The DMZ

Arperum

12:03

@Flyk Physical copies don't really work for being pulled through a cable.

Flyk

what is a "physical copy" ?

what purpose does that serve?

you know what

one of my releases is available on a torrent site

mixed emotions encapsulated in irony

I was on said torrent site ripping off tv shows

I am partially sad because this means I'm not getting paid as much

but I am also partially happy because this means that (a) somebody somewhere did, and (b) those that wouldn't normally still get to hear it

what a moral dilemma

it also means somebody cared enough to share it

hmmm

Barry Carlyon

*channels inner @Simon * Wait, I can download my own copy of @flyk

Flyk

sure, it's out there... somewhere

Arperum

@Flyk I have the bad habit of collecting CDs.

AviD

@Arperum you mean VDs.

Flyk

12:12

no he meant STDS

AviD

@Flyk thats what I said

Sexually transmitted infection

Sexually transmitted infections (STI), also referred to as sexually transmitted diseases (STD) and venereal diseases (VD), are infections that are commonly spread by sex, especially vaginal intercourse, anal sex and oral sex. Most STIs initially do not cause symptoms. This results in a greater risk of passing the disease on to others. Symptoms and signs of disease may include: vaginal discharge, penile discharge, ulcers on or around the genitals, and pelvic pain. STIs acquired before or during birth may result in poor outcomes for the baby. Some STIs may cause problems with the ability to g...

I guess they stopped calling it "VD" before your time

but kudos, you ruined yet another joke. And this one was great.

M'vy

@TerryChia It does ring a bell here as well

Terry Chia

Cool, after 3 weeks of work I finally got my interpreter to add 2 numbers. \o/

AviD

@TerryChia why didnt you just add them yourself and ask her to interpret the result?

Terry Chia

@AviD That's sexist.

Flyk

12:16

@AviD I guess

@AviD it was, sorry

@AviD That's sexist.

AviD

@TerryChia oh I see what is going on. You are implying that because your interpreter couldnt add, I must have assumed it was a she.

not only is that sexist, its racist.

Terry Chia

@AviD Heh.

AviD

also anti-semitic.

Terry Chia

Kidding aside, this is a pretty fun project to work on.

Flyk

your face is... facist

2

no, that doesn't work

well, it could

Nוnɛfוngɛrϛ

12:18

@AviD I enter the DMZ and I find that as the first thing I see

Why am I not surprised?

AviD

@Nוnɛfוngɛrϛ so, business as usual.

Flyk

ssdd

Nוnɛfוngɛrϛ

@AviD Basically yep

Flyk

welcome to the DMZ, moral standards are on the other side of the firewall

8

AviD

for the record, @TerryChia and @Flyk, I usually refer to anonymous professionals as "she". It would be sexist to always refer to them as "he". look it up.

Flyk

12:20

@AviD it's sexist to call them she, as well

use they

AviD

@Flyk thats pluralist.

Flyk

much better than sexism

how good is 256-bit AES?

Terry Chia

@Flyk Less good than 128-bit AES.

Flyk

really?

that doesn't seem logical

Terry Chia

@Flyk It's much slower than AES-128 but does not offer any compelling benefits over AES-128.

Flyk

12:28

ok and how is 128 bit AES vs 128 bit blowfish

AviD

@TerryChia thats not accurate.

I believe that should be "necessary benefits... that are worthwhile"

Tinned_Tuna

blowfish is also quite slow in comparison. To my mind, AES-256 is only really of use if you think your adversary has a quantum computer that can run Grover's (Correct me if I'm wrong) search over a 2^64 space in a "reasonable" about of time.

AviD

i.e. it is slightly better, in theory, but the betterer part is moot.

Flyk

if I'm VPN'd twice, and both VPNs are 256 bit AES, would that be why my internet connectivity is nowhere near as fast as without the VPNs, even though both VPNs have no bandwidth caps?

Terry Chia

@Flyk There hasn't been any (I think, not 100% sure about Blowfish now) attacks that will break the security of either cipher and AES at this point in time is probably much more scrutinized and faster (thanks to AES-NI).

@Tinned_Tuna Aye, and at that point in time you have far worse things to worry about since public key crypto is basically broken.

Rоry McCune

12:31

@Flyk well you're doing two additional hops and the VPN servers you're using may well be heavily loaded

AviD

@Tinned_Tuna the slowest part of blofish is the setup time. After that it tends to be quite speedy (in most circumstances), though not as fast as AES with CPU support.

M'vy

@Flyk you're putting more layers around your communications + lots of computation. You can't expect to have the same bandwidth

Rоry McCune

so their ability to process data is a bottleneck

Flyk

@RоryMcCune well sure, that and my exit point on the internet is geographically thousands of miles from my current location

Terry Chia

@AviD AES-NI really is a game-changer for speed.

AviD

12:32

@TerryChia yeah. Where available.

Tinned_Tuna

@TerryChia indeed, it's more that I'd rather have the justification for completeness.

Flyk

meh, my VPNs need paying for and I'm just looking at whether I keep the ones I'm currently with or changing them, is all

sorry for starting the on topic conversation in the security channel

let's talk ponies

AviD

@TerryChia (thats the CPU command set for AES, right?)

Tinned_Tuna

@TerryChia but I am quite the stick in the mud :-p

Terry Chia

@AviD Yep, on x86 platforms. I think most Intel CPUs has them for quite some time now.

Tinned_Tuna

12:33

@AviD AES-NI is the instruction set for accelerating AES work, yes

there's a couple of instructions, for key setup and one for performing a round.

Flyk

@TerryChia so I should stick with AES regardless, is what you're saying?

Terry Chia

@Flyk Yes.

Tinned_Tuna

@Flyk yes, AES is much faster, and has had much more academic interest.

AviD

@Tinned_Tuna yes, familiar(-ish), just forgot what theyre called.

Tinned_Tuna

@AviD fair enough :-)

AviD

12:34

@Tinned_Tuna ahem, and governmental.

Flyk

blowfish always makes me giggle

one day I'll grow up

Tinned_Tuna

@AviD ah yes, the ol' govt. Didn't they announce it can be used for all but the very highest classification of data or something recently?

AviD

makes me think of blofeld.

Tinned_Tuna

or am I mis-remembering?

Flyk

feels like I need a tshirt making saying "I blow fish"

great, Simon arrives immediately as I say that

Rоry McCune

12:35

aannd a wild @Simon appears

Flyk

fml

Rоry McCune

you ninja'd me!

Flyk

nope

refresh, I was first

Rоry McCune

@Flyk happier?

Flyk

yes, I like being first

Rоry McCune

12:36

that was my intent not to impune your Internet speed

Flyk

uhuh

next question

would you use OpenVPN client rather than Windows' build in client

Simon

pls all

Flyk

also, what does this mean:

"For key exchange and authentication 4096-bit RSA keys are used."

AviD

@Flyk I was using openvpn for a while. pissed me off.

Rоry McCune

@Flyk they use a big key

Simon

12:37

It means that 4096-bit RSA keys are used for key exchange and authentication.

AviD

@RоryMcCune its not the size of the key that counts

Flyk

@Simon -.-

AviD

its also what algorithm you use

Tinned_Tuna

Sounds speedy

Flyk

I can read the words

I need explanation

Simon

12:38

@Flyk I thought rewording would help you out.

Flyk

@Simon well there's the problem; you thought. Don't do that.

Simon

pls

Rory Alsop

@Flyk uhuh :-)

Flyk

@RoryAlsop well then there's less apprehension about whether you'll finish at all

makes the entire experience more enjoyable

Rory Alsop

That should not be in question

Flyk

12:40

WELL C'EST LA VIE

Rory Alsop

#somemenarenice

Flyk

can we get back on topic now

AviD

@RoryAlsop #notallmen

Rоry McCune

@Flyk doughnuts?

Flyk

should I just change VPN providers out of good practice

AviD

12:40

ehh? ehh @Flyk? see, it works both ways!

Simon

JE N'Y PEUX RIEN C'EST ELLE QUI M'A CHOISIE

Nוnɛfוngɛrϛ

@Flyk AES is a symmetric algorithm, that is, if you have the key you can both encrypt and decrypt by doing the same thing in different directions (and sometimes not even that, in the case of DES). For public key, you need to agree a secret over a public channel where you trust absolutely nobody who can listen in.

Simon

C'EST LA VIE

Nוnɛfוngɛrϛ

For that we have key agreement protocols, like diffie hellman

Flyk

@AviD unique usage

Nוnɛfוngɛrϛ

12:41

basically we exchange bits of secrets and do some magic operations each end, and voila we end up with the same key

but nobody in between did

however, there's still a Q - how do you know you were talking to me in the first place?

Flyk

oh god what have I done

Nוnɛfוngɛrϛ

For that, I "sign" my message using a well known signature scheme, like say RSA

Flyk

you know that I understand each of the individual words you use but not the sentences you form with them, right?

chat slower

what is "diffie hellman"

Nוnɛfוngɛrϛ

@Flyk the most common way of agreeing a secret over an untrusted channel, using maths

Rоry McCune

Tinned_Tuna

12:43

@Flyk that is the name of a key-agreement protocol, named for Diffe and Hellman

Rоry McCune

^^that's diffie

Nוnɛfוngɛrϛ

I give you some numbers, you give me some numbers, we do some maths and end up with the same thing, but nobody else can work out what we came up with

Flyk

ok

I understand

Nוnɛfוngɛrϛ

obviously, there are special restrictions on the numbers we can choose to make that possible, I can't just pick any old numbers

so

once we've got our secret, we can both use this as a key

to a symmetric algorithm (one that only needs one key)

if anyone else knew this key - bang goes security

but we agreed it, and nobody else can know it

HOWEVER

It is possible when we were exchanging secret numbers that I was replaced by an imposter

Let's say by @RoryAlsop

Flyk

@RoryAlsop invented math, though

he's basically unbeatable

final boss alsop

Nוnɛfוngɛrϛ

12:45

If that happens you might think, hey, I'm talking with this guy with Nine fingers when actually you're talking with @Rory

To make sure this doesn't happen you need more maths

AviD

@Nוnɛfוngɛrϛ even if you're talking with @Nוnɛfוngɛrϛ, you're always talking with @Rory.

It's like Omnipresent Man.

Tinned_Tuna

@Rory = NSA?

Nוnɛfוngɛrϛ

I have a public/private key based on RSA (more maths) and I can use the public one to encrypt stuff, and the private one to decrypt stuff, or sign (a special case, but I digress)

Flyk

but wasn't rsa4096 broken already?

Nוnɛfוngɛrϛ

@Flyk Nope, rsa 768 has been factored

1024 is probably doable by the NSA if they're in the mood, or you say things like bomb in public internet chat

anyway

Flyk

12:47

Is this a lie then?

Simon

I started Windows update before I left work yesterday. This morning: "Preparing to install".

Nוnɛfוngɛrϛ

Ah, there's breaking and then there's breaking breaking

Tinned_Tuna

@Flyk That's a side-channel attack

Simon

Hey @AviD, Windows is a fucking piece of shit.

Tinned_Tuna

the maths still holds, but the implementation had some problems

Nוnɛfוngɛrϛ

12:47

One break is I give you "n" and you work out my factors

that you can't do

Flyk

what's a side channel attack

AviD

@Simon I'm sorry, I spent all afternoon on it.

Tinned_Tuna

@Flyk basically, when you do some computation, you require things like power, time, etc.

Nוnɛfוngɛrϛ

@Flyk any way of measuring what's going on so you can infer so info about the key

Simon

@Flyk It's a sound played on a side channel with a lot of attack.

Flyk

12:48

so, looking over somebody's shoulder is a side channel attack?

Tinned_Tuna

From your patterns of usage of these resources, an attacker may be able to infer secret things, like your keys

AviD

@Simon you're thinking of wind chimes.

Simon

@AviD Good, I'm expecting a fix before this afternoon.

Tinned_Tuna

@Flyk not quite, those are neither attacks on the implementation or the protocol; they're always present due to "stoopid" users.

Flyk

@Simon I'm placing you on ignore for the duration of this highly intelligent conversation, my brain refuses to context switch between knowledge absorption mode and silly fuckabout mode

Tinned_Tuna

12:49

@Flyk welcome to the club

Simon

@Flyk Look at you trying to understand security.

AviD

@Simon I will be glad to reimburse you for the day of lost work. I am sending a stick of gum in the mail now.

M'vy

5

Q: Origin of side-channel attacks

What is the origin of side-channel attacks? Is it related to the algorithm or to the implementation? In other words, is the software responsible for the attack or the hardware? Is there a cryptographic algorithm that is resistant to side-channel attacks on system A, but is not on System B? Can ...

side-channel

Flyk

@Tinned_Tuna right so it would be more social engineering then?

Simon

@AviD Not even a donut?

AviD

12:50

@Simon tad greedy, arencha

Simon

@Tinned_Tuna Go back to the sea.

AviD

@Simon is tuna made out of chicken?

Nוnɛfוngɛrϛ

@Flyk Or just plain bad operational security. In the words of the mighty Thomas Pornin, cryptography concentrates security into the key. If you input the key in the presence of an adversary...

Tinned_Tuna

@Flyk in that class, yea. Basically, an "intelligent" user would shield their keyboard, tell the other person to go away, etc. Intimidating people, using "polite" society tricks, etc. to allow you to monitor people is probably in the class of social engineering.

Simon

@AviD Only on Wednesdays.

TildalWave

12:51

@Nוnɛfוngɛrϛ or count the fingers

Tinned_Tuna

@Flyk but drawing the line is not necessarily easy.

AviD

►

sorry, before your time.

Tinned_Tuna

Right, I'm going to go put food in mah face. Enjoy.

Nוnɛfוngɛrϛ

So anyway, the signing bit lets you decide who you're talking to is who they say they are. The exchanging bit lets you agree a key.

Then you can do crypto.

AviD

@Tinned_Tuna aim for the big hole on the bottom.

Rory Alsop

12:52

I am putting delicious food in my face

Flyk

@Tinned_Tuna right so a side channel attack would be like (and I don't remember any of the specifics, it's just stuff I've read) the thing where if you chill RAM it retains data, or measuring the voltage of the CPU, etc?

AviD

... is what yo mom said to me, last night.

Flyk

I need sugar

brb, ice cream

Simon

@AviD Please, tell me that's not a reality show?

Nוnɛfוngɛrϛ

You could use public key crypto for the whole session, but it's much less efficient than than symmetric stuff

AviD

12:53

@Simon from a reality show, yes. One of the first.... and that bit was damn famous.

Nוnɛfוngɛrϛ

Also, agreeing a key per session is nice because once the session is over, the key disappears and there's no key to steal

Simon

@AviD SHE GENUINELY ASKED THAT QUESTION?

Nוnɛfוngɛrϛ

this is called "ephemeral" cryptography, or forward secrecy.

AviD

isnt she also the one that started the antivax?

@Simon oh yes

she is genuinely that stupid

Simon

Wow.

Nוnɛfוngɛrϛ

12:57

so @flyk to answer your question, the 4096 bit key is the size of the modulus n used in the rsa signing bit of your openvpn connection, meaning it probably can't be directly factored for a while. Then you're using aes-256 for symmetric crypto which is fine also, there's no known attacks that significantly reduce the complexity from "try every possible combination there is and hope"

AviD

@Simon I love the husband's look. Not that he is known to be smart, but that is some special level there.

TildalWave

@AviD that does make you wonder what she's doing on telly tho and does the majority really enjoy seeing others more stupid than them and still doing much better than they do, because I find that rather scary

AviD

@TildalWave oh absolutely

TildalWave

also one of the reasons I don't watch TV

Flyk

@Nוnɛfוngɛrϛ so VPN inside a VPN is probably too much?

Transcript for