Viewing profile — sdevlin

> We talked English professors through the "number-theoretic" attacks on RSA in cryptopals set 6. The English professor finished set 8 as well!

> Using "one-time-use combinations of three English words" is "fine" only if your definition of "fine" includes allowing someone with a minimal budget to find out the password in l…

Emacs Lisp is most certainly not a Scheme.

Probably `M-x eww`.

They're not reading data out of the cache line. Often the contents of the cache are public anyway. What they're detecting is whether a piece of memory is in the cache or not. This …

These are great details, but they don't really answer my question.

You do have the choice. You don't need session tickets at all to run TLS. The cost of geographically-distinct STEKs would simply be an additional handshake if the client hops regio…

So it would be correct to say that if any of Cloud Flare's endpoint servers is compromised, the adversary can decrypt traffic passively on a global scale?

What is Cloud Flare's policy for managing STEKs? Are they distinct per geographic region as the article recommends?

I guess it depends what you mean by “crack”. Given f(1), which I assume is public, you can predict all future outputs.

It's impossible to bootstrap a secure connection without some preexisting trusted relationship. Otherwise, you'd always be vulnerable to middle-person attacks. Browsers solve this …

It's true that the space of valid RSA keys is sparse relative to size, but this isn't why we need big keys. As a counterexample, classic DH keys are also big (or they can be), even…

> More specifically, because of the RSA dependency on prime numbers, the RSA effective key space is very sparse (which is why going from 2048-bit RSA to 4096-bit RSA only increases…

Just read his blog.

ESR is a racist and a misogynist. And that document might as well be called "how to be ESR".

You were the first to finish set 7. I assume most people don't know, so: Filippo was one of our earliest adopters of cryptopals. He is a monster. He demolished everything we put in…

Our goal was to be accessible. If we were unsuccessful, we're happy to help fill the gaps. My email is spd@toadstyle.org.

I'm an author. My personal mail is spd@toadstyle.org. I'm happy to help you get unblocked.

Quick plug: set 8 is out. It's all about attacks on elliptic curves and GCM. This set is huge. There's as much content as in any two or three other sets. This set is tough. It's ea…

You are talking about quantum attacks, whereas tptacek is talking about classical attacks.

I don't think their bound is related to nonce-management issues. From the documentation: > The GCM security limit is 2^56 bytes because: > This is 2^52 AES blocks (each block is 16…

Where are you getting that number?

I think the free version of Burp Suite will handle all of this for you.

Not specifying the group/generator is a weak link, which is what David is taking advantage of. Curve25519 is a good counterexample of a DH function that leaves nothing to the imagi…

Yes, the posited attacker is an unprivileged spy process sharing a cache with the victim. The FLUSH+RELOAD cache-timing algorithm they use relies on a shared cache. See section 2.2…