Vashek (Vaclav) Matyas

Centre for Research on Cryptography and Security
Faculty of Informatics
Masaryk University                      
Botanicka 68a                        
602 00 Brno - Czech Republic             E-mail: LastName at

GPG/PGP keys - operational (GPG), old (PGP)

Office hours: Mon 13:30-55 & Tue 13:00-30 (in my office A407).

Current activities:

Usable security with respect to both end-user and advanced users (e.g., developers or admins). We published some very interesting results about developers in a recent study
Usability Insights from Establishing TLS Connections at IFIP SEC 2022 and about end-users in a viewpoint article Even if users do not read security directives, their behavior is not so catastrophic in the Communications of the ACM, and also in an article Usable and secure? User perception of four authentication methods for mobile banking in the Computers & Security (Elsevier) journal. Our work in the second domain was presented in the extended version - Will You Trust This TLS Certificate? Perceptions of People Working in IT of our ACSAC 2019 paper, and related matters also in our paper Why Johnny the Developer Can't Work with Public Key Certificates: An Experimental Study of OpenSSL Usability at RSA Cryptographers' Track 2018. Work in the first domain brought interesting findings like Experimental large-scale review of attractors for detection of potentially unwanted applications in Computers & Security or A large-scale comparative study of beta testers and standard users in the Communications of the ACM or the paper "Codes v. People: A comparative usability study of two password recovery mechanisms" at WISTP 2016, and our paper "On the impact of warning interfaces for enabling the detection of Potentially Unwanted Applications" was presented at the 2016 European Workshop on Usable Security.

Analyzing outputs of crypto primites, where we analyze outputs of various crypto primitives for their properties, primarily statistical ones. Our Journal of Cryptology paper A Bad Day to Die Hard: Correcting the Dieharder Battery is the most recent side-effect of work in this area, and we bring some very interesting results in our Large-scale randomness study of security margins for 100+ cryptographic functions. We also analysed usage of crypto primitives in our SECRYPT 2022 paper A Longitudinal Study of Cryptographic API: A Decade of Android Malware Our results published at ESORICS 2020 in the paper Biased RSA private keys: Origin attribution of GCD-factorable keys complement those from our older paper The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli (ROCA) that received the Real-World Impact Award at the 2017 ACM CCS conference. Measuring Popularity of Cryptographic Libraries in Internet-Wide Scans was presented at ACSAC 2017. Prior to that we published our RSA key fingerprinting findings as The Million-Key Question – Investigating the Origins of RSA Public Keys won the best paper award at Usenix Security 2016. Check the previous link for additional resources to this paper, including an online key classification tool. Our work also includes examinations of statistical tests as such, involving also significant speed-up of NIST STS and interpretation of the tests. Other improvements are described (and algorithms provided) in Evolving boolean functions for fast and efficient randomness testing (paper at ACM GECCO 2018) and in Optimizing the NIST Statistical Test Suite and the Berlekamp-Massey Algorithm. Our webpage on Faster randomness testing shows some papers on both the speed-ups and also on the interpretation of results. Our paper Constructing empirical tests of randomness (presented at SECRYPT 2014) shows some results for the eSTREAM candidates and other results are shown in the paper Determining Cryptographic Distinguishers for eStream and SHA-3 Candidate Functions with Evolutionary Circuits (extended version of our SECRYPT 2013 paper). Security of random number generation with our work Towards True Random Number Generation in Mobile Environments from NordSec 2009 (paper download), and earlier work with more experimental results appeared in paper The Sources of Randomness in Mobile Devices, NordSec 2007 (paper download).

International Journal of Information Security (Springer) and Infocommunications Journal, where I'm member of the Editorial Boards.

My lectures in security/crypto here at the Masaryk University: More information on these courses can be found through the university webpages on my courses, and our centre at FI.

Information for our students inquiring about supervision, support, etc. can be found at this page.

I supervise PhD students Katarina Galanska, Jan Jancar, Adam Janovsky, Agata Kruzikova, Milan Patnaik, Vojtech Suchanek, and I had the pleasure to supervise PhD graduates Milan Broz, Vit Bukac, Filip Jurnecka, Dusan Klinec, Jan (Honza) Krhovjak, Marek Kumpost, Jiri Kur, Matus Nemec, Lukas Nemec, Martina Olliaro, Radim Ostadal, Vladimir Sedlacek, Vlasta Stavova, Martin Stehlik, Andriy Stetsko, Petr Svenda, Martin Ukrop.

Older stuff:

Just in case you met me during my 2017 sabbaticals with Red Hat Czech and CyLab, Carnegie Mellon University, or in 2011/12 as a Fulbright-Masaryk Visiting Scholar at the Center for Research on Computation and Society (CRCS), Harvard University, or in 2003/04 either as a Visiting Researcher with Microsoft Research Cambridge, or a Visiting Lecturer with University College Dublin, Department of Computer Science, then yes, it is me. :-) And again thanks to all these institutions, their employees, and other visitors at the time for their kind hospitality and/or inspiring discussions.
Vashek Matyas
E-mail: LastName at
Last update: Sep 18, 2023.