Viewing profile — kwantam

The whole point of this article is that performant Wireguard-over-TCP support in Wireguard simply does not work. You're not fighting the prevalence of an idea, you're fighting an i…

One of the fun things about the median-of-medians algorithm is its completely star-studded author list. Manuel Blum - Turing award winner in 1995 Robert Floyd - Turing award winner…

Great stuff dga :) Turns out, Niall was also involved in one of the winning ZPrize submissions for fast multi-scalar multiplication (closely related to batch modexp, although over …

Maybe we're looking at different things, but the link appears to discuss ElGamal encryption, which is discrete log based (which means modern implementations use elliptic curves; hi…

Excellent points all around, and thank you for the pointer to the ECC slides :) (And indeed, nature could have been kinder to us and given us a Mersenne between 127 and 521...)

EdDSA signatures are specified to use deterministic nonce generation, so you're correct that they do not require randomness. But they certainly do require modular arithmetic in ord…

RFC6979 attempts to guarantee that the nonce is unbiased (under the assumption that HMAC's output is indistinguishable from random). It's definitely attempting to give a stronger p…

The nonce is taken modulo the order of the prime-order subgroup. For DSA that's generally a 256ish-bit prime (e.g.: choose a 1024-bit prime p such that a 256-bit prime q divides p-…

This vulnerability has very little to do with P-521 per se. The issue is with ECDSA: any use of ECDSA with biased nonce generation, regardless of the elliptic curve it's implemente…

I'm sorry to say that your analysis is wildly incorrect. - 10 billion people =~ 2^33 - 1000 CPUs =~ 2^10 - 1024 cores =~ 2^10 - 10 GHz =~ 2^33 So: one second's computation by all o…

The example you give is similar to but not quite the same as "lzAES". The distinction is that in your example, the application is deciding whether to compress or not---the input/ou…

Yes, a correct encryption algorithm can encrypt (essentially) any bit string. But it's quite easy to turn a correct encryption algorithm into an incorrect one by bolting on somethi…

Came here to reminisce about the same trick :) After a while we decided that adding one second per login was too subtle... echo "echo sleep 1 >> ~/.login" >> ~/.login

The paper, which is linked from the article, demonstrates a browser "fingerprinting" attack, which is to say, stealing pixels from one iframe using another iframe (which is quite c…

I completely understand your position, and I'm certainly sympathetic that it's often hard to find good instructional materials. I'll readily admit, however, that I do not know Cheg…

Yes, dc/dc conversion is definitely applicable in high-power applications. As one example, high-voltage DC power transmission [1] is in widespread use globally, and always requires…

Well, for one, UDP brings the U. It's called the User Datagram Protocol because (at least on UNIX-like systems) unprivileged programs can almost always send and receive UDP datagra…

Is this a good time to bring up T/TCP? https://www.rfc-editor.org/rfc/rfc1644 This memo specifies T/TCP, an experimental TCP extension for efficient transaction-oriented (request/r…

Do you have a source for this? I'd really love to read more about it. My impression from Ray's congressional testimony was "FTX.us might be solvent, but we don't know yet because t…

This is definitely very cool! But the circuit topology here can't meaningfully be called a discrete implementation of an LM386, unless by LM386 we just mean "a two-stage op-amp cap…

Very nice! It turns out that latexmk has this functionality: latexmk -pvc -pdf foo.tex (It can be configured to HUP your pdf reader if needed, too.) I usually add something like th…

Sounds like a great improvement! Would it be possible to contribute your code to the existing crate rather than release your own? Then we could all enjoy the benefits on the next r…

"Pick a random odd number and keep adding 2 until you find a prime" is, perhaps unintuitively, essentially fine for RSA key generation---under mild conditions, the security loss is…