matthewdgreen

675 ms·

3151.
by matthewdgreen 11y ago
However: even in this setting, all it takes is a single unauthorized call to Dual EC and an exfiltration of 240 bits to obtain the values used in all subsequent re-seeding of the ANSI generator. We already know there is unauthorized code in
3152.
by matthewdgreen 11y ago
Certicom did the same thing. The argument given was that these companies have less access to data interception, therefore the impact of a maliciously-generated set of parameters is lower. That's absolutely crazy. The real danger of inc
3153.
by matthewdgreen 12y ago
I mean DHE keys.
3154.
by matthewdgreen 12y ago
What is worth mentioning here is that Apache servers do the same thing for Diffie-Hellman 'ephemeral' keys. We imagine those keys are generated for each session, but in fact one key can last for weeks and millions of sessions. (I
3155.
by matthewdgreen 12y ago
The TLS spec suggests once per day or every 500 connections. Why didn't they do this? Who knows. Things like that are hard to get right...
3156.
by matthewdgreen 12y ago
The link is: SmackTLS.com
3157.
by matthewdgreen 12y ago
Heh. For the record, Nadia was doing the handholding. She ran the job across 75 EC2 nodes with software that kept crashing. I updated the post to make that a bit more clear.
3158.
by matthewdgreen 12y ago
First of all, there's no such thing as the 'Warmist' community. If you start by looking for views you disagree with, confirmation bias will produce a view of the community that corresponds to your pre-conceived notions. In re
3159.
by matthewdgreen 12y ago
Here's the update: http://blog.cryptographyengineering.com/2015/02/another-upda...
3160.
by matthewdgreen 12y ago
Thanks Thomas. This is Matt Green, one of the two people running the audit. As tptacek explained, we went down a few blind alleys following the public collapse of the Truecrypt (development) project. In the last few weeks we've signed
3161.
by matthewdgreen 12y ago
Does that include overall government spending, or only Federal spending?
3162.
by matthewdgreen 12y ago
Roughly speaking, the question here is: can you simulate a multi-edge protocol. That is, can you achieve the following properties using rewinding: 1. The 'fake Prover' simulating the protocol has no knowledge of an actual graph co
3163.
by matthewdgreen 12y ago
That wasn't spelled out perfectly in the post. The answer is that the set of crayon colors (e.g., red, blue, purple) is fixed and known to all parties. The only thing Google gets to swap is the ordering of which of the three colors it
3164.
by matthewdgreen 12y ago
> If they know your password no amount of device encryption will protect you, that is why he is ignoring them. I can set a 128-bit equivalent password on my computer. I don't know how to ensure that Microsoft's cloud provides e
3165.
by matthewdgreen 12y ago
> Both Apple and Google's schemes are predicated on the assumption that you'll have a full phone backup stored in the "cloud." They also offer photo backup and sync other key data. I wouldn't grant that. The whol
3166.
by matthewdgreen 12y ago
I'm not sure I understand the argument here. Several manufacturers have now implemented on-by-default device encryption with no backdoor. This is not only feasible (in a business and technical sense) but is rapidly becoming the standar
3167.
by matthewdgreen 12y ago
Yes, some other people who are familiar with the design have also corrected me. I've updated the post.
3168.
by matthewdgreen 12y ago
Really they can both be true. They're just true for different constituencies. The vast majority of users are not targeted by active attacks, nor should they have reason to be. They may be hacked or subpoenaed after the fact.
3169.
by matthewdgreen 12y ago
I think if you read it that way you probably didn't click the link to the extensive criticism I've written about iMessage's key distribution. Saying something is better than plaintext is not the same as saying it's good
3170.
by matthewdgreen 12y ago
Hi Thomas. I used to think this way too. I think this is certainly a fine way to think about things if your goal is to keep encrypted email deployment limited to the 3-4% of email users who are either technical experts with nothing to say a
3171.
by matthewdgreen 13y ago
As one of the people running this project, let me give a quick response that may help you feel better about it. I'm a technical person and, like you, my first inclination was to simply get on with it: we'd collect some money, then
3172.
by matthewdgreen 13y ago
That's a really poor idea. If you're concerned about guessing attacks on your RNG seed, the right response is to increase the size of your seed -- NOT to slow down the function. To put it another way, adding one bit to the seed le
3173.
by matthewdgreen 14y ago
My answer to that question was the same everywhere, because I think you'd be crazy to use these tools to fight an oppressive regime. Just different levels of crazy.
3174.
by matthewdgreen 14y ago
And this isn't good. But two points: 1. Your Telco doesn't advertise secure end-to-end encryption. 2. Cellular protocols are (relatively) hard to intercept /and/ interception is prevented by a whole bunch of FCC regulations. iMessage will h