Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Rune Programming Language

github.com

Post reply on HN
Print view View original

11–20 of 203 posts

Re: The Rune Programming Language

#11

Post by throwawaybutwhy »

threatofrain wrote: post #4
sideeffffect wrote: post #3

Earlier quoted context omitted.

Are there any officially supported Google products under github.com/google ?

Even if there aren't, it makes sense to clarify to media that this is an open source project made without any business commitments. I've seen other businesses do something similar; internally it reduces friction with the business admin when devs want to open source something.

_without any business commitments_ - not to sound trite, but when is the last time Google stood by its commitments?

Re: The Rune Programming Language

#13

Post by WhiteBlueSkies »

Can someone explain how this works:

"Assume the attacker can tell how long it takes for mac == computedMac to run. If the first byte of an attacker-chosen mac is wrong for the attacker-chosen message, the loop terminates after just one comparison. With 256 attempts, the attacker can find the first byte of the expected MAC for the attacker-controlled message. Repeating this process, the attacker can forge an entire MAC."

How precisely should an attacker guess how long the comparison runs?

Re: The Rune Programming Language

#15

Post by JohnBooty »

WhiteBlueSkies wrote: post #13

Can someone explain how this works: "Assume the attacker can tell how long it takes for mac == computedMac to run. If the first byte of an attacker-chosen mac is wrong for the attacker-chosen message, the loop terminates after just one comparison. With 256 attempts, the attacker can find the first byte of the expected MAC for the attacker-controlled message. Repeating this process, the attacker can forge an entire MA…

They wouldn't be guessing, they'd be measuring. I'm not qualified to really explain more but if you want to learn more, "timing attack" is what you're looking for

https://en.wikipedia.org/wiki/Timing_attack

Re: The Rune Programming Language

#16

Post by lgeorget »

WhiteBlueSkies wrote: post #13

Can someone explain how this works: "Assume the attacker can tell how long it takes for mac == computedMac to run. If the first byte of an attacker-chosen mac is wrong for the attacker-chosen message, the loop terminates after just one comparison. With 256 attempts, the attacker can find the first byte of the expected MAC for the attacker-controlled message. Repeating this process, the attacker can forge an entire MA…

By how fast the function returns.

This is white-box security, a hypothetical setting where we assume the attacker has access to the entire knowledge of the system and to every oracle they want (like an oracle telling them how much time each function takes), but don't know any secret, like private or symmetrical keys. If you can prove that your function is secure in that setting, then it's secure in real-case situations where the attacker knows even less.

Re: The Rune Programming Language

#17

Post by nine_k »

Pretty interesting: imperative programming meets relational DB models meets column store, with a serving of constant-time operations on top for data marked as secret.

Also, memory-safe and blazingly fast in certain circumstances. Not complete though, some tests currently fail.

Re: The Rune Programming Language

#18

Post by [deleted] »

WhiteBlueSkies wrote: post #13

Can someone explain how this works: "Assume the attacker can tell how long it takes for mac == computedMac to run. If the first byte of an attacker-chosen mac is wrong for the attacker-chosen message, the loop terminates after just one comparison. With 256 attempts, the attacker can find the first byte of the expected MAC for the attacker-controlled message. Repeating this process, the attacker can forge an entire MA…

[deleted]

Re: The Rune Programming Language

#20

Post by csande17 »

IshKebab wrote: post #5
simonebrunozzi wrote: post #2

> This is not an officially supported Google product. Then why is it under github.com/google ?

The code is owned by Google because it was written by a Google employee on the job.

Or off the job -- Google claims ownership either way. https://news.ycombinator.com/item?id=1969979
Post reply on HN