10,784 reputation
11046
bio website vyznev.net
location Helsinki, Finland
age
visits member for 2 years, 8 months
seen 2 hours ago

I'm not really a cryptographer, I just play one on the internet.

Seriously, I'm just a programmer and mathematician interested in puzzles and information security. I don't have any kind of formal crypto training, but I've picked up a few things here and there over the years. Topics I'm particularly interested in include protocol design and analysis, classical ciphers and information-theoretically secure crypto techniques such as one time pads and secret sharing schemes.

Please consider any (original) code I post to Stack Overflow (and other Stack Exchange sites) to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


Jul
18
comment using random encrypted RSA challenge as key material
The output of HKDF-Expand is uniquely determined by its parameters (PRK, info, length). Thus, if you want to derive multiple independent keys from the same PRK using HKDF, you need to either 1) use a different info parameter for each, or 2) generate them all with one call to HKDF-Expand and split the output. Generally, just appending a counter to the info string will work fine. (Ps. See also my edit to the answer.)
Jul
18
comment Secret sharing scheme with possibility to change the secret
If the encryption method used is secure, it should not be vulnerable to known-plaintext attacks.
Jul
1
comment Designing a protocol to record attendance to lectures
The teacher can see the students in the classroom when he's teaching, right? So he cannot gain any information by looking at the pictures that he couldn't gain equally well just by looking at the students himself (and having a good memory for faces). And you implied that was acceptable above.
Jul
1
comment Designing a protocol to record attendance to lectures
On a disk? Or a USB stick, if you prefer. Why is that a problem, anyway? Disk space is cheap nowadays. Or is there some hidden requirement here? In any case, I don't think most modern face recognition programs actually store images of the faces (unless told to do so e.g. for review purposes), but only relatively compact abstract representations of the facial features of the subject.
Jul
1
comment Why is “mod(n)” so central to most aspects of cryptography?
@mikeazo: Definitely at least related. I'm still on the fence about the duplication; they are essentially the same question, modulo (pun not intended) the mention of XOR, but asked in rather different ways. In particular, merging the answers wouldn't really work in either direction.
Jul
1
comment Designing a protocol to record attendance to lectures
OK, so how about just having the teacher make up nicknames for each student, then, and verifying visually which students are present in each class. Or, if there are too many students for that, mount a camera in the classroom and use facial recognition software to track which students are present, assigning an arbitrary random ID to each face. At the end of the semester, each student shows up with photo ID to link their real name (or official student ID) to their face. Seems kind of silly, but also seems to satisfy your requirements (and a face is a lot harder to forge than a signature).
Jun
30
comment Designing a protocol to record attendance to lectures
How are you going to keep the teacher from just looking at the students to see who's present?
Jun
26
comment How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
@MaxiWheat: Yes, that's true. If the actual plaintext is indistinguishable from a random sequence of bits, then there's no way to tell it apart from any incorrect decryptions. In particular, the raw output of many ciphers does look effectively indistinguishable from random (unless one knows the key). However, that's not always the case: for example, a CTR mode ciphertext might start with a non-random nonce, or a CBC mode ciphertext might end with non-random padding, etc. It really depends on the details of the mode, cipher, etc. used to produce the inner ciphertext.
Jun
26
comment How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
@MaxiWheat: Most image / music / video / etc. file formats start with a fixed and distinctive header, which is how your computer can tell how to play each file correctly. In fact, the same goes for most compression and/or encryption formats too. If you have some idea what the type of the file is, you can just decrypt the first few blocks and look for the correct header. If not, you can always just try to match the decrypted data against a list of common file headers, like the one used by the Unix file command.
Jun
25
comment Finding a keylength in a repeating key XOR cipher
@Paŭlo: Actually, you don't need human-language text; the attack works as long as the plaintext character distribution is sufficiently uneven (and the message sufficiently long) that you can statistically distinguish different key characters by their corresponding ciphertext character distributions.
Jun
25
comment Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?
@tcboy88: Yes, that is correct. Indeed, that's presumably the reason why SP 800-108 and RFC 5869 both suggest using a deterministic unique DPK identifier rather than a random salt for the expansion phase. Of course, if you can store a random salt for each file, there's no reason why you couldn't do both.
Jun
23
comment How does order-preserving encryption work?
Thanks for this excellent answer! I felt that it deserved more than just an accept and an upvote, so you'll be getting an extra 50 rep bounty on top of that in a day or so.
May
24
comment Requiring a “supervisor” key pair and a “user” key pair to decrypt multiple-recipient messages
@D.W.: I'm fairly sure that "Jim" in steps 2 and 3 should be "Bob", and have edited the question accordingly. I'm not sure what, if anything, the phrase "using his private key" as a whole is supposed to mean, though (unless perhaps it means that Bob signs the messages he encrypts with his (Bob's) private key).
May
9
comment Increased CRC collision probability when adding bits to input message
@D.W.: Agreed, this question isn't really on topic here. Stack Overflow might be a better home for it.
May
9
comment Winzip AES256 vs PGP
In addition to the file names, encrypted ZIP archives also leak the sizes and last modification timestamps of the unencrypted files and, if the older AE-1 format is used, their CRC checksums. Also, since they're vulnerable to various attacks if the attacker can modify the archive. These slides summarize some of the possible vulnerabilities.
May
7
comment Indistinguishability attack example
@juaninf: $m^{(0)}=m^{(1)}$ is useless, since that guarantees that nobody can distinguish the messages (since they're identical!). Now, $m^{(0)}_0=m^{(0)}_1$, on the other hand...
May
4
comment Is there a secure cryptosystem that can be performed mentally?
Ps. Here's a blog post I found with more details about the current security status of RC4. And yes, RC4-52 is probably less secure, and Solitaire even less so. They may both still be adequate for manual use (where messages are likely to be few and short), though.
May
4
comment Is there a secure cryptosystem that can be performed mentally?
@SmitJohnth: If used properly (derive the message key using a secure hash, and/or discard at least the first 768 or so bytes of output, don't encrypt more than about 1GB per message key), RC4 is still considered secure, in the sense of "no known practical attacks." I still wouldn't recommend it for new designs. Hand ciphers are kind of a special case, though: on one hand, one generally doesn't expect as much security from a hand cipher as from a computerized one; on the other, it would be quite hard for anyone to generate as much encrypted material by hand as most of the known attacks need.
Apr
30
comment Adversary Two Stages
Could you please provide a bit more context to your question? In particular, where did you see this paragraph, and what security property is it supposed to define? I can make some guesses based on what you wrote, but it would be nice to be able to tell for sure.
Apr
30
comment Why does key generation take an input $1^k$, and how do I represent it in practice?
Related: What does the expression $1^n$ mean as a function argument?