pbsd

26 ms·

211.
by pbsd 11y ago
It's not Salsa10; it's just that the author is counting double-rounds, which makes it looks like it's half the iterations. This has as many rounds as Salsa20, but whoever converted this to 16-bit words didn't know what t
212.
by pbsd 11y ago
NFS implementations have certainly improved, and certain sub-algorithms as well, e.g. lattice sieving and polynomial selection. But these things don't significantly tilt the exponent you expect in a factorization. As in, you expected a
213.
by pbsd 11y ago
> key sizes we'd have thought totally reasonable in 1995 are totally inadequate today. Not really. The last big jump in complexity was in 1991, when the first 512-bit modulus, 2^512+1, was factored by NFS [1]. What has progressed th
214.
by pbsd 11y ago
You're misrepresenting my suggestion. The idea is to choose the factor size according to the complexity of ECM; the modulus size is irrelevant. So for a 2^80 security level, you choose factors of ~341 bits; relaxing the security to a 2
215.
by pbsd 11y ago
But index calculus is the right way to do it, and it's not particularly difficult to exploit. P-H only puts a quadratic (at best) factor between you and an attacker; index calculus makes that gap subexponential. Below is the prime numb
216.
by pbsd 11y ago
The idea is to hide the factorization of the group order by using a composite modulus, e.g., p = q . r, where q and r are kept secret. Now the order (q-1)(r-1) is safely protected from ECM (though not from Pollard's p-1, if the order i
217.
by pbsd 11y ago
Even if RSA does go away, and it will, public-key encryption primitives won't. The post-quantum craze is mostly made up of encryption and signature primitives, so we have that to look forward to. Even the lattice-based key agreement we
218.
by pbsd 11y ago
I'm with you on this one. This 'RSA is evil' conclusion is like taking a look at [1]---or the gazillion Schnorr-style signature scheme nonce leaks published over the years---and concluding that elliptic curves are evil. [1]
219.
by pbsd 11y ago
You probably don't want to use BLAKE as the poster child for this argument, since it uses two sets of constants of distinct provenance: the initialization vector, which uses the same constants as SHA-2, i.e., the square roots of the fi
220.
by pbsd 11y ago
This story is kind of true, but is missing some detail. The first differential attack on DES broke up to 15 rounds, that is correct [1]. 2 years later, however, the same team broke the full 16 rounds, albeit with a hefty amount of chosen
221.
by pbsd 11y ago
The standard defines moved from objects (standard library types, at least) to be in a 'valid but unspecified state'. For container types like std::vector, 'valid but unspecified' usually means empty.
222.
by pbsd 11y ago
`swap` uses `move` to enable swapping objects that can only be moved but not copied (e.g., std::unique_ptr<T>). Note that this swap implementation is meant to be generic---types may implement their own specific `swap` that performs no
223.
by pbsd 11y ago
The Russian counterpart to the DES, GOST 28147-89, still stands to this day. A 64-bit block cipher with a 256-bit key, designed in the 70s .
224.
by pbsd 11y ago
I am not familiar with all the ways the GRH can be disproven, but Miller-Rabin doesn't strike me as the most efficient, with its running time of O((log n)^4) for each attempt. I am not sufficiently competent to say whether a GRH counte
225.
by pbsd 11y ago
Only the simple Fermat tests are vulnerable to Carmichael numbers. The test which is used in practice, Rabin-Miller, is not vulnerable to them. In fact, if you assume the extended Riemann hypothesis is true, (log n)^2 iterations of Rabin-M
226.
by pbsd 11y ago
One of the factors is 3684787 = 271 x 13597, so I suspect this is more accidental than malicious. The generator, 2, does not seem to have pathologically small order, but I didn't check very far.
227.
by pbsd 11y ago
This sort of thing is comparable to sending humans to the Moon. In and of itself, there's not much of a point to it; but the technology you develop to get there has a tendency to become useful in other, perhaps more useful, areas. In t
228.
by pbsd 11y ago
Carry propagation bugs are more or less self-explanatory: the implementer failed to add every possible carry bit during a large integer addition or multiplication, and this turns into an incorrect result. This may only happen in rare edge c
229.
by pbsd 11y ago
I think it's time we forgive the entertainment industry for that "you forgot to carry the one" trope. Turns out they were right!
230.
by pbsd 11y ago
In the case of the carry flag it was only lifted in Broadwell, which also introduced ADCX and ADOX to let you perform two carry chains concurrently. Conditional moves were also improved; you can do 2 per cycle now.
231.
by pbsd 11y ago
To be pedantic about it, string literals in C are of type `char[]`. In C++ they are of type `const char []`. In either case, altering the contents of the string literal is undefined behavior.
232.
by pbsd 11y ago
I would agree with you that scrypt's design was vindicated by the PHC, but I think calling it the winner is a bit much. I wouldn't want to go back to scrypt, given the choices available now. Incremental progress is still progress.
233.
by pbsd 11y ago
Gambit used Keccak.
234.
by pbsd 11y ago
Not true. In fact, modern x86 backends recognize the safe rotation idiom and also translate it to a single ROL instruction: http://goo.gl/NCMEVu http://goo.gl/9Ytsz2 http://goo.gl/vbzHNW
235.
by pbsd 11y ago
I don't know, it makes little sense to me too. Maybe there's some subtle flaw somewhere, which I haven't spotted. Since subtlety doesn't seem to be a thing with the changes we've seen so far, I'm not sure what
236.
by pbsd 11y ago
It seems to be a true statement: Dual EC is used to seed a X9.31 generator with 3DES, where 8 bytes are the initial seed V, and the remaining 24 are K (cf. [1]). I don't see any other usage of Dual EC other than to self-test and to see
237.
by pbsd 11y ago
No, that cannot be guaranteed. Equidistribution in 52 dimensions requires necessarily a minimum state size of 52 log_2(52) bits, which we don't even have. Even if we did, it could not be guaranteed anyway. You have already covered the
238.
by pbsd 11y ago
The shuffle question ties in with the overlap question. Let's stick with the AES in counter mode example. AES is a block cipher, or in other words a keyed permutation. What this means is that each key (resp. seed) determines a distinct
239.
by pbsd 11y ago
A short cycle would be a catastrophic outcome for any serious cipher. Although not every generator has a provably guaranteed period, relying instead on the properties of the 'average' random function, it easy to guarantee period.
240.
by pbsd 11y ago
> Not really. A statistical test _is_ a distinguisher! This seems self-evident to me. When the test repeatedly fails (with an extreme p-value or whatever criteria you want to apply here for 'failure'), you have successfully dis

More ›