FiloSottile

7 ms·

1.
by FiloSottile 2mo ago
Oooof, thank you for catching this. This is what I get for writing spec and API before the implementation (which, to be fair, is usually the right order not to lose sight of the broader picture). Sorry for the confusion, it's indeed th
2.
by FiloSottile 3mo ago
> I understand people are getting slammed and it sucks, but the main result of rejecting them is going to be an increase in full disclosure. Right, what I'm saying is that letting those bugs go to full disclosure (aka being filed as
3.
by FiloSottile 3mo ago
Thanks for the comment, I was actually hoping to get your take on this! I linked to it from the article. > Still on Hacker News, Juho Forsén, one of the most prolific reporters of Go security issues, wrote a long interesting comment that
4.
Securing the Nation Against Advanced Cryptographic Attacks(whitehouse.gov)
17 points by FiloSottile 3mo ago|5 comments
5.
by FiloSottile 3mo ago
Uh, yeah, this is not the writing of someone with the experience to maintain a cryptography toolkit: https://kerkour.com/nist-cryptography-backdoor (I’m more worried about judgement calls than implementation correctness, it
6.
by FiloSottile 3mo ago
TIL about ZFSBootMenu! Still, the whole frood system is significantly less complex than ZFSBootMenu alone.
7.
by FiloSottile 3mo ago
I’m pretty sure (even just based on the revenue of various SaaS products) that’s not typical, hence “most NDAs”. I’m also sure some require a SCIF, but that’s not most of them.
8.
by FiloSottile 3mo ago
Your NDAs prohibit emailing a colleague about the e.g. project, or discussing it in a Slack DM with the client, or tracking progress on it in JIRA? You have to do NDA’d work exclusively with local tools or end-to-end encryption? Those are s
9.
by FiloSottile 3mo ago
In the same way that using Gmail and Dropbox and iCloud and Notion violates it. (Which IANAL but for most NDAs would be not at all.)
10.
by FiloSottile 4mo ago
I would really like to look at the bug and whether we could have caught it with conventional testing, but it doesn't look like Apple actually disclosed it?
11.
by FiloSottile 5mo ago
I just use the VS Code git integration with the jj colocated git repo. HEAD is @- and the changes in @ are considered working copy changes. It works for all I was using the VS Code integration for.
12.
by FiloSottile 5mo ago
This will probably not help enough for asymmetric keys, and is unnecessary for symmetric keys. https://arxiv.org/abs/2603.28846 claims an attack runtime of a few minutes. There are enough order-of-magnitude breakthroug
13.
by FiloSottile 5mo ago
The calculated DW cost of the quantum attack is 2^104 (with conservative/optimistic assumptions and ignoring the physical cost of a single logical gate), which is "much more realistic than a brute force attack" in the same se
14.
by FiloSottile 5mo ago
Hashes are symmetric cryptography primitives, and it's even proper to talk about key sizes for e.g. HMAC and HKDF hash-based constructions, to which Grover's algorithm applies analogously to how it applies to cipher keys.
15.
by FiloSottile 5mo ago
The world just doesn’t work in such a binary way. Forming a mental model of an entity’s incentives, goals, capabilities, and dysfunctions will serve you much better than making two buckets for trusted parties and adversaries.
16.
by FiloSottile 5mo ago
> KyberSlash That's a timing side-channel, irrelevant to ephemeral key exchanges, and tbh if that's the worst that went wrong in a year and a half, I am very hopeful indeed.
17.
by FiloSottile 5mo ago
I mean "your OS and have a CRQC" because they will need to compromise the software PQ key by compromising the OS, and derive the hardware YubiKey private key using the CRQC.
18.
by FiloSottile 5mo ago
Thus succeeding at making the telecommunications vendors used for Top Secret US national security data less secure, the obvious goal of the US National Security Agency, and the only reason they wouldn't use the better cryptography de
19.
by FiloSottile 5mo ago
TIL about the Chicago Pile! (I don't know enough about the physics to tell if it could have indeed exploded.) > On 2 December 1942 https://en.wikipedia.org/wiki/Chicago_Pile-1 > on July 16, 1945 https:&#x2F
20.
by FiloSottile 5mo ago
If you are doing authentication with those hardware keys, you will probably be fine, if we do our job fast enough. Apple's Secure Enclave already supports some PQ signatures (although annoyingly not ML-DSA-44 apparently?) and I trust
21.
by FiloSottile 5mo ago
> The industry standard and general recommendation for quantum resistant symmetric encryption is using 256 bit keys It simply is not. NIST and BSI specifically recommend all of AES-128, AES-196, and AES-256 in their post-quantum guidance
22.
by FiloSottile 5mo ago
DES is the algorithms that was secretly modified by the NSA to protect it against differential cryptanalysis. Capping a key size is hardly a "backdoor." Also, that was the time of export ciphers and Suite A vs Suite B, which wer
23.
by FiloSottile 5mo ago
> from a classical security point of view PQC cannot be trusted [citation needed] https://words.filippo.io/crqc-timeline/#fn:lattices
24.
by FiloSottile 5mo ago
We can disagree on the tradeoff, but if you see no upside, you are missing the velocity cost of the specification work, the API design, and the implementation complexity. Plus the annoying but real social cost of all the bikeshedding and bi
25.
by FiloSottile 5mo ago
We are stretching the metaphor thin, but surely the progress towards an atomic bomb was not measured only in uranium production, in the same way that the progress towards a QC is not measured only in construction time of the machine. At the
26.
by FiloSottile 5mo ago
Yeah, that's an audience mismatch, this article is for "us." End users of cryptography, including website operators and passkey users ( https://news.ycombinator.com/item?id=47664744 ) can't do much right n
27.
by FiloSottile 5mo ago
See https://bas.westerbaan.name/notes/2026/04/02/factoring.html and https://scottaaronson.blog/?p=9665#comment-2029013 which are linked to in the first section of the article. > Sure,
28.
by FiloSottile 5mo ago
Remember that the entities most likely to heed those governments recommendations are those providing services to said government and its military. I feel like the NSA pushing a (definitely misguided and obviously later exploited by adversar
29.
by FiloSottile 5mo ago
Indeed, in an open system like the WebPKI it's fine in theory to only make the central authority PQ, but then you have the ecosystem adoption issue. In a closed system, you don't have the adoption issue, but the benefit to making
30.
by FiloSottile 5mo ago
This article is more aimed at those specifying and implementing WebAuthN and SSH, than at those using them. They/we need to migrate those protocols to PQ now, so that you all can start migrating to PQ keys in time, including the long t

More ›