1,685 reputation
415
bio website
location
age
visits member for 2 years, 11 months
seen yesterday

1d
comment Is there a cryptographic hash function that can be performed with pencil and paper?
@JohnDeters: I agree that colluding web site admins is unrealistic. However, I have accounts on so many different websites that it is not unreasonable to suspect that at least 2 of those sites will accidentally leak my password to an attacker.
Jun
11
comment Can you help me understand what a cryptographic “salt” is?
@Mike: Who? Someone says "You should always assume the attacker knows the salt.". People at another page says "Salts are public", and later says "the salts are known, because that's the industry-standard use of the word salt." Another says "the salt are public knowledge, or at least should be treated as public knowledge.".
Apr
21
comment encrypt message with one digest 0-9 instead of 01-26
I've been told that historically this Gronsfeld cipher was actually used more often than the Vigenère cipher.
Mar
22
comment Do any one-key-of-many cryptographic schemes exist?
+1. Perhaps you might also mention: This standard construction is standardized in more detail in "RFC 4880: OpenPGP Message Format".
Mar
15
comment Analogue encryption algorithms
I agree that most of these systems are mostly just obfuscation. Most people define things like the Playfair cipher as "encryption", although it is relatively easily distinguished from white noise. Even using your unnecessarily strict definition of "encryption", I suspect that it may be possible to build an analog system that would be practically indistinguishable from white noise; with a vocoder + frequency hopping using a "good" pseudo-random number generator + random chaff.
Mar
15
comment Analogue encryption algorithms
I dunno; I suspect that with a bit of tweaking the vocoder + frequency hopping using a "good" pseudo-random number generator + random chaff would be pretty close to indistinguishable from white noise.
Jan
24
comment Is there a standard for OpenSSL-interoperable AES encryption?
related: "Wheres the salt on the openssl aes encryption?"
Jan
24
comment Impact of distinguishing between random text and cipher text?
Wikipedia: Feistel cipher currently claims that '4 rounds are sufficient to make it a "strong" pseudorandom permutation'. Is Wikipedia wrong, or am I misunderstanding Patarin or Wikipedia or both?
Jan
13
comment Convert old and busted password encryption to something sensible
related: Increase the security of an already stored password hash
Jan
12
comment Is there a simple hash function that one can compute without a computer?
related: crypto.stackexchange.com/questions/11691/…
Jan
2
comment How does the secret key in an HMAC prevent modification of the HMAC?
@StephenTouset, by "appending data to the end", I think George is referring to a length extension attack, which is not trivial.
Dec
29
comment Salts, how does the script know what the salt is?
Yes, and often the name of the hash algorithm is also concatenated to the salt and the hash, in Modular Crypt Format or LDAP / RFC2307 format.
Nov
13
comment How can we get CA's public key?
@CodesInChaos: make that an answer.
Nov
12
comment How would I make a secret notation alphabet more secure?
You might enjoy looking at shorthand systems such as Gregg shorthand -- they were never intended to be difficult to decode, but some stenographers use so many of their own custom abbreviations that even other stenographers using the same system have difficulty reading it.
Nov
12
comment Is this hand cipher any more secure than the Vigenère cipher?
You could get a lot better diffusion if, rather than handle each letter independently with "mod 26", you allow a carry over -- i.e., when adding 5 to X and obtaining C, you get a "carry over" that changes the next column from E+3=H to E+3+1=I.
Oct
23
comment What is the most secure hand cipher?
@makerofthings7: if it is used properly, as Smit Johnth pointed out, then OTP is completely immune to statistical analysis and every other kind of ciphertext-only analysis, no matter how the letters are encoded into numbers -- ASCII, Baudot code, Morse code, etc. See Wikibooks: one time pads for more details.
Oct
16
comment Any efficient text-based steganographic schemes?
This steganographic scheme is called an acrostic ( Wikipedia: acrostic ).
Aug
4
comment Why are there $ signs in my passwd file?
+1. Recently people at Wikipedia shuffled things around. Is crypt (C) on Wikipedia what this answer ought to link to?
Jul
16
comment Physical analogue for MACs
+1. To make this more analogous to a real MAC, we could assume that an attacker could steal the case (and everything inside it) and substitute a similar-looking one of his one -- only someone with the "real" key would discover that it doesn't unlock the replacement case, just as only someone with the real secret key can tell that a substituted message with a substituted MAC isn't the original message.
Jul
15
comment Physical analogue for MACs
@Reid -- you have two pretty good ideas here; I wish you had posted them as two separate answers, so that the "better one" (whichever that may be) would float to the top. +1 anyway.