11,606 reputation
11049
bio website vyznev.net
location Helsinki, Finland
age
visits member for 2 years, 11 months
seen 5 hours ago

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

I started programming (in AmigaBASIC) when I was 10 years old. Nowadays, I'm most comfortable using Perl, C and JavaScript. I know Java and PHP too, but I can't really say I like them. I also know some Python, but not as much as I'd like.


CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:


Dec
22
comment Keeping IV secret for AES CFB mode
...unless they never reuse the key for two different messages; in that specific case (and only in that case) using a constant IV is safe.
Dec
22
comment Two-dimensional S-Box
If $S'$ and $S''$ are the same S-box, why do you use two different symbols to represent them?
Dec
22
comment Two-dimensional S-Box
I'm not sure I understand what you're asking. If $S_1$ and $S_2$ are $n$-bit-to-$n$-bit S-boxes, then the function $S_{12}$ defined as $S_{12}(x) = S_2(S_1(x))$ can also be represented as an $n$-bit-to-$n$-bit S-box, so combining S-boxes like that generally doesn't gain you anything.
Dec
22
comment Now that quantum computers have been out for a while, has RSA been cracked?
That last part is actually good advice, but not because of quantum computers.
Dec
21
comment ECB weakness and its exploitation
You should be able to find out the length of A, at least rounded down to a multiple of 16 bytes, by changing your message and seeing which ciphertext block is the first one that changes. Can you then figure out how to get the exact length of A in bytes? (Hint: What happens to the ciphertext if A is, say, 15 bytes long, and you change the first byte of your data? What if you change the second byte instead?)
Dec
17
comment Authentication mechanism for low memory, low computing power device
If you can't even do AES at all, I'm not sure how you think you're going to implement any kind of zero-knowledge proof. There's very little practical crypto you can do with devices that limited. (Then again, it's also possible that you're just underestimating the performance of your processors; even many smart cards can do AES nowadays.)
Dec
17
comment Authentication mechanism for low memory, low computing power device
You might want to add some more details to your question. For instance, who/what do you want to authenticate to whom, what kind of keys/passwords/tokens do they share, what kind of processor are you talking about ("low" can be relative), and what kind of attack scenarios are you expecting?
Dec
14
comment Testing a steganalysis technique on realistic data
@Layla: I just tried to do that myself, but feel free to change anything you want (especially if you feel I introduced any inaccuracies). It's your question, after all.
Dec
14
comment Testing a steganalysis technique on realistic data
I'm not sure if this question really qualifies as a "reference recommendation" in the sense discussed at the meta post @e-sushi linked to. Even if it does, though, rephrasing it e.g. as "How can I test the effectiveness of my new image steganalysis technique on realistic data?" should make it on topic here.
Dec
8
comment Rabin/RSA four possible messages?
Also, yes, the second part is just asking for the decryption algorithm. DrLecter's hint above should help with that too. Note that, for efficient decryption, you'll need to know the factors $p$ and $q$ of $N$.
Dec
7
comment Perfect secrecy over Stirling numbers
Ps. Also, yes, if $k$ is uniformly distributed over $\{0,1\}^n$ (i.e. "perfectly random"), then $k' = c_1 \oplus m_1$ $= k \oplus m_0 \oplus m_1$ (where $m_0, m_1 \in \{0,1\}^n$) is also uniformly distributed. This follows easily from the observation that the map $x \mapsto x \oplus m_0 \oplus m_1$ is invertible (and, in fact, its own inverse) on $\{0,1\}^n$.
Dec
5
comment Does it make sense to stretch non-keys?
@Andrew: "pseudorandom key". It's basically what the HKDF standard calls the output of the first KDF stage. It's not a particularly informative name, but I figured I'd follow their example, since I couldn't think of anything better either.
Dec
5
comment Regex searchable word list for space-less monoalphabetic substitution
You know, regexps are pretty useful for many things, but not too often for cryptanalysis. I'm somewhat reminded of that silly Jamie Zawinski quote here...
Nov
30
comment Is it theoretically possible to construct a string that contain its own hash value?
@Alex: With respect to what parameter? With respect to the hash output length $k$, it's clearly in NP($k$), assuming that computing the hash of a given string is in P($k$). By the argument given above, if the hash is secure in the sense described, finding such a string cannot be in P($k$). (Yes, the existence of secure hash functions implies that P ≠ NP.) With respect to the input string length, finding such a string (if there is one to be found) takes on average a constant number of hash evaluations, and is thus in ZPP.
Nov
28
comment Can homomorphic encryption filter?
However, using methods similar to those in your answer, it would be possible to query e.g. for "the first 50 students with scores higher than 90%" (with null values returned if there weren't that many matching records).
Nov
22
comment How to break AES/CBC/PKCS5 when key and IV are reused?
It's not a password database, is it? Adobe did that, and look where it got them.
Nov
22
comment How to break AES/CBC/PKCS5 when key and IV are reused?
+1 for noting the equivalence to ECB. Basically, the ways to attack this scheme are the same as you'd use to attack ECB (i.e. rely on the determinism to leak information if plaintext blocks are repeated).
Nov
20
comment Is the following symmetric design secure?
I know what both parts mean, but it's not obvious to me how you want to combine them. (For instance, in order to be reversible, the output obviously can't be entirely random.)
Nov
20
comment Is the following symmetric design secure?
Do you have a precise definition for your "reversible random oracle"?
Nov
20
comment Is CBC mode encryption vulnerable to a reordering attack?
@Bush: The attacker won't (AFAIK) be able to construct a ciphertext that would decrypt to $m_2 \mathbin\| m_1$, if that's what you're asking. He can, however, construct one that he knows will decrypt to $(m_2 \oplus c_1 \oplus v) \mathbin\| (m_1 \oplus c_2 \oplus v)$. (And if he can modify the IV, he can replace the first half of that with anything he wants.)