3 ms·
> And my claim is that if your threat model depends on an attacker who can afford $20M being unable to afford $40M But is it? I think the underlying claim is t
by omeid2 8y ago
> And my claim is that if your threat model depends on an attacker who can afford $20M being unable to afford $40M
But is it? I think the underlying claim is that 2X difference doesn't matter, which is patently false.
- Dylan16807 8y agoA 2X difference from baseline does not make a meaningful difference in who can attack you.
- omeid2 8y agoIt could make the difference of mounting a hash collision before a certificate expires or after (2X time), if the attack doesn't yield to parallelism and time becomes a limiting factor.
- Dylan16807 8y agoThe claim was about a 1 bit reduction in entropy. A scenario like that definitely acts differently, but it's not searching a space either; reducing a guaranteed calculation time by 2x is not really comparable to a loss of 1 entropy bit.
- geofft 8y ago2X difference doesn't matter to a reasonably constructed cryptographic threat model. Any threat model for which a 2X difference is meaningful is already flawed. I'm not saying a 2X difference doesn't matter in general. I'm saying a reasonably constructed cryptographic threat model is going to consider attacks as either "worth worrying about" or "not worth worrying about", and any maybes, like the possibility of an attacker who already controls $20M finding another $20M, fall in the "worth worrying about" bucket.