Post by @hipsterelectron@circumstances.run

@hipsterelectron@circumstances.run 5 hr. ago

so i fouind this website from a guy who is way way way too fanatic about david hilbert and gauss. and he phrased gauss's "golden theorem" of quadratic residues a bit differently than others: https://archive.lib.msu.edu/crcmath/math/math/q/q044.htm

If p and q are distinct odd primes, then the congruence:
x^2 = q (mod p)
x^2 = p (mod q)
are both solvable or both unsolvable unless both p and q leave the remainder 3 when divided by 4 (in which case one of the congruences is solvable and the other is not).

103 Replies

0 Boosts

d@nny disc@

@hipsterelectron@circumstances.run 5 hr. ago

this is very directly translating the gauss theorem i literally think is just false into a method to attack diffie-hellman key exchange. and that's really weird!!

Quadratic reciprocity - Wikipedia

d@nny disc@

@hipsterelectron@circumstances.run 5 hr. ago

Privately, Gauss referred to it as the "golden theorem".[2] He published six proofs for it, and two more were found in his posthumous papers. There are now over 240 published proofs.[3]

usually this is not the kind of behavior i associate with a strong proof

d@nny disc@

@hipsterelectron@circumstances.run 5 hr. ago

Generalizing the reciprocity law to higher powers has been a leading problem in mathematics, and has been crucial to the development of much of the machinery of modern algebra, number theory, and algebraic geometry, culminating in Artin reciprocity, class field theory, and the Langlands program.

if that's true then all of mathematics is fucked too

d@nny disc@

@hipsterelectron@circumstances.run 5 hr. ago

i'm forking mathematics

d@nny disc@

@hipsterelectron@circumstances.run 5 hr. ago

Quadratic reciprocity arises from certain subtle factorization patterns involving perfect square numbers.

everyone just absolutely refuses to avoid extremely abstract language like "is solvable" when making statements about discrete logarithms

d@nny disc@

@hipsterelectron@circumstances.run 5 hr. ago

after seeing the archmedes debacle i also feel that a lot of stuff fermat supposedly said was stuff gauss just made up and attributed to him

d@nny disc@

@hipsterelectron@circumstances.run 5 hr. ago

i also just really don't understand the framing of fermat's last theorem.

The proposition was first stated as a theorem by Pierre de Fermat around 1637 in the margin of a copy of Arithmetica. Fermat added that he had a proof that was too large to fit in the margin.

this definitely sounds like something someone made up and wrote in themselves

d@nny disc@

@hipsterelectron@circumstances.run 5 hr. ago

it's just flatly wrong to assume the "generalization" of "pythagorean triples" is to start cubing shit. that's just the fucking euclidean norm dudes!!!! if you stopped circlejerking over integer solutions for one fucking second you'd see that higher dimensions mean adding a new vector component!!!!!

but failson gauss decided yeah what if more dimensions meant cubic equations

d@nny disc@

@hipsterelectron@circumstances.run 5 hr. ago

i found this very ridiculous page from NIST on modular forms https://dlmf.nist.gov/23.15#i linked from the wikipedia page on modular forms https://en.wikipedia.org/wiki/Modular_form

Modular form - Wikipedia

DLMF: §23.15 Definitions ‣ Modular Functions ‣ Chapter 23 Weierstrass Elliptic and Modular Functions

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

now THIS is a really high-quality example of evil graph theory (from 2006) https://doi.org/10.1090%2FS0273-0979-06-01126-8

Expander graphs and their applications

...but it ALSO shows that the matrix view of graphs is WILDLY insufficient to capture their mechanics!!!

Bulletin of the American Mathematical Societysearch

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

Let A be an n×n matrix over the ﬁeld1 F. What is the least number
of gates in a circuit that computes the linear transformation x → Ax? Each gate is speciﬁed by two ﬁeld elements a and b. Such a gate receives two inputs x and y and outputs ax + by.

i.e. given a single input-output pair, can wee infer the underlying structure of the system, in some hardware circuit to perform a linear transformation A?

1 This problem is interesting for ﬁnite as well as for inﬁnite ﬁelds.

i.e. "this can be used for finite-field modular exponentation"

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

i hate it when people hide or act coy about doing evil shit. just say it right up front and maybe i will read your paper

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

they glaze up the fast fourier transform too. don't know why these kinds of people flock to FFTs like a moth to a lightbulb but clearly it excites them somehow

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

The technological implications of a Very Fast Fourier Transform, i.e. an O(n)-sized circuit that computes the transform (should one exist), are hard to overestimate.

i used to be on this side until i realized math loves us and math is on the side of justice

On the other hand, it would be a great theoretical breakthrough to establish a matching lower bound of Ω(n log n), or even rule out the existence of such a circuit with only O(n) gates.

you got it. coming right up

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

ohhhhh they're citing more evil graph theory

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

WTF THEY HAD ASYMPTOTIC RUNTIME FOR NUMA FIGURED OUT IN 1976????????? https://www.sciencedirect.com/science/article/pii/S0022000076800414/pdf?md5=9ad19c31757657dd445a077a46192f59&pid=1-s2.0-S0022000076800414-main.pdf

As a vehicle for exhibiting the kinds of complexity results that these graph- theoretic properties do imply, we introduce a random access model of computation with a certain cost for communicating between different locations.

cc @astraleureka valiant is someone spinrad taught in class and they make this sound so easy too

ScienceDirectScienceDirect (PDF)

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

For algorithms on this model that assume consecutive locations for the inputs we can resolve the
asymptotic complexity of some well-known arithmetic problems.

HOW DO THEY MAKE THIS SOUND SO EASY LMAO

The arguments used can be alternatively interpreted as supplying superlinear lower bounds for algorithms that are based on certain recursive splitting techniques but are otherwise unrestricted.

AAAAAAA LIKE OF COURSE YOU CAN STILL MAKE SURE TO KEEP MOST OF YOUR LOGIC IN THE STANDARD TURING REGIME SO IT STILL APPLIES MORE GENERALLY

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

We give upper and lower bounds of order n log n for the problems of computing polynomial convolutions and discrete Fourier transforms.

ahhhhhhh after reading https://en.wikipedia.org/wiki/Convolution i finally realized why discrete FFT is interesting to evil graph theory people: it lets you identify cyclic subgroups of a finite field efficiently!

Convolution - Wikipedia

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

cc @mildsunrise [i am not calling you evil here] i understand a little more why you were so passionate about the FFT a few months ago. that was really interesting work btw

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

it's just a little funny to see the author of a textbook works for the israeli war department and then it's published by cambridge university press. like oh this is some of that classic british colonialism

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

so this is basically how i was going to actually encrypt my messages was something like this http://cs-www.cs.yale.edu/homes/spielman/PAPERS/expandersIT.pdf they're calling it "expander codes" though and trying to expanders for error correction which is neat but i'm not sure i buy the hypothesis (which they are being very forthright about not knowing for sure)

View (PDF)

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

error correcting codes and encryption sound like opposites, but they are very very very closely related. imagine a cryptographic checksum or message digest as kind of the opposite of an error correction code, because a checksum squishes bits into fewer bits and hides stuff rather than adding extra bits in plaintext

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

i am waiting for someone else to have come up with my extremely terrible awful encryption method before and nobody's done it

d@nny disc@

@hipsterelectron@circumstances.run 4 hr. ago

it's such a grossly simple way to do encryption and i also think it may just be Really Good. but you WILL hate it

sean watters

@swatters@mastodon.social 3 hr. ago

@hipsterelectron one-time pad with (carrier)P(igeon)KI.

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

@swatters one-time pad is actually a terrible system and it's quiite literally an op when people mention that as the only unbreakable cryptosystem, for two reasons:

nobody who ever pushes that framing of the one-time pad as "ultimate/perfect" security actually explains what that would mean if the message was intercepted for example
you can in fact achieve something very close to that level of security with a completely different approach. the one-time pad is in this local maximum

the main reason for this is that (in my view) message encryption securtiy is actually much more permuting bits across boundaries than replacing text

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

@swatters llike if you were doing alan turing stuff in ww2 you would be reading intercepted messages with some parts unveiled (so you could extrapolate the rest of the text--that's kind of like a "chosen-plaintext attack" in today's terms but it's a little different).

but substitution is a fundamentally weaker primitive. consider: substituting the same symbol twice (a => b, b => c) is equivalent to just doing one substitution (a => c) [this is some kind of mathematical group operation but idk which one lol]

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

@swatters WHEREAS, if you chunk your bits into HIGHLY IRREGULAR (cruptographically-secure pseudorandom) size chunks, then reorder those chunks, then do it again (resulting in the same message length at all times), you actually do get more security. like shufflling a deck of cards

sean watters

@swatters@mastodon.social 3 hr. ago

@hipsterelectron so the key is what? the order of operations, chunk sizes, and position changes? is it the same number of chunks every time? does the encryption produce the ciphertext and the decryption key at the same time?

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

@swatters the key stream comes from a modular exponentiation process (literally just diffie-hellmann) and should be both independent of the message data stream as well as offline (not created interactively)

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

@swatters each round begins with recursive branching that takes 1-2 bits per branch (so instead of splitting the message up exactly halfway in length, a little more or less, up to like 1/3-2/3 depending upon the bits).

recurse on this until reaching some basic chunk size

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

@swatters this is the part i'm not quite sure about yet, because i don't fully understand all the scenarios where i might want to modify the message length (which in all cases means extending it).

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

@swatters hm i don't actually think i want to do the "down to basic chunk size" part at all actually, that was a new idea. and i also remembered i wanted to just do a single big split and then flip (i.e. take the uneven halves and write the second half from the start of your buffere and then the first half. so you have not changed length but you have split at an arbnitrary boundary and your data is out of order now..

i think one of the CSPRNG bits for that initial split and flip should go to deciding which half you then hit with a NOT (i.e. flip all its bits).

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

@swatters i think instead of just only splitting into two pieces and recursive, i would probably using a bit more randomness and produce some sequence of consecutive bucket lengths to split the message with. and then i would generate a sequence from [0, #buckets ) and that's the order i would rewrite them into

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

@swatters you do many rounds of this until you've decided iit's enough and then record all the split/not/reorder decisions you made and that's the symmetric key you share with the recipient

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

@swatters thank you to @promovicz for convincing me to grudgingly add in a terrible little substitution round into my terrible little cipher

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

@swatters @promovicz YOU WOULD HATE IT SO MUCH I PROMISE!!!!

i was going to actually try implementing it today but i got distracted by evil graph theory whose game i was unfamiliar with

sean watters

@swatters@mastodon.social 3 hr. ago

@hipsterelectron but we're good on the pigeons though, right?

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

@swatters well the IETF did an april fool's about that once and i believe the IETF is managed and maintained by incredibly evil people. but i love pigeons so if there are pigeons to feed i'm so down

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

@swatters damn can't find it now but i thought it was very revealing when i saw this princeton privacy lab https://ece.princeton.edu/about/advisory-council just had a literal former head of the IETF on their staff

https://ece.princeton.edu/about/advisory-council

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

looking up ABNNR and AEL codes to find this truly impressive disclaimer statement in a paper

This work was not supported in part by Microsoft Research fellowship, NSF Grant CCF0514167, IAS/DIMACS post-doctoral fellowship.

.....not supported? i was vaguely confused until the next line:

A. Akavia is with the School of Mathematics, Institute of Advanced Study, Princeton NJ, USA akavia@ias.edu
R. Venkatesan is with Microsoft Research, Redmond WA, USA andBangalore India. venkie@microsoft.com

and i was like oh these are like cartoon villain characters. of course they'd love to put shit like that in the disclaimer about accepting money from the government to fund their own research

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

once i understood princeton university as a fundamentally evil force in the world everything made much more sense

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

Furthermore, we present an error reduction algorithm for these codes. That is, an algorithm that, given a codeword corrupted by adversarial noise flipping a constant fraction of its bits, outputs a message that agrees with the original message on at least (1 − ε)-fraction of its bits, for ε an arbitrarily small constant.

this is pretty thoughtfully designed!

(Here, following standard terminology, we refer to the non-binary code as the outer code and to the binary code concatenated with it as the inner code.)

yeah my message stream codes have pronouns get used to it

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

hey're using this term "binary linear code" and i think it just means "indefinite-length bit string" but the field of coding theory definitely gets my approval for being the first to actually care about representations of data across the system

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

ugh i really wanna apply to princeton to work on cryptography bc while i know they are possibly the most evil people on the planet, i also am confident that they will not be able to break my really simple and safe cryptosystems. and i feel they would let me do actually good mathematics because it would be good PR for them

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

i will admit though part of it is because i realilzed the flaw in godel's proof of incompleteness is that it's defined in the very limited logic of the integer system used by hilbert. and a system defined in a way without those restrictions could still prove a statement of its own self-consistency as well as completeness

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

god damn i forget princeton has such good PR https://ece.princeton.edu/people/david-wentzlaff this guy's students appear to be actually developing operating systems???? crazy

https://ece.princeton.edu/people/david-wentzlaff

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

i feel like a phd advisor from MIT would be terrible for my mental health though

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

https://www.princeton.edu/~wentzlaf/

Before joining Princeton, he completed his PhD and MS at MIT and was Lead Architect and Founder of Tilera Corporation, a multicore chip manufacturer now owned by Mellanox.

back when i was still configuring my own kernel build (earlier this year) mellanox was one of the vendors i specifically refused to enable support for

David Wentzlaff

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

chip manufacturing is cool though

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

this guy's page is funny https://ece.princeton.edu/news/sharad-malik-named-inaugural-member-acm-sigsoft-academy nobody else in the world has this opinion except me but i find the SAT/SMT framework to be fundamentally engineered for enclosure/monopoly/fascism (not suprising, it's princeton)

but answer set programming is cool as SHIT because it lets you write universal quantifier expressions and then lets the computer do the work for you instead of having a million weird failure modes!! https://potassco.sourceforge.net/book.html

Potassco - the Potsdam Answer Set Solving Collection

https://ece.princeton.edu/news/sharad-malik-named-inaugural-member-acm-sigsoft-academy

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

so yes i do have a favorite logic programming paradigm and logic programming can be active engineered to resist systems of enclosure and accumulation

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

everything is political and that's fucking awesome

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

god i forgot reading the princeton site is so funny https://ece.princeton.edu/news/mittal-receives-ip-accelerator-award-improve-network-security this guy straight up getting a huge grant to do more and worse surveillance

https://ece.princeton.edu/news/mittal-receives-ip-accelerator-award-improve-network-security

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

Mittal, professor of electrical and computer engineering, proposes building a novel network monitoring framework, Layer7, to detect and mitigate malicious attacks.

omg i totally forgot about my anonymity network for message routing idea i would love to stunt on everyone with that

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

i also find it kind of cosmically funny that they're awarding him from the intellectual property accelerator fund when he's literally doing absolutely nothing new at all. sure it could be patentable but the patent wouldn't be valuable

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

i just want to fight every single fuckboy in hand to hand combat until i emerge as the supreme fuckboy who mathematically guarantees my work can't be misused to hurt anyone because it explicitly avoids encoding systems of enclosure

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

like one basic issue with the concept of "public-key cryptography" is that someone can steal the private key (the same one you use to sign messages all the time) and then now what?

gkrnours

@gkrnours@mastodon.gamedev.place 2 hr. ago

@hipsterelectron that's why you put a strong password on the private key

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

@gkrnours that protects it at rest, not when it's being actively used. if you are going to be signing any messages with that key, you are necessarily putting it at risk of theft somehow. i think that part is actually unavoidable

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

@gkrnours for the case of static public key authentication (which i think is actually kind of archaic in 2026 and it also enables surveillancE), you can expand the model to include the entity who is hosting your public key for you (e.g. codeberg).

you can actually solve the problem of identity theft surprisingly easily: send an encrypted+signed message to the server hosting your public key which contains a public key from a keypair you've just generated for this purpose and haven't shared with anyone else. the server will return a randomly-generated integer or bit string to you. you now keep both that backup private key and server ID elsewhere, away from your aactive usage of the active private key.

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

@gkrnours then in case of loss or theft, you can send a new message to the same server, using the public key of that backup keypair to authenticate, and presenting the server-provided ID back to it.

in this imagining, the server maintains persistent asynchronous double ratchet chains for all its clients, so upon receiving the correctly-authenticated backup key, the server will destroy the previous double ratchet chain state and create a new one for you.

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

@gkrnours of course, @tryst just went way way above and beyond here and described a solution that explicitly incorporates a server-like intermediary, but does not require that the user produce a global or publicly-visible identity https://try.st.imu.li/projects/committing-to-obsolescence/

There are two roles in this system, the user and certification agents. In practice both are likely to be under the control of the same user, but the certification agent might be embedded in a hardware security module, or simply a different software module with distinct access control.

in fact, a server intermediary like this makes for a great bastion for lots of reasons. one of the guarantees the signal server has always had is that the worst an attacker who completely compromises the entire system can achieve with that is just a denial of service.

i genuinely believe my anonymity network approach is going to be able to go beyond even that guarantee, but that's mostly because the entire thing is architected to make trust a dynamic quantity and to genuinely understand what a global active adversary means and can do, which means not just "constant-bandwidth between intermediaries at all times", but ""make it a highly reliable and redundant store-and-forward system with a fixed datagram length and buiilt-in verification of packet progress through the nodes you specified to use". and some coding theory so there's never a single end-to-end to measure.

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

@gkrnours @tryst
i strongly suspect the anonymity network would be too future for pretty much any university, but i can focus on i/o perf and casting aspersions on centralized OS randomness just fine

d@nny disc@

@hipsterelectron@circumstances.run 1 hr. ago

@gkrnours @tryst actually looking to do good crypto and os dev at fucking princeton university would be the most anime thing ever

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

in fact this susceptibility is a core assumption of the model. but we can address some of the flaws with that by incorporating a client-server model for the parts that require coordination (like putting your public key in a public place)

one thing i failed to realize (i figured this out when chatting with @alina) is that there's an intentional built-in assumption with "public key" that you're going to tie your cryptographic security to a real-world identity. and that's obviously extremely dicey

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

but the thing about diffie-hellman key exchange is that it is basically the only "primitive" operation that actually actts like a "primitive", i.e. doesn't pull you into assumptions that don't make sense for your trust and thread model (and in fact, it can be used to craft a cryptosystem, because it's such an atomic and simple operation)

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

that's why i've been so wacked out the past few days because while i do not genuinely expect to solve P < NP just by hating on the failson gauss.....i DEFINITELY believe an extremely simple and auditable cryptographic library is not only possible but easy to make now!

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

and both my symmetric and asymmetric approaches (my fucked up uneven permutation mixer and then the standard prime field modular exponentiation) have the ability to scale up or down a "security level" that corresponds to # of iterations or # of bits

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

so for example i'm not stuck running a cryptographic checksum on my hash table because djb negged my programming language to use his bad and not even safe hash by default in cpython

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

it is actually really strange that AES only does a block at a time like that. just a very basic issue with the approach. stream ciphers aren't better. but i'm apparently the only person who has ever treated parsing like a real research problem so i happened upon an encryption scheme too

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

ok i DO wanna make a project on codeberg for the crypto library now that i know for sure everything i will need to do

d@nny disc@

@hipsterelectron@circumstances.run 3 hr. ago

oh wait fuck yes i had literally forgotten how i solved stable directory tree hash tree representation too

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

because you need a commutative hashing operation to represent checksummed directory entries.........i do YET ANOTHER diffie-hellman key exchange (modular exponentation) to achieve that one

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

i unfortunately have so many patentable ideas but patents are not made to protect actual scientists without institutional backing. they are made specifically to scare you into waiting for institutional backing to do things nobody has ever done before

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

see lol i'm reading the perturbed error correcting code paper and just https://people.csail.mit.edu/akavia/AV_PerturbationCodes.pdf

The perturbation operator, given a generating matrix R ∈ k×n {0, 1} of any binary linear code R, outputs a generating matrix P ert(R) of a new binary linear code P ert(R). The columns of the generating matrix P ert(R) are sums (modulo 2) r ⊕ of columns r of R and vectors from k low dimensional subspaces of {0, 1} .

it's RIDICULOUS to describe a stateful serial data flow (the earlier bits are literally being sent first!) with a matrix transform like the perturbations are completely independent.

maybe if your message is going to be stored in the persistent storage device on a satellite orbiting the sun this matrix assumption could make sense. but if you can't design a basic automaton (doesn't have to be a whole turing machine!!) for a stateful transformation and you're name dropping fucking adi shamir???? then yes i absolutely do think less of you and for work for that!

We think of the sums r ⊕ as a perturbation of the column r by. Specifically, the columns of P ert(R) are all sums r ⊕ for r ∈ Ri , ∈ Li, i = 1, . . . , Θ(n) for Ri and Li chosen as follows.

oh jesus FUCKING christ they're not even like.......using that matrix to simulate perturbation on the message at all. the matrix is apparently a representation for an expander graph of some kind??

and a uniformly random r ∈ Ri,

or maybe not at all, maybe they're just a statistician and they don't a god damn clue what they're doing

View (PDF)

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

can't fucking believe the evil graph theory guys are keeping their block lengths constant at all times https://cs.uwaterloo.ca/~elena-g/CS860-FT25/lec14.pdf

View (PDF)

d@nny disc@

@hipsterelectron@circumstances.run 2 hr. ago

the one thing i absolutely do need to do though is to incorporate some way of mixing bit information across bits (in an invertible way)s because even a 1-bit block size is still a block size