Post by @hipsterelectron@circumstances.run

@hipsterelectron@circumstances.run 8 hr. ago

i'm heartbroken =',[ merkle how could you https://link.springer.com/content/pdf/10.1007/0-387-34805-0_40.pdf

While there has been a lively debate about the actual security level provided by DES[14.15,16,17] the fact remains that no major deviations from random behavior have been found.

shadow the hedgehog voice "what? this can't be....."

The existence of "random block ciphers" seems almost assured in some intuitive sense, and DES appears to be a reasonable approximation to one.

yeah that sounds good

46 Replies

3 Boosts

d@nny disc@

@hipsterelectron@circumstances.run 7 hr. ago

wow! this is easily one of the worst things i've ever read. worse than the incremental hashing paper and very directly says to put in secret information as a prefix to a message checksum

d@nny disc@

@hipsterelectron@circumstances.run 7 hr. ago

i totally assumed that was just a natural mistake anyone would make regard checksum security. nope! if this is actually a real paper he is on record telling you to put secret info in the prefix

d@nny disc@

@hipsterelectron@circumstances.run 7 hr. ago

another AWFUL one from mihir bellare https://cseweb.ucsd.edu/~mihir/papers/inchash.pdf

you might ask: didn't he already do an incremental hash paper? answer is: yes! this one has bad hashes instead of an incorrect usage of modular exponentiation

View (PDF)

d@nny disc@

@hipsterelectron@circumstances.run 7 hr. ago

i am kind of going mad with power though because you see there are very clearly two separate primitives at play for commutative (not order-dependent) and non-commutative (serial) data structures. and i have them both in my head now

~57 more replies

d@nny disc@

@hipsterelectron@circumstances.run 7 hr. ago

one of them is for parallel data, the other is for serial data. the first is not parallellizable, the second is fully parallelizable

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

somehow found this book when looking up the monster group https://archive.org/details/gdelsproof00nage/page/n133/mode/2up "Godel's Proof" by Ernest Nagel

https://en.wikipedia.org/wiki/Ernest_Nagel

it's kind of fascist but it's very compelling i couldn't stop reading

Ernest Nagel - Wikipedia

Internet Archive

Gödel's proof : Nagel, Ernest : Free Download, Borrow, and Streaming : Internet Archive

http://uf.catalog.fcla.edu/uf.jsp?st=UF020674712&ix=pm&I=0&V=D&pm=1

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

it does come out very strong against simulation of intelligence though. but i absolutely see why godel was possible to integrate into the number theoretic formal system without exploding it

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

https://en.wikipedia.org/wiki/Goldbach%27s_conjecture

that even integers are an infinite group and also that each of them can (probably) be represented as the sum of two primes is FUCKING ME UP FAM

Goldbach's conjecture - Wikipedia

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

oh yeah and. i also learned about our boy lenstra https://en.wikipedia.org/wiki/Lenstra%E2%80%93Lenstra%E2%80%93Lov%C3%A1sz_lattice_basis_reduction_algorithm and now i see:

it's 1982. you are the US government. you have discovered a polynomial factoring method using lattices thanks to lenstra
it's 1985. you are still the US government. you have discovered an integer factoring method using elliptic curves thanks to lenstra

Factoring integers with elliptic curves | Scholarly Publications

Lenstra–Lenstra–Lovász lattice basis reduction algorithm - Wikipedia

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

over the next 50 years, both elliptic curves and lattices would be advanced as cryptographic techniques. both of them are a component of cracking diffie-hellman

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

literally this is so absolutely 100% not serious https://en.wikipedia.org/wiki/Learning_with_errors#Public-key_cryptosystem

Learning with errors - Wikipedia

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

hm. it's interesting how closely this mirrors the definition of "differential privacy"

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

so now i understand why they do so much fucking hashing

Like other PQC-KEM methods, Kyber makes extensive use of hashing internally. In Kyber's case, variants of Keccak (SHA-3/SHAKE) are used here, to generate pseudorandom numbers, among other things.[10]

literally the entire fucking "module learning with errors" problem is about sampling from random distributions gratuitously often so of course it's going to need an absurd degree of "randomness"

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

this is fucking my head up https://en.wikipedia.org/wiki/Transfinite_number

Any finite natural number can be used in at least two ways: as an ordinal and as a cardinal. Cardinal numbers specify the size of sets (e.g., a bag of five marbles), whereas ordinal numbers specify the order of a member within an ordered set[10]

Transfinite number - Wikipedia

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

forgot about these https://en.wikipedia.org/wiki/Unum_(number_format)

Unum (number format) - Wikipedia

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

oh hell yeah. i'm the world's biggest SHA-3 hater now

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

https://link.springer.com/content/pdf/10.1007/3-540-69710-1_5.pdf

this is the second draft from 1998, called PANAMA:

the buffer operates as a linear feedback shift register

bet? https://en.wikipedia.org/wiki/Linear-feedback_shift_register

The initial value of the LFSR is called the seed, and because the operation of the register is deterministic, the stream of values produced by the register is completely determined by its current (or previous) state. Likewise, because the register has a finite number of possible states, it must eventually enter a repeating cycle.

View (PDF)

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

Panama has a low per-byte work factor while still claiming very high security.

it's literally a fucking CRC

The price paid for this is a relatively high fixed computational overhead for every execution of the hash function.

it's literally unkeyed. you have no excuse

This makes the Panama hash function less suited for the hashing of messages shorter than the equivalent of a typewritten page.

please do not try to check our randomness on a short stream

A typical application for Panama might be the encryption or decryption of video-rate data in conditional access applications (e.g. pay-TV).

please do use our guaranteed-to-recur-to-initial-state machine for high-rate data

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

RadioGatún is still a secure hash function;[2][3][4][5]

ok buddy

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

they describe how round 2 was different than round 1

https://drops.dagstuhl.de/entities/document/10.4230/DagSemProc.09031.17

The round function in the mill is very similar to that of Panama, except that the indexes are taken modulo 19 (instead of modulo 17).

The Road from Panama to Keccak via RadioGatún

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

# Sponge functions?

they're trying so hard to make sponge functions a thing

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

literally you look this shit up https://en.wikipedia.org/wiki/Sponge_function

algorithms with finite internal state that take an input bit stream of any length and produce an output bit stream of any desired length.

ah so it's a turing machine. you're describing a turing machine

Sponge function - Wikipedia

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

more specifically it's very obviously an attempt to dodge how finite-field diffie-hellman is still the best CSPRNG on the market

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

In the sponge construction, the input is applied to and the output is extracted from the same part of the state. This is in fact essential for the simplicity of the indifferentiability proof of the sponge construction

i'm no crypto genious but this sounds wrong

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

god fucking damn it. now i'm reading the maurer paper on indifferentiability and i feel this is just so obviously fucked now https://codeberg.org/cosmicexplorer/corporeal/src/branch/main/literature/maurer-indifferentiability-2003-161.pdf

The security of a cryptosystem C(S) involving a component S is typically proven by considering the cryptosystem C(T ) obtained from C(S) where the component S is replaced by an idealized component T.

yeah my cryptosystem would be soooooo secure if my components were replaced by spherical cows

The original system C(S) is secure if (a) the system C(T ) is secure, and (b) the component S is indistinguishable from T

see this is so clearly trying to pretend to be a polynomial-time reduction (WHICH DOES WORK!!!!) but it's WRONG

Cookie monster! (PDF)

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

omfg now read the very first line of SHA-3 explaining why they're sooooo spongey nao https://keccak.team/files/SpongeIndifferentiability.pdf

All cryptographic hash functions of any significance known today, i.e., MD4, MD5, the SHA and RIPEMD [15] families and several others, share the same design paradigm.

LMAO

They all consist of the iterated application of a compression
function.

NOT US!!! WE ARE THE BRAVE ONES WHO GO INTO BATTLE WITH ONLY A CRC

View (PDF)

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

During the last years, with
the recent collision attacks on SHA-1 as culminating point, it has become clear that designing a compression function that is both collision-resistant and efficient is not an easy task.

this is referring to the "compression function" that operates upon exactly one chunk of input at a time. it absolutely does NOT apply to generally "compressing" the bytes, since hash functions don't do that whatsoever.

but it sounds good right?

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

Moreover, weaknesses have been shown in the Merkle-Damgård construction itself.

gasp! not my Merkle-Damgård construct!!! anything but my Merkle-Damgård!!!!!

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

A well known example of such a weakness, discussed in [7], is the insecurity of the MAC function constructed from a Merkle-Damgård hash function by feeding the latter with the secret key followed by the message.

yeah cause it can leak the secret key not because it breaks the hash. this is SO unserious

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

also they keep getting Merkle-Damgård wrong in the text layer it's decomposed into like `a or some shit. lliterally could not be exerting less effort

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

wow i'm reading the maurer indifferentiability paper again and i cannot fucking believe this ever sounded good to me

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

Together with its derived notion of reducibility (Section 5), it will allow for exactly the same general statements about the security of cryptosystems as the conventional definitions.

this line is the killer. the incredibly vapid and confusing proofs that reduce to a confusing-but-standard framework? they are absolutely not fucking necessary. they're actively obfuscatory

general statements about the security of cryptosystems

you literally cannot do this. it is not something you can achieve

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

i really do wonder if several of the papers i've read today were composed with the authors like cackling over their incredibly mean-spirited april fool's day joke except people think this is real and they are gonna die

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

For each of these constructions they provide theorems stating that if the compression function is constructed using an ideal component, i.e., a finite input length (FIL) random oracle or an ideal block cipher (used as Davies-Meyer compression function), the hash function behaves as a random oracle [3] with output truncated to a fixed length.

literally "if it's ideal, then it would be literally random"

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

i can't fucking believe "random oracle" literally fucking means "totally random bitstream xD"

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

i'm gonna hate read the bellare random oracle paper that's ridiculous

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

wikipedia is blocking me from reading the page on random oracles

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

We argue that the random oracle model —where all parties have access to a public random oracle— provides a bridge between cryptographic theory and cryptographic practice.

bellare and rogaway are such absolute fuckboys

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

i liked a presentation rogaway gave to NIST a few years back and someone who i know is absolutely not a fed said he was a good guy so i guess i will have to tell them that is wrong

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

idk why they let me see those papers from the 1980s explaining how to use DH to do everything

d@nny disc@

@hipsterelectron@circumstances.run 57 min. ago

Unfortunately, theoretical work often seems to gain provable security only at the cost of efficiency.

how are you being anti-intellectual while being cryptographic academics

This is due in part to the following. Theorists view certain primitives (e.g., one-way functions) as “basic”

one-way functions are bullshit, that's what merkle said about fucking DES. it's NP-completeness or go home

and build more powerful primitives (e.g., pseudorandom functions) out of them in inefficient ways;

i don't even know what a pseudorandom function is but i bet it sucks. also "inefficient"????? maybe yeah if you mean the BLAKE3 reference implementation

but in practice, powerful primitives are readily available and the so-called basic ones seem to be no easier to implement.

literally indistinguishable from LLM boosters

d@nny disc@

@hipsterelectron@circumstances.run 56 min. ago

In fact theorists deny themselves the capabilities of practical primitives which satisfy not only the strongest kinds of assumptions they like to make, but even have strengths which have not been defined or formalized.

this is a crazy fucking thing to say. everyone in this field is first against the wall

d.rift

@d_rift@beige.party 37 min. ago

@hipsterelectron very glad I wasn't drinking something right then 😂

d@nny disc@

@hipsterelectron@circumstances.run 35 min. ago

@d_rift IT'S SO BAD

d@nny disc@

@hipsterelectron@circumstances.run 32 min. ago

@d_rift idk if you saw but i also found that lattices and ECC are quite literally both two parts of the same method to crack finite-field diffie-hellman from lenstra in 1982-1985. so the reason we're all dealing with these waves of bullshit is because:

yes, it is literally supposed to be obfuscated if you are looking for protection from it and not trying to fuck everyone over
it's really great if they can make it seem like elliptic curves and lattices are not just flatly obviously ways to break diffie-hellman over a finite field

d.rift

@d_rift@beige.party 14 min. ago

@hipsterelectron 🤨 oh dear... I can see I have some catching up to do. (Not least I read a lot slower. And, uh, had mentally cache swapped out all of mathematics after the last few years.)