12,328 reputation
11352
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 3 months
seen Nov 20 at 10:54

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

I started programming (in AmigaBASIC) when I was 10 years old. Nowadays, I'm most comfortable using Perl, C and JavaScript. I know Java and PHP too, but I can't really say I like them. I also know some Python, but not as much as I'd like.


CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:


Sep
28
comment Who uses Dual_EC_DRBG?
@nealmcb: True. Color me surprised.
Sep
25
comment How broken is a xor of two LCGs?
+1, excellent analysis! It does seem to me, however, that much if not all of the issues you identified basically arise from a poor choice of modulus. What if the proposed algorithm was modified to use, say, $p=18446744073709551557=2^{64}-59$? That wouldn't leave much bias to detect, and it would also simplify the implementation. I suppose that might be better asked as a separate question, though.
Sep
19
comment Which encryption method supports random reads?
@CodesInChaos: Good point about not reusing the keystream. See the edit I just made to my answer for some ways to address it.
Sep
19
comment Which encryption method supports random reads?
@tylo: True, CFB and CBC also support random-access decryption, although encryption with those modes is inherently sequential. Unlike CTR mode, they also require you to retrieve the entire previous block of the ciphertext (and for CBC, the entire current block too) in order to decrypt any part of a block.
Sep
19
comment Shamir's secret sharing with passwords
Related, possibly duplicate: crypto.stackexchange.com/questions/2970/…. The scheme I describe in my answer there is basically the same as your XOR-based one.
Sep
18
comment Fast post-processing for broken RDRAND
The point of the Becker et al. attack is that they reduce the state space of the RNG to (e.g.) 32 bits (plus a 224-bit constant known only to the attacker). Testing each of $2^{32}$ possible states is generally not much of a challenge to an attacker with even a single modern CPU.
Sep
16
comment Precise meaning of various terms related to universal hash functions
@nightcracker: Actually, I think there's a reasonable question in here. All these terms are closely related to universal hashing, and explaining the precise differences between them would be useful. I've tried to edit the question to make it less "homeworky" (@Govinda: please check my edits and fix anything you don't like), and may try to answer it later when I'm not so busy.
Sep
13
comment Zero knowledge proof of possession of key
Ps. An obvious solution would be for Alice to calculate a commitment $Q$ to $M$ and tack it onto $C$. Technically, this doesn't prove that $C$ decrypts to $M$, but it does prove that Alice knew $M$ when she generated $C$.
Sep
13
comment Zero knowledge proof of possession of key
What's Dave's role in all this, from Alice and Bob's perspective? You say he "performs certain operations" based on $M$, but you also say that he has no contact with Alice or Bob (except, presumably, for receiving $C$ from Bob). So if Dave can't communicate the results of his "certain operations" back to Bob, why does he even need to be part of the whole system?
Sep
13
comment Can I dynamically calculate an appropriate number of iterations for PBKDF2 based on the system time, rather than using a fixed value?
@Tiran: Why not give the salt away? It's not like salts are supposed to be secret, anyway. Or, if you do want to include a "secret salt", you can always have a second KDF pass (which need not be slow) on the server with a different salt. (That's actually a good idea anyway, since you don't want to store password-equivalent tokens, like the client-side KDF output, unhashed in the database.) Really, doing key stretching on the client side is an excellent idea, it's just not very widely used yet.
Sep
8
comment Who uses Dual_EC_DRBG?
@D.W.: I agree that the link is useful, but a summary (along with the link, of course) would IMO be even better. On one hand, the NIST table isn't exactly easy to read; on the other, it strikes me that having a summary of the current situation, as of this writing, could also be useful for future readers.
Sep
5
comment Is there an encryption/decryption algorithm that can give two different outputs?
Ps. A one-time pad is the obvious trivial answer, but I assume you're looking for a practical scheme (i.e. one that doesn't require a key as long as the message).
Sep
5
comment Is there an encryption/decryption algorithm that can give two different outputs?
Related: Deniable Encryption from simple primitives, Is there a way to encrypt multiple sets of data into one result, with separate keys decrypting each set of data and maybe Encryption algorithm that produces dummy output on incorrect passwords
Sep
4
comment Will rehashing an SHA256 hash continually, eventually produce every possible value?
@Earlz: You could test it on a truncated version of SHA-256. Something like, say, 24 or even 32 bits ought to be doable. (Or course, this won't prove anything about the full SHA-256 behaving the same way, but it's at least illustrative.)
Sep
4
comment Using one-way hash functions as the encryption method
As for your other questions above: 1) SHA-512 only has 512 bits of internal state, so it can't store more entropy than that anyway. Up to that limit, the last 512 bits of the ciphertext should contain all the entropy in the key and message put together, so you don't really need any more. 2) If you increase the attacker's workload by a factor of 8 (he has to try up to 8 hashes to find the right one), that's equivalent to 3 bits of extra strength ($2^3 = 8$). 3) Yes, encrypt-then-MAC is generally better, but the "SIV trick" (using the MAC of the plaintext as an IV) wouldn't work with it.
Sep
4
comment Using one-way hash functions as the encryption method
Bob could send both two separate keys to Alice, but generally, secure key distribution is the hard part of symmetric-key encryption. If Bob can send, say, 1024 key bits to Alice, they're better off using it all as $K_1$, and deriving $K_2$ from it as I suggested, than they'd be splitting it into two 512-bit keys. As for key reuse, yes, both keys can be reused for multiple messages. The important part in the modified scheme is that $K_1$ is only used to HMAC plaintext, while $K_2$ is only user to HMAC ciphertext. That's why two keys are needed.
Sep
3
comment Using one-way hash functions as the encryption method
For each word, I suggested HMACing the previous 16 bytes (i.e. 512 bits) of the ciphertext (i.e. the part of the ciphertext encoding the previous word). You could HMAC more of the preceding ciphertext, but there's no real advantage to it. As for the hash and the key length, hiding the choice of the hash only adds at most a few bits of strength. That hardly makes up for the fact that it makes the security of your scheme harder to study. And you can use a longer key if you want, but 128 bits is enough to thwart any plausible brute force attacks using computers based on known physics.
Sep
3
comment Using one-way hash functions as the encryption method
@jj57: Having an Enigma machine just tells you how the scheme works, not what key was used to encrypt a given message. A modern, secure encryption scheme would not have been affected in any way by an attacker obtaining an encryption device, or even a detailed schematic of one. See Kerckhoffs' principle for details.
Sep
2
comment Is it possible to translate a piece of language into your own without knowing the language?
Ps. Obligatory Wikipedia link: en.wikipedia.org/wiki/Decipherment
Sep
2
comment Is it possible to translate a piece of language into your own without knowing the language?
Although it's kind of close, I don't think this question is really on topic for Cryptography Stack Exchange. You might have better luck with it on the History or Linguistics Stack Exchange sites. (That said, if someone else thinks it's on topic here and wants to answer it, I could change my mind.)