12,328 reputation
11352
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 3 months
seen 17 hours ago

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

I started programming (in AmigaBASIC) when I was 10 years old. Nowadays, I'm most comfortable using Perl, C and JavaScript. I know Java and PHP too, but I can't really say I like them. I also know some Python, but not as much as I'd like.


CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:


Jan
30
comment Is the Couvreur et al. polynomial time attack on McEliece practical?
Hi, fractal, and welcome to Cryptography Stack Exchange! I've edited your question to add some detail and make it a better fit to our site. Please don't hesitate to correct any mistakes or omissions I may have introduced while doing so.
Jan
29
comment Avoiding overflow when encrypting with RSA
Also, just to clarify your last sentence above, the "flaws" for small $e$ (like Coppersmith's attack) only appear if one does not use a secure padding scheme (e.g. OAEP). With proper padding, RSA is secure even for $e=3$; without proper padding, it may not be secure for any $e$.
Jan
29
comment Efficient Robust Private Set Intersection Additive ElGamal
I just approved this edit suggestion from an anonymous user. (It still needs someone else to approve it.) I assume that was you? You might want to register an account here, so that you'll be able to edit your posts more easily.
Jan
14
comment Many time pad attack
@e-sushi: How does one attack a two-time pad (i.e. one time pad with key reuse)? would be a closer match; it even appears to be about the same Coursera exercise. This one's a little bit more specific, though, since the other question is about general solution methods while this one is specifically about the hint. (Also, the other question is kind of messy.) I wouldn't necessarily object to having them merged, but only if the questions are also edited to combine them.
Jan
12
comment Difference between CBC-MAC and CMAC
@figlesquidge: While the information requested probably is obtainable from Wikipedia, it's not very clearly presented there. IMO, this is a perfectly good reference question, and I'm hoping to see a concise and comprehensive answer summarizing the main differences.
Jan
3
comment Replay attack in ECB mode
@figlesquidge: Indeed. (Just to be clear, the fact that the link works is not a bug; I've reported the actual bug to SE privately, since it has (minor) security implications.)
Dec
28
comment Why xor is a linear operation but ordinary adding is not
Nitpick: the integers with ordinary addition modulo 256 are not a vector space over any finite field. In fact, they're not a vector space at all, although they are an abelian group, and therefore a module over the ring of integers.
Dec
27
comment How to attack this authentication protocol from “Cryptography: An introduction”
Ps. Where is this exercise from, anyway?
Dec
27
comment How to attack this authentication protocol from “Cryptography: An introduction”
possible duplicate of What does this Authentication protocol achieve and what information is shared?
Dec
27
comment Off-the-record communication
@RamRachum: No, because that would lose the deniability property we wanted in the first place: for a given $W' = W \oplus SHA(m) \oplus SHA(m')$, finding $Y'$ and $Z'$ such that $W' = H(Y' + Z')$ (for any meaning of $+$) would require breaking the preimage resistance of $H$.
Dec
25
comment Off-the-record communication
@RickyDemer: Good point. $\hspace{400px}$ But honestly, what's the deal with $\hspace{300px}$ the random $\hspace{240px}$ MathJax spaces, anyway? $\hspace{200px}$ $\hspace{200px}$ You know it doesn't really look the same $\hspace{100px}$ to anyone who doesn't have the exact same browser and fonts as you $\hspace{250px}$ anyway, right?
Dec
22
comment Keeping IV secret for AES CFB mode
...unless they never reuse the key for two different messages; in that specific case (and only in that case) using a constant IV is safe.
Dec
22
comment Two-dimensional S-Box
If $S'$ and $S''$ are the same S-box, why do you use two different symbols to represent them?
Dec
22
comment Two-dimensional S-Box
I'm not sure I understand what you're asking. If $S_1$ and $S_2$ are $n$-bit-to-$n$-bit S-boxes, then the function $S_{12}$ defined as $S_{12}(x) = S_2(S_1(x))$ can also be represented as an $n$-bit-to-$n$-bit S-box, so combining S-boxes like that generally doesn't gain you anything.
Dec
22
comment Now that quantum computers have been out for a while, has RSA been cracked?
That last part is actually good advice, but not because of quantum computers.
Dec
21
comment ECB weakness and its exploitation
You should be able to find out the length of A, at least rounded down to a multiple of 16 bytes, by changing your message and seeing which ciphertext block is the first one that changes. Can you then figure out how to get the exact length of A in bytes? (Hint: What happens to the ciphertext if A is, say, 15 bytes long, and you change the first byte of your data? What if you change the second byte instead?)
Dec
17
comment Authentication mechanism for low memory, low computing power device
If you can't even do AES at all, I'm not sure how you think you're going to implement any kind of zero-knowledge proof. There's very little practical crypto you can do with devices that limited. (Then again, it's also possible that you're just underestimating the performance of your processors; even many smart cards can do AES nowadays.)
Dec
17
comment Authentication mechanism for low memory, low computing power device
You might want to add some more details to your question. For instance, who/what do you want to authenticate to whom, what kind of keys/passwords/tokens do they share, what kind of processor are you talking about ("low" can be relative), and what kind of attack scenarios are you expecting?
Dec
14
comment Testing a steganalysis technique on realistic data
@Layla: I just tried to do that myself, but feel free to change anything you want (especially if you feel I introduced any inaccuracies). It's your question, after all.
Dec
14
comment Testing a steganalysis technique on realistic data
I'm not sure if this question really qualifies as a "reference recommendation" in the sense discussed at the meta post @e-sushi linked to. Even if it does, though, rephrasing it e.g. as "How can I test the effectiveness of my new image steganalysis technique on realistic data?" should make it on topic here.