12,438 reputation
11352
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 4 months
seen 18 hours ago

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

Vote for me in the Mathematics.SE 2014 moderator election!


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:

CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


Oct
27
comment Are there attacks that break collision resistance but not preimage resistance?
OK, great! I've remade the edits.
Oct
27
comment How can I prove/disprove that a construction yields a secure PRG?
Is the input space of your PRG really $\{0,1\}^*$? If so, what's the distribution of the inputs? (It can't be uniform, since there is no uniform distribution over $\{0,1\}^*$.)
Oct
27
comment Are there attacks that break collision resistance but not preimage resistance?
I tried to copyedit your question, but I realized that I wasn't really sure whether you were asking for attacks that break preimage resistance but not collision resistance, or the other way around. Could you please clarify that?
Oct
25
comment Can you help me understand how RC4-52 is done using pen-and-paper?
Somewhat related: crypto.stackexchange.com/questions/844/…
Oct
21
comment Safety when disclosing hashes of secrets used to calculate other secrets
And if you don't want to exclude the empty string, you can always, say, publish HMAC(A, "0") and return HMAC(A, "1" || B) when given B.
Oct
21
comment Safety when disclosing hashes of secrets used to calculate other secrets
That's not really a goal in the sense I meant -- it's, at best, the means of reaching some goal that you haven't told us. But fair enough -- if that's all you need, then Ricky's suggestion of using HMAC should do fine.
Oct
21
comment How vulnerable is RSA when using it to encode ~1000s of datasets with 500bytes each? How easy can the private key passphrase be hacked?
As for the second problem, what I meant is that is should be as slow as possible for an attacker to test whether a guessed password is correct. The typical way to do that is to use a deliberately slow function (such as PBKDF2) to transform the password into whatever it is that you'll actually use to verify the correctness of the password and to decrypt the encrypted RSA key (which can be the same thing -- if you use an authenticated key wrap algorithm like SIV to encrypt the RSA key, then a successful decryption means the password must be correct).
Oct
21
comment How vulnerable is RSA when using it to encode ~1000s of datasets with 500bytes each? How easy can the private key passphrase be hacked?
IMO, "password strength checkers" frequently do more harm then good: diligent and security-conscious users don't need them, and lazy users will just pick the easiest password that passes the check, leading to passwords like "pa$$w0rd" or "asdfghjkl;'1234567890". Better to tell your users how to choose good passwords, and/or provide a secure random password generator.
Oct
21
comment How does one use AES block cipher modes of operation?
This should be specified in SP 800-38A (specifically, look in Appendix B). Anyway, the usual method is to send the initial counter value with each message, and to increment the counter by 1 for every subsequent block in the message. (It's possible to leave out the initial counter value if the recipient can reliably infer it from some other data, such as a message number.) And what you seem to be forgetting is that the key is also needed for successful decryption. :)
Oct
20
comment Complexity class of an idealised version of Bitcoin's proof-of-work (hashcash)?
Without analyzing the specific hash function used, I don't see how we can even show totality. For an arbitrary hash function (or a random oracle), there's no a priori guarantee that any input hashes to a value less than $x$, although it's extremely likely that one in fact does.
Oct
20
comment Safety when disclosing hashes of secrets used to calculate other secrets
What's the security goal of the overall scheme? In particular, if it's to prevent anyone else from later pretending to have known the secret before you published it, how do you plan to stop a potential pretender from simply relaying all queries to you?
Oct
19
comment Non-linearity of a boolean function
I've retagged this question, since it's certainly not about functional-encryption. However, if anyone can think of any more specific appropriate tags, feel free to add them.
Oct
18
comment Secure order preserving hash function
@pg1989: Interesting. Can you describe this "something almost as good" in more detail? (In particular, I don't suppose it helps to avoid the binary search attack, since that's a generic plaintext recovery attack against any OPE scheme that allows encryption oracle access.)
Oct
16
comment How does one use AES block cipher modes of operation?
You could start reading the input a bit earlier, at the 250th cycle (or even earlier, but that wouldn't help with throughput). That way, when the encryption was finished on the 266th cycle, you'd already have the next input block buffered and ready for encryption. Of course, that would require an input buffer separate from the AES encryption registers.
Oct
14
comment Encoding numbers that can be decoded mentally?
Or, even better, just make a simple database of the objects and their prices, with a unique (possibly random) ID for each object, and tag the objects with those IDs. Assuming you don't have billions of items, you phone should be able to store the database just fine. As a bonus, you can have the phone display the name (or a description) of the item, so you can tell if the customer has switched the tags.
Oct
12
comment How does one use AES block cipher modes of operation?
Yes, you need to send the IV / nonce to the recipient. The usual way is to just prepend it to the ciphertext. Also, yes, the CTR, ECB and OCB modes are easy to parallelize. AE modes using CTR as a component (EAX, GCM, SIV, etc.) can do the CTR mode en/decryption in parallel, but the authentication is typically less parallelizable. CBC and CFB mode encryption is inherently serial, but decryption can be parallelized. OFB mode is inherently serial in both directions, although it's possible to precalculate the keystream.
Oct
8
comment How does redundancy in a file effects performance and security of encryption?
Exactly.​​​​​​​
Oct
8
comment how much trust can we place in protocol verifiers?
Related, possibly duplicate: Is there an automated security protocol verification tool?
Oct
8
comment Definition of cryptographic advantage vs. probability of success
Why do you think you can't divide an advantage by 2? If I can guess $b$ with probability 0.50002, and you can guess it with probability 0.50001, then your advantage is $\frac12$ of mine.
Oct
8
comment Encryption algorithms and the “One-Time pad”
Possible duplicate of Why not the one-time pad with pseudo-number generator (or maybe What is the difference between a stream cipher and a one-time-pad?).