pbsd

55 ms·

511.
by pbsd 13y ago
Can you point to a problem where a GPU actually outperforms a CPU by 250x and the CPU is not being criminally underused? I have tried to find such examples, and never did. Unless, maybe, you mean the communication costs are the real bottlen
512.
by pbsd 13y ago
If you find CFRG infuriating at times, don't even bother with the metzdowd list -- it's an order of magnitude worse.
513.
by pbsd 13y ago
> instead, what everyone should be encouraging is to seed /dev/urandom from /dev/random and then use /dev/urandom. I have no problem with this whatsoever; it's probably overkill for most users, but it&#
514.
by pbsd 13y ago
Here's my understanding of your argument: - Using /dev/random occasionally blocks applications, but that's acceptable because it's only a small high-throughtput subset of them, and those users can deal with it thems
515.
by pbsd 13y ago
The article you cite cites a Peter Gutmann article [1, Section 3.6] that details what programmers will do when things don't work as expected. Additionally, what the article recommends (Section 6.2) is that OS generators behave like Fre
516.
by pbsd 13y ago
Don't forget to install your perfectly-secure favorite text editor [1], of course! The vast majority of 'attacks' on Windows are based on exploiting user trust: phishing, malicious binaries, and so on. Suggesting Linux as a f
517.
by pbsd 13y ago
Accepting arbitrary EC parameters would, of course, be madness. Not wanting to start a holy war here, this is one case where the NIST curves could be a better choice than curve25519 (or any other Montgomery or Edwards curve). Being a Montgo
518.
by pbsd 13y ago
I've tried to diagnose when the RDRAND failures happen. From my experiments on Haswell, it only seems to happen when you have > N threads, where N is the number of physical cores, simultaneously reading continuously from RDRAND. But
519.
by pbsd 13y ago
People seem to forget that NSA is not the only player in town. When you plant weaknesses into things, you need to make sure that you're not actually helping your adversaries. You need to carefully weigh the chance/cost of discover
520.
by pbsd 13y ago
> you can think of a poly MAC as a thermonuclear CRC algorithm Funny you would put it like that. You can turn the regular CRC algorithm (which is essentially a polynomial division) into a secure Wegman-Carter authenticator (like polyno
521.
by pbsd 13y ago
I honestly don't understand the outrage here. This is about standard library functionality, not new language features. As far as standard libraries go, C++'s is actually pretty small and could use some additions.
522.
by pbsd 13y ago
I'm aware that the implementations are not strictly equal, but how is libsodium doing it 'wrong'? Is it because it does not partition reads into smaller chunks (avoiding the unspecified >= SSIZE_MAX read)? I consider any r
523.
by pbsd 13y ago
The forward security issues have been fixed for a long time (since Vista I believe): they now use SP800-90A's CTR_DRBG. But the generator continues to be unprotected in user mode, seeded from kernel.
524.
by pbsd 13y ago
> The randombytes function in NaCl does it right, unfortunately libsodium did their own thing. I don't know what you're talking about. Sodium does the same thing as NaCl, while also being more portable.
525.
by pbsd 13y ago
Yes, you're right, perhaps I oversimplified too much. That is the main hurdle Waters and Sahai have overcome. They do this by not using a counter, but randomly-selected nonces that feed a keyless stream generator (like AES-CTR with a f
526.
by pbsd 13y ago
Obfuscating a PRF turns a symmetric primitive into an asymmetric one. You can think of a PRF as a keyed hash. Now, you can turn this into an encryption scheme by running it in counter mode: keystream = PRF(K, 0) || PRF(K, 1) || ...
527.
by pbsd 13y ago
Razvan Barbulescu's PhD thesis [1]. Note that the best asymptotic complexities are a little different: the 'best' is really L_n(1/3, 1.902), but that variant is hopeless in practice (it would require truly gigantic input
528.
by pbsd 13y ago
You're not wrong. The current state of the art puts the precomputation step at complexity L_n(1/3, 1.923)§, and additional individual discrete logs at L_n(1/3, 1.232). So individual logarithms are still subexponential and not
529.
by pbsd 13y ago
This sort of thing is a recurring theme in cryptography: 1. Someone proposes a scheme based on Hard Problem X. X looks strong, but the resulting scheme either is too slow or has gigantic keys. 2. Someone else comes along and proposes a rela
530.
by pbsd 13y ago
If you can control what gets written to the wx memory, then all you have to do as an attacker is rewrite a function pointer or return address to that memory. Better yet, if you can rewrite a return address, you can "return" to a r
531.
by pbsd 13y ago
Very nice exposition (for a mathematician :) Given the quality of this initial post, I actually find it kind of unfortunate that the focus of the series seems to be on the Dual_EC_DRBG backdoor, since that is (and should be) such a rare use
532.
by pbsd 13y ago
I was strictly replying to the Intel FLOPs claim of the parent comment. I have only a faint idea how the Mill CPU works, so I can't really compare against it. From the little I have read, the Mill CPU looks like a cool idea, but I&#x27
533.
by pbsd 13y ago
A Haswell core can do 2 vector multiply-adds per cycle, which results in a peak of 32 single-precision FLOP per cycle per core or 16 double-precision FLOP per cycle per core.
534.
by pbsd 13y ago
This is a neat trick, but it will segfault in architectures where alignment is enforced (like MIPS, ARM, etc) if the input buffer is not suitably aligned. One relatively cheap way to sidestep this is to memcpy into a stack-allocated struct:
535.
by pbsd 13y ago
The current version of their compiler supports many C99 language constructs and libraries; I think VLAs and the restrict keyword are the most noteworthy features still missing.
536.
by pbsd 13y ago
I'm not sure I can handle that kind of pressure :)
537.
by pbsd 13y ago
It's obfuscation that is dependent on fully homomorphic encryption (FHE), not the other way around. Therefore, Barak's impossibility proof is irrelevant to FHE. With respect to FHE, before 2009 we already had some tools. We had RS
538.
by pbsd 13y ago
That is incorrect. Quisquater was not involved in any of the AES candidates, let alone the winner.
539.
by pbsd 13y ago
After checking the docs, it seems the fast syscall instructions force the GDT to be laid out in a specific order. Since the segment values (selectors) are really offsets into the GDT, it makes sense that they end up being the same.
540.
by pbsd 13y ago
You can jump between 32-bit and 64-bit modes in a 64-bit Windows and Linux by switching between the 0x23 and 0x33 code segments. Like so: BITS 32 start: call far 0x33:code64 code32: nop ; resume code64:

More ›