pbsd

79 ms·

571.
by pbsd 13y ago
My first thought was uop cache as well. The fact that pre-Sandy Bridge processors have the intuitive performance behavior makes me more certain it's related. One interesting experiment to try would be to realign the loop to 0..31 mod 3
572.
by pbsd 13y ago
Yeah, this special case always weirded me out, it's hard to see a justifiable use case. In regular usage you'd use auto& instead to achieve the same effect. C++14's decltype(auto) confuses things even further: http:&#x2F
573.
by pbsd 13y ago
That particular case isn't vulnerable to length extension, since the key is placed at the end of the message. This MAC breaks down, however, when the function used is not collision-resistant. HMAC offers some level of protection agains
574.
by pbsd 13y ago
Yes, that's the aggregate time 7 + 14 (plus some small overhead). The 14cpb figure is mentioned at the end of page 10.
575.
by pbsd 13y ago
The best timings I'm aware of are ~7cpb for AES-CTR, and ~14cpb for GHASH on Nehalem [2]. It's a bitsliced implementation, so it makes sense to compare it to counter-mode AES-NI. A recent AES-NI implementation on Sandy Bridge [1,
576.
by pbsd 13y ago
He's right; implementing plain constant-time AES can be done without AES-NI, but is by no means easy or obvious.
577.
by pbsd 13y ago
> cellular automata-based PRNGs for stream ciphers This is something that kind of died in the late 80s. One of the most noteworthy cases was Damgard's CA-based hash function in the paper that proved collision-resistance of the Merk
578.
by pbsd 13y ago
I'm going to be a little pedantic here: the trick of using a PRF (hashing with a secret) to obtain the DSA nonce was not invented by Dan Bernstein. In the Ed25519 paper it's attributed to George Barwood and John Wigley in 1997. Al
579.
by pbsd 13y ago
That's a pretty good summary.
580.
by pbsd 13y ago
This has nothing to do with VDM; the emulator is only accessible from kernel mode (it's in HAL.dll) and is not meant to be used by usermode applications. See [1,2]. [1] http://x86asm.net/articles/calling-bios-from-
581.
by pbsd 13y ago
What weakening, may I ask?
582.
by pbsd 13y ago
This is mostly orthogonal to the article's point, but the motivating example ignores the actual syntax that already exists in C++(11) to initialize classes: std::map<std::string, int> m1 = { {"one", 1
583.
by pbsd 13y ago
Well, suppose we have 4 moduli, N1, N2, N3, N4. The naïve way to find all pairwise GCDs is to compute GCD(N1, N2), GCD(N1, N3), GCD(N1, N4), ...., GCD(N3, N4). That's (n^2 - n)/2 GCD computations. The shortcut is to compute P = N1
584.
by pbsd 13y ago
You're not quite right. The hardness of the discrete logarithm depends a lot on what mathematical structure you are using below. For example, the discrete logarithm on the group of the integers modulo some prime is known to be more o
585.
by pbsd 13y ago
OpenSSL's 'speed' utility doesn't seem to have RSA-3072 on the list, but I suppose I can downgrade to ECDSA-224 instead: Doing 224 bit sign ecdsa's for 10s: 27648 224 bit ECDSA signs in 9.94s Doing 224 bit
586.
by pbsd 13y ago
I'm not sure I'd go with 'discredited'. Paranoia aside, I'd go with 'superseded' by better choices that weren't around in 1999. We probably mean the same thing, but this has become one of my pet peeve
587.
by pbsd 13y ago
The performance comparison of ECDSA vs RSA is somewhat unfair. In ECDSA, signing is the cheapest operation, whereas in RSA it is the most expensive. If the timings chosen were signature verification time, RSA would be much faster. See:
588.
by pbsd 13y ago
It is an x86 with very weak in-order cores, which instead have very large (512-bit) vector units. Very much like an NVIDIA "symmetric multiprocessor". If you try to program the Xeon Phi anything like a general-purpose CPU, you wil
589.
by pbsd 13y ago
The Xeon Phi resembles a GPU much more than it does a CPU. The original project, Larrabee, was at one point meant to be a GPU that competed with NVIDIA and ATI.
590.
by pbsd 13y ago
> not in the source code, where they would be more easily found. Why do you say that? Compiling the source with the same compiler and flags, plus diffing the binaries would quickly show where the differences lie, and if they're hos
591.
by pbsd 13y ago
No. What you're seeing in that log is only the two last steps in the number field sieve: linear algebra and the square root step. The rest of the details are missing. The time of the square root is where you are seeing the 52 hours. Th
592.
by pbsd 13y ago
While it does have no impact in the expected complexity of factoring larger keys, this kind of thing is informative of the maturity of public factoring software: a single person with (presumably) access to a number of machines can pull off
593.
by pbsd 13y ago
I meant something like this, i.e. not going through C at all: http://golang.org/src/pkg/syscall/asm_freebsd_amd64.s
594.
by pbsd 13y ago
I agree, I honestly don't see where the expressiveness claims of Go come from. I've always put it in the Java-like bin of languages (which is not necessarily a bad thing). I suppose the one thing that Go does well (compared to C++
595.
by pbsd 13y ago
Go uses an assembly syntax completely different from everyone else. That's mighty annoying.
596.
by pbsd 13y ago
Don't forget that NIST has mentioned they'll standardize variable-output-length SHA3: SHAKE512 with 20 byte output would be perfectly fine. They've also mentioned they might include MAC and AEAD standards, so I'm not c
597.
by pbsd 13y ago
Well, not so much now that SHA-3 is length-extension resistant, eschewing the need for HMAC. A standard MAC mode has to be defined anyway, and truncating the output might as well be part of it.
598.
by pbsd 13y ago
Interestingly, Schneier sounds more reasonable in 1999 than now (with relation to ECC; don't hate me). That essay was pretty good: elliptic curves were relatively new on the block (but really, not even 10 years newer than RSA), and not
599.
by pbsd 13y ago
I haven't checked what exactly massscan is doing to randomize the IP and port sequences, but if reduction modulo some runtime constant is that much of a problem (according to the Readme at least) perhaps you should consider replacing t
600.
by pbsd 13y ago
The 2006 paper calls the Dual EC DRBG as DEC PRG. They're the same thing. Their attack does work in the advertised time, but it a purely distinguishing attack, i.e., it tells you "this stream of random bits was generated by the DE

More ›