10,784 reputation
11046
bio website vyznev.net
location Helsinki, Finland
age
visits member for 2 years, 8 months
seen 3 hours ago

I'm not really a cryptographer, I just play one on the internet.

Seriously, I'm just a programmer and mathematician interested in puzzles and information security. I don't have any kind of formal crypto training, but I've picked up a few things here and there over the years. Topics I'm particularly interested in include protocol design and analysis, classical ciphers and information-theoretically secure crypto techniques such as one time pads and secret sharing schemes.

Please consider any (original) code I post to Stack Overflow (and other Stack Exchange sites) to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


Jan
30
comment Cryptographic Symmetric Stream Cipher
@Auth: Technically, yes. However, note that, with symmetric crypto, anyone who can compute $P$ can also compute $S$, and vice versa. If this is not desirable, you'd need to use some kind of asymmetric encryption scheme. Your question, however, did not mention anything about that.
Jan
29
comment RSA and One Time Password (OTP) service
And why should the server trust the results of whatever verification the client does (or claims to have done)?
Jan
28
comment RSA and One Time Password (OTP) service
What, exactly, are your requirements? In particular, what is that you're trying to achieve with this scheme? It looks like you're trying to authenticate something to something else, but who or what exactly are the parties involves and their roles in this authentication?
Jan
24
comment Cryptographic Primitive Method
@Auth: Did you post that last comment on the wrong question?
Jan
23
comment How to generate a key using any m passwords out of total n?
Possible duplicate of Can I pre-define the points in Shamir's Secret Sharing algorithm. (Your question is somewhat more general, since it doesn't mention Shamir's scheme explicitly, but the answers apply to the more general case as well.)
Jan
23
comment Does it take brute force to find a pair of plaintext and ciphertext that each follow a certain condition, given an AES encryption key?
@Joe: Note that, if you fix 64 bits of the plaintext and 64 bits of the ciphertext of a 128-bit block cipher, then there's about a $e^{-1}\approx 0.37$ chance that no such pair will exist. (More generally, if you fix $j\gg0$ out of $n$ bits of the plaintext and $k\gg0$ out of $n$ bits of the ciphertext, then the probability of there being at least one matching pair is about $1-e^{-2^{n-j-k}}$.)
Jan
16
comment Two way encryption with random IV
See also: What's is the main difference between a key, an IV and a nonce?
Jan
16
comment How do single use passwords work for an encrypted message
@hunter: I suppose they might derive the actual encryption key directly using PBKDF2 from the user's permanent password, and then save an encrypted copy of that key for each one-time password. Or the statement on the website might just be missing some details.
Jan
11
comment Is it possible to break a hash-based block cipher?
Paŭlo, I know you're perfectly aware of this, but for others reading this answer, it may be worth pointing out that the "tweakable block cipher" $Enc_k^n(P)=P\oplus H(k,n)$ described above is also trivially distinguishable from a pseudorandom permutation, being linear in $P$. As indistinguishability from a PRP is the usual security property expected of a block cipher, I'd be hesitant to call this a block cipher of any kind at all (except maybe a "hopelessly broken" one).
Jan
11
comment Deriving Keys for Symmetric Encryption and Authentication
@Thomas: I believe I've seen the term "generalized counter" used in the literature for such deterministic non-repeating sequences.
Jan
11
comment Creating an encryption key from several other keys and using hash functions
Alternatively, you could also use any standard key derivation function, such as HKDF (RFC 5869).
Jan
10
comment How secure is the knapsack?
I assume you'd also want the process for generating $W$ and $X$ to give you $S$ as well (since knowing a hard problem that even you can't solve, and which may or may not have a solution, isn't generally very useful), right? What were you actually planning to do with it if you had one, anyway?
Jan
10
comment How and why can a decryption program tell me that a key is incorrect?
@Paŭlo: While storing a plain hash of a low-entropy password would be bad, I'm not aware of any issues with storing a hash of an encryption key properly derived from the password using a key-stretching KDF. If there's something wrong with that that I'm missing, please do let me know.
Jan
10
comment Why is RSA usually limited to messages up to 1 block
possible duplicate of Why is asymmetric cryptography bad for huge data?
Jan
9
comment Using CBC with a fixed IV and a random first plaintext block
@Joshua: In the scheme you've described in your question, the first ciphertext block is, in effect, the IV for the rest of the message. (That's how CBC works: every block of ciphertext is, in effect, used as the IV for the next block.) It's not predictable, even if the first plaintext block (or the "real" IV that's XORed with it) is, because it's obtained by encrypting the plaintext with an unknown (to the attacker) key.
Jan
9
comment Using CBC with a fixed IV and a random first plaintext block
Note that that's assuming that the adversary does not have oracle access to the block cipher. Even if the adversary does have such access to the high-level CBC mode encryption function (i.e. they can request the encryption of chosen plaintexts), CBC mode prevents them from directly feeding chosen inputs to the block cipher as long as they cannot predict the IV. Thus, the ability to predict the IV and oracle access to the block cipher are essentially equivalent for an IND-CPA adversary attacking CBC mode using this IV generation method -- either one implies the other.
Jan
9
comment Using CBC with a fixed IV and a random first plaintext block
@Joshua: It becomes unpredictable (to an adversary who does not know the key) when it passes through the block cipher.
Jan
7
comment How and why can a decryption program tell me that a key is incorrect?
Related: How does GPG verify succesful decryption? and Can I determine if a user has the wrong symmetric encryption key?
Jan
6
comment Why xor the message into the state for sponge hashes?
My point with the last sentence was that replacement is not really "mixing" at all; it just means throwing away part of the state and using that space to store the unmixed input for some later mixing step. At some point, you'll have to combine the input and the existing state in some nontrivial way; certainly that way doesn't have to be XOR -- it could be modular addition, or multiplication, or even something like an S-box -- but it has to be something other than just replacement. XOR seems as good a choice as any to me.
Jan
6
comment Why xor the message into the state for sponge hashes?
Replacing throws away the replaced part of the internal state. Of course, if the remaining part of the state is long enough, that might not matter, but then why bother even calculating the part you're going to replace anyway? And then you need to decide how you're going to mix the part you just replaced with the rest of the state...