The DMZ

David Freitag

15:01

In other news, there is lots of construction happening at my apartment building, and I haven't lost a wink of sleep due to it.

Ohnana

@simon yeah i saw her. obvious user name

Simon

ohnuhnuh

@Ohnana Hahaha.

Ohnana

-10 pts

Simon

:(

Will

Does anyone know what (real world) problem TLS renegotiation actually solves?

Simon

15:02

wtf, she even posted an answer on English.SE

David Freitag

@Will You might want to ping @ThomasPornin, he's the resident expert.

Simon

10 hours ago?

Rоry McCune

@Simon well at least that proves it's not one of your sock-puppets !

Simon

@RоryMcCune plssssssss

I was sleeping when she posted that @@@

wat a donut

AviD

@Simon she's on a roll!

before you know it, she'll have more rep here than you do.

Rоry McCune

15:04

@Simon better be careful, before you know it she'll be a mod, and come in here and kick you

AviD

I guess, association bonus would be enough

Simon

@AviD Definitely.

@AviD pls

@RоryMcCune My donut wouldn't do thaaaat.

Ohnana

i really wanna be a sex.se power user

AviD

@Simon that's sweet, but dont call me your donut. And I would.

Rоry McCune

@Simon yeah it'll be like "you were meant to do the dishes" <kick>

Simon

15:05

@RоryMcCune That's actually a plausible discussion.

Thomas Pornin

@Will IIS uses renegotiation to ask for a client certificate, but only for some specific directories / services within a server.

IIS cannot know the URL path before receiving the full HTTP request, so it first makes a handshake without asking for a client certificate, and does a renegotiation if it finds out that this particular request actually needed a client certificate (as per the server configuration).

David Freitag

See, I knew that would work.

Will

@DavidFreitag @ThomasPornin Oh, OK, thanks. Good to know!

Thomas Pornin

Amusingly, this works only as long as IIS can buffer the whole request, and the default buffer size is 48 Ko.

Things break in very unclear ways when the buffer is not large enough.

lookup "UploadReadAheadSize" for details.

Will

So, if I am never going to use client certificates or if I think IIS can burn in hell, I have no need to support renegotiation, right? I mean, there are no other good reasons out there as far as you know?

AviD

15:09

@ThomasPornin how does non-IIS support that scenario?

raz

@ThomasPornin Is rekeying a separate mechanism in TLS?

Thomas Pornin

@AviD In general, it does not support it. It either requests a certificate every time, or never.

etherealflux

renegotiation is the only way to prevent nuclear war

Thomas Pornin

Note that client certificates in a Web context are a rarity.

AviD

@ThomasPornin really?? So IIS is - in principle - the only web server that supports configuring client certificates by directory?

Simon

15:10

@Ohnana Ya I read/upvoted a few of your answers yesterday.

AviD

@ThomasPornin rare, sure, but still exist. In corporate environments, less rare.

Thomas Pornin

@AviD I know they exist; I work with that.

Ohnana

@Simon i almost just want to pst dup answers to get the area 51 site stats up

David Freitag

@Ohnana That never works.

AviD

ha, I'm sure you do - I was not implying otherwise

David Freitag

15:11

In fact, it's a good way to get booted from a beta.

Ohnana

@DavidFreitag i mean like well-researched decent answers

not bullshit ones

Thomas Pornin

@AviD I don't think Apache supports per-directory client certificates (I mean, asking for a client certificate, not processing it when it is there). IIS does. For other Web servers, I have no idea.

David Freitag

@Ohnana A duplicate answer is still a duplicate answer no matter how well researched it is.

Ohnana

yeah, that's why the answers per question metric seems bullshitty

Thomas Pornin

@raz "Rekeying" is the polite name for an animist ritual that involves chanting, dancing, and sacrificing a goat or an unlucky war prisoner to propitiate the crypto gods.

5

David Freitag

15:13

I mean, if you really mean answering a question with an existing (possibly accepted) answers with a much better answer, that is not a dupe.

etherealflux

someone downvoted an answer I posted please destroy them for being mean to me and being hitler

Will

TLS1.2 RFC: tools.ietf.org/html/rfc5246#section-6.1 : "Do you support renegotiation, both client and server initiated? While renegotiation is an optional feature, supporting it is highly recommended." <-- You'd think there would be a rationale mentioned for it being "highly recommended", but no...

David Freitag

@etherealflux It can't be Hitler, Dr Farnsworth killed that guy with a laser.

Thomas Pornin

Some people have used TLS renegotiation as a way to "rekey" because the mechanics of a new handhsake imply computing new keys for the symmetric encryption algorithms.

etherealflux

@DavidFreitag maybe it's Hitler's nephew?

Thomas Pornin

15:16

Some people do that because they think that keys are like gasoline and get used up when employed.

etherealflux

well yeah, your keys get worn out after opening the locks for a while

they have to open those locks REALLY fast

Thomas Pornin

@Will The security features offered by renegotiations have never been formally specified.

Even when secure renegotiation was published, nobody actually wrote down what that secure renegotiation actually achieved.

AviD

@ThomasPornin it achieved allowing you to renegotiate, securely.

cmon, does #simon need to explain everything?

Will

@ThomasPornin Haha... Glad it wasn't just me who had misgivings

etherealflux

I mean, some people have business requirements involving secure renegotiation

so there ya go

securely renegotiated

We all need a little cargo cult in our lives

Simon

15:19

@etherealflux Don't you mean "bam, securely renegotiated"?

raz

@etherealflux What answer?

etherealflux

@Simon bam

Thomas Pornin

It seems that Microsoft developers believe (or believed) that TLS renegotiation meant that the certificate-based client authentication retroactively applied to all data exchanged before the second handshake.

This was proven false, and RFC 5746 seems to be an attempt at fixing that, although it does not clearly state it.

etherealflux

@raz on the one about unique keys per customer; I gave a little too specific of an answer for the overly vague question

AviD

@ThomasPornin wut, how is that possible

also, why would it matter

Thomas Pornin

15:27

@AviD Read this section: tools.ietf.org/html/rfc5746#section-1

AviD

oh man @ThomasPornin must really hate me, just made me read an IETF RFC...

Simon

rip

AviD

also, I meant that, as I understand the situation, a user is browsing an HTTPS website; tries to access a client-cert protected virtual directory, and is presented with a demand for his client cert to authenticate and thus gain access. What I was asking was - at that point, all previous interactions are done, and now the client cert only applies to future traffic. This is totally obvious, how would it be possible to imagine this could apply retroactively?

(not asking how it would be implemented, its the concept of time travel I'm having trouble with)

oh! never mind.

I just got it.

Simon

he just got it lads

AviD

It could be the same session. SessionId isnt reset, anything done in the previous connection still apply in the application, since the server sees the same session outside of the CC-protected directory. Yes?

Rory Alsop

15:34

Simon

wat

Rory Alsop

@simon - that one on the left is surely your perfect gift

Simon

I'm mostly worried about the one on the right.

AviD

eww grape frosting

Rory Alsop

The one on the right is possibly nsfw

AviD

15:34

@Simon thats your perfect gift

NOT that there is anything wrong with that!

Simon

A donut butt?

raz

@AviD Well I'm sure it doesn't taste like grape.

@Simon wut wut?

Simon

in da donut butt

Rory Alsop

sobadsogood.com/2015/08/02/…

etherealflux

to test this web application, I'm violently SIGKILLing it during important operations

this is good

Simon

15:36

You're good.

Ohnana

hmmm limp-testing

etherealflux

er, it survived the sigkill

wat

must've murdered another process by mistake

Ohnana

haha

hope you're not on prod

etherealflux

>not randomly invoking SIGKILL on prod

Rоry McCune

@etherealflux again

Simon

15:38

>keeps forgetting to add a space

raz

Hopefully your not testing on production

etherealflux

I'm not trying to make a quote there

David Freitag

and @raz as usual, 5 minutes late to the party

Simon

>lies

etherealflux

these are the wacky greentext arrows from wackyland

Simon

15:38

@DavidFreitag Hahaha, poor roz.

etherealflux

and uh

yeah this is just on my laptop

raz

@DavidFreitag Dude, you don't want to be the first person there. Then it's just awkward.

David Freitag

@raz I enjoy the satisfaction of helping setup.

Then I feel less bad about getting drunk and falling asleep on the couch

raz

@DavidFreitag Ah, well if that's in the deck of cards then yeah. I at least help cleanup

David Freitag

@raz That's always in the deck of cards. Especially when that deck of cards is CAH.

raz

15:45

CAH?

David Freitag

Cards Against Humanity

Cards Against Humanity is a party game using cards. It is available as a free download that players can print to create their own cards, and also available to purchase in published hardcopy. Its development originated from a successful Kickstarter campaign and has received acclaim for its simple concept backed up by its satirical, mature content. The game is available under a non-free Creative Commons license BY-NC-SA. Its title references the phrase "crimes against humanity", reflecting its politically incorrect content. == History == Cards Against Humanity was created by a group of Highland Park...

raz

hahaha

David Freitag

Nothing better than playing CAH with your parents.

Ohnana

i only heard of cards against security after it got whacked

David Freitag

It's only, like, a bonding experience, or something.

Rоry McCune

15:47

Cards Against Humanity: Aisha Tyler, Laina Morris, & Ali Spagnola Join Wil on TableTop S03E10

►

^The Tabletop CAH episode was very funny (Also very NSFW!)

David Freitag

@RоryMcCune Yeah I'm not watching that.

Thomas Pornin

@AviD The idea is that since the second handshake is done in the context of the first one (it is encrypted and MACed), then it somehow comes "from the same client".

Rоry McCune

@DavidFreitag well not at work anyway..

AviD

@ThomasPornin I figured something like that, but I was asking what effect it would have, if true.

etherealflux

I've set up a command to grep top for all ruby processes, then grab their PIDs and SIGKILL them

this will work and be a good thing

Rоry McCune

15:50

@etherealflux why would you do that to poor defenseless ruby processes!

AviD

@RоryMcCune oo oo! That's Lana!!

Ohnana

@etherealflux russian sigkill

Thomas Pornin

@AviD If it comes from the same client, then the server can assume that the HTTP request it received before the second handshake really comes from the client that was authenticated during that second handshake, and may honour it right away.

Rоry McCune

@AviD and Laina

Thomas Pornin

(In a Web context, this is about request that modify data, not read-only requests.)

David Freitag

15:50

@etherealflux Are you sure that grep won't find itself within top?

You could end up sigkilling your own script

AviD

@ThomasPornin ah - assuming it is still in queue, and will be served after the later authenticated request? weird.

@RоryMcCune OAG?

Rоry McCune

@AviD yep

Ohnana

@DavidFreitag as long as it's not ruby it should be safe

David Freitag

@Ohnana wat

Ohnana

oh wait it shows up with it's search pattern

whoooopsie

AviD

15:52

@RоryMcCune that game seems very similar to many other games - like apples to apples, a family favorite here.

David Freitag

@Ohnana Right, but if you have one ruby process and you do top | grep 'ruby' you will get two results, one for the process and one for grep.

Simon

whoopsies

AviD

I take it the difference is how horrendous the cards are...

Rоry McCune

@AviD yeah pretty much

@AviD the idea is to come up with the funniest (and generally most NSFW) combination for each round

David Freitag

@AviD That's because it was based on apples to apples.

Rоry McCune

15:53

@Simon you did it again?

AviD

ahhh see what do I know

David Freitag

With a quite large NSFW streak. If you know what I'm saying.

Simon

I've played with your heart

AviD

okay wow jeez, definitely need the headphones to listen to this

David Freitag

@AviD Yes CAH is the definition of NSFW.

Rоry McCune

15:55

@AviD what part of Very NSFW did you miss

David Freitag

In fact, many say CAH is NSFL.

Rоry McCune

yeah it's not really near the knuckle, so much as, you have no knuckle left

David Freitag

@Simon LUNCH

AviD

lol, I usually dont have a problem with that. buuuut dont want kids to overhear this.

Simon

@DavidFreitag YAAAAAAY

Rоry McCune

15:56

I think the idea is that if you get to the end of the game and haven't been offended at least once, you're not playing it right

David Freitag

@AviD That would definitely ruin them.

Thomas Pornin

@AviD That's expected from the way they do things. IIS wants to ask for authentication based on the path, and that path is sent by the client only after the first handshake has completed. So they must buffer the request and ask for a new handshake.

A "cleaner" solution would be to respond to the first request with a redirect, so that the client sends the request again, after doing the second handshake.

Simon

A clean solution is Dove™

AviD

@ThomasPornin yeah, I would have assumed

@RоryMcCune I find OAG To be hysterical here. So innocent, so inappropriate.

"I feel like I'm being punked"

okay I have to buy this game

Rоry McCune

@AviD yeah she's definitely the straight woman of the vid and her bit makes it funnier

JukEboX

16:05

has returned

Sup guys. What I miss?

@Simon !command SUMMARIZE

Simon

donuts

JukEboX

Excellent

etherealflux

The script worked like a charm

top -l 1 | grep ruby | grep -o "^[0-9]\+" | xargs kill -9 && echo "YOU MANIACS! YOU BLEW IT UP!"

Ohnana

neato

etherealflux

Then I poured mountain dew™ on my keyboard

JukEboX

16:28

I wish I understood what any of that malarkey was

LOL

etherealflux

It prints out a list of processes, finds the ones with "ruby" in the name, grabs the first number from each line (which is the process ID), then passes it to xargs, which runs a kill -9 command for each line. Kill -9 sends the SIGKILL signal to a process, immediately killing it without any chance for it to react

unlike SIGTERM, which just tells it that it should really think about closing soon

I think the Windows equivalents are SIGTERM=End Task, SIGKILL=End Process

David Freitag

@etherealflux So, why are you killing ruby?

etherealflux

@DavidFreitag I'm testing the behavior of a server if it dies during a file download

David Freitag

@etherealflux That makes sense, actually.

etherealflux

I'm not sure if this trashes the entire web stack or not, though

it's a Rails app using Unicorn

might need to make it even more violent

David Freitag

16:32

@etherealflux So it farts rainbows?

etherealflux

SIGKILL is as close as I can get to total system failure without using any mountain dew

Pretty much

David Freitag

@etherealflux Unless it's a laptop, the worst that mountain dew into a keyboard will do is power off that usb connector.

etherealflux

@DavidFreitag It's a laptop. Definitely gonna do something exciting

David Freitag

@etherealflux Yeah, you might let the magic blue smoke out. Which, as we all know, is a necessary ingredient.

@etherealflux Why don't you just yank the ethernet cord out, or disable the wifi during the download. Wouldn't that achieve the same thing?

etherealflux

@DavidFreitag This's all running on one box. It'd be worth testing that kind of failure as well, though. Could just trash the loopback interface or something

David Freitag

16:37

@etherealflux Or, you know, get a raspberry pi, or something.

etherealflux

@DavidFreitag It's a pretty heavy application. Dunno if my pi could handle it

it also scrambles the SD card if it doesn't like its power supply

or if it just gets bored

David Freitag

@etherealflux That's why you network boot.

etherealflux

@DavidFreitag Are you sure it isn't interference from the FBI mind control radiation?

David Freitag

@etherealflux No, it's definitely those things, PXE is just way more stable.

etherealflux

@DavidFreitag That's what the FBI would say. Nice try, FBI mind control division

Flyk

16:43

I don't know what Microsoft have done, I've never had problems with my taskbar before...

etherealflux

10

Q: Is it a scam if the person only wants to deposit into my account, not make a withdrawal?

A man in west coast Austria wants to deposit money into my account. I'm in Alabama I had to get a online account. I did that but he says his bank manger needs all this information: DOB SSN online access username online access password security question and answer bank name...

Simon

.

How can people be this gullible?

etherealflux

I thought it might be a reasonable question at first

"okay, so he's just going to give them a routing number and a few other things.."

> online access username
> online access password

dammit I'm just going to do the pls dance

Simon

When in doubt, do the pls dance.

Iszi

16:58

@ThomasPornin Do you always refer to yourself in the third person like that?

Ohnana

@etherealflux baahahahah

etherealflux

2

Q: Why does gpg use /dev/urandom

Looking at the strace output of GPG on my box seems to show that it uses /dev/urandom when encrypting a message without any access to /dev/random even when --no-random-seed-file is specified. Are messages at risk of being encrypted with a low entropy session key and if so how does one instruct G...

gnupg random

pls

Ohnana

@etherealflux pls

etherealflux

17:17

this guy clearly had an answer to his question before asking it

David Freitag

@etherealflux SE actively encourages people to answer their own questions.

Hence why there is an "Answer your own question" box at the bottom of the page when you are asking your question.

etherealflux

@DavidFreitag as in, he asked "is this a problem?" and then rejected any claims that it wasn't

coulda' just answered it himself immediately if he wasn't sure

David Freitag

@etherealflux Sure, just because he has an answer in mind does not mean that the answer he has is at all correct.

etherealflux

I can see where's he's coming from if it's a headless server that happens to be eating a lot of randomness..I'd be interested to dig further into the subject

David Freitag

He should probably just get a hardware entropy generator.

etherealflux

17:24

so @Simon ?

David Freitag

@etherealflux Like this one tindie.com/products/ubldit/…

Simon

??????????

David Freitag

@etherealflux Also, @Simon cannot serve as a decent generator, he can only count to six.

etherealflux

pls = 0

donut = 1

Simon

donut pls pls donut donut pls

raz

17:30

@Simon donut code

d d d p p p d d d

etherealflux

s86 architecture

the registers are pls1, pls2, ...

Simon

CENTIPEDE

David Freitag

GET FOOD

IS DONUT? OMNOMNOM
IS NOT? PLS

etherealflux

You cannot get ye food

Simon

exit after pls

etherealflux

17:35

jne pls1 pls2

and the award for the most incorrect assembly syntax goes to...

David Freitag

@Simon No, that's the benefit of donut code, you don't need to exit. It just roams around your CPU and eats donuts.

Simon

@DavidFreitag om

etherealflux

it provides a heuristic antivirus approach

by randomly overwriting the stack with donuts

David Freitag

@etherealflux And if the program does not consume the donut(s), it must be malicious.

Also, if it chokes and dies, it deserves it anyway.

etherealflux

@DavidFreitag It didn't need that %ebp anyways

Simon

17:46

0

Q: Password Hashing SELECT (PHP)

Is it possible to select a hashed and salted password from MySql DB only using the posted password? If so, how?

hash php mysql salt

What's going on with the awful PHP questions?

raz

@Simon awful is generally implied with reference to PHP. No need to add it in there.

Simon

Knew it, I knew that someone would make that comnment.

David Freitag

Saying "terrible PHP" is like saying "delicious bacon"

Rоry McCune

@Simon Psychic @Simon :op

Simon

You guys make me want to become a PHP crypto pro to revolutionize the world.

'Cause you know, I'm already a pro at PHP.

etherealflux

17:49

isn't the answer just "hash and salt the password, then do a SELECT WHERE" ?

Simon

Look: $strSQL = "SELECT * FROM TBL WHERE strPassword = '" . $_GET['tbPassword'] . "'";

I don't think this code can be ANY better.

etherealflux

yes it can

add emoji and unicode

$ヽ༼ຈل͜ຈ༽ﾉ = "SELECT * FROM TBL WHERE strPassword = '" . $_GET['tbPassword'] . "'";

David Freitag

@Simon Did you properly sanitize your inputs?

Jeroen - IT Nerdbox

Gotta love $_GET parameters.... :P

Simon

@DavidFreitag We all know that PHP has a built-in function to sanitize anything that comes from POST and GET.

David Freitag

17:52

@Simon We do?

etherealflux

hm, I see. Each user has a unique salt, so you can't just do one hast+salt operation and select from all users

Simon

It is also executed automatically!

David Freitag

I personally have never used PHP, so I wouldn't know.

Simon

#simonlivindadream

@DavidFreitag Oh no that was pure bullshit.

Thomas Pornin

@etherealflux He did answer his own post.

David Freitag

17:53

@Simon I was going to say, that sounded much too logical for PHP.

Simon

:p

Jeroen - IT Nerdbox

lol

Simon

@etherealflux What about the table flip one?

etherealflux

@Simon don't be ridiculous this is serious coding work

Simon

soz

etherealflux

17:55

wait, you forgot to sanitize the input

try using an alcohol-based cleaner

Simon

@etherealflux Oh sorry: $strSQL = "SELECT * FROM TBL WHERE strPassword = '" . str_replace("'", "plsno", $_GET['tbPassword']) . "'";

etherealflux

excellent

Jeroen - IT Nerdbox

no more SQLi that way huh?! :P

Simon

@Jeroen-ITNerdbox Tsk, no need this SQLinfection.

etherealflux

Remember RFC-3514? Just check the security bit.

Jeroen - IT Nerdbox

17:59

include_once("automaticaly_santize_everything.php");
include_once("no_more_session_fixation.php");
include_once("lies.php");

LOL

etherealflux

if (packet & SECURITY_BIT == 1) return "pls"

David Freitag

@Jeroen-ITNerdbox That last one should be include_once("cake.php");

Jeroen - IT Nerdbox

;)

etherealflux

@DavidFreitag can I get a pls here

David Freitag

@etherealflux No, I have run out of pls, all I have left is wat

Jeroen - IT Nerdbox

18:01

I think we should request an RFC for SQLi, then all we need to do is block the SQLi TCP/UDP port in our firewal's and we're goo! :P

Simon

@etherealflux And of course define("SECURITY_BIT", 0)

Jeroen - IT Nerdbox

@ICANN

etherealflux

define("hackable",false)

David Freitag

@etherealflux Of course this is PHP, so it will treat SECURITY_BIT and packet as strings, and this will always return false.

etherealflux

define("sunglasses","worn")

Jeroen - IT Nerdbox

18:02

hehe

etherealflux

@DavidFreitag Nah, it'll try to interpret them as floating point booleans

somehow

David Freitag

@etherealflux Hahahaha, I spat out my drink

etherealflux

Which are then interpreted as strings anyways

and you can only compare them with the new ==== operator

or the floating_boolean_compareReal2() method

MSQL is great about that

you can use datetime

or datetime2

David Freitag

@Simon play.google.com/music/m/… "Empty Space"

Super chill.

> Unfortunately Inbox has stopped.

Yeah cause that's never happened before...

etherealflux

my phone's Bluetooth crashes whenever Spotify changes a song that I'm playing on my speakers

but the audio keeps going until I acknowledge the crash

good!

TildalWave

18:28

@etherealflux sounds like your drivers don't approve of the music you're listening to

etherealflux

@TildalWave what's wrong with some Infected Mushroom

TildalWave

dunno, what's the crash message?

David Freitag

@etherealflux Absolutely nothing. Especially when it's Heavyweight.

etherealflux

@TildalWave "It stopped i dunno"

David Freitag

@etherealflux Must be an iPhone

Pirate's Booty

@piratesbooty, New York

Ahoy matey! You’ve discovered a deliciously baked treasure, now get hooked! Pirate’s Booty snacks are free from fryers & ingredients you can’t pronounce. Arrr!!

3.7k tweets, 7.7k followers, following 659 users

Someone brought in a box of that stuff. I lol'd.

etherealflux

18:40

"ingredients you can't pronounce" makes me twitch

sure, if you call sugar a mix of α-D-glucopyranose and 1,3,4,5,6-Pentahydroxy-2-hexanone, it's a mouthful

David Freitag

@etherealflux It doesn't actually say that on the bag. Everything on there is pronounceable.

TBH they weren't that good though.

etherealflux

but all the ingredients are all natural so it must be good, right?

David Freitag

"good" is in the tongue of the beholder.

WOOT, no more dinklebot. theverge.com/2015/8/4/9095863/…

Simon

@DavidFreitag I'll give it a go.

0

A: Password Hashing SELECT (PHP)

I think you mean how to select a hashed and salted password from a database then verify it with a plaintext password? If so, here is how with bcrypt. Keep in mind, this requires PHP 5 >= 5.5.0. Also, I recommend scrypt over bcrypt, but you have to install scrypt manually. SQL stuff CREATE DA...

Now what the hell is that answer?

David Freitag

@Simon I can't seem to decipher it. It seems to be written in some archaic form of cave man language.

Simon

18:51

"Also, I recommend scrypt over bcrypt, but you have to install scrypt manually."

WHY ON EARTH?

Jeroen - IT Nerdbox

A motivation would be useful

Simon

Sigh.

raz

@Simon Why on earth what?

Simon

@raz What's wrong with bcrypt now?

etherealflux

@Simon It's much harder to attack scrypt with dedicated hardware. It eats large amounts of memory.

Thomas Pornin

18:54

@Simon Too old. Too common. Already implemented by frameworks, even by PHP.

Simon

@ThomasPornin Hahaha.

Thomas Pornin

@etherealflux Whether this assertion holds in configurations meant for basic Web servers authenticating incoming users remains to be seen.

raz

@ThomasPornin Sounds like @Simon's mom

etherealflux

It does a space-time tradeoff by using large random strings, which can either be held in memory or generated every time they're needed

Simon

pls my mom isn't implemented by frameworks

Thomas Pornin

18:55

scrypt was initially designed to support password-based encryption of the hard disk of a computer.

Simon

@Simon I didn't say anything was wrong with bcrypt, I said "I recommend scrypt over bcrypt, but you have to install scrypt manually." — Sakamaki Izayoi 38 secs ago

WHY DO YOU RECOMMEND IT THEN?

37*TTTTTD?@³@ffsdfs3243234

etherealflux

?

Thomas Pornin

Thus, scrypt normal parameters involve using lots of RAM (possibly hundreds of megabytes) and running for non-negligible time (say 5 seconds at full CPU).

On a Web server, you need it to complete much faster, and then it will use a lot less RAM.

To the point that it is unclear whether it will defeat attackers better than bcrypt does.

bcrypt and its 4 kB RAM is already quite good at making life hard for attackers with GPU

scrypt can claim to do "better" only on hardware that is already better at cracking bcrypt than normal PC

David Freitag

@ThomasPornin But what about an fpga with dedicated memory?

Thomas Pornin

i.e. on FPGA

etherealflux

18:58

plscrypt will do the trick

Thomas Pornin

@DavidFreitag Unfortunately, we lack a good, consensual model of what an attacker can do with FPGA.

Simon

@etherealflux I gotta start working on that. I was thinking ROT13 could be its root but maybe I'm gonna be wild and do it with ROT26.

etherealflux

do a cyclic bit shift on the data

David Freitag

@ThomasPornin It would probably be easier to compile a list of what an attacker cannot do with an fpga.

Thomas Pornin

A lot of research papers on the subject begin by assuming that attackers can get the same performance for their custom designs as Intel can with its CPU, for the same price -- which is rather unrealistic.

etherealflux

18:59

1. land a date with @Simon 's donut

David Freitag

@Simon ROT13 is fine, but you need to apply it twice for maximum effect.

Simon

pls, it's my donut

Thomas Pornin

There have been quite some discussion on the subject during the PHC.

Transcript for