Discussion
learning about kyber from wikipedia https://en.wikipedia.org/wiki/ML-KEM
Compared to competing PQ methods, it has typical advantages of lattice-based methods, e.g. in regard to runtime as well as the size of the ciphertexts and the key material.[6]
"advantages of lattice-based methods" they are famously the slowest and biggest but go off i guess
Now we apply our probabilistic algorithm A, whose existence was assumed,
ridiculous paper
oh the A part is ok
In fact we give a random problem: find a short vector in a certain class of random Iattices (whose elements can be generated together with a short vector in them), whose solution in the mentioned sense would imply the solution of a group of related “famous” problems in the worst case.
It has been realized a long time ago that a possible solution would be to find a set of randomly generated problems and show that if there is an algorithm which finds a solution of a random instance with a positive probability, then there is also an algorithm which solves one of the famous unsolved problems in the worst case.
i'm not sure if this is wrong but it's incredibly misleading:
i think it may be correct technically but no IBM paper is ever just correct. that place is just not a source of truth
anyway now they've rolled this out during wartime very cool
oh wait lmao mihir bellare completely validated my hypothesis https://cseweb.ucsd.edu/~mihir/papers/inchash.pdf
The problem is you need to store the entire tree, meaning all the intermediate hash values.
bet?????????
To date the only incremental hash function was proposed by [BGG1], based on work of [CHP].
ok ok ok ok ok ok ok ok ok
This function is based on discrete exponentiation in a group of prime order. It uses one modular exponentiation per message block to hash the message.
YEAH!!!!!!!!!!!!!!!!!
oh lmao i did not realize i was describing incremental hashing this whole time. ok cool so i am atm equivalent to mihir bellare in 1996
It turns out that even putting incrementality aside, functions resulting from our paradigm have attractive features, such as parallelizability.
jack nicholson zoom in jpg
What we want is to store only the final hash value and be able to increment given only this.
sorry this is just a ridiculous, absurd requirement when describing filesystem integrity???? when someone modifies your hard drive where did it happen??? it's literally C * log^2 n space i think???? i don't think it's that much???? nobody else is doing the memory analysis???
also this paper does the WORST FUCKING SHIT THAT I HATE and puts an incredibly lengthy appendix after the citations
now they're like oh yeah chaum invented discrete log signatures and the last time anyone mentioned chaum it was to thank him for inventing the mixnet which he did not invent nor even describe
but it's even worse this time because it's the same shit as lattice crypto where the paper is an "extended abstract" and the real one is named the same and impossible to find
The cryptographic assumption, needed for the security of the recipients, is that we have an infinite sequence of groups G_p of known prime orders p, where one can perform the group operations and choose random elements efficiently, but the discrete logarithm is hard.
that is not an assumption i will make?????
mihir bellare just talking out of his ass now https://cseweb.ucsd.edu/~mihir/papers/inc1.pdf
Some care must be taken in formalizing this since the update algorithm receives the entire nb-bit message as input and in a standard Turing machine model could not even read the relevant part in poly(k, b) time. Thus we assume a RAM type computation model and in the formal definition allow the update time to depend on log n.
that's not a footnote-type comment but it's in the tiniest possible text? i have never heard of "the security parameter k" before in my life??? i have also never heard of anyone assuming a RAM type model before either
Install bonfire.cafe
Get the full app experience
