pbsd

28 ms·

241.
by pbsd 11y ago
I find it disingenuous to see properties such as equidistribution or low discrepancy being described as 'quality' of a generator. Yes, they make certain Monte Carlo algorithms converge quicker. No, they are not closer to a truly r
242.
by pbsd 11y ago
Yes, a single block encrypted under 2^40 distinct keys (you can generalize this to a few popular blocks, instead of just the same block encrypted over and over). Each key you guess during bruteforce has a 2^40/2^128 chance of being cor
243.
by pbsd 11y ago
I know this paper, and like this approach. Reduced-round primitives let you take advantage of existent analysis, and keep some guarantees while improving speed. In the case of AES, we know that the probability of any differential for 4 ro
244.
by pbsd 11y ago
My bad; I somehow skipped over your paragraph saying to 'dive in', which renders all of my disagreement invalid.
245.
by pbsd 11y ago
In the context of reverse engineering I feel like learning assembly this way is 'doing it wrong'. Of course, there's no such thing as 'doing it wrong' when it comes to learning, but here's what worked for me. W
246.
by pbsd 11y ago
Yes, you're right, I am calling the AES round once per `next()` call. But note that this his could be rewritten as if(counter_ >= 4) { counter_ = 0; u_.words_[0] = _mm_aesenc_si128(u_.words_[0], key_); } return u_.st
247.
by pbsd 11y ago
Although this thing is able to fool the 200 or so tests from TestU01, it would take a short time for an expert to devise a test that would distinguish it from random, and even recover the key (read: seed). On the other hand, AES-CTR (conjec
248.
by pbsd 11y ago
It means exactly what it sounds like: the author tried to attack the generator, failed, and thus concluded that it must be a Very Hard Problem. Note that the field of pseudorandom number generation for non-cryptographic purposes is much les
249.
by pbsd 11y ago
Retired: https://sites.google.com/site/jmptidcott2
250.
by pbsd 11y ago
As far as academic articles go, "* considered harmful" is probably as vague and bombastic (read: clickbaity) as a title gets (perhaps after 'Ron was wrong, Whit is right'). Personally I'd prefer a more descriptive t
251.
by pbsd 11y ago
It is not a common occurrence, but it does happen occasionally. Once upon a time the best known way to compute discrete logarithms was Shanks's Baby-Step Giant-Step. This method begins by constructing a table of size sqrt(p), and then
252.
by pbsd 11y ago
Yes, though it would be quite impractical. See for example http://cr.yp.to/talks/2010.05.28/slides.pdf
253.
by pbsd 11y ago
Loosely speaking, you need n + epsilon qubits and 4n^3 operations to break RSA-n, whereas you need ~6n qubits and 360n^3 operations to break ECC-n. For n = 256, you need around 1536 qubits, whereas you need at least 3072 for RSA-3072. Thi
254.
by pbsd 11y ago
On that note, I was surprised to learn that if all you do is apply some invertible transform to the IV (xor with a constant, swap words, whatever) before processing the last padded block in Merkle-Damgard, you get an indifferentiable hash.
255.
by pbsd 11y ago
The important bit here is not that the IV is different, but that you can also inject arbitrary differences into the IV. This gives the attacker more freedom than in the usual case, where differences only go into the message.
256.
by pbsd 11y ago
> - It has powerful generics and macros, so people who want to write really clever code, can. To take a cue from the article: how do you write a generic max() function for an arbitrary number of arguments?
257.
by pbsd 11y ago
Yeah, I'm not too worried either. There is one class of cryptographic code, however, that is entirely unsuitable to distribute in Bitcode---DPA/EM-protected code. EM attacks on middle-end ARM chips have been demonstrated recently
258.
by pbsd 11y ago
`always_inline` is only there to make -O0 smaller for presentation purposes. It has no impact on -O2. The trick here is that -march=i386 predates CMOV, and that LLVM specializes code emitting for bool (and _Bool). If the secret bit were an
259.
by pbsd 11y ago
Very small one, but (taken from [1]): http://goo.gl/M8XThn vs http://goo.gl/RZZf1N [1] https://cryptocoding.net/index.php/Coding_rules#Compare_secr...
260.
by pbsd 11y ago
That's how you unroll a loop, not how you write one. As far as I can tell in PeachPy you can do something similar with anonymous labels: counter = GeneralPurposeRegister64() MOV(counter, 64) with Loop() as loop: ... DEC
261.
by pbsd 11y ago
The best complexity these days [1] is essentially n log n. More precisely, O( n log n 8^(log* n) ), where log* is the extremely slow-growing iterated logarithm. The original Schönhage-Strassen algorithm is O(n log n log log n). [1] http:&
262.
by pbsd 11y ago
Not sure I understand precisely what you're asking. 'Generic composition' is a tricky term, because it tends to hide the assumptions underlying what we're actually composing together. Bellare and Namprempre's paper,
263.
by pbsd 11y ago
Rogaway brought it back with a vengeance back in 2006, with SIV: http://web.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf Essentially all 'misuse resistant' modes are some form of MtE, since in those modes
264.
by pbsd 11y ago
Basically equivalent to this C code (assuming BSR = procedure call): int x2(int x) { return x + x; } int x4(int x) { return x2(x) + x2(x); } int x8(int x) { return x4(x) + x4(x); } int x16(int x) { return x8(x) + x8(x); }
265.
by pbsd 11y ago
Neither does; the author is linking to the i386 documents, where there is indeed a difference between syscall and C calling conventions on some operating systems. On x86_64, everyone follows the SysV ABI and uses registers for both purposes
266.
by pbsd 11y ago
This is hard to answer because many quantum algorithms useful for cryptanalysis have probably not been discovered yet. See, for example, the debacle surrounding Soliloquoy [1], an algorithm that despite being based on the hardness of lattic
267.
by pbsd 11y ago
The recent Rowhammer.js paper showed that you don't even need non-temporal instructions to achieve faults---regular accesses, with a clever eviction strategy, will do: http://arxiv.org/abs/1507.06955
268.
by pbsd 11y ago
You're mixing modes of operation with compression functions. A mode can be shown to be unconditionally resistant to length-extension attacks. Every SHA-3 finalist's mode was shown to be 'perfect' (indifferentiable) as lo
269.
by pbsd 11y ago
BLAKE(2) is not open to length-extension attacks---in fact resistance to those was a requirement of any SHA-3 submission. Its design does not have much in common with MD5 and SHA-1 beyond the usage of the compression function building block
270.
by pbsd 11y ago
Arguing the frivolity of Hollywood movie piracy is not terribly hard. Would you apply the same reasoning to academic research paper and/or textbook piracy?

More ›