical quantum computing, like practical fusion power, has been "10-20 years in the future" for several decades already. Basically, in both cases, we thought we knew the theory, and that the rest would be just a simple matter of engineering. Alas, sometimes "mere engineering" turns out to be not so easy, after all.
Sep
14
comment Solution with high decryption cost and low encryption cost
You mean the comment you left on the question above? I don't see any obvious issues there; obviously with such a small keyspace, you'll want to use a large slowdown factor; say, at least around $s = 32$ (or more, if practical).
Sep
11
comment Isn't a simple Vernam cipher as secure as known symmetric key algorithms?
@Rox: See Kerckhoff's principle: a secure cryptosystem should remain secure even if the attacker knows exactly how it works (and, in particular, how you produced your key). Besides, if someone trying to crack your cipher didn't already know that you used a standard PRNG, now they do, because you posted about it here. Mind you, even if they didn't know, they might guess it anyway, since it's such a common amateur mistake.
Aug
28
comment Solution with high decryption cost and low encryption cost
Alas, this does not meet the 100,000+ messages/sec encryption requirement, at least not if the messages have different keys.
Aug
28
comment Good challenges for a crypto competition for teenagers
Sure you can do visual crypto without a computer. Just get some semitransparent graph paper and color in the squares. The resolution won't be too great, but you should be able to make some recognizable images.
Aug
28
comment Good challenges for a crypto competition for teenagers
Honestly, I think this could be a good subjective question, and I don't think the closing reason quoted by @e-sushi really applies (as the question is really asking for answers based on expertise, not for purely personal opinions). That said, the current bunch of answers isn't particularly inspiring. I really wish someone would come up with at least one really good, comprehensive answer to set the proper tone here.
Aug
9
comment Recover from compromised shares with Shamir Secret Sharing
+1. Of course, it's worth noting that the dealer still needs to be trusted; a malicious dealer could construct their polynomial with a non-zero constant term, thereby changing the secret (potentially to one of their choosing, if they can guess the original secret).
Jul
18
comment Is TripleDES 168bit vulnerable to Differential Cryptanalysis?
@owlstead: Agreed. Not only is it full of both factual and grammatical errors, but most of the text, or at least the more fluent parts of it, appears to be plagiarized. If this were an undergrad course assignment, I'd give it an F; since the authors appear to be grad students, and since it appears to have been published in something pretending to be a scientific journal...
Jun
4
comment Why is TLS SRP verifier based on user name?
@simbo1905: The compromised server wants to know if Alice and Bob have the same password. So, when Alice tries to log in, the server looks up Bob's authentication data $(s_{\rm Bob}, v_{\rm Bob})$ and sends Alice $s=s_{\rm Bob}$ and (in SRP-6) $B=3v_{\rm Bob}+g^b$, gets back $M_1$ and verifies that it equals $H(A,B,S)$, $S=(Av_{\rm Bob}^u)^b$. If it does, Alice has just successfully authenticated herself as Bob, which (with overwhelming likelihood) means they must have the same password $P$ and identifier $I$. Assigning each user a separate $I$ (typically, their username) plugs this hole.
May
31
comment Encryption of log files
Using a stream cipher (or a block cipher in CTR mode) would be tempting, but would be vulnerable to an attack where the attacker deliberately truncates the log file before letting your program append to it, in order to obtain multiple logs encrypted with the same keystream. Still better than just XOR with a static key, though.
May
31
comment Why is plain-hash-then-encrypt not a secure MAC?
@D.W.: I agree that these questions have substantial overlap, but it's not obvious which one(s) of them should be deemed canonical. In particular, given that this question seems to have the most thorough and highly voted answer (not that the others don't have good answers too), there's an argument to be made for closing both of the earlier questions as duplicates of this one.
May
25
comment Common password derivation function for different encryption methods
Even with Grover's algorithms, you're still looking at $2^{128}$ quantum operations, which is still damn hard, even if you assume that quantum computing becomes as easy as classical. If you assume that a 128-bit keyspace is safe against any foreseeable classical attacks (which I think most cryptographers would), then you should consider a 256-bit keyspace safe against quantum attacks too.
May
24
comment Is a Mersenne-twister cryptographically secure if I truncate the output?
This does not seem to be a real question, but rather an attempt to argue a point or to discuss the merits of a novel cryptographic primitive. As such, it is off-topic for Cryptography Stack Exchange, as described in our help center.
May
24
comment Common password derivation function for different encryption methods
However, if you need more key material simply because you need multiple keys (say, a MAC key and an encryption key, and maybe something else too), then PBKDF2+HKDF with a 256-bit hash is perfectly fine. Or you could always use SHA-512 to widen the "bottleneck" to 512 bits.
May
24
comment Common password derivation function for different encryption methods
It kind of depends on why you want that much key material. If it's because you think a 256-bit key is too short to be secure, then, indeed, you should not have a 256-bit bottleneck in your KDF. (But if you really think someone could brute-force a 256-bit keyspace, then you obviously know something the rest of us don't. Also, considering that key-stretching rarely adds more than 30 bits of entropy, where are you getting a password with over 226 bits of entropy from?)
May
24
comment Common password derivation function for different encryption methods
For some strange reason, if you ask PBKDF2 for more than one hash output block's worth of key material, it repeats the whole key-stretching process several times. This severely slows down the key derivation for legitimate users, whereas attackers typically don't suffer at all (since they only need to derive one output block to confirm their guess). PBKDF2+HKDF doesn't have that issue.
May
23
comment Which tamper-protection algorithm provides the shortest output?
... Hence, we just slapped a MAC onto any serialized data items, without any associated data; if users wanted to poke into the HTML code and replace one serialized string with another, that was fine with us, as long as we knew they couldn't pwn the server by feeding in some serialized code and telling the deserializer to overwrite a common library function with it.
May
23
comment Which tamper-protection algorithm provides the shortest output?
@D.W.: Also worth noting is that, sometimes, you might not care about replay attacks: for example, I once worked on an in-house web app framework that supported passing arbitrary serialized data structures as hidden variables. On the framework level, we did not care about replay or pick-and-mix attacks -- those, if they were an issue, would be checked for at the application level. But we did want to stop untrusted data from going into the deserialization library, since it wasn't designed with security in mind, and had "features" that allowed e.g. arbitrary code execution. ...
May
23
comment Which tamper-protection algorithm provides the shortest output?
... A convenient feature of SIV mode, in this regard, is that it can take a tuple of strings as associated data, rather than just a single string, so you don't have to worry about details like unambiguous encoding.