tptacek

17 ms·

391.
by tptacek 2mo ago
Regev in 2005 was hugely important, but '90s NTRU remains unbroken, and Atjai was 1996. The Suite B thing undercuts your argument! You've managed to establish 25519's publication the same year as Suite B. Again: Bernstein did
392.
by tptacek 2mo ago
It sounds like what's actually happening here is you're fleeing to an abstraction after acknolwedging that (a) NSA couldn't have had a hand in designing MLKEM and (b) that nobody at IETF is advocating against hybrids --- inde
393.
by tptacek 2mo ago
Lattice cryptography is not in fact fairly nascent. It's new to you, which is not the same thing. That's why I raised the point about 25519's vintage: you're thinking about 25519 in today's context (which, ironica
394.
by tptacek 2mo ago
No it isn't! Everyone is fine with hybrids, hybrids are the default, and hybrids have a standards-track, recommended=y RFC, unlike pure. If you think this is about hybrids, Bernstein has bamboozled you.
395.
by tptacek 2mo ago
We'll never know, because he only started advocating for hybrids after MLKEM happened. When he did 25519, he did not advocate for 25519/RSA or 25519/FFDH or 25519/P256 hybrids. Agree or disagree with my arguments on subs
396.
by tptacek 2mo ago
In addition to being closely associated with the conditions semaglutide treats, NAION is quite rare.
397.
by tptacek 2mo ago
I don't see anything RFK-like in that comment.
398.
by tptacek 2mo ago
WebKit and Chrome are platform codebases. WhatsApp is an example of what I'm talking about, though.
399.
by tptacek 2mo ago
See, this is what upsets me about this situation. Bernstein has managed to get you to a point where you think NSA "proposed" MLKEM, or had some hand in its design. That's not remotely what happened. A team of European cryptog
400.
by tptacek 2mo ago
That's why I brought him up. Now, because you used the plural, I'd like to know the other "legendary cryptographer" to which your comment refers.
401.
by tptacek 2mo ago
The legendary cryptographer that isn't Orr Dunkelman that you're referring to would be...? What's noteworthy about the last list of sponsors of his position that Dan Bernstein posted was how few of them were cryptographers.
402.
by tptacek 2mo ago
No, it's not. The article itself is somewhat incoherent; for instance, if you're using key-only authentication (which: of course you are) fail2ban has literally no function (unless you think attackers are brute-forcing ECDH keys).
403.
by tptacek 2mo ago
Just stop logging that stuff.
404.
by tptacek 2mo ago
This is a link to a comment from 38 days ago.
405.
by tptacek 2mo ago
The person this is about is not an acquaintance of mine. I have no idea if they applied or didn't apply. The person I've spoken to --- am acquainted with (though not personal friends with) is Henry de Valence, who obviously did no
406.
by tptacek 2mo ago
I have no idea what the fuck you're talking about here but nobody "lost a grad school spot" to Jacob Appelbaum. It is true that I was once a Bernstein stan. He's generally been nothing but nice to me. But then I met othe
407.
by tptacek 2mo ago
There is nobody at IETF saying you shouldn't use a hybrid! In fact, it's the exact opposite: hybrid ECDH/MLKEM is a standards-track RFC, and the proposed pure-MLKEM RFC is not, nor is it "Recommended" (in IETF parla
408.
by tptacek 2mo ago
See, here's another argument that doesn't work here, because Bernstein very publicly backs a different lattice cryptography scheme. In addition to the previously-stated reason why that argument is inoperative (besides being unfa
409.
by tptacek 2mo ago
No. This whole situation is extremely dumb. Bernstein is a co-author on NIST PQC competition submissions that didn't win (Classic McEliece, which just had a huge new research result, and Streamlined NTRU Prime, a lattice cousin to MLKE
410.
by tptacek 2mo ago
Just so we're clear, you're acknowledging that this argument hinges on the idea that documenting pure MLKEM is dangerous because, once it's documented in an (informational, optional) RFC, but only if it's documented in a
411.
by tptacek 2mo ago
That can't be the argument --- it can't be that NSA simply knows a vulnerability that impacts one very specific lattice scheme and not the others. The reason for that is a cryptographic concept known as the Vizzini Conjecture: the
412.
by tptacek 2mo ago
I don't know what this is, but it isn't an answer to the question. I'm starting to notice that nobody is able to come up with an answer.
413.
by tptacek 2mo ago
It's a simple question. I'm not asking anybody to prove anything. I'm literally asking: propose the PQC standard IETF could have subverted, and give a sketch of how they could have done it. The bar is merely "plausibilit
414.
by tptacek 2mo ago
In addition to noticing that your argument had moved goalposts (the part you claim is an ad hominem, but is not) I also responded substantively to a factual claim you made, and you're pretending otherwise.
415.
by tptacek 2mo ago
I can think of several academic cryptographers (or rather, practitioners with doctorates) who think the hybrid/pure thing is silly. I didn't claim that a majority oppose hybrids. The point of the message he snipped from the HN t
416.
by tptacek 2mo ago
Amazing. Six patents! I sign literally everything I write here with my own name, so it's pretty easy to find out my background.
417.
by tptacek 2mo ago
I feel like what's most likely happening here, given your initial argument, is that you just learned that this is a debate about whether it should be forbidden to even document a particular MLKEM configuration, and you're now work
418.
by tptacek 2mo ago
A majority (but not a large majority) of cryptography engineers would use hybrids at this point, and hybrids are largely the default design for any mainstream deployment. Bernstein argument isn't "use hybrids, not pure MLKEM"
419.
by tptacek 2mo ago
Which PQC standard are you suggesting they pushed, and how did they push it? Flesh the argument out.
420.
by tptacek 2mo ago
HTTP, JSON, and HTTPS all have standards-track RFCs.

More ›