12,113 reputation
11251
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 2 months
seen 3 hours ago

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

I started programming (in AmigaBASIC) when I was 10 years old. Nowadays, I'm most comfortable using Perl, C and JavaScript. I know Java and PHP too, but I can't really say I like them. I also know some Python, but not as much as I'd like.


CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:


Nov
30
comment Is it theoretically possible to construct a string that contain its own hash value?
@Alex: With respect to what parameter? With respect to the hash output length $k$, it's clearly in NP($k$), assuming that computing the hash of a given string is in P($k$). By the argument given above, if the hash is secure in the sense described, finding such a string cannot be in P($k$). (Yes, the existence of secure hash functions implies that P ≠ NP.) With respect to the input string length, finding such a string (if there is one to be found) takes on average a constant number of hash evaluations, and is thus in ZPP.
Nov
28
comment Can homomorphic encryption filter?
However, using methods similar to those in your answer, it would be possible to query e.g. for "the first 50 students with scores higher than 90%" (with null values returned if there weren't that many matching records).
Nov
22
comment How to break AES/CBC/PKCS5 when key and IV are reused?
It's not a password database, is it? Adobe did that, and look where it got them.
Nov
22
comment How to break AES/CBC/PKCS5 when key and IV are reused?
+1 for noting the equivalence to ECB. Basically, the ways to attack this scheme are the same as you'd use to attack ECB (i.e. rely on the determinism to leak information if plaintext blocks are repeated).
Nov
20
comment Is the following symmetric design secure?
I know what both parts mean, but it's not obvious to me how you want to combine them. (For instance, in order to be reversible, the output obviously can't be entirely random.)
Nov
20
comment Is the following symmetric design secure?
Do you have a precise definition for your "reversible random oracle"?
Nov
20
comment Is CBC mode encryption vulnerable to a reordering attack?
@Bush: The attacker won't (AFAIK) be able to construct a ciphertext that would decrypt to $m_2 \mathbin\| m_1$, if that's what you're asking. He can, however, construct one that he knows will decrypt to $(m_2 \oplus c_1 \oplus v) \mathbin\| (m_1 \oplus c_2 \oplus v)$. (And if he can modify the IV, he can replace the first half of that with anything he wants.)
Nov
12
comment How does secret sharing solve the partial exposure problem?
We have a pretty nice tag wiki for the shamir-secret-sharing tag. (At least, I think so -- I wrote it.) It may explain some of the issues you're asking about. If there's still something you don't understand, you may want to edit your question to make it more specific.
Nov
11
comment What is the name of this kind of protocol
@archie: I agree, these questions really should be merged. We can flag a mod to do that once one of them is closed. (We could do it before that, but then the mods would have to either wait or cast a binding close vote themselves.)
Nov
11
comment What is the name of this kind of protocol
possible duplicate of Can two people with different one time pads securely exchange a message like this?
Nov
11
comment Can two people with different one time pads securely exchange a message like this?
This question is a duplicate of crypto.stackexchange.com/questions/3379/…. This one's more nicely written, though, so I think I'll vote to close the other one.
Nov
10
comment Why don't we use MACs to store passwords?
@Maeher: Specifically, any PRF or, more generally, a privacy-preserving MAC (PP-MAC) would do. Bellare has proven that HMAC is a PRF and/or a PP-MAC as long as the compression function of the underlying hash is one; we currently believe this to be true for e.g. the SHA-2 hashes, but the only reason for that belief is that no-one has managed to break them (and published it) so far.
Nov
1
comment If I have the unencrypted text and the encrypted text, can I calculate the key?
Related / near duplicates: crypto.stackexchange.com/questions/2949/… crypto.stackexchange.com/questions/3952/… crypto.stackexchange.com/questions/3832/… (and these are just the ones I've answered myself; I'm sure there are more)
Oct
28
comment Why are the initial states of hashes functions (like SHA-1) often non-zero?
@user8911: Typically, the kinds of things you may want to avoid are e.g. having the IV be equivalent to itself rotated by some number of bits, or perhaps reversed and/or inverted, or otherwise having some simple bit pattern that might make an attacker's work easier. A random IV is very unlikely to have such a pattern, but may raise suspicions if you can't explain why it was chosen; hence "nothing up my sleeve" numbers, which are supposed to be free of such patterns while still not having enough degrees of freedom to hide a back door.
Oct
27
comment Are there attacks that break collision resistance but not preimage resistance?
OK, great! I've remade the edits.
Oct
27
comment How can I prove/disprove that a construction yields a secure PRG?
Is the input space of your PRG really $\{0,1\}^*$? If so, what's the distribution of the inputs? (It can't be uniform, since there is no uniform distribution over $\{0,1\}^*$.)
Oct
27
comment Are there attacks that break collision resistance but not preimage resistance?
I tried to copyedit your question, but I realized that I wasn't really sure whether you were asking for attacks that break preimage resistance but not collision resistance, or the other way around. Could you please clarify that?
Oct
25
comment Can you help me understand how RC4-52 is done using pen-and-paper?
Somewhat related: crypto.stackexchange.com/questions/844/…
Oct
21
comment Safety when disclosing hashes of secrets used to calculate other secrets
And if you don't want to exclude the empty string, you can always, say, publish HMAC(A, "0") and return HMAC(A, "1" || B) when given B.
Oct
21
comment Safety when disclosing hashes of secrets used to calculate other secrets
That's not really a goal in the sense I meant -- it's, at best, the means of reaching some goal that you haven't told us. But fair enough -- if that's all you need, then Ricky's suggestion of using HMAC should do fine.