12,133 reputation
11251
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 2 months
seen yesterday

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

I started programming (in AmigaBASIC) when I was 10 years old. Nowadays, I'm most comfortable using Perl, C and JavaScript. I know Java and PHP too, but I can't really say I like them. I also know some Python, but not as much as I'd like.


CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:


Oct
21
comment How vulnerable is RSA when using it to encode ~1000s of datasets with 500bytes each? How easy can the private key passphrase be hacked?
As for the second problem, what I meant is that is should be as slow as possible for an attacker to test whether a guessed password is correct. The typical way to do that is to use a deliberately slow function (such as PBKDF2) to transform the password into whatever it is that you'll actually use to verify the correctness of the password and to decrypt the encrypted RSA key (which can be the same thing -- if you use an authenticated key wrap algorithm like SIV to encrypt the RSA key, then a successful decryption means the password must be correct).
Oct
21
comment How vulnerable is RSA when using it to encode ~1000s of datasets with 500bytes each? How easy can the private key passphrase be hacked?
IMO, "password strength checkers" frequently do more harm then good: diligent and security-conscious users don't need them, and lazy users will just pick the easiest password that passes the check, leading to passwords like "pa$$w0rd" or "asdfghjkl;'1234567890". Better to tell your users how to choose good passwords, and/or provide a secure random password generator.
Oct
21
comment How does one use AES block cipher modes of operation?
This should be specified in SP 800-38A (specifically, look in Appendix B). Anyway, the usual method is to send the initial counter value with each message, and to increment the counter by 1 for every subsequent block in the message. (It's possible to leave out the initial counter value if the recipient can reliably infer it from some other data, such as a message number.) And what you seem to be forgetting is that the key is also needed for successful decryption. :)
Oct
20
comment Complexity class of an idealised version of Bitcoin's proof-of-work (hashcash)?
Without analyzing the specific hash function used, I don't see how we can even show totality. For an arbitrary hash function (or a random oracle), there's no a priori guarantee that any input hashes to a value less than $x$, although it's extremely likely that one in fact does.
Oct
20
comment Safety when disclosing hashes of secrets used to calculate other secrets
What's the security goal of the overall scheme? In particular, if it's to prevent anyone else from later pretending to have known the secret before you published it, how do you plan to stop a potential pretender from simply relaying all queries to you?
Oct
19
comment Non-linearity of a boolean function
I've retagged this question, since it's certainly not about functional-encryption. However, if anyone can think of any more specific appropriate tags, feel free to add them.
Oct
18
comment Secure order preserving hash function
@pg1989: Interesting. Can you describe this "something almost as good" in more detail? (In particular, I don't suppose it helps to avoid the binary search attack, since that's a generic plaintext recovery attack against any OPE scheme that allows encryption oracle access.)
Oct
16
comment How does one use AES block cipher modes of operation?
You could start reading the input a bit earlier, at the 250th cycle (or even earlier, but that wouldn't help with throughput). That way, when the encryption was finished on the 266th cycle, you'd already have the next input block buffered and ready for encryption. Of course, that would require an input buffer separate from the AES encryption registers.
Oct
14
comment Encoding numbers that can be decoded mentally?
Or, even better, just make a simple database of the objects and their prices, with a unique (possibly random) ID for each object, and tag the objects with those IDs. Assuming you don't have billions of items, you phone should be able to store the database just fine. As a bonus, you can have the phone display the name (or a description) of the item, so you can tell if the customer has switched the tags.
Oct
12
comment How does one use AES block cipher modes of operation?
Yes, you need to send the IV / nonce to the recipient. The usual way is to just prepend it to the ciphertext. Also, yes, the CTR, ECB and OCB modes are easy to parallelize. AE modes using CTR as a component (EAX, GCM, SIV, etc.) can do the CTR mode en/decryption in parallel, but the authentication is typically less parallelizable. CBC and CFB mode encryption is inherently serial, but decryption can be parallelized. OFB mode is inherently serial in both directions, although it's possible to precalculate the keystream.
Oct
8
comment How does redundancy in a file effects performance and security of encryption?
Exactly.​​​​​​​
Oct
8
comment how much trust can we place in protocol verifiers?
Related, possibly duplicate: Is there an automated security protocol verification tool?
Oct
8
comment Definition of cryptographic advantage vs. probability of success
Why do you think you can't divide an advantage by 2? If I can guess $b$ with probability 0.50002, and you can guess it with probability 0.50001, then your advantage is $\frac12$ of mine.
Oct
8
comment Encryption algorithms and the “One-Time pad”
Possible duplicate of Why not the one-time pad with pseudo-number generator (or maybe What is the difference between a stream cipher and a one-time-pad?).
Oct
8
comment How does one use AES block cipher modes of operation?
BTW, I think you're probably confused on a fairly fundamental level about how block ciphers work. I'd suggest reading the Wikipedia articles on block ciphers and block cipher modes of operation before even looking at my answer below.
Oct
2
comment Shamir's Secret Share Over the Reals
Sort of. If we have some bounds for $S$ (say, we know that $a\le S\le b$ for some $a,b\in\mathbb R$), then in principle we can, say, let $r$ be normally distributed with standard deviation $\sigma$ much greater than $b-a$, in which case any effect of $S$ on $y_1$ will mostly be buried in the noise. (Of course, then we still have the problem that we cannot really store a random real number picked from a continuous distribution in a finite amount of memory, so we'll have to settle for some discrete approximation, which introduces new leaks.)
Sep
28
comment Who uses Dual_EC_DRBG?
@nealmcb: True. Color me surprised.
Sep
25
comment How broken is a xor of two LCGs?
+1, excellent analysis! It does seem to me, however, that much if not all of the issues you identified basically arise from a poor choice of modulus. What if the proposed algorithm was modified to use, say, $p=18446744073709551557=2^{64}-59$? That wouldn't leave much bias to detect, and it would also simplify the implementation. I suppose that might be better asked as a separate question, though.
Sep
19
comment Which encryption method supports random reads?
@CodesInChaos: Good point about not reusing the keystream. See the edit I just made to my answer for some ways to address it.
Sep
19
comment Which encryption method supports random reads?
@tylo: True, CFB and CBC also support random-access decryption, although encryption with those modes is inherently sequential. Unlike CTR mode, they also require you to retrieve the entire previous block of the ciphertext (and for CBC, the entire current block too) in order to decrypt any part of a block.