10,794 reputation
11046
bio website vyznev.net
location Helsinki, Finland
age
visits member for 2 years, 8 months
seen yesterday

I'm not really a cryptographer, I just play one on the internet.

Seriously, I'm just a programmer and mathematician interested in puzzles and information security. I don't have any kind of formal crypto training, but I've picked up a few things here and there over the years. Topics I'm particularly interested in include protocol design and analysis, classical ciphers and information-theoretically secure crypto techniques such as one time pads and secret sharing schemes.

Please consider any (original) code I post to Stack Overflow (and other Stack Exchange sites) to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


Nov
20
comment Is the following symmetric design secure?
Do you have a precise definition for your "reversible random oracle"?
Nov
20
comment Is CBC mode encryption vulnerable to a reordering attack?
@Bush: The attacker won't (AFAIK) be able to construct a ciphertext that would decrypt to $m_2 \mathbin\| m_1$, if that's what you're asking. He can, however, construct one that he knows will decrypt to $(m_2 \oplus c_1 \oplus v) \mathbin\| (m_1 \oplus c_2 \oplus v)$. (And if he can modify the IV, he can replace the first half of that with anything he wants.)
Nov
12
comment How does secret sharing solve the partial exposure problem?
We have a pretty nice tag wiki for the shamir-secret-sharing tag. (At least, I think so -- I wrote it.) It may explain some of the issues you're asking about. If there's still something you don't understand, you may want to edit your question to make it more specific.
Nov
11
comment What is the name of this kind of protocol
@archie: I agree, these questions really should be merged. We can flag a mod to do that once one of them is closed. (We could do it before that, but then the mods would have to either wait or cast a binding close vote themselves.)
Nov
11
comment What is the name of this kind of protocol
possible duplicate of Can two people with different one time pads securely exchange a message like this?
Nov
11
comment Can two people with different one time pads securely exchange a message like this?
This question is a duplicate of crypto.stackexchange.com/questions/3379/…. This one's more nicely written, though, so I think I'll vote to close the other one.
Nov
10
comment Why don't we use MACs to store passwords?
@Maeher: Specifically, any PRF or, more generally, a privacy-preserving MAC (PP-MAC) would do. Bellare has proven that HMAC is a PRF and/or a PP-MAC as long as the compression function of the underlying hash is one; we currently believe this to be true for e.g. the SHA-2 hashes, but the only reason for that belief is that no-one has managed to break them (and published it) so far.
Nov
1
comment If I have the unencrypted text and the encrypted text, can I calculate the key?
Related / near duplicates: crypto.stackexchange.com/questions/2949/… crypto.stackexchange.com/questions/3952/… crypto.stackexchange.com/questions/3832/… (and these are just the ones I've answered myself; I'm sure there are more)
Oct
28
comment Why are the initial states of hashes functions (like SHA-1) often non-zero?
@user8911: Typically, the kinds of things you may want to avoid are e.g. having the IV be equivalent to itself rotated by some number of bits, or perhaps reversed and/or inverted, or otherwise having some simple bit pattern that might make an attacker's work easier. A random IV is very unlikely to have such a pattern, but may raise suspicions if you can't explain why it was chosen; hence "nothing up my sleeve" numbers, which are supposed to be free of such patterns while still not having enough degrees of freedom to hide a back door.
Oct
27
comment Are there attacks that break collision resistance but not preimage resistance?
OK, great! I've remade the edits.
Oct
27
comment How can I prove/disprove that a construction yields a secure PRG?
Is the input space of your PRG really $\{0,1\}^*$? If so, what's the distribution of the inputs? (It can't be uniform, since there is no uniform distribution over $\{0,1\}^*$.)
Oct
27
comment Are there attacks that break collision resistance but not preimage resistance?
I tried to copyedit your question, but I realized that I wasn't really sure whether you were asking for attacks that break preimage resistance but not collision resistance, or the other way around. Could you please clarify that?
Oct
25
comment Can you help me understand how RC4-52 is done using pen-and-paper?
Somewhat related: crypto.stackexchange.com/questions/844/…
Oct
25
comment About repetitions of cipher alphabets in Cipher Text of play fair cipher
I'm sorry, but I honestly have no idea what you're really trying to ask, except that it presumably has something to do with the Playfair cipher. Could you please clarify your question?
Oct
21
comment Safety when disclosing hashes of secrets used to calculate other secrets
And if you don't want to exclude the empty string, you can always, say, publish HMAC(A, "0") and return HMAC(A, "1" || B) when given B.
Oct
21
comment Safety when disclosing hashes of secrets used to calculate other secrets
That's not really a goal in the sense I meant -- it's, at best, the means of reaching some goal that you haven't told us. But fair enough -- if that's all you need, then Ricky's suggestion of using HMAC should do fine.
Oct
21
comment How vulnerable is RSA when using it to encode ~1000s of datasets with 500bytes each? How easy can the private key passphrase be hacked?
As for the second problem, what I meant is that is should be as slow as possible for an attacker to test whether a guessed password is correct. The typical way to do that is to use a deliberately slow function (such as PBKDF2) to transform the password into whatever it is that you'll actually use to verify the correctness of the password and to decrypt the encrypted RSA key (which can be the same thing -- if you use an authenticated key wrap algorithm like SIV to encrypt the RSA key, then a successful decryption means the password must be correct).
Oct
21
comment How vulnerable is RSA when using it to encode ~1000s of datasets with 500bytes each? How easy can the private key passphrase be hacked?
IMO, "password strength checkers" frequently do more harm then good: diligent and security-conscious users don't need them, and lazy users will just pick the easiest password that passes the check, leading to passwords like "pa$$w0rd" or "asdfghjkl;'1234567890". Better to tell your users how to choose good passwords, and/or provide a secure random password generator.
Oct
21
comment How does one use AES block cipher modes of operation?
This should be specified in SP 800-38A (specifically, look in Appendix B). Anyway, the usual method is to send the initial counter value with each message, and to increment the counter by 1 for every subsequent block in the message. (It's possible to leave out the initial counter value if the recipient can reliably infer it from some other data, such as a message number.) And what you seem to be forgetting is that the key is also needed for successful decryption. :)
Oct
20
comment Complexity class of an idealised version of Bitcoin's proof-of-work (hashcash)?
Without analyzing the specific hash function used, I don't see how we can even show totality. For an arbitrary hash function (or a random oracle), there's no a priori guarantee that any input hashes to a value less than $x$, although it's extremely likely that one in fact does.