pbsd

33 ms·

301.
by pbsd 12y ago
> And by the way few people do math "heavy lifting" with x86 CPUs today, they would rather do it in a GPU This depends on the workload, really; some workloads are quite GPU-unfriendly. In any case, the supercomputer in question
302.
by pbsd 12y ago
That would not be very semantically secure; while you could not see exactly what the original image was, you could still make out the movement. That would sort of be the analog of the ECB penguin on moving pictures.
303.
by pbsd 12y ago
Yes, Bitlocker. There is something called "Device Encryption" in every edition, but it has some rather unusual hardware requirements (TPM and connected standby).
304.
by pbsd 12y ago
No.
305.
by pbsd 12y ago
For what it's worth, regarding the recommendation in page 14 of the report, there is a portable implementation (well, direct port of the SSSE3 code) of AES-CTR in NaCl: https://github.com/jedisct1/libsodium/tr
306.
by pbsd 12y ago
No, that is not how factorization scales. The time difference between a 760 and 768-bit modulus is less than a factor of 2.
307.
by pbsd 12y ago
As far as I know they didn't try to make a good implementation without CLMUL. However, the older endomorphism-free curve2251 implementation [2, 3] is eye-opening: - the SSSE3 implementation is ~2.7 times slower than with CLMUL - the g
308.
by pbsd 12y ago
PCLMULQDQ is a godsend to both (GCM and binary elliptic curves), since both rely heavily on multiplication performance over F_{2^n}. The current fastest elliptic curve implementations are over binary fields using this instruction: http:&#x
309.
by pbsd 12y ago
All the author had to to was to add '-march=native' or '-march=core-avx2' to the compiler command line: http://goo.gl/H4f62I
310.
by pbsd 12y ago
I was puzzled as well. There is an analogous of the FFT method of multiplying polynomials and integers to the matrix multiplication case [1], but it is not as simple and probably does not belong in an introduction to linear algebra. [1]
311.
by pbsd 12y ago
I finished 4th in Microcorruption. While exploiting vulnerabilities is not my day job, I have been playing CTFs for a long time, and am familiar with the process. It is certainly something one can overspecialize in. Looking at the first pag
312.
by pbsd 12y ago
I think CADO's own tools (cadofactor.py and friends) do a better job than the FAAS script at the moment. For smallish factorization jobs like this a lot of bells and whistles are not required anyway.
313.
by pbsd 12y ago
It is not fundamentally impossible. It has been shown [1] that forward-secure public-key encryption can be done without the key size blowing up with the expected number of encrypted messages, though it's not very practical. The trivial
314.
by pbsd 12y ago
> The "nonce" bits of the AES-CTR must be random Huh? This is not an IV, the only hard requirement is that it be unique. What am I missing?
315.
by pbsd 12y ago
First time it appears in the author's page is November 25, 2004: https://web.archive.org/web/20041125085351/http://www.math.u...
316.
by pbsd 12y ago
It is. The original article is already using several other C++11 features, such as variadic templates and alias templates.
317.
by pbsd 12y ago
I have seen more than one such compiler, usually from Haskell-like dialects to C++ metafunctions (e.g., http://gergo.erdi.hu/projects/metafun/ ). In this case the metaprogramming seems unnecessary---even assuming t
318.
by pbsd 12y ago
Even when you don't get it wrong (i.e., no out-of-bounds writes), you can still get out-of-bounds reads because strncpy does not always null-terminate strings. C strings suck.
319.
by pbsd 12y ago
It's not really fair to indict this bug on OpenSSL's complexity. Over the last couple of years, both NaCl [1] and TweetNaCl [2] had carry propagation bugs not unlike the above. I'm surprised this kind of bug is not found mor
320.
by pbsd 12y ago
I chose the singular example for its simplicity; invalid curve attacks are, of course, much more general (smooth-order curve + CRT). That said: how would you mount an invalid curve attack on a curve in Edwards form? It is obvious if the adv
321.
by pbsd 12y ago
I think they're OK, but would not recommend them unless you have serious bandwidth woes.
322.
by pbsd 12y ago
> "needs hardware support to be performant and secure at the same time" So does Poly1305; it just so happens that most popular processors have strong hardware support. Here's an exercise: implement both GHASH and Poly1305
323.
by pbsd 12y ago
> AES was also designed by NSA No, it was designed by Joan Daemen and Vincent Rijmen, two Belgian academics.
324.
by pbsd 12y ago
In general I agree and am as anti-64-bit blocks as it gets; but I don't think it matters in the specific case of SSH.
325.
by pbsd 12y ago
Here's the most egregious case: Bitcoin's secp256k1. This curve is defined by the equation y^2 = x^3 + 7 with arithmetic modulo the prime p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1. Suppose you have some way to send a poin
326.
by pbsd 12y ago
It is conceivable, with the right tradeoffs, that computing individual discrete logs over a few popular 1024-bit moduli could be made cheap. However, none of the available evidence suggests this practice. There is a lot of inconsistent thin
327.
by pbsd 12y ago
When I say DHE, I mean finite field DH in general; I have no beef with replacing the old TLS DHE mechanism by the one from the ffdhe draft, with curated prime fields to work with. Index calculus. Over prime fields it has seen essentially no
328.
by pbsd 12y ago
That TLS thread is nonsense. Take Dan Boneh's latest TLS survey paper [1], and notice that 34% (!) of DHE-supporting servers still support 512-bit ephemeral primes, and virtually every server defaults to 1024 bits. Who needs fancy new
329.
by pbsd 12y ago
C programmers should also be familiar with carry propagation; I see no reason they shouldn't be expected to work out the correctness of int cmp(int x, int y) { const unsigned a = x; const unsigned b = y; const u
330.
by pbsd 12y ago
Not exactly chosen-plaintext; pedantically speaking it's blockwise-adaptive chosen plaintext. The distinction is important because provable resistance to regular chosen plaintext attacks (i.e., IND-CPA) is part of what kept broken mode

More ›