Post by @hipsterelectron@circumstances.run

@hipsterelectron@circumstances.run 8 hr. ago

i still don't get why people use elliptic curves instead of diffie-hellman since you can use it for public keys too. the index calculus cryptanalytic method appears to apply for the usage of F_q where q = pn for some prime p. it appears that if q is a large prime and q - 1 is divisible by a large prime, that covers the two biggest error cases

17 Replies

8 Boosts

This comment is unavailable — it may have been deleted or is not visible to you.

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

cryptographers will literally tell you to encrypt your disk and add checksums to individual files instead of the other way around

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

The HBSH (hash, block cipher, stream cipher, hash) construction, published by Google employees in 2018, allows a fast stream cipher to be used in disk encryption.

"published by Google employees in 2018" oh yeah that's trustworthy

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

hmmmm very interesting that ARM has no AES instruction set

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

i'm realizing that since i have no need for my in-memory filesystem to correspond to disk blocks, i can make files out of ordered variable-size chunks. this might be completely useless though

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

like it means you could theoretically add a chunk in the middle..........but you still need to recompute the whole hash tree. and i was thinking oh maybe non-contiguous data? but contiguous data rox

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

i suppose it probably is kind of nice to be able to store a very large file in smaller chunks............or to support appends even if they get normalized into a contiguous representation later

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

this is too hard. i'm gonna learn about pseudorandom generator functions

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

https://en.wikipedia.org/wiki/Linear_congruential_generator#Advantages_and_disadvantages

thank you wikipedia for mentioning these are not suitable for cryptographic usage 2/3rds of the way down the page

Linear congruential generator - Wikipedia

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

Ideally, the generation of random numbers in CSPRNGs uses entropy obtained from a high-quality source, generally the operating system's randomness API.

operating systems do not have a randomness "API" for high-quality randomness. the output of /dev/u?random is a CSPRNG

However, unexpected correlations have been found in several such ostensibly independent processes.

i love to unexpect some correlations

Daniel Lakeland

@dlakelan@mastodon.sdf.org 1 hr. ago

@hipsterelectron
Yes but afaik they do seed the CSPRNG using data collected from timing interrupts etc right? like the RNG encrypts a counter or something with a secret key thats derived from collected data etc

Daniel Lakeland

@dlakelan@mastodon.sdf.org 1 hr. ago

@hipsterelectron
Also theres a long history of bullshit about this. kernel programmers used to think entropy was a thing like water in a bucket that you could use up... /Dev/random would block if the bucket wasn't full enough... 😵‍💫

Adam ♿

@voltagex@aus.social 1 hr. ago

@dlakelan I could definitely use some reading material on this - that was still in the back of my mind, even though I am rarely using /dev/(u)random directly these days
@hipsterelectron

Daniel Lakeland

@dlakelan@mastodon.sdf.org 56 min. ago

@voltagex
entropy is more or less a number of bits of secret information you need to know to predict everything about what /dev/(u)random will output. in the early boot process the kernel collects timing info etc and builds a secret key from it, then encrypts a counter and uses the output as a bitstream (it wasn't always like this, thats just what it does currently). i think they unified urandom and random eventually. so they both block until that key is formed then dont block
@hipsterelectron

Daniel Lakeland

@dlakelan@mastodon.sdf.org 50 min. ago

@voltagex
https://lwn.net/Articles/884875/

discusses some of these things from a 5 year old viewpoint but is still good history I think
@hipsterelectron

LWN.net

Uniting the Linux random-number devices

Blocking in the kernel's random-number generator (RNG)—causing a process to wait for 'enough' e [...]

Rod Van Meter

@rdviii@famichiki.jp 2 hr. ago

@hipsterelectron DH and RSA are the canonical examples of vulnerable to factoring or discrete logarithm breakthroughs and surprise, that's exactly what Shor's algorithm does.

d@nny disc@

@hipsterelectron@circumstances.run 35 min. ago

@rdviii shor's algorithm, the one that works on a quantum computer, which will never exist

d@nny disc@

@hipsterelectron@circumstances.run 34 min. ago

@rdviii it has never once been proven that the claimed mathematical framework assigned to a quantum computer is actually physically realizable