13,720 reputation
11458
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 7 months
seen Mar 24 at 1:45

I'm not really a cryptographer, I just play one on the Internet. ;-)

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:

CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


Feb
8
comment RSA with composite numbers
Related: crypto.stackexchange.com/questions/5170/…
Feb
8
comment Simple multiplication as an encryption method
See the part below the horizontal line.
Feb
3
comment CPA security of a stateless and deterministic encryption system
Essentially the same argument also works for symmetric ciphers, since the definition of IND-CPA security assumes that the attacker has access to an encryption oracle.
Jan
14
comment Specification of the Megamos crypto algorithm
Just for posterity, let me note that the protocol description that you quote above, via the cybergibbons website, appears to be originally quoted (without attribution, alas) from my answer to this question. (The cybergibbons version also has what appears to be a minor editing mistake in the second-to-last step, where it reads ${\rm T \to C}: r,G$ instead of ${\rm T \to C}: G'$, but you seem to have fixed that.)
Jan
6
comment Encryption for a short packet size
@BaruchEven: Yes, counter mode is safe even with predictable IVs, as long as they're never repeated. Generally, only CBC mode (and certain variants of CFB) requires unpredictable IVs.
Jan
5
comment Why is the private key generated first in public key crypto?
@yyyyyyy: In fact, many RSA implementations do store $p$ and $q$ as part of the private key, since doing so allows using the Chinese remainder theorem to speed up the algorithm.
Jan
3
comment Why are there no MACs inspired by block cipher modes other than CBC and CFB?
Please clarify your question, especially the statement quoted by Ricky. None of the traditional cipher modes (ECB, CBC, CFB, OFB and CTR) include a MAC, nor can they be (directly) used as one. There are MAC constructions that do bear some resemblance to these modes, such as CBC-MAC and its modern replacement CMAC, but those are separate constructions (although CBC and CBC-MAC do work very similarly). (Also, MAC usually stands for message authentication code; if you really mean mutual, please clarify that too.)
Dec
30
comment Attribute-based broadcast encryption with respect to ABE
Thanks, @Gilles! (Ps. I have no idea why I typed "Ability" instead of "Attribute" above. Must've been a brain fart.)
Dec
30
comment Is the DES F-function injective for a given subkey?
We just had a very similar (but apparently not duplicate) question less than 24 hours earlier. Just out of idle curiosity, are these coming from some online course or something, or is it just a remarkable coincidence?
Dec
30
comment Attribute-based broadcast encryption with respect to ABE
Also, I think we could use a broadcast-encryption tag. Would anyone more familiar with the topic than me want to create one (and look for some old posts to tag it with)?
Dec
30
comment Attribute-based broadcast encryption with respect to ABE
Based on a quick Google search, I assume those acronyms stand for Ability Based (Broadcast) Encryption?
Dec
29
comment Do I have to transfer the private key to digitally sign a remote document?
Also, one specific issue that puzzled me: if the user uploads the document to your server, is there some reason why they can't simply sign it before they upload it? Your server could then verify that the document has been properly signed, using the user's public key.
Dec
29
comment Do I have to transfer the private key to digitally sign a remote document?
Hi, rtan, and welcome to Crypto Stack Exchange. I tried to edit your question to make it a bit clearer, but I'm not 100% sure I interpreted all of it correctly. Could you please check that I didn't introduce any mistakes, and if you find some, edit the question to fix them? Thanks!
Dec
29
comment Embedded devices Authentication, Integrity and Confidentiality
@DmitryKhovratovich: A per device AES-GCM key can take place of public/private key pairs but what happens if the server was hacked and all the keys go with it? But your point about needing a RNG is quite important, which I really didn't take into account. [Note: This was posted by the OP as a non-answer, because they've apparently lost access to their original account.]
Dec
29
comment Embedded devices Authentication, Integrity and Confidentiality
@RobertNACIRI: When the devices are programmed with public/private key pairs. The public keys are recorded and sent to the server by the admin. The devices are programmed in batches. The server certificate will be CA issued(for revocation and easy verification etc). The client key pair is generated at the factory. A bit like generating GPG key pairs. [Note: This was posted by the OP as a non-answer, because they've apparently lost access to their original account.]
Dec
28
comment How are random numbers for RSA generated?
Related: crypto.stackexchange.com/questions/71/…, crypto.stackexchange.com/questions/1970/…, crypto.stackexchange.com/questions/690/…, crypto.stackexchange.com/questions/2532/…. In fact, I'd say the first two are essentially dupes.
Dec
28
comment How are random numbers for RSA generated?
Ensuring that the number is odd will not save much time testing it, but it will save you some RNG calls. It's not a huge optimization, but it's trivial to make and does provide some benefit.
Dec
28
comment Power analysis and exponentiation by squaring
Thank you for contributing this answer! I do think your answer would be much improved if you could briefly summarize the key points from the references you cite in it. As it stands, your answer does not really provide a stand-alone answer to the question asked. You should also edit the additional information you've posted in the comments directly into your answer, if you think it's potentially worth retaining.
Dec
28
comment Why shouldn't I use ECB encryption?
@FedericoPoloni: Generally, because direct low-level access to the block cipher is sometimes useful for building higher-level constructions, such as new cipher modes. See this recent question for one example.
Dec
28
comment Why shouldn't I use ECB encryption?
@giorgim: Even if you don't have any MAC or AE mode available, using CBC is still strictly better than ECB. If you do have a MAC function, CBC-then-MAC is a perfectly good AE mode.