pbsd

67 ms·

601.
by pbsd 13y ago
There are already several alternative curve sets, satisfying various degrees of paranoia: - http://certivox.org/display/EXT/CertiVox+Standard+Curves - http://tools.ietf.org/html/rfc5639 - cur
602.
by pbsd 13y ago
Does NIST actually publish standard DL groups? All I have seen is instructions on how to generate them, i.e., SP800-56A. NIST publishes standard curves because the instruction list to generate them would require describing Schoof's alg
603.
by pbsd 13y ago
They broke 16 out of 32 rounds, with an unrealistic amount of chosen-plaintext. It's not really something to write home about. Rijndael was selected as AES when the best known attack broke 7 out of 10 rounds.
604.
by pbsd 13y ago
It's telling that RSA is not practical to deploy at 256-bit security today .
605.
by pbsd 13y ago
55 chars. The MD5 and SHA-1 algorithms process data in 512-bit (64 byte) blocks, where the last bytes are the 0x80 0x00 ... 0x00 padding followed by the message size. A message with 55 bytes will end with [0x80 0x37 0x00 0x00 0x00 0x00 0x00
606.
by pbsd 13y ago
Modern Intels also cache decoded uops to alleviate this. So if your (say) main loop is less than about 1500 uops, decoding performance becomes less relevant. This is particularly important for SIMD instructions, which are often quite large
607.
by pbsd 13y ago
This is not really too relevant to the article, but that random generator makes me cringe. You can replace it with a decent quality one (xorshift) with about as many lines of code: uint32_t genrand(uint32_t *seed) { uint32_t x = *
608.
by pbsd 13y ago
Yes. As opposed to Shannon entropy -sum(p log p).
609.
by pbsd 13y ago
Do you really not trust binary curves that much? I'm certainly not going to defend them, but curves over prime exponent binary fields seem OK for now. For us this might not matter much, but hardware people like binary fields a lot.
610.
by pbsd 13y ago
It's the finite field with 2^32 elements. There are several equivalent representations, but we typically work with it as the polynomials with coefficients modulo 2 modulo an irreducible polynomial of degree 32, e.g., x^32 + x^7 + x^3 +
611.
by pbsd 13y ago
I'm not 100% sure if that was tongue-in-cheek or not, so I'll clarify: I was disagreeing with aortega. This is not a typical PRNG, where the seed generally marks the initial point of the same sequence . Choosing a random generato
612.
by pbsd 13y ago
A 32-bit LFSR generates a sequence of bits with period 2^32-1; what you really want is a Lehmer-like generator using arithmetic in GF(2^32).
613.
by pbsd 13y ago
What do you mean by "template functions are practically useless"?
614.
by pbsd 13y ago
> 32-bit integers in JS don't have float problems because the precision doesn't break Unless you try multiplying them.
615.
by pbsd 13y ago
Lest we think everything's lost, Thomas Pornin's RFC to fix (EC)DSA's need for good randomness when signing was published this month [1]. The approach is similar to Dan Bernstein et al's EdDSA. [1] http://tool
616.
by pbsd 13y ago
Yes, that's the kind of logarithm where the breakthroughs have happened, and the source of all this fuss. Not all logarithms over these fields are affected equally, though. Do you know of any actual thing using Diffie-Hellman (or anyth
617.
by pbsd 13y ago
They weakened DES by reducing key size from 128 to 56 bits. Everything suggests they didn't know about linear cryptanalysis at the time, and in any case their improved sboxes, by being stronger against DC, were also stronger against LC
618.
by pbsd 13y ago
If you can compute discrete logarithms modulo composite n, you can actually factor n. Suppose that n = p * q. The order of the multiplicative group of the integers modulo n is (p-1) * (q-1). Suppose that, given a randomly generated a, we ca
619.
by pbsd 13y ago
I believe you're thinking of this [1]. [1] http://research.cs.wisc.edu/vertical/papers/2013/hpca13-isa-...
620.
by pbsd 13y ago
Per the C99 standard, long long is guaranteed to be at least 64 bits, but is allowed to be larger.
621.
by pbsd 13y ago
You're right -- this is a great theoretical result, but it is hopelessly impractical for use today (just like FHE). Also note that the security of the scheme itself is untested. There are a handful of hardness assumptions here that hav
622.
by pbsd 13y ago
Yes, that is correct. Generally the block Lanczos variant used in practice is Montgomery's [1], though, not Coppersmith's. Lanczos was popular until a few years ago, as it requires slightly less actual matrix-vector multiplication
623.
by pbsd 13y ago
The matrices involved are generally modulo a prime (2 in factorization, a fairly large prime for the discrete logarithm), and very sparse. The latest factorization record, RSA-768, involved finding elements of the nullspace of a 192e6 x 1
624.
by pbsd 13y ago
I agree with pushing elliptic curves, but I don't like the way they get there. First, some historical corrections: the first L[1/2] algorithm for either factorization or discrete log was CFRAC, presented by Brillhart and Morrison
625.
by pbsd 13y ago
I have no idea how to simulate a variable PALIGNR on Intel chips without making the loop extremely slow. On AMD (with XOP), it can be done using VPPERM, which can shuffle from 2 sources. We can do variable alignment like this: vpperm xm
626.
by pbsd 13y ago
In the interest of achieving the simplest instruction sequence, I've also found (AVX2): key = _pdep_u32(key, 0x03030303); key *= 0x01010101; key >>= 24;
627.
by pbsd 13y ago
Oh, I missed that. That makes things trickier, but I think we can still get away with something like vmovdqu xmm7, [rdi + rax + 5 - 1] vpinsrb xmm7, xmm7, [rdi + rax + 0], 0 without too much of a performance penalty. The adjustment
628.
by pbsd 13y ago
Thinking a little further about this, I believe using PSHUFB is the way to go, at least for when the count is large. This is because we can do 2 iterations in essentially one go (haven't tested the code, it's mostly a sketch):
629.
by pbsd 13y ago
We can use the exact same approach used in the bit reversal trick of the article: ((x * 0x01010101) & 0xC0300C03) % 1023 This is probably not gonna be faster than the naive approach, though.
630.
by pbsd 13y ago
Strictly speaking, AMD's XOP extensions do have an instruction that is close enough: VPPERM. It allows to not only shuffle bytes, like the already mentioned PSHUFB, but also reverse bits within each byte. Therefore, a single VPPERM ins

More ›