« first day (661 days earlier)      last day (4209 days later) » 

1:04 AM
@ScottPack oo looks yumm. could be kosher, too.
cant speak to the parsnip - seems to be the type of thing your mother always tries to get you to eat when you're a kid, but you refuse to - but the rest sounds great.
 
I really like parsnip. It's what I think a carrot should be.
More earthy tasting, slightly spicy.
Well, more sharp. Spicy like how garlic is spicy.
 
hmm. not like a radish, or a turnip?
according to wiki, they do sound delish.
 
Less strong
 
interesting, the reverse-translation of parsnip in hebrew, is "white carrot".
 
Which makes sense.
 
1:12 AM
I think I may have had notpotato chips made from them. If so, it was indeed fantastic.
 
My favorite fall food item is probably roasted parsnips.
Slice em up, little bit of oil, light sprinkle of salt, bake for a while. Yummo
 
Looking at some of the tag cleanup threads... some good work there, still a lot left to do...
@Iszi wrt the wireless tag - there are still 2 questions, re wireless keyboard/mouse - are these not typically bluetooth?
some of the others, like the satellite, will just need to stay generically "wireless" :)
 
What would be the Latin for wireless? Is there a commonly accepted form?
 
Duuuuuude.
 
Eh?
 
1:42 AM
I think superuser hates me.
0
Q: Getting canon printers to work with Arch Linux

Terry ChiaI am trying to setup a canon MF4412 printer on my Arch Linux desktop. I followed the official guide in setting up a CUPS server/client as well as installing the cndrvcups-lb driver package. However, my CUPS server is still unable to detect the printer. My best guess is there is a problem with ...

Anyone knows a solution for this? Or should i just install another distro?
 
 
5 hours later…
6:25 AM
hey guys - has anyone been messaged with regards to the IT Security Anniversary Competition? Thanks.
 
 
4 hours later…
10:18 AM
@RoryAlsop hello! What's happened to the blog login? Looks like I can't get in via my old account any more :(
It wants me to log in via SE these days, but then I'm ninefingers-2 and not my old self.
 
10:42 AM
In bear terms, this is how I felt:
Oh also @AviD how did your friend get on with his procmon type thing? I'm pretty certain I could take on such a challenge these days :) Feel free to use my email if you can't tell me about it here. I never did finish writing my procmon rebuild, but I did make some extensive modifications to a driver at work to get around UAC :)
 
@Ninefingers huh?
ahh, right. they hired a couple of guys, went and got themselves a big investment (just closed due diligence last week), and they are all going to become disgustingly riche.
cool about the UAC driver thing, though :)
 
@AviD phew, glad you remembered cause searching the transcripts wasn't working :(
@AviD yeah, well, it was also somewhat undocumented and painful. I'm good friends with windbg now.
 
@Ninefingers heh. does make feel kinda like that bear, though - I coulda / shoulda / woulda joined em, and made my mint too.
 
@AviD That's life, and they might not become disgustingly riche. Idea's gotta fly first!
 
@Ninefingers heh. that's a friendship in blood. And, one that does not last long, if you do not upkeep the relationship.
I've forgotten so much about it, it makes me sad.
@Ninefingers oh, it is. They turned down some sick buyout offers, have some serious interest from potential clients, startup life, se la vie
 
10:54 AM
@AviD Oh. Ok. Well, all you need to do is come up with a similarly awesome idea.
@AviD out of interest, what do you think of Bromium?
 
@Ninefingers actually, that's not strictly true. just ask the guys (and gals) over at OnStartups.
In fact, I do have the awesomer idea, just not able to do the biznessy part of getting it off the ground.
not yet, anyway. its a work in progress.... I hope.
@Ninefingers thought I'd heard of it, but I thought it was a takeoff on google chromium. I think I was wrong, but I'm having a hard time figuring out what exactly that is...
 
@Ninefingers looks like a buttload of marketing crap to my amateur eyes.
 
@TerryChia thats what I was having trouble sifting through.
 
@AviD looks like a VM product from the technology page.
 
my best guess right now, is it IS a layer on top of chromium, with very strict process permission controls, and management for it. E.g. Chrome on Windows 7 with UAC (Integrity Levels) with a bit of user experience thrown in.
but I could be wrong.
@TerryChia no, they're very careful not to use that exact term, so they cant be pinned down to something specific.
first tip off on marketingspeak.
 
11:05 AM
@AviD did they mention chromium anywhere on the website?
or are you basing that off the name?
 
not explicitly, not by name. no.
partly the name, partly the screenshots of wireframe browser windows, and partly some of the micro-terminology they are dancing around not using.
 
they have a good web designer. the layout is one of the least annoying ones i have seen on sites selling technical products.
very clean.
 
11:23 AM
I'm so hung over ._.`
 
@TerryChia "good" web designer. Perhaps. and a "good" crap marketer, too.
A good web designer would point out that the whole site is designed to obscure the content of what the hell this product really is, and what it does.
on the other hand, it could be one of those stock content placeholders, that the designer put in waiting for some real content.
 
> the whole site is designed to obscure the content of what the hell this product really is
That describes pretty many enterprisy websites
 
Damn, i give up trying to get this freaking canon driver to play nice with arch linux.
Is fedora lightweight enough to use on a 7-8 year old machine?
 
@AviD I'm not sure what to make of it. On the one hand, the website is totally free of specifics as we've observed. On the other, the guys behind it wrote Xen.
 
11:50 AM
Why is keccak more different from SHA-2 than other SHA-3 candidates? Does this claim refer to the sponge construction, or properties of the compression function?
 
12:12 PM
@ninefingers I'm not 100% sure on how that login works on the blog any more. It does use the openid authentication, but not sure what happens at the back end. Is it breaking your login completely?
 
12:43 PM
@Ninefingers "wrote" or "sold"?
 
@Ninefingers After the Great BlogOverflow Breach of 2012 they moved the authentication from local to SEI's oauth backend.
 
1:33 PM
@CodesInChaos Keccak does not use additions over 32-bit or 64-bit words. In the MD5 / SHA-* designs, the additions are a major source of non-linear propagation of bit differences
"Non-linear" if you analyze things in GF(2)^x, of course.
The mix of bit-level operations and word-level operations is what the SHA-* feed on; and Keccak does not do that.
That's how I see it, at least.
Most of the work on MD/SHA collisions is about following differential paths, dancing around the carry propagation in additions. By nature, such things do not apply to Keccak.
 
It sounded like some people were referring to the sponge when they made that claim, but I'm not sure if those misunderstood what NIST meant.
 
@CodesInChaos The sponge is a bit over-hyped.
Many of the candidates were sponge-like
 
My impression is that the sponge is virtually identical to MD style hashing with custom finalization when using unkeyed hashing.
 
@CodesInChaos The sponge requires a wider internal path. With MD5, you have a 128-bit internal state for 128-bit output.
For a true sponge, you must have an internal state bigger than the output.
Anyway
 
The "Doesn't rely on additions for non linearity" explanation certainly sound more convincing than the "sponge is so different" explanation
 
1:43 PM
I predict that in the mid-term future, Skein will be more widely used than Keccak, because there will be some half-informed maverick who will imagine that fitting it in some p2p protocol or OpenBSD login will be a nice political gesture ("we sneer at your government-approved function !").
 
Well the software performance and integrated tree mode is certainly appealing
 
The software performance is overrated, also. Skein sucks on architectures where there are actual performance issues.
I mean, just yesterday, someone was emailing me because he had to hash 8 petabytes of data and he wanted to "speed up SHA-1". But it turned out that his bottleneck was I/O, not SHA-1
 
Personally I like Blake best, since it's faster on lower end CPUs, but I guess I'll live with keccak
 
To outperform SHA-256 on a PC (or Keccak, for that matter), you need to read data at a higher bandwidth that what gigabit ethernet can provide.
It does not happen often.
 
with RAIDs or SSDs one might get into the region where CPU becomes significant
with normal harddisks or network it's rather hard
 
1:48 PM
It is more infiniband area, indeed.
However, on low-end 32-bit CPU (e.g. wireless routers), we already have systems where CPU is the bottleneck, and even SHA-1 is not fast enough.
That's the same kind of system where you would prefer dedicated stream ciphers over AES for encryption.
 
Blake256 seems to have decent performance there, so I hoped for it to win
 
BLAKE-xxx has roughly the same performance than SHA-xxx on the same systems.
With some boost on high-end x86 (exactly where it matters least).
It was a nice replacement for SHA-2 for performance: wherever SHA-2 runs, BLAKE would run equally well.
 
I was hoping for a nice SHA-2 replacement, NIST preferred something that complements SHA-2
 
@CodesInChaos I'm going to memorize that, and repeat it at my next dinner party. It will make me sound so intelligent.
4
 
NIST was initially looking for a SHA-2 replacement, but they shifted their goal at some point.
 
1:57 PM
The thing that annoys me most is that we still don't have standardized higher level operations, in particular personalization and tree-hashing
 
@AviD Well... ok, somewhere behind Xen, then.
 
@Ninefingers I dont know for a fact either way, really.
 
@AviD mmm. I'm only trying to get a sense of whether it will be something awesome, or something that just disappears quietly. I guess time will tell.
 
But I find myself being very dubious at any claims made by a marketing-driven startup. Did you ever notice how everybody at those shops were sooo integral to world development?
 
Still, I do wonder what with all these people writing security systems based on hypervisors whether I'll still be able to run my own VMs...
 
2:07 PM
this one was solely responsible for Oracles database engine, that one implemented the first real time messaging, this one invented a div within a span....
 
@Ninefingers With VMWare a VM can still run sub-VM because the hypervisors can nest
 
I should be nicer, being kinda/sorta a startup guy myself, but the marketing-driven startups (and they are easy to spot, usually) just rub me the wrong way.
 
But I don't know of any other VM vendor who supports that kind of thing
 
@ThomasPornin Don't they essentially have to emulate Intel VT to make that happen?
 
@ThomasPornin used to be with MS VirtualPC/VirtualServer, might be different now with hypervisor...
 
jrg
2:09 PM
I think virtualbox has the option to emulate Intel VT.
 
Ofc you could do qemu based emulation inside a vm... but that'd be slow.
 
@Ninefingers That would be one way to do it, but I think it would be quite expensive. In the VMWare case, the two hypervisors talk to each other and are aware of each other.
@Ninefingers Well yeah, I was talking about hypervisors which use AMD-V / Intel VT, and run 64-bit x86 code at native speed.
 
@ThomasPornin Intriguing.
@ThomasPornin Ahh yes, like this:
17
Q: How to run VMWare ESX or ESXi in a virtual machine?

MassimoCan VMWare ESX or ESXi be installed and used inside a virtual machine? It can be installed inside VMWare Workstation or Server, but then it doesn't work; the main symptoms are: It runs REALLY slowly. It lets you create VMs, but when powering up them it gives an error stating "You may not power...

That's great, because vmware is just one hypervisor and they can all co-operate nicely, but what if you have security-based hypervisor product called Squares (for example) and I want to run it on my Tao hypervisor and the two don't talk?
 
@Ninefingers Well, then, you're hosed.
 
See the thing is, I want a secure desktop and I want to be able to run VMs.
 
2:19 PM
That's a reasonable set of requirements, and it should be supported more widely. It requires hypervisors which nest. As VMWare shows, it is possible to do it efficiently.
 
@Ninefingers Buy an expensive dedicated bare metal hypervisor and ssh in ;)
I finally got my canon printer driver to work on lubuntu after an agonizing day trying to work it on arch linux...
 
@TerryChia If you want things to "just work" (or at least, to "just not work" in an irremediable way), buy a Mac.
Mac and OS X are great time-savers, which makes them worth their price.
 
@ThomasPornin Hmmm. Food for thought. Might investigate that.
 
@ThomasPornin I was trying to give a 7 year old computer new life by installing linux on it ;)
It is so bad that even Windows XP runs slow on it.
 
@TerryChia I've given up trying to work around some things that just don't work under Linux - these days I read before buying hardware and/or go without.
 
2:22 PM
@TerryChia Try NetBSD. An OS which can run on a toaster will be fast on just about anything.
What will kill your performance anyway is Web browsers.
 
@ThomasPornin No printer drivers, but it can make you breakfast? Excellent ;)
 
@Ninefingers Yeah, problem was that i already have the printer. Luckily the driver cooperated with me with lubuntu.
Any new hardware purchases will have to be linux compatible for sure.
 
@TerryChia I pretty much buy nvidia graphics cards solely for that reason. I brought an ATI one back when they were ATI and had a lot of pain getting it to work with Ubuntu, so gave up.
Nvidia + rpmfusion repositories = yum install kmod-nvidia
that's how easy it should be.
Or you could buy a mac
 
@Ninefingers is that the new name for Qubes?
 
@AviD I was trying not to refer to any specific product...!
 
2:25 PM
@Ninefingers ohhhh, oops, my bad :$
 
But yes, Qubes looks really clever, but I look at it and think wait, so how do I run virtualbox?
 
okaaay, so abotu a certain anonymous nameless desktop hypervisor product... anything new with that? Havent kept up in a while.
 
@Ninefingers Actually virtualbox can run in an hypervisored 64-bit OS, but only if the virtualbox guest is 32-bit
 
@AviD I think they released v 1.0. I've got some spare hard disks so I'm going to give it a shot some time.
 
@ThomasPornin interesting, I might try that too, for a creaky ol' home server I'm going to be setting up.
have any great quick tutorials?
@Ninefingers interesting, would love to hear how it goes!
 
2:29 PM
@AviD mmmm blog post mebbe? I have a toaster in the post, by which I mean esata/usb external hdd connector, so I can nuke some external hdds.
 
@Ninefingers ooo excellent. cc @RoryAlsop see above :)
 
@ThomasPornin Blerg. I still want my cake and I still want to be able to eat it.
 
@Ninefingers is it a good cake?
 
@Ninefingers you put your cake in the toaster...?
 
Look, what I do with cake in the privacy of my own home is my own business!
 
2:31 PM
@Ninefingers as long as its not pie. We all know what you do with pie in private.
 
If I want to put it in a toaster... well, one of them amendment things says I can!
 
@Ninefingers the cake committee might disagree
 
Anyway, how come cake isn't one of the tags of this room? Pretty sure cake is so awesome it deserves a little distinction from food?
 
and with that fine thought, I bid you good weekend.
@Ninefingers ah, that would fit into tag #3.
 
2:33 PM
@AviD Ah. Yes.
 
@AviD doesn't everything?
 
Alas, I too must venture outside into the strange beast that is sunlight. Have fun :)
 
@ThomasPornin oo thanks. I will probably bug you in a few weeks with eternal questions.
 
I know reading documentation is soooo medieval, and Steve Jobs (blessed may His name be) frowned on it, but sometimes it works.
You can train in a VM, if need be
 
@AviD Some are Bluetooth, but others use proprietary 2.4 GHz or 900 MHz protocols.
 
2:35 PM
Even a 32-bit VM on a 64-bit host, regardless of how toasted is @Ninefingers' cake
 
@ThomasPornin the real question is, how toasted is @Ninefingers, to want to shove his cake into virtualbox?
 
@AviD If he succeeds, then it would make an impressive video !
 
(in case that is an americanism, toasted is a euphamism for high. or, having had one too many "special brownies", if we're talking about cake....)
 
2:49 PM
It looks like this question is quite close to being closed for being "black hat" -ish, though nobody seems to have cared enough to comment as to why it's actually "off topic". Any suggestions?
1
Q: How to override port settings when connecting to a public wifi?

Pennf0lioI am connecting to a free public wifi, I want to connect or use other ports like FTP and SSH. What are the possibility to override it? In order to connect to the internet, They are requiring me to add their proxy on my HTTP and HTTPS settings, under network (Mac OSX). I've asked them why I can't...

 
@Iszi Doesn't seem that bad to me.
 
@TerryChia Some people might have objections to the fact that it seems the OP is trying to use a system in a manner which they are not authorized. While this is indeed frowned upon, the community (in Meta) has agreed that "black hat" alone is not a good close reason.
 
@TerryChia I do like using OSX as a desktop OS, but keep in mind that you're using their environment. If you're accustomed to the "do anything you want if you're willing to put in the effort" mindset you will be in for quite the culture shock.
 
@ScottPack Agreed. I gave up trying to work somethings on OS X.
 
@TerryChia As a pretty standard desktop, it works pretty dang nice. But yeah, if you take more than a step or two off the Jobsian Path you'll pretty quickly find the cliff face of the Abyss.
 
jrg
2:59 PM
I prefer platform consistency. What do you run on your servers? $OS? Oh, then go use $OS.desktop_variant.
But, back to that question: Seems on-topic, it is a little borderline, but I don't think it's close enough to close.
 
@jrg I think it is on-topic, if only to show that clear definitions matter.
I mean, what kind of security can enforcing HTTP-proxying be, if you still allow HTTPS ?
 
@jrg I used to feel more strongly about that. The biggest advantage for me to run a compatible desktop OS at work is that I can manage it the same way without much modification, that is managing a Fedora desktop using a puppet tree designed for RHEL requires very few changes.
@jrg These days...do I have ssh available using a reasonable interface? Doesn't so much matter then.
 
I make typing mistakes this morning. I am not in good conditions to do proper chat/answering. I should get back to designing cryptographic algorithms.
4
 
3:43 PM
@ThomasPornin Where psuedo-random typos appear to be intended behavior?
 
 
4 hours later…
7:59 PM
Do we have a canonical thread discussing the (lack of) merits of on-screen keyboards to combat keyloggers?
 
1
Q: How does duqu delete itself?

Gajet GajettI'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?

 
There's an odd looking ('to me') edit on this Burp Q. security.stackexchange.com/posts/2264/revisions
looks like three changes were made that didn't change anything and the narrative is '555-555-0199@example.com'
 
8:17 PM
An anonymous user replaced ' by ' in the markdown source
and @ThomasPornin inexplicably approved it
What is it with abbreviations in tags here?
 
ahh, looks to me like an automated scanner then ( that narrative field is the same as the number that burp scanner auto inputs into some forms)
 
@RoryAlsop please synonymize to
@Iszi it's looking for a practical method to bypass a firewall. It's more a matter of functionality than security
I gave the last OT vote and flagged for migration
-3
Q: buy secure certificate for facebook apps and website?

Rev SuzI have http // domain_name (dot0 com Now, I want https://domain_name.com. I can buy from namecheap or RapidSSL. I also have created Facebook Apps on this domain. Facebook only supports https. My apps is hosted on the same server where domain_name (dot) com is hosted. Do I have to buy separate ...

I'm on the fence with this one
on-topic because it's about authenticating a web app? Or off-topic because it's about getting the right SSL certificate on a specific website, which would be better on Webapps (?)?
 
8:52 PM
I'm told: not Webapps, maybe Webmasters or SO
 
Have had to many beers so wanted to get second opinion. Offtopic?
 
@Gilles It looked harmless enough. Why not approve it ?
 
@RoryAlsop There are never enough beers to commit such a linguistic atrocity!
 
@ThomasPornin if it's harmless but doesn't make anything better: “too minor”
 
The spelunking mistake is autocomplete'a issue
As was that:)
 
8:54 PM
uh-oh, drunk!modding
 
Doing anything Sec.Se is always better whilst drinking.
 
Drunkmodding on a smart phone- beware! Hence me wanting to check that post- I reckon SU would be a better place
 
@RoryAlsop the firewall piercing one?
I'd go for Apple, or failing that U&L
 
@RoryAlsop I'm not sure there is a "best" place for it, which I suppose unfortunately means SU.
 
@Gilles That one appears to be already gone (to U&L)
@Gilles I don't like to instill the bitter feeling of rejection on hopeful users who took the effort of suggesting an edit, only to get denied at the last instant by what they feel to be the disdain of a pompous stranger. It is much more exquisite to make fun of them in public, with snarky comments and exuberant pedantry.
 
9:11 PM
@ThomasPornin yeah, but put your snark in a rejection comment as well
useless edits bump the thread, make the post closer to CW, and muddy the history
 
@ThomasPornin Useless use of pedantry.
 
9:27 PM
grrr
there's something seriously wrong with this version of Chrome
it's doing something with the X server that keeps both the Chrome overseer process and the X server at ~15% CPU each
and the whole GUI is really sluggish as a result
I wish there was a stable version of Chrome
instead of a choice between fresh-off-git, daily build and alpha release
 
@Gilles On Windows / MacOS X, Chrome has yet another version, which is "infinite".
Since it is automatically updated, often without you noticing.
 
@ThomasPornin same thing everywhere, but there are three “infinite” versions, depending on how much delay there is in propagating updates
I use the google-chrome-stable package, but it keeps updating anyway
I use the package from Google. I could use the Debian package, but then “it's not the latest version, we don't support it”
I should try a recent Firefox, see if its JS engine has improved enough for SE
 
Last time I used FF with SE the new /review page obliterated it.
 
@ScottPack I am using Firefox right now with SE, and it works.
I cannot use Chrome, there is no Chrome for PowerPC systems.
 
@ThomasPornin Doesn't spool the CPU up to 75% until you kill the tab?
 
9:41 PM
Not that I have noticed -- and, on this machine, I do notice CPU hogs.
I also use Firefox on my access-from-work system: a WinXP VM running on a 2 GHz VIA C7 CPU (again, something where CPU consumption is easily noticed)
 
10:26 PM
Remove: google-chrome-stable:i386 (22.0.1229.79-r158531)
Install: google-chrome-beta:i386 (23.0.1271.17-r159779)
that seems to have fixed it
all browsers suck, w3m just sucks less
 
Luc
11:25 PM
@ThomasPornin I was reading back the SHA-3 discussion, and @ThomasPornin mentioned that the NIST was originally looking for a SHA-2 replacement but shifted their goal to a complement for SHA-2. I was wondering why this is, because I'm sure everybody will assume SHA-3 to be an improved version. I can already see the forums full of "Why would you still use SHA-2 when there is SHA-3!"... (PS. This is my first message on a stackexchange chat, hope I got the syntax right)
 
@Luc Your syntax looks good.
NIST officially says this:
> The only ordering implied in sha2 vs sha3 is when they were designed; we explicitly are *not* telling people they should move from sha2 to sha3. The two standards will coexist.
(now that's my syntax which does not work...)
Anyway, people will assume many things, as is customary with people.
 
Luc
hm well I hadn't expected it to start with @yourname, thought it would only provide a this-is-a-reply icon, now it reads weird. Oh well, you get the message ^^
 
@Luc That's the normal way of linking a message to a previous message. You get used to it after a while.
A few days ago, I was reading a message somewhere of someone lamenting that one VMWare product offered "only" AES-128 encryption, whereas another could do AES-256.
Similarly, many people will insistently demand SHA-3, which is "obviously" better than SHA-2.
This is kind of unavoidable.
 
Luc
Yeah, that's why. I guess we'll just have to keep linking to NIST's statement about it being complementary
 
As for reasons for using SHA-2 instead of SHA-3, well, there is a big glaring one known as performance. Especially on small 32-bit CPU, Keccak is substantially slower than SHA-256 (like, twice slower).
 
Luc
11:33 PM
hmm where did you get that quote from by the way? "The only ordering implied in sha2 vs sha3 [...]" Then I can link to it when anyone argues :P
hm I have an edit icon whereas you don't in previous messages, I did see something being appended.. Will this get appended? test
ah yeah that's it, new messages just get appended ^^
 
@Luc It is from an email from John M. Kelsey, aka "john.kelsey@nist.gov". The email was sent to the hash-forum mailing-list (the mailing-list NIST maintains as part of the SHA-3 competition). I don't think it is publicly available.
I mean, it cannot be considered secret in any way, but it is not within reach of Google's bots.
 
Luc
Oh okay
That explains why Google didn't come up with anything for it, thought it might be in pdf
 
@Thomas Are there any classes of standard commercial compruters on which SHA-3 would be faster?
 
Luc
Lol here we go already, wikipedia mentions "to replace the older sha1 and sha2"
 
@ScottPack The x86 processors with SSE2 registers ought to run Keccak faster than SHA-256 and SHA-512 (but these are already at more than 150 MB/s, so that's a bit moot).
 
11:40 PM
So in theory anything that's about what P2 and newer would be gaster, but we're really already I/O bound?
 
@ScottPack Let's say it take some effort not to be I/O bound, at these speeds. You might get up to 300 MB/s with a good SSD, but mechanical harddisks will be at 100 MB/s or less.
It also takes some effort to find a scenario where such speed is relevant. Normally, when you read data, it is to do something with that data; the "something" could easily be the bottleneck (and usually is).
 
@Gilles scratch that, it was fine for a few minutes, and then it started again
 
Also, when doing encryption and a MAC, the authenticated modes (like EAX or GCM) are usually a better idea than plain encryption + HMAC.
 
@Thomas Sometimes that thing is validating, or computing, the hash at which point you want it done fast. How frequent that's the case I'm not sure.
 
@ScottPack smartcards (with a tailored hardware instruction), I think
 
11:54 PM
@Gilles Well, that's not (yet) a "standard commercial computer", then.
 
@Gilles Do smartcards actually do any processing onboard? I assumes they were just storage.
 
@ScottPack Oh yes they do. Some embed even 32-bit CPU (ARM cores or similar)
Base frequency is 3.57 MHz, but it can be enhanced. I use 50 MHz smartcards at work.
 
Cute.
 
@ScottPack um, yes, that's why they're called smart cards
 
The really limited thing in smartcards is RAM. You can have up to about 8 kB at most (but easily 128 kB of ROM).
 
11:57 PM
@Gilles I've learned that attaching "smart" to the name doesn't actually say anything about the intelligence of the product.
 
Luc
Can smartcards run asymmetric encryption algorithms?
 
@Luc sure
 
Luc
That's the only way I can imagine bank cards being secure (the previous magnetic chips we used could simply be copied...)
 
it's slow, but they do
 
@Luc Yes. Many smartcards have accelerators for RSA, and can do RSA-2048 signature generation (or decryption) in 100 ms or so.
Older smartcards did symmetric encryption (actually a kind of MAC)
 
Luc
11:59 PM
That might explain why with a chip is so much slower than the previous magnetic strips (we used them until a few months ago)
 
that's what they have done for two decades in France (the payment / credit cards that just everybody has)
 

« first day (661 days earlier)      last day (4209 days later) »