Ilmari Karonen

6,341 reputation

725

bio	website	vyznev.net
	location	Helsinki, Finland
	age
visits	member for	1 year, 10 months
	seen	Jun 14 at 14:08
stats	profile views	91

I'm not really a cryptographer, I just play one on the internet.

Seriously, I'm just a programmer and mathematician interested in puzzles and information security. I don't have any kind of formal crypto training, but I've picked up a few things here and there over the years. Topics I'm particularly interested in include protocol design and analysis, classical ciphers and information-theoretically secure crypto techniques such as one time pads and secret sharing schemes.

Please consider any (original) code I post to Stack Overflow (and other Stack Exchange sites) to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.

	6,341 reputation	bio	website	vyznev.net	visits	member for	1 year, 10 months
725 badges		location	Helsinki, Finland		seen	Jun 14 at 14:08

summary answers questions tags badges favorites bounties reputation activity

192 Comments

suggestions reviews revisions comments badges posts accepts all

Nov 25	comment	Cracking WWII-era codes - code found on a pigeon's leg in Surrey However, you may be onto something with the G/F thing: for example, the BBC transcript quoted in the question gives the 24th group as "FQIRU", but comparing the first letter with the other Fs and Gs in the rest of the message makes it pretty clear that it should be "GQIRU" instead. Similarly, the 17th group should probably be "UAOTA", not "WAOTA".
Nov 25	comment	Cracking WWII-era codes - code found on a pigeon's leg in Surrey There are several scans of the message floating around, with varying original quality and postprocessing. Looking at the Times version you show, it's pretty clear that someone took a poor quality scan or photo and tried to make it clearer by overdrawing some of the letters; you can still see the original text in the background if you look closely. The new GCHQ scan has much better quality (though still not perfect), and most importantly is in color.
Nov 24	comment	Pseudorandom generator and AE-secure encryption If you have a PRG, can't you use it to derive multiple keys from a single master key?
Nov 22	comment	Will varying plaintext compensate for a fixed initialisation vector? @Brent: One notable weakness of 8-bit CFB with a zero IV that, for every key $K$, there is some byte $B_K$ such that encrypting $B_K$ with CFB-8 will yield a zero byte, and will thus leave the internal state unchanged. Thus, any plaintext beginning with $n$ bytes of value $B_K$ will yield a ciphertext beginning with $n$ zero bytes.
Nov 16	comment	Is it safer to encrypt twice with RSA? Breaking IND-CPA security does not require fully recovering the plaintext -- it just requires you to learn enough about it to have a better than random chance of telling the encryptions of two plaintexts (of your choosing) apart.
Nov 15	comment	Does gpg's symmetric encryption keep information about the filename? @illsecure: GPG will always ask for the password when decrypting symmetrically encrypted data. The original filename (if any) is stored inside the encrypted data packet, so GPG needs the password to decrypt it.
Nov 2	comment	How can I break a Vigenère cipher with partial plain text? @Pierre: Just decode as much of the plaintext as you can and try guessing what the first word might be. (Also, the key itself is a meaningful phrase, too.)
Oct 30	comment	Why is an Encrypt-and-MAC scheme with deterministic MAC not IND-CPA secure? OK, thanks @Hendrik. :) I was kind of hoping you guys might have some handy "move comments" button to go with the answer-to-comment conversion feature, but I guess not. Thanks for going the extra mile, anyway. (Ps. I guess the two BiggBen1989's ought to be merged...)
Oct 17	comment	Is there a secure cryptosystem that can be performed mentally? @Thomas: That's what I suggest in the last paragraph above, just with a standard 52 card deck. I wasn't aware of 56 card decks being that common, although apparently they do exist.
Oct 16	comment	Are there secure stream ciphers that cannot be parallelized? @Paŭlo: Depends on exactly what the "desired property" is, which I'm not too clear about. By my reading of the question, something like iterated (or arbitrarily extended) scrypt would seem closer to what he wants (paraphrased, "if I run this for a year on a fast CPU and then extract a value, nobody else should be able to derive the same value without spending at least a year on it unless they have a faster CPU").
Oct 16	comment	Hill Cipher known plaintext attack You're right, as far as I can tell that should not be enough to solve for the matrix. Do you have any additional information, like undecrypted ciphertext? Or could the keyspace be limited somehow?
Oct 15	comment	Hash Digest Legal Status @Paŭlo: I just started a meta thread about whether questions like this should be on topic here. You may want to contribute your opinion there.
Oct 15	comment	Is it safe to hold key file's hash in application If you can hardcode a hash of the key into your application, why can't you just hardcode the key itself?
Oct 10	comment	Perfect security definitions I went a little further and transcribed the linked image. I also deleted the one time pad definition to which @Paŭlo's comment (presumably) refers to, since it didn't really seem relevant to the actual question.
Oct 4	comment	Could the Enigma algorithm be classified as a Feistel network? +1 for the analogy. :)
Oct 4	comment	Is it possible to obtain AES-128 key from a known ciphertext-plaintext pair? @Denis: The problem with ECB mode is not that it can leak the key, it's that it can leak information about the data being encrypted. If you want a secure mode of operation that allows fast deciphering of arbitrary blocks, use CTR instead (although, as fgrieu notes, CBC decryption also allows random access fairly efficiently).
Sep 27	comment	Why is CBC with predictable IV considered insecure against CPA Not always, but more often than you'd think. See my edit above for a practical example.
Sep 22	comment	Why is there a strong distinction between stream and block ciphers? Would you guys mind taking this discussion to chat?
Sep 22	comment	Why is there a strong distinction between stream and block ciphers? In an effort to keep this question from being closed, I've edited it to remove the argumentative last paragraph, leaving only the actual question. Further improvements are welcome.
Sep 22	comment	Why is there a strong distinction between stream and block ciphers? The last paragraph makes this seem more like an argument than a question. Please note that you should only ask practical, answerable questions based on actual problems that you face here. If you don't want to risk your question being closed or downvoted, I'd strongly suggest rewriting it to be more of an actual question (perhaps just deleting the last paragraph outright).