pbsd

72 ms·

631.
by pbsd 13y ago
Indeed it was. Wang's breakthrough work [1,2] broke most of the common hash functions at the time, and later also SHA-1 [3]. The SHA-3 competition was motivated by this streak of new successful attacks. [1] http://eprint.iac
632.
by pbsd 13y ago
Why is SHA-2 orange? As far as I know, besides length-extension, there's no known weakness on the full hash function.
633.
by pbsd 13y ago
Nothing, I'm always happy to yap about things. Do I email you or something?
634.
by pbsd 13y ago
While I agree that elliptic curve cryptography is the near-future (not necessarily because of new attacks, but mostly cost-effectiveness), I have trouble seeing how you'd explain the possible pitfalls and attacks to laypeople, without
635.
by pbsd 13y ago
The code keeps using high registers for no discernible reason, instead of sticking with EAX--EDI; this means that each instruction is 1 byte longer than it could be. This has consequences to the instruction fetching and decoding circuitry,
636.
by pbsd 13y ago
FWIW, those particular instructions have been around since the Pentium 3. Most of the recent advances have been in width (64 -> 128 -> 256 -> ...) and execution units of that actual width.
637.
by pbsd 13y ago
SUPERCOP [1] has a bunch of public-domain implementations. [2] is a portable one. To get top speed, you need SIMD, though. The available implementations in SUPERCOP are in (x86) assembly, but they really should be converted to intrinsics to
638.
by pbsd 13y ago
Assuming this [1] is what Go is using, it is not ISAAC. It looks like a lagged Fibonacci generator. [1] http://golang.org/src/pkg/math/rand/rng.go
639.
by pbsd 13y ago
I do believe that there's no reason that any modern language should not have a secure random number generator by default. But while ISAAC is likely fine for this purpose, I'd recommend Salsa20/12 instead (Salsa20/8 would
640.
by pbsd 13y ago
There's no notion of (default) constructors in Rust? How do you build complex objects in it?
641.
by pbsd 13y ago
In C++, << has higher precedence than &&, so in effect what is being done is (cout << 1) && 2; ...which is not an error, since the result of operator<< is an std::ostream, which is convertible to b
642.
by pbsd 13y ago
Well, I was comparing apples to apples (i.e., C++ expression template linear algebra libraries). Some (most?) of them [1,2] are linkable against BLAS routines from Intel MKL or ATLAS or whatever. [1] http://eigen.tuxfamily.org&#x
643.
by pbsd 13y ago
I'm not exactly an expert on this kind of thing, but from what I understand, Eigen and Armadillo [1] are the best performing libraries in this space. I'd probably go with Eigen, since it appears to be used in more high-profile pla
644.
by pbsd 13y ago
Unless it's a friggin' gigantic loop, instruction cache miss will usually not be the issue there; branch misprediction will. Instruction cache misses are particularly problematic in codebases with many virtual function calls (or p
645.
by pbsd 13y ago
> Also setcc is abysmally stupid in leaving the high 3/7 bytes of the register unmodified - what were Intel's engineers smoking? It makes sense in context. When the instruction was introduced, it made sense to have 8-bit flags
646.
by pbsd 13y ago
Are you ready to test all the 2^128 possible multiplications your CPU can do?
647.
by pbsd 13y ago
One would think that burden of evidence would be on the side of the accusers of backdooring. So far all I have seen is inaccurate speculation.
648.
by pbsd 13y ago
FTR, that limit is also mentioned in the Intel manual [1, 3.2.3], and in the Cryptography Inc report [2, 2.4.2]. [1] http://software.intel.com/en-us/articles/intel-digital-rando... [2] http://www.crypto
649.
by pbsd 13y ago
In NIST parlance (SP800-90{A,B,C}), RDRAND is a DRBG, while /dev/random should be a NRBG. For what it's worth, the RDSEED instruction has been announced by Intel a while back (but not yet on current processors), which means t
650.
by pbsd 13y ago
It's not easily exploitable, but it can be done. Elias Yarrkov's page on this: https://cipherdev.org/rc4_2013-03-13.html
651.
by pbsd 13y ago
That does sound like CAO [1,3,4], from the CACE [2] project. [1] https://eprint.iacr.org/2005/160 [2] http://www.cace-project.eu/ [3] http://www.cace-project.eu/downloads/deliverab
652.
by pbsd 13y ago
They are the same book; Cryptography Engineering is simply the 2nd edition, although they decided to change the title for some reason.
653.
by pbsd 13y ago
Not only the number of bits in the seed, but also their unpredictability. There are many things that can go wrong. Some examples: - the seed is timer-based and has far less entropy (information) than its bit size - the seed is OK, but the g
654.
by pbsd 13y ago
If you're only worried that your PRNG doesn't look random, there's TestU01: http://www.iro.umontreal.ca/~simardr/testu01/tu01.html However these are just statistical tests; they tell you nothing a
655.
by pbsd 13y ago
It seems to me you haven't understood PFS. (Elliptic-curve) Diffie-Hellman protects the session key only as long as the (elliptic-curve) discrete logarithm problem is hard. Here's how, in a simplified nutshell: - A sends g^x to
656.
by pbsd 13y ago
For what it's worth, you don't really need your problems to be NP-hard to resist quantum computers. You just don't want problems that are in the BQP (or P, obviously) complexity class. Why bring up OTPs if current symmetric e
657.
by pbsd 13y ago
No problem. Agree that quantum is not really something to worry about, though it's a good thing that someone out there is thinking of alternatives. By the way, the Batch NFS has seemingly fallen out of favor. Despite being significantl
658.
by pbsd 13y ago
It is [1]. Quantum computers, using Shor's algorithm, polynomially break any specialization of the abelian hidden subgroup problem; see [2] for a fairly complete list. Whatever reason to prefer elliptic curves over integer factorizatio
659.
by pbsd 13y ago
> RSA (and Rabin) and conventional DH, both of which are looking increasingly sketchy in 2013. May I ask why you say this? (Not agreeing nor disagreeing, just curious.)
660.
by pbsd 13y ago
In this case, it could have been done. Dual_EC_DRBG hinges on the discrete log of two points being unknown; P and Q could have been both generated verifiably at random.

More ›