pbsd

68 ms·

541.
by pbsd 13y ago
In the follow-up paper, Sahai and Waters turn the weak indistinguishability obfuscation (which, by itself, is not strong enough for the white-box setting) and one-way functions into public-key encryption. This is what white-box (symmetric)
542.
by pbsd 13y ago
Indeed. The output of a noncryptographic generator like the Mersenne Twister would also pass those same tests, and would be not secure at all. This is not how indistinguishability works. The 'correct' to make this point would be t
543.
by pbsd 13y ago
For all intents and purposes no. unique_ptr is nothing more than a pointer container that disables copying but allows moving. Therefore only one unique_ptr should be owning a pointer at any given time (unless, like everything in C++, you go
544.
by pbsd 13y ago
You're right that it's UB, good point. It's hard to think what a sane compiler would do in this case besides going through with the dereference, though.
545.
by pbsd 13y ago
Analogous example in C++11, using unique_ptr (which Rust's owned pointer models): #include <stdio.h> #include <memory> void destroyer(std::unique_ptr<int> x) { printf("%d\n", *x);
546.
by pbsd 13y ago
There's also DHE, which is not "NIST-corrupted" I guess. As far as I know, in theory it should be possible to use the Brainpool curves in TLS, but haven't seen such a thing in actual use.
547.
by pbsd 13y ago
I doubt those instructions (especially stos* and movs*, respectively matching memset and memcpy) are going anywhere. Intel has even changed their semantics in recent chips to work on 16-byte or larger chunks, and to have out-of-order memory
548.
by pbsd 13y ago
CT-RSA, RSAC's cryptographic subconference, while not being a flagship conference like CRYPTO, is fairly relevant.
549.
by pbsd 13y ago
From what I've seen, this whole brouhaha has done more damage to the reputation of elliptic curves than it did to the RSA algorithm.
550.
by pbsd 13y ago
A new private-set intersection paper, claiming to scale orders of magnitude better than predecessors, has just been released [1]. I don't know whether it solves your problem, as I haven't read anything beyond the abstract, but you
551.
by pbsd 13y ago
Assuming nothing changes, 4096-bit RSA has around 160 bits of security, roughly equivalent to 320-bit elliptic curves. Depending on how Moore's law progresses and our understanding of the Universe, you may never need to change (ignorin
552.
by pbsd 13y ago
That paper does not apply to integer factorization, and number field sieve computations in general. DJB himself, in another paper [1, §5], argues that is more cost effective to factor one number at a time. [1] http://eprint.iacr.
553.
by pbsd 13y ago
You work modulo p, yes, but the group is the set of points of the curve. The qubit bottleneck seems to be the Extended Euclidean Algorithm to perform modular divisions, which requires the greatest amount of space. Check [1, §6.2] for detail
554.
by pbsd 13y ago
In symmetric primitives, Grover is the useful quantum algorithm. It reduces unordered (read: brute-force) searches from 2^n to 2^(n/2) operations, and requires n qubits. This is a big deal one the 64-128 bit range: it makes very costly
555.
by pbsd 13y ago
100-qubit machines would help in breaking some small-key symmetric algorithms (e.g., 80-bit key block/stream ciphers, etc), but it would have negligible effect on public-key crypto.
556.
by pbsd 13y ago
Here's an example in Sage, if the verbosity of OpenSSL code annoys you as much as it does me: n = 115792089210356248762697446949407573529996955224135760342422259061068512044369 p = 2^256 - 2^224 + 2^192 + 2^96 - 1 a = -3
557.
by pbsd 13y ago
Avoiding the backdoor does not require changing the points (and possibly getting in patent trouble). Even with malicious points, truncating enough bits out of each x coordinate is enough to thwart the attack. I don't know why this is n
558.
by pbsd 13y ago
It seems your edit did all the work for me. Being in the core of the MD2 compression function puts the Sbox in a good place to be a backdoor. However I strongly doubt this is one. The attacks that have broken MD2 do not seem to hinge terrib
559.
by pbsd 13y ago
There were certificates (including a root CA) using MD2 until recently. MD2 itself was only retired in 2011 [1]. https://www.rfc-editor.org/rfc/rfc6149.txt
560.
by pbsd 13y ago
The beauty of this backdoor, for all its faults, is that it was reasonable to believe that it wasn't a backdoor. And it was also reasonable to believe that it was. This backdoor is quite deniable, elegantly so. So far I have disagreed
561.
by pbsd 13y ago
From the article: Noisy environment. One may expect that placing the machine in a noisy machine will foil the attack. However, the energy of noise generated in a typical noisy environment (such as outdoors or a noisy room) is
562.
by pbsd 13y ago
C++'s standard library has valarray, which is supposed to avoid aliasing effects, and is allowed to use expression templates and other tricks. Something like: float dot(std::valarray<float> const& x) { retur
563.
by pbsd 13y ago
Your way is much cleaner; mine was just a size gimmick. I just can't resist it :)
564.
by pbsd 13y ago
Agree, AT&T syntax was just not designed for human reading. I doubt this is too optimized for size, since there are obvious tricks that it misses. Another observation: the strlen code is incorrect, as it also counts the \0. We can fix t
565.
by pbsd 13y ago
> You may even have to inherit a base class or implement an interface. Subtype polymorphism is a very poor substitute for closures. This is why C++ algorithm library is unusable. Does anybody understand what the author means by this? STL
566.
by pbsd 13y ago
But now there's no one to destroy the object (in a non-trivial case). Returning a reference lets RAII take its natural course.
567.
by pbsd 13y ago
The comparison is ludicrous. Non-obfuscated binaries, often with debug symbols, are much easier to reverse-engineer and analyze than hardware. Additionally, you can analyze binary diffs, much like source code. You would not start from scr
568.
by pbsd 13y ago
0xB8000, to be precise. This is 16-bit 8086 legacy, where addresses were 20-bit and segmented. The most fun mode was mode 0x13 from INT 0x10, with its fantastic 320x200 resolution and 256 colors. That one had the buffer at 0xA0000.
569.
by pbsd 13y ago
Curiously enough, using separate reads and writes, with appropriate nop padding, seems to do better than any read-modify-write variation I tried. By the way, read-modify-write is not fused altogether: only the write part is fused, so it gen
570.
by pbsd 13y ago
The prefetch is only serving as 6-byte padding here. The nopw instruction performs no memory access, it does not double as a prefetch. There are remarkably few memory accesses actually being performed in that loop. The CPU is using store fo

More ›