10,584 reputation
11044
bio website vyznev.net
location Helsinki, Finland
age
visits member for 2 years, 7 months
seen 3 hours ago

I'm not really a cryptographer, I just play one on the internet.

Seriously, I'm just a programmer and mathematician interested in puzzles and information security. I don't have any kind of formal crypto training, but I've picked up a few things here and there over the years. Topics I'm particularly interested in include protocol design and analysis, classical ciphers and information-theoretically secure crypto techniques such as one time pads and secret sharing schemes.

Please consider any (original) code I post to Stack Overflow (and other Stack Exchange sites) to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


Oct
18
comment Secure order preserving hash function
@pg1989: Interesting. Can you describe this "something almost as good" in more detail? (In particular, I don't suppose it helps to avoid the binary search attack, since that's a generic plaintext recovery attack against any OPE scheme that allows encryption oracle access.)
Oct
16
comment How does one use AES block cipher modes of operation?
You could start reading the input a bit earlier, at the 250th cycle (or even earlier, but that wouldn't help with throughput). That way, when the encryption was finished on the 266th cycle, you'd already have the next input block buffered and ready for encryption. Of course, that would require an input buffer separate from the AES encryption registers.
Oct
14
comment Encoding numbers that can be decoded mentally?
Or, even better, just make a simple database of the objects and their prices, with a unique (possibly random) ID for each object, and tag the objects with those IDs. Assuming you don't have billions of items, you phone should be able to store the database just fine. As a bonus, you can have the phone display the name (or a description) of the item, so you can tell if the customer has switched the tags.
Oct
12
comment How does one use AES block cipher modes of operation?
Yes, you need to send the IV / nonce to the recipient. The usual way is to just prepend it to the ciphertext. Also, yes, the CTR, ECB and OCB modes are easy to parallelize. AE modes using CTR as a component (EAX, GCM, SIV, etc.) can do the CTR mode en/decryption in parallel, but the authentication is typically less parallelizable. CBC and CFB mode encryption is inherently serial, but decryption can be parallelized. OFB mode is inherently serial in both directions, although it's possible to precalculate the keystream.
Oct
8
comment How should we handle patents on FPE that NIST proposed in draft 800-38g?
If you're interested in the validity of the patent(s), you might want to ask about it on patents.SE. In particular, it occurs to me that this old Usenet thread from 2005 might (IANAL) qualify as prior art for several of the claims in the Voltage "core patent" #7,864,952 (and I'm now a bit disappointed that I never publicly posted another script I wrote around the same time, which included check digit removal and reconstruction).
Oct
8
comment How does redundancy in a file effects performance and security of encryption?
Exactly.​​​​​​​
Oct
8
comment how much trust can we place in protocol verifiers?
Related, possibly duplicate: Is there an automated security protocol verification tool?
Oct
8
comment Definition of cryptographic advantage vs. probability of success
Why do you think you can't divide an advantage by 2? If I can guess $b$ with probability 0.50002, and you can guess it with probability 0.50001, then your advantage is $\frac12$ of mine.
Oct
8
comment Encryption algorithms and the “One-Time pad”
Possible duplicate of Why not the one-time pad with pseudo-number generator (or maybe What is the difference between a stream cipher and a one-time-pad?).
Oct
8
comment How does one use AES block cipher modes of operation?
BTW, I think you're probably confused on a fairly fundamental level about how block ciphers work. I'd suggest reading the Wikipedia articles on block ciphers and block cipher modes of operation before even looking at my answer below.
Oct
2
comment Shamir's Secret Share Over the Reals
Sort of. If we have some bounds for $S$ (say, we know that $a\le S\le b$ for some $a,b\in\mathbb R$), then in principle we can, say, let $r$ be normally distributed with standard deviation $\sigma$ much greater than $b-a$, in which case any effect of $S$ on $y_1$ will mostly be buried in the noise. (Of course, then we still have the problem that we cannot really store a random real number picked from a continuous distribution in a finite amount of memory, so we'll have to settle for some discrete approximation, which introduces new leaks.)
Sep
28
comment Who uses Dual_EC_DRBG?
@nealmcb: True. Color me surprised.
Sep
25
comment How broken is a xor of two LCGs?
+1, excellent analysis! It does seem to me, however, that much if not all of the issues you identified basically arise from a poor choice of modulus. What if the proposed algorithm was modified to use, say, $p=18446744073709551557=2^{64}-59$? That wouldn't leave much bias to detect, and it would also simplify the implementation. I suppose that might be better asked as a separate question, though.
Sep
19
comment Which encryption method supports random reads?
@CodesInChaos: Good point about not reusing the keystream. See the edit I just made to my answer for some ways to address it.
Sep
19
comment Which encryption method supports random reads?
@tylo: True, CFB and CBC also support random-access decryption, although encryption with those modes is inherently sequential. Unlike CTR mode, they also require you to retrieve the entire previous block of the ciphertext (and for CBC, the entire current block too) in order to decrypt any part of a block.
Sep
19
comment Shamir's secret sharing with passwords
Related, possibly duplicate: crypto.stackexchange.com/questions/2970/…. The scheme I describe in my answer there is basically the same as your XOR-based one.
Sep
18
comment Fast post-processing for broken RDRAND
The point of the Becker et al. attack is that they reduce the state space of the RNG to (e.g.) 32 bits (plus a 224-bit constant known only to the attacker). Testing each of $2^{32}$ possible states is generally not much of a challenge to an attacker with even a single modern CPU.
Sep
16
comment Precise meaning of various terms related to universal hash functions
@nightcracker: Actually, I think there's a reasonable question in here. All these terms are closely related to universal hashing, and explaining the precise differences between them would be useful. I've tried to edit the question to make it less "homeworky" (@Govinda: please check my edits and fix anything you don't like), and may try to answer it later when I'm not so busy.
Sep
13
comment Zero knowledge proof of possession of key
Ps. An obvious solution would be for Alice to calculate a commitment $Q$ to $M$ and tack it onto $C$. Technically, this doesn't prove that $C$ decrypts to $M$, but it does prove that Alice knew $M$ when she generated $C$.
Sep
13
comment Zero knowledge proof of possession of key
What's Dave's role in all this, from Alice and Bob's perspective? You say he "performs certain operations" based on $M$, but you also say that he has no contact with Alice or Bob (except, presumably, for receiving $C$ from Bob). So if Dave can't communicate the results of his "certain operations" back to Bob, why does he even need to be part of the whole system?