pbsd

52 ms·

451.
by pbsd 12y ago
There's some confusion going on here. This algorithm: - Has nothing to do with elliptic curves. - Has virtually zero repercussions in any real-world cryptosystem. - Is a mostly theoretical refinement of the 'cryptopocalypse'
452.
by pbsd 12y ago
Well, we can lower bound it using physical limitations. An irreversible bit operation (e.g., xoring or anding two bits together), by Landauer's principle [1], costs at least 7.92x10^-28 kWh.I don't know what is the minimum number
453.
by pbsd 12y ago
Collision resistance implies 2nd-preimage resistance, and is therefore the stronger notion. Suppose your function is collision resistant, but not 2nd-preimage resistant. Then this means we cannot find an arbitrary pair (x, y) such that H(x)
454.
by pbsd 12y ago
Those two being the choices, I'd go for 41417: arithmetic modulo 2^414-17 is (to me, at least) simpler, and smaller Edwards coefficient. Performance should be in the same ballpark, if not faster. I wonder if a higher security margin cu
455.
by pbsd 12y ago
Interesting. I wonder if the slowdown of small pages is a result of excessive pointer chasing on the kernel side, which intuitively does a better job of trashing the TLB than sequential accesses would.
456.
by pbsd 12y ago
Cycle counts and DTLB_LOAD_* events should be enough here. Note that the random number generation also doubles as the "populate" flag in this case, since malloc returns uninitialized pages. I fully expect huge pages to be faster,
457.
by pbsd 12y ago
> And what does it mean to read it if it's already in memory? It means walking whatever structures the OS uses to keep things in cache. We generally don't know what they are, nor control them. > What I don't understand
458.
by pbsd 12y ago
It's moving page faults away from the main addition loop, which is what I'm interested in measuring anyway. It also reads the whole file in one go, instead of page by page with the default lazy approach. The best wall times (that
459.
by pbsd 12y ago
You get a similar effect to huge pages by passing MAP_POPULATE to mmap, which pre-faults all pages itself before returning.
460.
by pbsd 12y ago
GCC vectorizes the sum fine if the input is unsigned bytes , cf [1]. My guess is some odd interaction between integer promotions and the backend. [1] http://goo.gl/B7KX1V
461.
by pbsd 12y ago
SRT is named after Sweeney [1], Robertson [2], Tocher [3], which came up with the idea independently of each other. There is also a 1956 paper by Nadler said to have a similar algorithm, but it seems impossible to find. [1] http:/&#x2
462.
by pbsd 12y ago
Interesting. 7.3 seems to be a very early instance of the xor swap trick, albeit with addition and subtraction as group operations.
463.
by pbsd 12y ago
Sorry, I mistyped the section number. Updated the parent comment with corrections and links. I assume the intent of tweetnacl is to be C89-compatible, but due to the long long (and char, although that one's pretty pedantic) issue there
464.
by pbsd 12y ago
C99 standard [1], §5.2.4.2.1 says otherwise. Int must acommodate at least 16 bits, long 32 bits, and long long 64 bits. C89 [2], §2.2.4.2 says the same thing but omits long long, so tweetnacl's u64 may not exist (this was the case with
465.
by pbsd 12y ago
Concepts will certainly be nice once they arrive in the standard, but it is already possible today with some trickery. Example checking whether an std::vector<T>'s type is comparable with `operator<`: http://coliru.
466.
by pbsd 12y ago
No, not that I know of. You're of course right that what exists today are approximations. But the maps can be made to work for any given n, so we can pretend they're 'real'.
467.
by pbsd 12y ago
The dissertation in question: http://www.cs.ucla.edu/~sanjamg/Sanjam%20Garg_files/sanjam-t... Garg's work has been very influential, even comparable to Craig Gentry's fully homomorphic encryption breakth
468.
by pbsd 12y ago
It's not (by itself, at least). But you can give it hints, as in my example above (with __builtin_unreachable; other compilers have similar facilities, like __assume in MSVC). The compiler should, in theory, be able to deduce that x %
469.
by pbsd 12y ago
There is one oft-forgotten case that neither compilers nor (seemingly) libdivide seem to handle: when we know that an integer is a multiple of some constant, and we just want to get the result of the exact division. This case allows for a
470.
by pbsd 12y ago
Yes, caching. 32 bit quantities are often sufficient, and take up less space in cache. Additionally, code that handles 32-bit registers in x86_64 is often shorter than its 64-bit counterpart due to the lack of REX prefixes in instructions.
471.
by pbsd 12y ago
Now that '~' is being removed for pointers, can it be used instead for unary bitwise NOT instead of '!'?
472.
by pbsd 12y ago
Unless I'm misunderstanding what you are saying, this is not true. Instruction selection and data dependencies play a big role in the performance of a routine. What is indeed true is that the x86(-64) ISA alone does not give you enough
473.
by pbsd 12y ago
Have you checked Rogaway's AEZ? Its core could probably be repurposed to disk encryption, being an AES-based tweakable wide block cipher.
474.
by pbsd 12y ago
Whirlpool is unbroken. It uses the same design principles as AES, which both makes it a little more complicated than it could be, but also demonstrably secure against the attacks that plagued the MD4 family of hashes.
475.
by pbsd 12y ago
Not yet. Consider a = -1, b = 1. Due to the OR, any a and b with different signs will return overflow.
476.
by pbsd 12y ago
Your function is incorrect. Consider the case a = b = 0x80000000.
477.
by pbsd 12y ago
We can take advantage of two's complement arithmetic, plus the knowledge that the overflow flag is the xor of the carry into the sign bit with the carry out of the sign bit, to devise a simple expression: int checked_add_n(int_t
478.
by pbsd 13y ago
Probably quite a few. There's also more than just division by 0 to be wary of: http://blog.cmpxchg8b.com/2013/02/the-other-integer-overflow...
479.
by pbsd 13y ago
The AES is a good example of a cryptographic algorithm that is rather not straightforward to implement in an efficient and safe manner. AES is defined on a 4x4 byte state, and every operation (even the sbox) is defined over GF(2^8). However
480.
by pbsd 13y ago
You're right, it does add 1 to RDI, but this is exactly what we want. This is x86_64 calling convention, where arguments come on registers, not the stack. On 32-bit x86 you'd do something like mov eax, 1 add eax, [esp +

More ›