sdevlin

5 ms·

1.
by sdevlin 7y ago
> We talked English professors through the "number-theoretic" attacks on RSA in cryptopals set 6. The English professor finished set 8 as well!
2.
by sdevlin 8y ago
> Using "one-time-use combinations of three English words" is "fine" only if your definition of "fine" includes allowing someone with a minimal budget to find out the password in less than a year. Magic Worm
3.
by sdevlin 8y ago
Emacs Lisp is most certainly not a Scheme.
4.
by sdevlin 8y ago
Probably `M-x eww`.
5.
by sdevlin 9y ago
They're not reading data out of the cache line. Often the contents of the cache are public anyway. What they're detecting is whether a piece of memory is in the cache or not. This lets them infer the contents of some other pie
6.
by sdevlin 9y ago
These are great details, but they don't really answer my question.
7.
by sdevlin 9y ago
You do have the choice. You don't need session tickets at all to run TLS. The cost of geographically-distinct STEKs would simply be an additional handshake if the client hops regions. (Is this common?) This is a choice Cloud Flare is m
8.
by sdevlin 9y ago
So it would be correct to say that if any of Cloud Flare's endpoint servers is compromised, the adversary can decrypt traffic passively on a global scale?
9.
by sdevlin 9y ago
What is Cloud Flare's policy for managing STEKs? Are they distinct per geographic region as the article recommends?
10.
by sdevlin 9y ago
I guess it depends what you mean by “crack”. Given f(1), which I assume is public, you can predict all future outputs.
11.
by sdevlin 9y ago
It's impossible to bootstrap a secure connection without some preexisting trusted relationship. Otherwise, you'd always be vulnerable to middle-person attacks. Browsers solve this problem by bundling a number of trusted root certi
12.
by sdevlin 9y ago
It's true that the space of valid RSA keys is sparse relative to size, but this isn't why we need big keys. As a counterexample, classic DH keys are also big (or they can be), even though the space of valid keys is dense. We need
13.
by sdevlin 9y ago
> More specifically, because of the RSA dependency on prime numbers, the RSA effective key space is very sparse (which is why going from 2048-bit RSA to 4096-bit RSA only increases the effective key space by ~16%). With elliptic curves,
14.
by sdevlin 10y ago
Just read his blog.
15.
by sdevlin 10y ago
ESR is a racist and a misogynist. And that document might as well be called "how to be ESR".
16.
by sdevlin 10y ago
You were the first to finish set 7. I assume most people don't know, so: Filippo was one of our earliest adopters of cryptopals. He is a monster. He demolished everything we put in front of him. You should watch Filippo run set 8. I&#x
17.
by sdevlin 10y ago
Our goal was to be accessible. If we were unsuccessful, we're happy to help fill the gaps. My email is spd@toadstyle.org.
18.
by sdevlin 10y ago
I'm an author. My personal mail is spd@toadstyle.org. I'm happy to help you get unblocked.
19.
by sdevlin 10y ago
Quick plug: set 8 is out. It's all about attacks on elliptic curves and GCM. This set is huge. There's as much content as in any two or three other sets. This set is tough. It's easily the toughest set so far. And there is so
20.
by sdevlin 10y ago
You are talking about quantum attacks, whereas tptacek is talking about classical attacks.
21.
by sdevlin 10y ago
I don't think their bound is related to nonce-management issues. From the documentation: > The GCM security limit is 2^56 bytes because: > This is 2^52 AES blocks (each block is 16 bytes). The limit is based on the risk of birthd
22.
by sdevlin 10y ago
Where are you getting that number?
23.
by sdevlin 10y ago
I think the free version of Burp Suite will handle all of this for you.
24.
by sdevlin 10y ago
Not specifying the group/generator is a weak link, which is what David is taking advantage of. Curve25519 is a good counterexample of a DH function that leaves nothing to the imagination.
25.
by sdevlin 10y ago
Yes, the posited attacker is an unprivileged spy process sharing a cache with the victim. The FLUSH+RELOAD cache-timing algorithm they use relies on a shared cache. See section 2.2. Of course, there may be other ways to extract the same dat
26.
by sdevlin 10y ago
I'm not familiar with all the details, but don't you just have an absence of proof that it's X?
27.
by sdevlin 10y ago
If messages come from one known-good source (e.g. firmware updates), a digital signature is a valid message authenticator. Where this falls down is in multi-user settings (e.g. iMessage), where secret-key authentication via MAC becomes a ne
28.
Postcards from the post-XSS world(lcamtuf.coredump.cx)
3 points by sdevlin 11y ago|0 comments
29.
by sdevlin 11y ago
Some examples detailing the dangers of HTML corruption: http://lcamtuf.coredump.cx/postxss/ .
30.
by sdevlin 11y ago
> I mean, I'm not trying to be a conspiracy theorist, but certainly similar things have happened. Could you list some?

More ›