The DMZ

Plus block ciphers can be used to make almost anything: stream ciphers (CTR), authentication (CMAC), hash algorithms (Merkle-Damgaard hashes like MD{4,5} and SHA{1,2}), KDFs (HKDF), PRGs ({CTR,HMAC,Hash}_DRBG)...

Anonymous

That's also a very good point.

Anonymous

3:05 AM

I am going to try and at least watch one lecture a week while I do this course.

Anonymous

Because what happened before was, I was studying cryptography thenI started a course

Anonymous

but i didnt keep up the crypto while i did the course

Although the current trend is going away from block ciphers as a universal cryptographic primitive and instead going towards public permutations (like Keccak and Gimli) which can be used to make anything a block cipher can, and are typically a lot easier to analyze.

Anonymous

so i keep having to semi start again

Have you done anything with asymmetric crypto yet?

RSA, DH, Rabin, that kind of thing?

Anonymous

3:06 AM

@forest Oh interesting. I recognise Keccak but no Gimli.

Anonymous

Yeah, a bit. I basically got to that part of the course before.

@J-- It's a DJB design, I think: gimli.cr.yp.to

Anonymous

Which was like lecture 16 out of 25.

A 384-bit public permutation, for general use. Can be used for sponge functions/XOF like Keccak in SHA-3, or really anything. I read the paper. It's a very neat design (not ARX though). See also

Anonymous

But that was a long while ago now.

Anonymous

3:07 AM

I am now again on lecture 8. But I am also using this book that I was recommended because apparently it is better.

Anonymous

I am starting this exploit dev course on 7th march so im going to be quite busy but i am just gonna try and do at least 1 lecture a week so i dontjust forget everything

Anonymous

then once i finish this course ill go back to crytpo because i find it super interesting and so its more important for my health to do that

Yeah I find crypto to be a relaxing study, as strange as that sounds. Not because it comes easily to me, but because I don't have to constantly wonder what earth-shattering 0day is around the corner. Things move more slowly in crypto, and fatal breaks often come with ample warning.

Anonymous

Yeah, also for me because it is purely interest.

Anonymous

I can go slower. It isn't like I'm going to get a job in this stuff.

Anonymous

3:09 AM

I can barely even do my times tables.

Anonymous

So I don't have some pressure with this.

The thing I like about Gimli is that it can actually be visualized:

Anonymous

It isjust something I know I really love and am interested in.

Keccak is also a lot like that, tbh.

Anonymous

Oh wow, that's cool.

Anonymous

3:10 AM

This is probably quite far away in my crypto studies.

Anonymous

But I'll get there.

Of course to truly understand it takes more understanding than can be imparted from a visual 3D matrix, but it at least gives a general understanding which is useful in knowing the design.

Anonymous

Stupid question but...

Anonymous

What is the difference between "<<<" and "<<"

<<< is rotate, << is shift.

Anonymous

3:11 AM

Does that mean the number of times to shift?

Anonymous

ohhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

Anonymous

i NEVER knew that.

So a <<< b does not lose anything, whereas a << b causes some bits to "fall off".

Anonymous

That's fucking cool.

Anonymous

I never saw an explanation of this notation before.

Anonymous

3:12 AM

Or this symbol, rather.

Anonymous

What the fuck. I remember seeing it used in relation to old shift ciphers.

Anonymous

I saw the "<<<"

An n-bit a <<< b can be implemented as (b << a) | (b >> (n - b))

So rotates can be done with just shift and OR (but less efficiently than native rotate instructions).

Anonymous

Wow...

Anonymous

Wait, also, what is this use of an up and down arrow? X ^ Y and then hwoever the fuck you do down

Anonymous

3:15 AM

never seen that before...

Anonymous

oh i know so little about this shit it makes me wanna stay awake for a week learning

That's OR and AND, in logic operation style.

Anonymous

lmfao...

a ∨ b (logic) is a | b (computer), and a ∧ b (logic) is a & b (computer).

Anonymous

Right, okay.

Anonymous

3:17 AM

See, I am not familiar with this at all. I knew "|" for division.

Anonymous

But I never knew thats how we represent those things

Likewise a ⊻ b (logic) is a ^ b (computer), i.e. XOR. But it's usually a ⊕ b in our world.

Anonymous

Right, yes.

Anonymous

Thank you, that makes sense.

Anonymous

I have so much to learn. Christ.

Anonymous

3:18 AM

Don't even understand fucking symbols :D

Q: Are any block ciphers provably free of equivalent keys?

This is about my limit when it comes to writing mathjax:

6

There are $2^n!$ possible permutations of an $n$-bit block cipher $E_k:\{0,1\}^n \rightarrow \{0,1\}^n$, and any given key $k$ selects one of these permutations at random. Define equivalent keys as a pair of keys $k \neq k^\prime$ where $\forall P:E_k(P) = E_{k^\prime}(P)$ and $P\in\{0,1\}^n$. Th...

Anonymous

Likewise mine!! :D

Anonymous

I write my notes like that of course.

A: Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?

But at least I can understand things like this (e.g. the big oplus is like the big sigma, but XOR rather than "normal" summation):

6

Background. PBKDF2 has a stupid design where generating two blocks of output costs the legitimate user twice as much as generating one block of output, without necessarily putting additional cost on the adversary's task of confirming a password guess. This is because each block of PBKDF2 output ...

Anonymous

And I frequently need to Google and use that cheatsheet

Anonymous

3:20 AM

Unrelated but: I fucking love learning.

Anonymous

I mean, I wish every conversation I had I would learn something. Such is the case when I come here but often not in real life LUL

Anonymous

Don't suppose you're also a chess wizard? :D

If you can understand k≠k′ where ∀P:E_k(P)=E_k′(P) and P∈{0,1}^n (equiv key definition) hen you're already way ahead of the competition in terms of understanding the crypto you read.

Anonymous

So P∈{0,1} means they're bits, right.

Yeah.

Anonymous

3:22 AM

0 or 1.

And P∈{0,1}^n means n bits.

Anonymous

Then E is our encryption function

Anonymous

P is our bits. what is the apostrophe?

Anonymous

do we not k * p?

Yeah. In my question I defined E as E_k:{0,1}^n→{0,1}^n

Anonymous

3:23 AM

E_k′(P)

The apostrophe means "prime", aka "modified k".

Anonymous

Ohhhhhhhhhhh

It's not just used in math. Also in biochemistry (and probably a lot of other places).

Anonymous

I see, right.

Anonymous

Didn't know that. I am still very weak on block ciphers in general.

3:24 AM

So k≠k′ (pronounced "k not equal to k prime") means a pair with k, and a modified k which differs.

Anonymous

I have studied stream ciphers, well, the basics of them the most.

Well it's not specifically block cipher terminology. You could also have said k_1 and k_2, but prime implies that you've modified k in some way and it's otherwise the same.

Anonymous

Right, okay.

Anonymous

Oh okay.

So k≠k′ where ∀P:E_k(P)=E_k′(P) and P∈{0,1}^n, the equivalent key definition, means a situation for E where there are two keys, k and k' which differ, but, for ALL POSSIBLE inputs (P), the encryption with k and k' result in the same ciphertext, i.e. k and k' are equivalent keys.

And P∈{0,1}^n tells you that all Ps are the same size, and are measured in bits.

Anonymous

3:27 AM

That seems very clear now.

Anonymous

Oh I have so much to learn.

A real-world example of equivalent keys is in the TEA block cipher, which has an effective keyspace of only 126 as a result (each key has two other equivalent keys, due to its ultra-simple key schedule).

Anonymous

Interesting.

Anonymous

So, is there a reason to need equivalent keys?

Fun fact: Microsoft tried to use TEA to construct a hash algorithm (remember, block ciphers can be used to make hashes), but because of the equivalent keys, it had a trivial collision attack! :D

Anonymous

3:29 AM

Or is it a design limitation?

@J-- No. It's just an undesired artifact of simple key schedules. It reduces the effective keyspace.

Anonymous

Right, figured.

Anonymous

I think I am getting sick...

Anonymous

Fuck.

Anonymous

I can feel a temperature developing.

3:31 AM

Hope you're not getting covid.

Anonymous

Hmm, I hope not....

Anonymous

Haven't been out much...

I got a stomach bug a few weeks ago. Sucked.

Anonymous

I could have got it yesterday but I wouldn't have symptoms already, right?

Anonymous

Too soon...

3:32 AM

It's probably not covid anyway. I don't think it starts with a fever.

Anonymous

Yeah, that's what I thought.

Anonymous

I usually get cold from not sleeping, not warm...

Anonymous

But, it could just be that. I guess I should go to bed.

Go to bed with some light crypto reading: "The Wide Trail Design Strategy" ;)

Anonymous

I was actually going to read Mechs manifesto :D

3:34 AM

He has a manifesto?

inb4 Mein Kampf.

Anonymous

Haha, I made that up but now you mention it, we should check :)

lol

Anonymous

I am stuck between Mechs manifesto and a book on the process of sharia courts :')

Anonymous

Probably will watch a chess match actually. Trying to get better at this damn game.

Anonymous

And if I wake up sick I am going to be FUCKING pissed.

3:37 AM

Beat a cop's daughter. Take your anger out constructively. :^):^):^)

Anonymous

I start this new course in like a week i realy dont have time to be sick...

Anonymous

@forest hahahahhahahaha

Anonymous

i need to rewatch these primer lectures on x86 again before this course starts so being sick is not acceptable

The general x86 ISA?

Anonymous

Uhh its wait. let me find it.

Anonymous

3:39 AM

this one

Anonymous

opensecuritytraining.info/IntroX86.html

Anonymous

I finished it long ago. when i first got intereted in this stuff

Anonymous

but i need to watch it again to prepare for this course

oh neat

So it's an in-person class.

Anonymous

Yeah, but they recorded it and uploaded all the videos + slides.

3:41 AM

ah

That's great. You'll walk away with a much better understanding of x86!

Anonymous

Yeah. For sure. As I said, I did already finish it once but it has been a while so. Just need to go over it again so I don't waste time when I get my actual course material.

Have you seen infocon.org?

You may love that as a resource.

Anonymous

I need to spend the time in the labs not trying to remember x86 instructions.

Anonymous

@forest I've never seen this before, no. Looks cool.

Anonymous

Oh wow, this is so extensive.

3:43 AM

It's basically a collection of all videos/slides from all cons that are available.

Anonymous

Yeah, I really, really like this.

At DEF CON if you bring in a very large hard drive, they'll copy it all to it for you to bring home.

So you don't have to download more than a terabyte of data.

Anonymous

Heh, one of my friends is on here :D

(If you bring two other hard drives, they'll also give you some rainbow tables)

Anonymous

Damn, they only seemed to upload her transcript.

Anonymous

3:44 AM

Not the videos.

Anonymous

Oh wait, it's here.

Anonymous

Hahah.

Anonymous

This is awesome.

Anonymous

Thank you, this is great.

Anonymous

I am now going to tease her about giving a talk at a conference well known enough to make it on such a large site.

3:46 AM

heh

Who is it?

Anonymous

Of that I cannot disclose.

Anonymous

I'd dox myself in the process, most likely.

Anonymous

Okay time to go. If I wake up sick I am going to be a very unhappy man.

Well now I know that it's a female whose talk is on InfoCon. Sort it by realistic dates and your interests and set of knowledge and I could probably find out who it is. :P

Anonymous

I bet it is because I smoked with a friend yesterday...

Anonymous

3:47 AM

@forest yeah it probably wouldn't be too hard to figure it out.

Anonymous

if you do figure it out then you can have it :D

:p

Only problem: I'm supremely lazy.

Anonymous

Hahahhaha :D

Anonymous

Yeeah I can't say there is much to gain.

Anonymous

Uh

Anonymous

3:48 AM

you know when you can feel you're getting sick

Anonymous

like you can feel just inside your body

Anonymous

like some kind of... fever starting to circulate

Have you been up for a long time?

Anonymous

i dont even know how to describe it

Because that can make you feel ill.

Anonymous

3:49 AM

nah only 13 hours.

Anonymous

i woke up very late.

Anonymous

i guess ill find out in the morning

Guess so. I wish you luck.

Anonymous

thank you :)

Anonymous

see you soon.

3:50 AM

o/

6:17 AM

Hi everyone!

Pls give me a suggestion:-

I have two choices now- 1. Staring a high paying software engineering job

2. Low paying entry level security job

What would be better If I want to ultimately go into security field?

Some people say you start with software dev and after 2-3 yrs switch to security and some say it will be really difficult so better will be start with a security role even if it pays very low

I am in a very confused state and I think about it daily but never arrive at any conclusion

(You guys might be thinking why I said entry level security job is "low" paying because that's just how it is in India)

What I want is a job that I love and also pays decently but unfortunately that's not gonna happen with current scenario

7:11 AM

@daya What kind of software job is it?

Is security a part of it at all, or is security a non-issue for the software you develop?

7:23 AM

@forest Hi forest!

hi

Yeah no security at all, it will be just pure development

You might be able to ask on The Workplace, if you can formulate your question to their standards.

But it really depends on 1) the pay difference, 2) the situation where you live in terms of moving up, and 3) whether or not your current job can get you leverage for a security job.

@forest Yeah but I just wanted to ask that in your experience, do you know guys who did development initially and now they got a decent job in security?

I can't think of any off the top of my head, but absence of proof is not proof of absence.

7:29 AM

@forest Pay difference is huuuuuuge, 9x that of security

Wow, that is a lot. Are there opportunities for quickly moving up in the security job?

And have you considered a programming job involving security so your skills transfer?

(e.g. moving on to developing software that will be exposed to untrusted input)

Well I don't know really as I am a fresher, but many people I asked they say If you got
"lucky" then you can switch teams internally in the organization

I guess it differs for each organization. In some, it's quite easy to move laterally to a security-oriented team. Unfortunately I'm not the best person to ask, because I'm a contractor, not an employee.

The reason for it is low paying in India that majority of them are just startups and big techies dont't hire freshers in security and but they do hire a lot in dev roles and pay very well

But will you be able to move up easily with time, or are you taking the risk that the security job will always be low paying and/or will end up going under?

7:36 AM

I do see a lot of opportunities in US, Canada, France where even big tech companies are hiring freshers in security

But high paying jobs do require a lot more experience.

@forest I think I should prepare for dev job and then will move to security

@forest Not really in dev, you can quickly check

@daya That might be a good idea. Perhaps you can mentally classify bugs you're working on as security-related or not, e.g. think about some trusted API as an untrusted API. That could help you learn secure coding practices that you could use later if you move on.

@forest Yep, that's what I'll do, thanks!

cya

cya

7:44 AM

And btw If someone wants to add something to the discussion then they are welcome :)

@J-- might know a thing or two about it.

Journeyman Geek

@daya as cynical as it may sound...

go "Money" "Brand recognition" then "This looks fun"

In that order ;)

8:14 AM

@JourneymanGeek I find that "this looks fun" can end up getting you more money in the long run, since you'll be working on something that you enjoy, so you'll spend more free time learning it.

Journeyman Geek

8:50 AM

@forest plausibly bit sometimes getting the money means you have more avenue to learn things

+++ indian culture kinda sucks in some respects

@JourneymanGeek That's what I was thinking, but didn't want to say lest I risk a ban. :p

Journeyman Geek

But I'd take this into account :D

I mean, if you think the fun job can lead you somewhere better, why are you even asking some random people on the internet

@daya hot take. The current model of IT in india is inherently exploitative - basically cause it was exported by richer countries to do the scut work.

on the other hand, get your foot in, and by the same model, you have a reasonable chance of getting poached.

buuut while you're there, those rules

9:14 AM

@JourneymanGeek Of course it is, I myself totally agree

But that's just about service based companies like Wipro, Accenture, Infosys, TCS, HCL,etc. and some new startups

and product based companies like Amazon, msft, Google, DE Shaw, GS, Salesforce and many others pays really well

But for that one have to go through a rigorous technical interview rounds where your problem solving skills will be tested and the knowledge of data structures and algorithms,

So there is no wonder why people are getting crazy for FAANG companies

@JourneymanGeek yep, that's what I am planning to do

9:44 AM

@JourneymanGeek The fun job for me is security which is less paying but as I know development too, so that will not be that bad either. I can switch later on

12:48 PM

Question: For the purpose of gaining rep, is it better to write short simple answers or longer detailed ones?

Anonymous

1:28 PM

@daya I would say that if you really, really want to do security and you know that for sure, then do it.

Anonymous

As forest said, in the long run you'll be better off. You will be working on something you love day in and day out, few people have this luxury. I would take it. Sure, the money won't be great but honestly, unless you're a super materialistic person you'll quickly realise that getting wrapped up in money has way more negative benefits than positive ones.

@J-- Not having enough money limits opportunities too. Like when you don't having enough money to get the relevant courses and certifications

Anonymous

That's a good point.

Anonymous

But as someone who did something he hated for 2 years simply just to eat.

Anonymous

A job which made me regularly self-harm just because I had to work.

Anonymous

1:37 PM

I would rather earn £4 an hour than ever go back to that.

Anonymous

Doing soimething I love is my only requirement now.,

You feel that way because you already have all the resources you need. Imagine trying to do the work you love to do when the computer you have doesn't have enough ram to spin up VMs.

Anonymous

No, I felt like that when I had no money and hated my last job.

Anonymous

He needs to make his own decision, nobody here can make it for him.

Yeah your right with that

Anonymous

1:40 PM

But personally, I would rather do anything than ever go back to doing something I don't love. It nearly crushed me so.

Anonymous

That's how I feel on the matter.

Maybe you're right. I've never worked a job, so I can't say

Anonymous

I mean, there isn't really a right or wrong answer, I guess

Anonymous

Both have different positives and negatives. But personally, I could never do something I don't want to do again because I remember how it nearly ended.

2:29 PM

Hey I wrote this answer to this question. Does my answer still make sense as response to the question it was merged with?

It seems to be the questions were a little different and my answer doesn't really answer the question it was merged with.

@J-- it's easier to have this stance when you don't have kids to feed

Anne Batch

2:50 PM

Hello everyone

Anonymous

@ThoriumBR For sure.

Anonymous

But he didn't mention having kids.

Anonymous

So I assumed he doesn't have them...

and that is something that changes everything

Anonymous

I don't disagree.

Anonymous

2:51 PM

But it isn't relevant here because he never said he has kids.

I had a terrible job once but kept going every day (and searching a new one) because of them

Anonymous

I also don't have kids. So it wasn't relevant to my personal experience. Which is what I gave as my reasoning.

well, not terrible, but bellow my expectations

Anonymous

I wouldn't advocate the same stance if he said "oh and I also have a family to feed"

Anonymous

But as I said before, ultimately, nobody online can make that choice for him. He has to make it.

Anonymous

2:53 PM

So what I said really, really does not matter in the grand scheme of things.

@AnneBatch Hi