David Cary

868 reputation

bio	website
	location
	age
visits	member for	1 year, 8 months
	seen	6 hours ago
stats	profile views	14

	868 reputation	bio	website		visits	member for	1 year, 8 months
19 badges		location			seen	6 hours ago

summary answers questions tags badges favorites bounties reputation activity

33 Comments

suggestions reviews revisions comments badges posts accepts all

May 16	comment	Are picture files “random enough” to be usable as a one-time pad? @PaŭloEbermann: Yes, Lavarand shows that, with (a) photographs that have adequate randomness, and (b) a good randomness extractor, one can produce excellent truly random numbers.
May 16	comment	True random numbers generated by sensors Many people seem to think we should "not harvest the bits generated when it's not moving", or "only use the bottom 8 bits from some samples", or "xor together" data from various sources and only put the single final result into the entropy pool. However, the top answer from "use all and hash, or trim least significant bits?" recommends feeding all directly directly into the CSPRNG, and let the CSPRNG handle any "hashing" or "XORing" that needs to be done.
May 5	comment	Theoretical pi-based stream cipher Good point. Some numbers do have more "1"s than "9"s in its decimal representation, even if that number is normal. But I was under the impression that most mathemeticians believe that not only is pi normal, but also that the decimal representation of pi has (as far as we know) exactly the same number of "1"s, "2"s, "9"s, etc. -- see "Frequency of Each Digit of Pi" by Eve Andersson. What evidence is there that the distribution is distinguishable from random?
Apr 25	comment	Theoretical pi-based stream cipher @Thomas: "most certainly"? Many mathematicians would be very surprised if it turns out that pi is not a "normal number". Are you really saying "I have discovered a truly remarkable proof of this theorem which this margin is too small to contain."?
Feb 23	comment	Algorithm/Technique for Steganography Some of the steganography schemes listed at crypto.stackexchange.com/questions/6058/… are more efficient, in the sense of requiring a smaller file to send the same number of ciphertext bits.
Feb 1	comment	Any efficient text-based steganographic schemes? @Mok-KongShen: Yes, the warden can easily detect trailing whitespace -- but often trailing whitespace accidentally and innocently ends up in files I write and others as well. How can a warden detect a real covert channel without getting false positives from such innocent accidental whitespace? If the warden cannot distinguish innocent random whitespace from a real covert channel, then the steganographic channel is secure IMHO.
Dec 9	comment	Public key cryptography - public key encrypts and cannot decrypt? +1 nice explanation. ArtOfTheProblem uses a similar but possibly easier-to-understand explanation in their "Public Key Cryptography: RSA Encryption Algorithm" youtube video.
Dec 1	comment	Software implementation of a commutative cipher? Number of intersections of two sets gives some interesting algorithms that apparently can tell you if you have any SSNs in common, and if so, how many, without leaking any more information.
Nov 13	comment	Stretching passwords for encrypting small files +1 for linking to a complete interoperable best-practice standard for encrypting files -- OpenPGP -- rather than mentioning one particular primitive or another, which all too often are used incorrectly or at least in unnecessarily incompatible ways.
Nov 2	comment	symmetric-key cryptography based key establishment techniques @D.W. : Yes, Wikipedia's Kerberos protocol article lists a few RFCs that explain the protocol. I wish someone would edit Simple Wikipedia's Kerberos protocol article to explain it in a way that normal humans could understand.
Nov 2	comment	Would this simple encrypted chat program be feasible using One Time Pads? Yes, the Linux version of /dev/random is the easiest way to do true random number generation. Many hardware random number generators come with a device driver that pulls the random bits from the device, checks every block of samples, and (if it passes the checks) feeds that random data into /dev/random . If your code uses /dev/random , it automatically uses whatever HRNGs are available -- including keyboard events and mouse events.
Oct 17	comment	Is there a public key semantically secure cryptosystem for which one can prove in zero knowledge the equivalence of two plaintexts? @RickyDemer: I'm no poker expert, but I don't follow. If Alice wants to prove that message A (the ace of hearts with a freshly-generated 256-bit random number) is the same as message B (also the ace of hearts with the same 256-bit random number), can't she simply point out that X and Y are identical, without revealing the 256-bit random number or her private key or the fact that A represents the ace of hearts?
Oct 2	comment	Tips on conceiving safe software messaging platform This answer would be more useful if you named specific systems that met those needs. Are you perhaps thinking of Freenet, or what?
Oct 2	comment	Salting when encrypting? "Is there a standard for OpenSSL-interoperable AES encryption?" implies that salted encryption (or at least salted AES encryption) is common.
Oct 2	comment	Is there a standard for OpenSSL-interoperable AES encryption? related: "Salting when encrypting?"
Aug 20	comment	What is the most secure hand cipher? +1: The [one-time pad[(en.wikipedia.org/wiki/one-time_pad) is the most secure cipher, period.
Aug 14	comment	Random decomposition of symmetric key Does the description for the secret-sharing tag sound like what you are trying to do?
Aug 10	comment	Is there a simple hash function that one can compute without a computer? Perhaps when we find a good hand hash, we could also use it for generating site-specific passwords which can be executed in my own head?.
Aug 10	comment	Do I have to recompute all hashes if I change the work factor in bcrypt? @PaŭloEbermann: Ah, right -- some password hash functions allow one to "continue", but not bcrypt.
Aug 8	comment	Secure private key storage related: "How to create Java Key Store (.jks) file with AES encryption?"