pbsd

36 ms·

331.
by pbsd 12y ago
The most common call in the benchmark is to `getLongestPath<16>`. Passing 16 bits by value is cheaper and easier for the compiler to optimize (i.e., no aliasing) than passing by reference. I'd expect graphs with many nodes to beh
332.
by pbsd 12y ago
GCC 4.9 does have `-fsanitize=signed-integer-overflow`, and it generates pretty good code for that toy function: f(int, int): mov eax, edi add eax, esi jo .L8 ret .L8: ...
333.
by pbsd 12y ago
The way your scalar multiplication is performed leaves you open to two attacks: - Scalar multiplication is variable-time, with the variation being correlated with the position of the most significant bit of the exponent (see https:/
334.
by pbsd 12y ago
> The Chinese Remainder Theorem works in a similar fashion to Lagrange Interpolation They're not only similar---they're the same thing. Notice that f(a), for some polynomial f(x), is equivalent to f mod (x - a). Then Lagrange i
335.
by pbsd 12y ago
FWIW, the C++ random number library is very much not meant for cryptography. This is obvious when you see the weak guarantees given by std::random_device: on Windows, libstdc++ will actually use the Mersenne Twister with a hardcoded seed,
336.
by pbsd 12y ago
On Windows, the easy way is to call `rand_s`: http://msdn.microsoft.com/en-us/library/sxtz2fa8.aspx
337.
by pbsd 12y ago
You probably mean N3664 [1]. The compiler is indeed allowed to get rid of allocations in new expressions it deems unnecessary. You can verify that recent versions of clang allocate no memory in the function int f() { return *new int(1
338.
by pbsd 12y ago
The attack you describe---Joux's multicollisions, as far as I can tell---applies to Merkle-Damgard functions. SipHash is a spongy, wide-pipe, design where that sort of thing doesn't work. The generic bound is (k!)^(1/k) ⋅ 2^(
339.
by pbsd 12y ago
No, I meant what I wrote. SipHash is fine as a keyed primitive -- 128-bit security against key recovery, (64 - t)-bit security against 2^t forgery attempts. However, as a hash function (e.g., with a fixed key), it is entirely too weak: 2^
340.
by pbsd 12y ago
Do NOT use SipHash as a cryptographic hash function. It is designed to be a PRF, and its output length is way too small to make it collision-resistant when used as a hash. SHA-3, SHA-512/256 or BLAKE(2) (in increasing order of performa
341.
by pbsd 12y ago
SipHash's page is missing the recent analysis by Dobraunig et al [1]. The short summary is that it continues to look strong for its use case. [1] https://eprint.iacr.org/2014/722
342.
by pbsd 12y ago
The `-` is there to turn 1 into -1 (mod 2^n), and 0 into 0. I use `- (x >> (sizeof(x)*8-1))` to get arithmetic shift semantics while only using unsigned arithmetic.
343.
by pbsd 12y ago
Indeed. The two main differences are that I didn't care about returning {-1, 0, 1} to emulate `memcmp`, and that I don't rely on implementation-defined behavior (signed shifts being arithmetic).
344.
by pbsd 12y ago
I'm not sure I understand what you're suggesting. x ^ y will obviously never be 0 when x != y, but there is no quick way to locate where they differ to turn it into a mask. When x != y, either x - y or y - x will be negative and t
345.
by pbsd 12y ago
> One problem is, I don't know of a nice constant-time comparison algorithm for (say) 160-bit values. [...] I would appreciate any pointers to such a constant-time less-than algorithm. The following should be constant-time relativel
346.
by pbsd 12y ago
I don't know what exactly you mean by that, but I'm going with no. Unconditional jumps do interact with the uops cache in recent Intel chips, but they do so by terminating the current uops cache line---which is generally desirable
347.
by pbsd 12y ago
nop word ptr [eax+eax+0] ; 66 0f 1f 84 00 00 00 00 00
348.
by pbsd 12y ago
You can do an unconditional jump every 1 or 2 cycles, depending on the chip, whereas no chip I know of can execute more than 4 nops per cycle. Therefore I would say the jump is probably marginally faster than 12 nops. Smart toolchains will
349.
by pbsd 12y ago
"Sequences of numbers generated by addition in formal groups and new primality and factorization tests", by the Chudnovsky brothers [1]. This paper is incredibly ahead of its time. While elliptic curves in cryptography are usually
350.
by pbsd 12y ago
I'm probably not the best person to argue in favor of one flavor or another of PAKE, but balanced schemes give you forward security whereas a naive preshared-key scheme does not.
351.
by pbsd 12y ago
Hunting-and-pecking is essentially the same algorithm as try-and-increment, where instead of incrementing an x-coordinate on failure one picks another x (pseudo-)randomly. Therefore both are susceptible to the same kind of timing attacks. D
352.
by pbsd 12y ago
I don't see what the problem is, exactly. If you have a secure hash function taking some string into a point of elliptic curve E, multiplying said point by the cofactor is also a secure hash function into the relevant subgroup of E. Se
353.
by pbsd 12y ago
Curious; Symantec's report said the RC5 encryption was performed in CFB mode, but this is not the case. Instead, we have a weird combination of CBC and CFB, with CFB being used solely for the last block (instead of padding or ciphertex
354.
by pbsd 12y ago
Choosing RC5 is an irrelevant implementation detail; they probably used whatever was in hand at the time. The only requirement is that the function makes things random-looking, really. I agree with alister in that the reason---if there was
355.
by pbsd 12y ago
Your modification results in the inclusion of a bounds check in the inner loop: .LBB0_4: cmp rdx, rsi jae .LBB0_7 At `LBB0_7` is a call to `panic_bounds_check`.
356.
by pbsd 12y ago
Let's change the example to pub fn f(v: &mut [u8]) { let vlen = v.len(); for i in range(0, vlen) { let x = &mut v[i]; test::black_box(x); // do some work with x }
357.
by pbsd 12y ago
Think regular expression JIT compilation, for instance, in the spirit of http://swtch.com/~rsc/regexp/regexp-x86.c.txt
358.
by pbsd 12y ago
Well, it would depend on the entropy of the folder. Maybe we know the general structure of the folder, except some crucial short piece of information. Otherwise, everyone would also be fine using SHA-1 to store passwords. N.B: I don't
359.
by pbsd 12y ago
Ueli Maurer continues to be one of the foremost theoretical cryptographers out there. He is responsible for the notion of indifferentiability, which has been quite useful in designing hashing modes out of block ciphers / compression fu
360.
by pbsd 12y ago
DUAL_EC_DRBG would have been the dumbest possible way to backdoor RDRAND. It would also imply that Intel is somehow able to slip in circuitry able to do two 256-bit elliptic curve scalar multiplications in under 300 cycles, and pretend it i

More ›