3 ms·

I enjoyed the @tptacek cameo. I suspect tptacek didn’t.

by philodeon 2mo ago

cassonmars 2mo ago
[flagged]
- timschmidt 2mo ago
  [flagged]
  - philodeon 2mo ago
    [flagged]
    - tptacek 2mo ago
      I have no idea what the fuck you're talking about here but nobody "lost a grad school spot" to Jacob Appelbaum. It is true that I was once a Bernstein stan. He's generally been nothing but nice to me. But then I met other cryptographers.
      - philodeon 2mo ago
        Quoting https://archive.fo/3QWJF#selection-801.0-805.168 https://archive.fo/3QWJF#selection-801.0-805.168 “Als Appelbaum im September 2015 an der Technischen Universität Eindhoven ein Doktorandenprogramm beginnt, ist auch sie interessiert. Für Appelbaum ist die Universitätsstelle in Eindhoven auch eine existentielle Stütze, falls er, nach den Vorwürfen im März in Valencia, seine Arbeit beim Tor-Projekt nicht fortsetzen kann. Lovecruft versucht schließlich, bei den selben Professoren wie Appelbaum angenommen zu werden. Am Ende wird ihr das nicht gelingen. Ein anderer Mensch wird jedoch das Büro beziehen, das direkt neben Appelbaums liegt. Es ist der Lebenspartner von Isis Agora Lovecruft oder einer ihrer Lebenspartner, das ist nicht klar. Dieser Mann wird später Arbeiten von Appelbaum bewerten, deren Ergebnisse für dessen Vorankommen in der Universität wichtig sind. Im Januar 2016, kurz nachdem sie an der Universität in Eindhoven abgelehnt wird, beteiligt sich Isis Agora Lovecruft daran, Geschichten zu sammeln über Jacob Appelbaum.”
        tptacek 2mo ago
        The person this is about is not an acquaintance of mine. I have no idea if they applied or didn't apply. The person I've spoken to --- am acquainted with (though not personal friends with) is Henry de Valence, who obviously did not lose a spot in Bernstein's lab to Appelbaum. These are all incredibly creepy and inappropriate accusations for you to be making. They're also wildly against the site guidelines.
        timschmidt 2mo ago
        [flagged]
        philodeon 2mo ago
        Henry de Valence is the person mentioned in that quote as having moved in next door to Appelbaum, as documented by djb: https://eindhoven.cr.yp.to/false-statements-by-henry-de-valence.txt https://eindhoven.cr.yp.to/false-statements-by-henry-de-vale...
tptacek 2mo ago
He didn't publicly call me an NSA shill, so I got off pretty easy. Obviously, I stand by what I said. I think it would be an understatement to suggest support for what Bernstein is arguing is a minority cause among cryptographers.
- directoron 2mo ago
  The argument from Roberto Avanzi is reasonable: "as a codesigner of ML-KEM myself I would not trust using it exclusively: what if it gets broken mathematically and in the classical computational model (I.e. non-quantum)? Hybrid is better, and the additional time used by ECC is not significant."
  - tptacek 2mo ago
    A majority (but not a large majority) of cryptography engineers would use hybrids at this point, and hybrids are largely the default design for any mainstream deployment. Bernstein argument isn't "use hybrids, not pure MLKEM"; it's "MLKEM is so dangerous there shouldn't even be an informational standard saying how to use it". That's a problem, because there are non-mainstream deployment environments where you can't use hybrids. Obviously, Bernstein is counting on you not following that level of nuance; he'd much rather you believe he's arguing for hybrids against people who are trying to exterminate hybrids. For clarity: I am not a cryptographer; I'm a vulnerability researcher who does some cryptography work and for several reasons I talk to a lot of academic cryptographers and cryptography engineers. You could not pay me to design a PQC transport protocol for you.
    - directoron 2mo ago
      Yes, the argument is MLKEM is so dangerous that it shouldn't be used alone. Even its codesigner says so. Why is it so hard to accept? Take a look at the crypto from the 80's and 90's. They are considered bad jokes nowadays, badly designed and easily breakable. Why would the first-generation PQC algorithms be any different? Of course they're going to be broken and ridiculed in 20 years, in ways you cannot comprehend yet
DonHopkins 2mo ago
[dead]

I enjoyed the @tptacek cameo. I suspect tptacek didn’t.

cassonmars 2mo ago

[flagged]

timschmidt 2mo ago
[flagged]
- philodeon 2mo ago
  [flagged]
  - tptacek 2mo ago
    I have no idea what the fuck you're talking about here but nobody "lost a grad school spot" to Jacob Appelbaum. It is true that I was once a Bernstein stan. He's generally been nothing but nice to me. But then I met other cryptographers.
    - philodeon 2mo ago
      Quoting https://archive.fo/3QWJF#selection-801.0-805.168 https://archive.fo/3QWJF#selection-801.0-805.168 “Als Appelbaum im September 2015 an der Technischen Universität Eindhoven ein Doktorandenprogramm beginnt, ist auch sie interessiert. Für Appelbaum ist die Universitätsstelle in Eindhoven auch eine existentielle Stütze, falls er, nach den Vorwürfen im März in Valencia, seine Arbeit beim Tor-Projekt nicht fortsetzen kann. Lovecruft versucht schließlich, bei den selben Professoren wie Appelbaum angenommen zu werden. Am Ende wird ihr das nicht gelingen. Ein anderer Mensch wird jedoch das Büro beziehen, das direkt neben Appelbaums liegt. Es ist der Lebenspartner von Isis Agora Lovecruft oder einer ihrer Lebenspartner, das ist nicht klar. Dieser Mann wird später Arbeiten von Appelbaum bewerten, deren Ergebnisse für dessen Vorankommen in der Universität wichtig sind. Im Januar 2016, kurz nachdem sie an der Universität in Eindhoven abgelehnt wird, beteiligt sich Isis Agora Lovecruft daran, Geschichten zu sammeln über Jacob Appelbaum.”
      - tptacek 2mo ago
        The person this is about is not an acquaintance of mine. I have no idea if they applied or didn't apply. The person I've spoken to --- am acquainted with (though not personal friends with) is Henry de Valence, who obviously did not lose a spot in Bernstein's lab to Appelbaum. These are all incredibly creepy and inappropriate accusations for you to be making. They're also wildly against the site guidelines.
        timschmidt 2mo ago
        [flagged]
        philodeon 2mo ago
        Henry de Valence is the person mentioned in that quote as having moved in next door to Appelbaum, as documented by djb: https://eindhoven.cr.yp.to/false-statements-by-henry-de-valence.txt https://eindhoven.cr.yp.to/false-statements-by-henry-de-vale...

tptacek 2mo ago

He didn't publicly call me an NSA shill, so I got off pretty easy. Obviously, I stand by what I said. I think it would be an understatement to suggest support for what Bernstein is arguing is a minority cause among cryptographers.

directoron 2mo ago
The argument from Roberto Avanzi is reasonable: "as a codesigner of ML-KEM myself I would not trust using it exclusively: what if it gets broken mathematically and in the classical computational model (I.e. non-quantum)? Hybrid is better, and the additional time used by ECC is not significant."
- tptacek 2mo ago
  A majority (but not a large majority) of cryptography engineers would use hybrids at this point, and hybrids are largely the default design for any mainstream deployment. Bernstein argument isn't "use hybrids, not pure MLKEM"; it's "MLKEM is so dangerous there shouldn't even be an informational standard saying how to use it". That's a problem, because there are non-mainstream deployment environments where you can't use hybrids. Obviously, Bernstein is counting on you not following that level of nuance; he'd much rather you believe he's arguing for hybrids against people who are trying to exterminate hybrids. For clarity: I am not a cryptographer; I'm a vulnerability researcher who does some cryptography work and for several reasons I talk to a lot of academic cryptographers and cryptography engineers. You could not pay me to design a PQC transport protocol for you.
  - directoron 2mo ago
    Yes, the argument is MLKEM is so dangerous that it shouldn't be used alone. Even its codesigner says so. Why is it so hard to accept? Take a look at the crypto from the 80's and 90's. They are considered bad jokes nowadays, badly designed and easily breakable. Why would the first-generation PQC algorithms be any different? Of course they're going to be broken and ridiculed in 20 years, in ways you cannot comprehend yet

DonHopkins 2mo ago

[dead]