12,328 reputation
11352
bio website vyznev.net
location Helsinki, Finland
age
visits member for 3 years, 3 months
seen 2 days ago

I'm a PhD student in biomathematics, working on stochastic individual-based models of evolution in spatially structured populations. My other interests include cryptography, programming games and puzzles, photography and graphic design.

I started programming (in AmigaBASIC) when I was 10 years old. Nowadays, I'm most comfortable using Perl, C and JavaScript. I know Java and PHP too, but I can't really say I like them. I also know some Python, but not as much as I'd like.


CC-Zero Please consider any (original) code I post to Stack Overflow and other Stack Exchange sites to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.


I'm the main author and maintainer of the Stack Overflow Unofficial Patch (SOUP), a user script for browsers with GreaseMonkey-compatible user script support (Firefox, Chrome, Opera, possibly Safari) that fixes or works around a number of outstanding issues with the Stack Exchange user interface.

I tend to answer a lot more questions than I ask. Some answers I'm rather proud of:


May
9
comment Increased CRC collision probability when adding bits to input message
@D.W.: Agreed, this question isn't really on topic here. Stack Overflow might be a better home for it.
May
9
comment Winzip AES256 vs PGP
In addition to the file names, encrypted ZIP archives also leak the sizes and last modification timestamps of the unencrypted files and, if the older AE-1 format is used, their CRC checksums. Also, since they're vulnerable to various attacks if the attacker can modify the archive. These slides summarize some of the possible vulnerabilities.
May
7
comment Indistinguishability attack example
@juaninf: $m^{(0)}=m^{(1)}$ is useless, since that guarantees that nobody can distinguish the messages (since they're identical!). Now, $m^{(0)}_0=m^{(0)}_1$, on the other hand...
May
4
comment Is there a secure cryptosystem that can be performed mentally?
Ps. Here's a blog post I found with more details about the current security status of RC4. And yes, RC4-52 is probably less secure, and Solitaire even less so. They may both still be adequate for manual use (where messages are likely to be few and short), though.
May
4
comment Is there a secure cryptosystem that can be performed mentally?
@SmitJohnth: If used properly (derive the message key using a secure hash, and/or discard at least the first 768 or so bytes of output, don't encrypt more than about 1GB per message key), RC4 is still considered secure, in the sense of "no known practical attacks." I still wouldn't recommend it for new designs. Hand ciphers are kind of a special case, though: on one hand, one generally doesn't expect as much security from a hand cipher as from a computerized one; on the other, it would be quite hard for anyone to generate as much encrypted material by hand as most of the known attacks need.
Apr
30
comment Adversary Two Stages
Could you please provide a bit more context to your question? In particular, where did you see this paragraph, and what security property is it supposed to define? I can make some guesses based on what you wrote, but it would be nice to be able to tell for sure.
Apr
30
comment Why does key generation take an input $1^k$, and how do I represent it in practice?
Related: What does the expression $1^n$ mean as a function argument?
Apr
29
comment Secure order preserving hash function
@curious: Full semantic security with OPE is impossible anyway, and, technically, being able to efficiently recover plaintexts using an encryption oracle doesn't break the alternative security definition suggested by Boldyreva et al. It still makes the system rather useless in situations where such oracle access is possible.
Apr
29
comment Secure order preserving hash function
@curious: Yes. As the paper you linked to notes at the end of section 1, order-preserving encryption is useless if the attacker has access to an encryption oracle.
Apr
29
comment Secure order preserving hash function
@curious: If I can choose a string and ask you for its hash, then the attacks still works. Even if I can only ask whether the hash of my string is less than the hash of your string, that's still enough information for this attack.
Apr
29
comment Counter Mode: static IV but different keys
...or maybe Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?
Apr
27
comment Attacking historical ciphers methodology
The Hill cipher isn't exactly unbreakable either. (Mind you, that question concerns a known-plaintext attack, but you could always do crib-dragging. Actually, it might be possible to use frequency analysis and linear algebra for a direct ciphertext-only attack... need to think about that a bit more.)
Mar
30
comment Using encryption schemes for identification
I think you need to define your attack scenario a bit more precisely. In particular, can the attacker impersonate B to A? If so, they can carry out a straightforward MITM attack by just using the real B as an oracle. If not, why do you even need an authentication protocol?
Mar
22
comment What is the difference between a hash and a permutation?
@Nik: While there are various definitions of what constitutes a hash function, I don't think your example would qualify under most of them. Certainly it's not a hash function in the sense we usually use in cryptography. Still, you do have a point: if we restrict our hash to a set of inputs equal to its set of possible outputs, the thus restricted function could be a permutation. Most cryptographic hashes still won't be, though.
Mar
5
comment is AES secure for java application licensing
Digital signatures are a form of public key cryptography (but they don't generally involve encryption, although some algorithms such as RSA can be used for both). Their advantage in your situation is that the software only needs to contain the public half of the keypair, which can be used to verify signatures but not to create new ones. Of course, distributing a modified copy is still possible, but considerably less convenient for the cracker than simply distributing keys to unmodified copies.
Mar
2
comment Why is CAMELLIA suddenly so widely used?
@CodesInChaos: Indeed, this seems like a silly reason, given the existence of SSLHonorCipherOrder and similar options for other servers. Still, +1 to Jumbogram for figuring out the reason, even if it's silly.
Feb
27
comment Why do we need to hash both the message and the $h$ value in ElGamal signature?
I tried to clean up your question a bit, but there were some places where I wasn't really sure what you meant. Could you please check that I didn't introduce any mistakes, and maybe try to clarify your question further.
Feb
27
comment Is there a length-preserving encryption scheme?
-1, this question is so vague and poorly written that, even with the "clarifying" comments, it's hard for me to tell what's really being asked. Sorry, but it really is. Considering voting to close as "not a real question".
Feb
25
comment How to generate a random polynomial of degree $m$?
@Dilip: Good suggestion. I left the $\mathbb Z_q$'s unchanged, since that was the notation used in the quoted paper, and changing it mid-answer seemed needlessly confusing to me. I did, however add a (hopefully) clarifying note at the end. As for your scenario, the whole point is that, if the shareholders have no prior reason to assume that $c_k=0$, then assuming that and observing that it implies a particular value of the secret (e.g. "Attack at dawn"), however likely a priori, gives them no new information (in a sense that can be formalized and proven) about the actual secret.
Feb
25
comment How to generate a random polynomial of degree $m$?
@Dilip: Anyway, any given participant's share will be equal to the secret with probability $1/q$ anyway, simply because the underlying field only has $q$ elements to choose from. This doesn't matter, since such coincidences are completely random and provide no information about the secret. If the idea still bothers you, you could always work in, say, $GF(2^{256})$, where any of this would be astronomically unlikely to happen.