3 ms·

Many thanks. I wish Beamer made a bigger point of recommending distribution in handout mode or more accurately dissuading distribution in presentation mode.

by dfc 12y ago

cperciva 12y ago
I always do that now. The only reason I didn't this time is that the slides were from 2010, before I updated my Makefile to automatically build both versions.
- zokier 12y ago
  > that the slides were from 2010 Considering this, what do you think has changed in the past 5 years? Eg the slides mention SHA3 as a future option, now it is finalized and afaik usable. There is also one interesting thing about SHA3 which I learned recently, namely that it can apparently be easily used as MAC too: > Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be performed by simply prepending the message with the key from http://keccak.noekeon.org/ http://keccak.noekeon.org/ In this light, do you think it would be reasonable to add exception for "DON’T: Try to use a hash function as a symmetric signature." rule? Another thing is that ECC seems to be on the rise (or is it just my perception?). Do you think a revised slide set would include something more about elliptic curves?
  - cperciva 12y ago
    what do you think has changed in the past 5 years? Eg the slides mention SHA3 as a future option, now it is finalized and afaik usable. Not much has changed. I still think SHA3 is worth considering 5-10 years into the future; five years ago I was concerned about the implications of MD5 and SHA1 breaks on SHA2, but the lack of recent progress makes me happier with staying on SHA2 while SHA3 gets more analysis. do you think it would be reasonable to add exception for "DON’T: Try to use a hash function as a symmetric signature." rule? I mentioned this in the talk; even with SHA3 you need to be careful, since a simple "append and hash" would result in MAC("key", "data") == MAC("keyd", "ata"), which breaks the MAC assumptions. Yes, you can use SHA3 as a MAC, but make sure you know what you're doing. ECC seems to be on the rise (or is it just my perception?). Do you think a revised slide set would include something more about elliptic curves? ECC is getting more popular; not necessarily for the right reasons, though. (The big drivers seem to be "bitcoin uses this" and "the most common way of using this provides forward perfect secrecy".) That said, as mathematicians continue to attack ECC systems, I am gradually becoming more comfortable; the 2025 version of this talk might recommend using them, but for now I don't think it makes sense to change my recommendation (except for situations like bitcoin which specifically need ECC's advantages).

Many thanks. I wish Beamer made a bigger point of recommending distribution in handout mode or more accurately dissuading distribution in presentation mode.

by dfc 12y ago

Many thanks. I wish Beamer made a bigger point of recommending distribution in handout mode or more accurately dissuading distribution in presentation mode.

cperciva 12y ago

I always do that now. The only reason I didn't this time is that the slides were from 2010, before I updated my Makefile to automatically build both versions.

zokier 12y ago
> that the slides were from 2010 Considering this, what do you think has changed in the past 5 years? Eg the slides mention SHA3 as a future option, now it is finalized and afaik usable. There is also one interesting thing about SHA3 which I learned recently, namely that it can apparently be easily used as MAC too: > Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be performed by simply prepending the message with the key from http://keccak.noekeon.org/ http://keccak.noekeon.org/ In this light, do you think it would be reasonable to add exception for "DON’T: Try to use a hash function as a symmetric signature." rule? Another thing is that ECC seems to be on the rise (or is it just my perception?). Do you think a revised slide set would include something more about elliptic curves?
- cperciva 12y ago
  what do you think has changed in the past 5 years? Eg the slides mention SHA3 as a future option, now it is finalized and afaik usable. Not much has changed. I still think SHA3 is worth considering 5-10 years into the future; five years ago I was concerned about the implications of MD5 and SHA1 breaks on SHA2, but the lack of recent progress makes me happier with staying on SHA2 while SHA3 gets more analysis. do you think it would be reasonable to add exception for "DON’T: Try to use a hash function as a symmetric signature." rule? I mentioned this in the talk; even with SHA3 you need to be careful, since a simple "append and hash" would result in MAC("key", "data") == MAC("keyd", "ata"), which breaks the MAC assumptions. Yes, you can use SHA3 as a MAC, but make sure you know what you're doing. ECC seems to be on the rise (or is it just my perception?). Do you think a revised slide set would include something more about elliptic curves? ECC is getting more popular; not necessarily for the right reasons, though. (The big drivers seem to be "bitcoin uses this" and "the most common way of using this provides forward perfect secrecy".) That said, as mathematicians continue to attack ECC systems, I am gradually becoming more comfortable; the 2025 version of this talk might recommend using them, but for now I don't think it makes sense to change my recommendation (except for situations like bitcoin which specifically need ECC's advantages).