11,556 reputation
11048
bio website vyznev.net
location Helsinki, Finland
age
visits member for 2 years, 11 months
seen 3 hours ago

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

I started programming (in AmigaBASIC) when I was 10 years old. Nowadays, I'm most comfortable using Perl, C and JavaScript. I know Java and PHP too, but I can't really say I like them. I also know some Python, but not as much as I'd like.


CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:


Sep
5
comment Is there an encryption/decryption algorithm that can give two different outputs?
Ps. A one-time pad is the obvious trivial answer, but I assume you're looking for a practical scheme (i.e. one that doesn't require a key as long as the message).
Sep
5
comment Is there an encryption/decryption algorithm that can give two different outputs?
Related: Deniable Encryption from simple primitives, Is there a way to encrypt multiple sets of data into one result, with separate keys decrypting each set of data and maybe Encryption algorithm that produces dummy output on incorrect passwords
Sep
4
comment Will rehashing an SHA256 hash continually, eventually produce every possible value?
@Earlz: You could test it on a truncated version of SHA-256. Something like, say, 24 or even 32 bits ought to be doable. (Or course, this won't prove anything about the full SHA-256 behaving the same way, but it's at least illustrative.)
Sep
4
comment Using one-way hash functions as the encryption method
As for your other questions above: 1) SHA-512 only has 512 bits of internal state, so it can't store more entropy than that anyway. Up to that limit, the last 512 bits of the ciphertext should contain all the entropy in the key and message put together, so you don't really need any more. 2) If you increase the attacker's workload by a factor of 8 (he has to try up to 8 hashes to find the right one), that's equivalent to 3 bits of extra strength ($2^3 = 8$). 3) Yes, encrypt-then-MAC is generally better, but the "SIV trick" (using the MAC of the plaintext as an IV) wouldn't work with it.
Sep
4
comment Using one-way hash functions as the encryption method
Bob could send both two separate keys to Alice, but generally, secure key distribution is the hard part of symmetric-key encryption. If Bob can send, say, 1024 key bits to Alice, they're better off using it all as $K_1$, and deriving $K_2$ from it as I suggested, than they'd be splitting it into two 512-bit keys. As for key reuse, yes, both keys can be reused for multiple messages. The important part in the modified scheme is that $K_1$ is only used to HMAC plaintext, while $K_2$ is only user to HMAC ciphertext. That's why two keys are needed.
Sep
3
comment Using one-way hash functions as the encryption method
For each word, I suggested HMACing the previous 16 bytes (i.e. 512 bits) of the ciphertext (i.e. the part of the ciphertext encoding the previous word). You could HMAC more of the preceding ciphertext, but there's no real advantage to it. As for the hash and the key length, hiding the choice of the hash only adds at most a few bits of strength. That hardly makes up for the fact that it makes the security of your scheme harder to study. And you can use a longer key if you want, but 128 bits is enough to thwart any plausible brute force attacks using computers based on known physics.
Sep
3
comment Using one-way hash functions as the encryption method
@jj57: Having an Enigma machine just tells you how the scheme works, not what key was used to encrypt a given message. A modern, secure encryption scheme would not have been affected in any way by an attacker obtaining an encryption device, or even a detailed schematic of one. See Kerckhoffs' principle for details.
Sep
2
comment Is it possible to translate a piece of language into your own without knowing the language?
Ps. Obligatory Wikipedia link: en.wikipedia.org/wiki/Decipherment
Sep
2
comment Is it possible to translate a piece of language into your own without knowing the language?
Although it's kind of close, I don't think this question is really on topic for Cryptography Stack Exchange. You might have better luck with it on the History or Linguistics Stack Exchange sites. (That said, if someone else thinks it's on topic here and wants to answer it, I could change my mind.)
Sep
2
comment Initialization vector in symmetric-key encryption
Related: Encryption with “constant” initialization vector considered harmful
Sep
1
comment How to renew keys for a statically-encrypted database
Actually, I see no fundamental reason why you couldn't replace, say, the last byte in the SIV tag with a key identifier, provided that you ignored that byte when verifying message authenticity. It would slightly decrease the nominal strength of the S2V (i.e. authenticity) part of SIV, but not significantly. Of course, the resulting scheme would no longer be standard SIV, which might be a concern. (It's always nice to be able to say that you're using a standard encryption method.)
Aug
31
comment Why is the complexity of RSA-1024 80 bit and not 86 bit?
@user129789: Essentially, yes.
Aug
30
comment Why is the complexity of RSA-1024 80 bit and not 86 bit?
@poncho: That's correct. What I was driving at was more that, if the $o(1)$ term (assuming it's not just a mistake) was significant for typical values of $n$, one would expect it to be included explicitly in the formula, or at least to be mentioned in the article.
Aug
29
comment The security of an encrypt and MAC
This seems very similar to this recent question. The only real difference I can see is that the other question explicitly specifies that k1 = RC4(k2).
Aug
29
comment The security of an encrypt and MAC
It's not necessarily that impractical: you can derive the unique encryption and MAC keys from a master key and some nonce (e.g. a message number) using a KDF. Sure, changing the key for each message is probably slightly slower than using the same key for all of them, but then, if you're using HMAC you're presumably not aiming to squeeze every last bit of performance from your hardware anyway. (If you are, consider using a universal hashing based MAC instead.)
Aug
27
comment RC4 system pitfalls
Your description seems to be missing some possibly relevant details. For instance, what key is used for the HMAC? Is the HMAC output also encrypted, and if so, how? And how are the segment lengths transmitted?
Aug
26
comment The specification of modern, non-communicating cipher machinery
I agree with @owlstead, and have voted to close this question as essentially unanswerable. There might be a meaningful and practical question hidden behind it, but if you want it answered, you'll have to be more explicit about what it is. As currently written, I'm fairly sure the only kind of literature such questions have been considered in is science fiction and fantasy. (And for that, we have another Stack Exchange site.)
Aug
26
comment Lagrange Interpolation for finite field GF(2^8), for Secret Reconstruction
Is the result you're getting actually 104, not 14? Because that's what you should be getting if you calculate 17 × 3 + 34 × 3 + 61 in GF(2^8). The reason you're not getting 10 is that the points (1,17), (2,34) and (3,61) do not satisfy y = 5x² + 2x + 10 in GF(2^8). To make the reconstruction work in GF(2^8), you need to calculate the shares in that field too; see poncho's second answer for details.
Aug
26
comment Lagrange Interpolation for finite field GF(2^8), for Secret Reconstruction
If you're using operator overloading to implement Galois field arithmetic, remember that you need to overload addition and subtraction too. And don't forget to overload the non-assignment versions of the operators, either.
Aug
25
comment Generating an IV for ESP 3DES-CBC
@JuanAndrés: For details on the "fixed IV trick", see crypto.stackexchange.com/questions/5421/…. Basically, it's just a clever way to perform both the NIST-recommended IV derivation and the actual CBC encryption using a single call to a CBC encryption function.