The DMZ

Mark Buffalo

17:00

Either way

Simon

-.-

YOU WERE STEALING WOW GEAR

WHICH MEANS YOU'RE GREEDY

GREEDY PEOPLE ALWAYS ROLL NEED

Mark Buffalo

@Simon I only used it on myself

Simon

@kalina pls hulp

Mark Buffalo

Because two factor seemed silly against Keyloggers and I wanted to prove it.

Ohnana

@MarkBuffalo yeah, but it raises the resources and sophistication

you can't just run hashcat and get accounts

now you need to compromise the target machine AND scoop another piece of information

Iszi

17:02

@MarkBuffalo In short, threat moves from MitM to MitB.

Mark Buffalo

Indeed, but I like breaking things just because

Ohnana

@MarkBuffalo ees fun

Mark Buffalo

@Ohnana Yeah. Anything can be broken, circumvented, etc. That's my thinking

SebTu

Hello . Does anybody know if the NaCl Crypto Library uses Montgomery-reduction for the ECC primitives ? :-) Thx in advance

Ohnana

@ThomasPornin someone's using scary crypto words in chat, can you help?

^^ he knows everything about crypto

SebTu

17:17

Oh yes . I already read a few comments from him :D

Mark Buffalo

@Ohnana We better call the FBI. Only terrorists use encryption

Ohnana

@SebTu fun fact, he's one of the few people on SE that have been cleared to use a sockpuppet. tom leek is his other account

Mark Buffalo

@Ohnana Why?

Ohnana

@MarkBuffalo he only votes on the pornin account, and that much rep is too much for one account :P

bascially it's a harmless sock puppet

Simon

He repcaps too quickly for one account so he needs a second one.

SebTu

17:21

didn't bears are that clever

*know

Mark Buffalo

All the sudden my kidney is killing me. I'm feeling weird too

Rоry McCune

@Ohnana lol that article is like 5 years old :op

PC world are lame for not putting a date on it, but try looking at the comments

they start at 1285 days ago...

Ohnana

@RоryMcCune :O

Mark Buffalo

@Ohnana Motherfucker I just showed my boss and we botched at LinkedIn together

Ohnana

@MarkBuffalo they deserve it

Mark Buffalo

17:36

Lol

Get to work from home tonight though, so yay

Ohnana

@RоryMcCune those comments are cancer

Rоry McCune

@Ohnana heh, it's amusingly trending on twitter, loads of people RT'ing that linkedin has a hack.... I suggested to the pcworld twitter that putting dates on their articles might be a plan :)

Ohnana

@RоryMcCune apparently they updated the article?

timestamps motherpony, DO YOU USE THEM

Simon

@MarkBuffalo And my buddy posted it on his work Slack.

Whoopsies

Ohnana

@Simon hue

Rоry McCune

17:43

@Ohnana sure in 2012

Ohnana

@RоryMcCune /table flip

Rоry McCune

look at the content says linkedin hasn't responded and has 161 million users

I think they'd respond in 3 years and they have over 300 million users

Ohnana

haha

Rоry McCune

I tweeted a couple of people who're speading it, but I doubt it'll slow it down

would make an interesting study in how mis-information spreads on the Internet

Simon

The date of the article should be the first thing at the top

Ohnana

17:47

@RоryMcCune see also "we did it reddit"

Cameron Verotti

17:57

I'm dying

Simon

wot

Ohnana

wot

Cameron Verotti

o

kalina

@Simon what do you want

Simon

@kalina They said my WoW joke made no sense.

Thomas Pornin

18:05

@SebTu I have not looked at the code and the documentation is a bit scarce on the internals, but chances are that Montgomery reduction is NOT used.

Montgomery reduction helps with doing computations modulo an arbitrary prime p.

SebTu

and curve25519 doesn't use an arbitrary prime p ?

Thomas Pornin

NaCl uses the special "curve25519" where everything is done modulo p = 2^255 - 19

Mark Buffalo

@Simon Lol, now @Ohnana has started a riot

Ohnana

@MarkBuffalo wat

kalina

@Simon I didn't see a joke, were you trying to be funny?

Simon

18:07

pls

Thomas Pornin

That prime is chosen specifically so that modular reductions are efficient without needing to use Montgomery reduction.

kalina

@Simon srs -.-

SebTu

For ECC with prime p of no special form are their three common algorithms for modular reduction ? Classic / Barret / Montgomery ?

Ohnana

i didn't start the fire!

Thomas Pornin

@SebTu Normally people use Montgomery multiplication and Montgomery reduction, because it is simple enough to implement, and it is constant-time.

However, not many implementations support arbitrary curves.

SebTu

18:09

Montgomery multiplication for the ecc group operation ? e.g. montgomery ladder ?

because im wondering if it is a common way to use a native multiplication algorithm like the schoolbook- or comba-method for big integer multiplication e.g. $ c = a \times b $ passing the result $c$ to one of the modular reduction algorithms mentioned above ?

Thomas Pornin

Most implementations support only a few specific curves, typically the P-256 and P-384 curves from NIST, that use special-form primes.

Mark Buffalo

@ThomasPornin Real men support curves

Thomas Pornin

Using an integer multiplication (e.g. with Karatsuba) and then doing a reduction is not a usual thing to do with arbitrary primes, because this makes the reduction more expensive.

SebTu

@MarkBuffalo good point ! :D

Thomas Pornin

(Because you start with an integer which is twice bigger)

You still do that if you have a special-form prime that makes reduction easier.

As for the point multiplication algorithms, there are various methods.

SebTu

18:12

So usually you interleave multiplication and reduction ?

Thomas Pornin

@SebTu That's the point of Montgomery multiplication.

Multiply by one word, then reduce size by one word; repeat.

SebTu

And this applies for ecc ?

Not only rsa

Thomas Pornin

@SebTu Montgomery multiplication applies to all computations modulo a prime, and ECC computations use a lot of these.

SebTu

Yeah

Thomas Pornin

ECC tends to use smaller primes (say 256 bits instead of 1024 or 2048) but the principles remain.

This book will give you a lot of information on these subjects: cacr.uwaterloo.ca/ecc

SebTu

18:15

I always used an not interleaved approache for my implementations

Mark Buffalo

@Ohnana imgur.com/gallery/rAstg

SebTu

Yes . I habe it in front of me ! :D

*have

Thomas Pornin

That book has a lot more information but it is also a bit harder to read: amazon.com/…

SebTu

I used Comba-Method for multiplication and then montgomery-reduction for the result and obtained good results for my µC

using the MIRACL Library

AJ Henderson

I hate how clear communication can be perceived as offensive. I used a choice selection of one expletive phrase in my e-mail to the third party benefits provider, to make sure that the severity of the issue was clearly communicated (ie, you're making the last 4 of my SSN public which also probably puts you in violation of HIPAA since it deals with HSA funds). But, the fact is, it worked properly. It got the message forwarded to the CEO of the company and made sure he was aware of the issue

SebTu

18:18

Even better results using the µNaCl Library

Thomas Pornin

@SebTu For the point multiplication algorithm (this is independent of what you use for the base field), the algorithm of choice will depend on the curve type.

Mark Buffalo

@AJHenderson I would've just filled every few words with expletives.

AJ Henderson

so I just let him know "please tell your employees that were upset by it that I'm sorry, but it was necessary to make sure the severity was appreciated."

Thomas Pornin

For binary curves (curves in GF(2^m)), the Montgomery ladder is hard to beat in efficiency and ease of implementation.

Ohnana

@AJHenderson ooooh yeah that's something to watch out for

Mark Buffalo

18:19

@AJHenderson His response?

Ohnana

@MarkBuffalo :O

SebTu

@ThomasPornin Hm I skipped binary curves due to security concerns

Thomas Pornin

For curves in a prime field, some curves allow for an efficient ladder; others will usually prefer a window-based optimization on double-and-add.

AJ Henderson

@MarkBuffalo nah, explitives have a purpose, but it's only really effective if you use it sparingly in formal communication. It is valuable for conveying a specific feeling, but it's something to be cautious with

Mark Buffalo

@AJHenderson I prefer to come across as a rabid animal.

Thomas Pornin

18:20

@SebTu There is no real, rationally justified, security concern about normal binary curves.

But third-party support is less common.

AJ Henderson

@MarkBuffalo basically offered assurances that he'd make sure it was looked in to by their vendor and to have some security people take a look

Mark Buffalo

@AJHenderson Kidding, btw. So what happened? Did the CEO try to make you feel bad?

"some security people"

That worries me.

AJ Henderson

@MarkBuffalo that is a paraphrase, he sounded serious

this is a small local company

Mark Buffalo

Ah

AJ Henderson

I'm sure they hadn't even thought about the issues

Rоry McCune

18:21

@kalina this is @Simon I kind of assume he's always trying to be funny (absent explicit srsface -.- )

Mark Buffalo

@RоryMcCune I assume that too, but even when he does "-.-"

Ohnana

schroooooderrrr the diamond man

Rоry McCune

@MarkBuffalo oh no, srsface is srsbusiness, should not be dismissed -.-

Mark Buffalo

@RоryMcCune Oh no. He's done that to me before

schroeder

@Ohnana howdy

AJ Henderson

18:23

but his response was good, actually better than I expected. Basically thanked me for reporting it, pointed out the impact it had on his employees (make me feel a little bad) and sandwiched it with more assurances. I responded similarly that I thanked him for looking in to it and I'm sure they'll get it worked out (they really do a great job in their domain, security just isn't their domain), that I stand by my word choice, but that certainly I'm sorry for the collateral damage along the way...

and a few more security related thoughts I had realized since

Ohnana

@AJHenderson yeah it's one thing to use expletives, but being on the recieving end can be kind of harsh

Mark Buffalo

@AJHenderson That's good.

Ohnana

the best kinds of expletives are ones that aren't directed at people or projects

AJ Henderson

@Ohnana well and in fairness, I always avoid directed explitives

I dropped a "the only response I can have to this leak of data is WTF" or something like that

it was very specifically as my reaction to the situation

Ohnana

@AJHenderson oh jeez

that's weak

AJ Henderson

18:25

I spelled it out

Mark Buffalo

@AJHenderson I had this problem where an employee kept trying to harass me repeatedly. Instead of saying "f-you," I just said, "f-it," and walked out.

@AJHenderson Then she told everyone I said "f-you," and treated me even worse next time :-D

So I try not to use expletives when talking to people. Gives them a reason to be upset

Ohnana

@MarkBuffalo wooooow what a meanie-pants

idk how people decide that's an acceptable way to treat people

Mark Buffalo

@Ohnana Health care worker with a chip on her shoulder. She got fired for doing that to other people too.

but I never complained to her boss about her

AJ Henderson

yes, it does, sadly, sometimes that's a neccessary cost of making sure the severity of feeling is communicated accurately too though, especially since a non-security person is not going to understand the scale of issue of last four ssn in a username

without the explitive drawing attention to it, it is just "oh, someone's frustrated", not "WTF the sky is falling, get this fixed now or you're liable to be sued for HIPAA violations by someone because this is totally NOT OK"

Ohnana

i've found a good substitute for WTF is quoting a legal statute

that's sure to get their hearts a'quiverin

AJ Henderson

18:29

yeah, the hipaa angle hadn't actually occured to me at the time

so I didn't know for sure if there was a legal argument outside of just a general civil suit

and honestly, I would rather swear a bit than threaten legal action. It's a mistake and people are too law suit happy

Mark Buffalo

Everyone ready for some Star Wars spoilers?

AJ Henderson

cause threats are far worse than non-directed expletives in my mind, but maybe that's just me

Mark Buffalo

Luke....

....is Darth Vader's son!

AJ Henderson

@MarkBuffalo Nnnnoooooooooooooo!!!!!!!!!

Mark Buffalo

@AJHenderson Gotta be careful in the crybaby sissypants age. Almost anything can be perceived as a threat these days.

kalina

18:32

what about that bit at the beginning with the thief?

AJ Henderson

@kalina or the dinosaurs

kalina

and then Han finds a co pilot

and then the resistance forces land

AJ Henderson

I hear nature finds a way

kalina

and the rebel forces attack

Ohnana

@kalina the movie's not even out yet how are you spoiling

kalina

18:33

what do you mean how?

Ohnana

how are you spoiling something that's not out yet

kalina

because I already know what happens?

SebTu

@ThomasPornin may you find some time to anwser one remaining question . would be nice ! :)

1) Using Montgomery Multiplication is there any restriction for the multiplication algorithm for the field arithmetic ( e.g. Comba- / Schoolbook- / Karatsuba)

kalina

I don't understand the question

AJ Henderson

simple, she threatend to light JJ Abrams on fire unless he spilled the beans

Ohnana

18:34

@kalina movie is not out

how u spoil

kalina

well "how" is I press these buttons on my keyboard and words appear and then I press enter

Ohnana

how did you see the movie

did you set jj abrams on fire?

kalina

oh I can't share that information

Ohnana

please wait to do it after the new star trek movie is finished

kalina

wait, what?

Mark Buffalo

18:35

@Ohnana There are, ehrm, ways, to obtain the script/movie right now.

kalina

anyway they sneak into the deathstar

and then stuff happens

the end

Ohnana

@MarkBuffalo awwww i hate leaks

it ruins things

i don't like star wars, but still

kalina

in all honesty if you expected a star wars movie without all of that stuff ^ then you've not been watching star wars movies before anyway

AJ Henderson

@Ohnana I didn't realize you were so evil

;)

kalina

I've never even seen a star wars movie

well I watched like 15 minutes

Ohnana

18:36

not my fault the movies suck

kalina

and I've seen other bits walking through the room at various times

and I played one of the games for a few weeks

Mark Buffalo

@kalina I read 'bits' incorrectly for a second there.

AJ Henderson

but hey, now that George Lucas can't lucas them, who knows what could happen

kalina

because light saber duels...

pls they're getting disney'd

AJ Henderson

disney'd is still an improvement over a good old fashion lucasing

lucasing, now that should be an explitive

Rоry McCune

18:38

anyone posts star wars spoilers and they're on a one way trip to kicks-ville courtesy of my mouse :)

11

AJ Henderson

@RоryMcCune does that mean I should post spoilers just to see what happens ;)

kalina

@RоryMcCune well you should kick me then

since all of that stuff happens

Thomas Pornin

@SebTu Montgomery multiplication is, inherently, the combination of "schoolbook multiplication" interleaved with Montgomery reduction.

kalina

in that order

bye chat

Rоry McCune

@AJHenderson thats' just straight up mod-abuse! given I can't kick the hallowed blues

Ohnana

18:39

@RоryMcCune NO BALLS

kalina

"hallowed"

Rоry McCune

@kalina I didn't know you'd actually spoilered yet

Thomas Pornin

If you use Karatsuba + Montgomery reduction then you do not use Montgomery multiplication; you use Karatsuba + Montgomery reduction.

Rоry McCune

@Ohnana no I literally can't

kalina

oh well if you want an actual spoiler

Rоry McCune

18:39

@Ohnana the option does not appear in my menu on mods

Simon

SHUT UP NO

STOP IT

Ohnana

@RоryMcCune oh lol

AJ Henderson

@RоryMcCune I guess you'll just have to get kalina to get some good old fashion vigilante burnings

RoraΖ

@kalina A spoiler to Montgomery multiplication??? I think we all know how that ends

kalina

R2D2 ... at the ... :(

Rоry McCune

18:40

@AJHenderson "burn the spoiler"

Ohnana

is there a moderator so powerful that they can't kick themselves

SebTu

@ThomasPornin and it's the implementer decision to do the multiplication and reduction separated or not ?

AJ Henderson

@Ohnana yes, but they also can't unban themselves

Rоry McCune

@Ohnana I dunno, perhaps a mod can kick a mod, ...

AJ Henderson

as Undo discovered

Ohnana

18:41

@AJHenderson wait what

SebTu

@ThomasPornin There is so much stuff to consider with ECC !

Iszi

Well this was fun.

1. Found vulnerability, sent to sysadmins.
2. Sysadmins apply configuration changes to fix. App works, but changes fail to fix the vulnerability.
3. Repeat step 2 ad extremis - eventually the configuration was so that there should be no possible way the vulnerability conditions would exist. But it did.
4. Sysadmins tried an alternate solution. Solution fixed the vulnerability but broke some app features.
5. There's no obvious reason the new solution should be breaking the app, so I jumped in to review the docs. And found a step the Sysadmins were missing in the *original…

AJ Henderson

@Ohnana in chat, moderator permissions are tied to which account you have set as your primary association

so when I am mod-status, none of the ban or unban options are available for my user

Ohnana

@AJHenderson so he couldn't undo himself

AJ Henderson

but if someone changed my primary account to one I'm not a mod on, I become bannable

Ohnana

18:43

@Iszi /facepalm

AJ Henderson

so someone did that to undo and undo switched back to his mod account, but couldn't unban himself

Thomas Pornin

@SebTu It is up to the implementer to decide on implementation strategies, as long as it keeps things safe.

Iszi

@Ohnana More like #facepalm.

AJ Henderson

he could talk despite being banned since it didn't actually apply to him

but he showed as banned

Thomas Pornin

In particular, protection against side-channel leakage requires a lot of care and deep understanding.

AJ Henderson

18:43

it was pretty hillarious

Ohnana

@AJHenderson lawl who banned him?

Thomas Pornin

You should not implement crypto until you can actually explain why your implementation strategy is safe.

AJ Henderson

I forget, it was actually started as an experiment

but then it went on for like two weeks because it was just too funny

SebTu

@ThomasPornin I read that using special modular reduction e.g. with pseudo mersenne primes is not fully protected against side channel attack

@ThomasPornin uh . This will still take a long time thought ! ;-)

anyway thanks for the help :-)

Ohnana

@SebTu that fact that you say that gives me hope that you'll have a great product!

SebTu

18:46

Haha

well ...

:D

Thomas Pornin

@SebTu It really depends on how you do it, and the specifics of the hardware platform.

Mark Buffalo

@Iszi /palmface

Thomas Pornin

For timing attacks, Montgomery reduction is safe as long as the hardware multiplication opcode is constant-time.

AJ Henderson

@SebTu yeah, but the alternative is that someone who does looks at your code down the road and wonders why you are using the same key-stream for every encryption operation... oh wait, that was the last major incident I saw with incorrect application of cryptographic principals

Thomas Pornin

"Classic" reduction is much harder to make constant-time because you have to estimate the next quotient word, and, depending on data, fix it afterwards. That fix step is prone to leak data through timing.

Rоry McCune

18:49

How to troll nerds: 1) Go see #StarWars 2) Open support tickets 3) Include film spoilers in the ticket

Tweeted by buro9 on December 16, 2015 at 3:46 PM

Now that's evil

Ohnana

@RоryMcCune EVIL

Mark Buffalo

@RоryMcCune Ouuuuuuuch

Ohnana

4) get rekt by your it department in 5 different ways

Mark Buffalo

@AJHenderson Sounds like they deserve an award:

Ohnana

hue

SebTu

18:51

@AJHenderson I tested the implemented code and it works just fine . I used some libraries and did myself some modifications. ECC is really a lot of stuff to consider and partially I know what I am doing. The rest manages the library ;-)

@ThomasPornin Are side channel attacks your research area ?

Thomas Pornin

@SebTu Technically no, but I did look such things up recently.

And more generally, I take care to try to understand how things work, down to the fundamental interactions (most of what happens in computers comes from electromagnetism).

SebTu

Think there are side channels attacks measuring electromagnetism

You probably spend a life time on this to understand how things work

Thomas Pornin

@SebTu That's not a problem, since being alive appears to come with, indeed, a life time.

SebTu

@ThomasPornin true ! :D

I leave . Nice evening / day guys :-)

and thanks again for taking time to awnser

*answer

S.L. Barth

19:08

I'm looking at this new question:

0

Q: ethical hacking question

Lets say for instance... X has hacked Y X does not know Y but thought Y looked and sounded suspicious over social media X infiltrated their emails and discovered content that local authorities would be highly interested in. The only issue is how would X inform the authorities about Y being a ...

ethics

I'm wondering if this is on-topic? It is a valid question, and I think there can be some good answers to this. But it also feels off-topic - and perhaps too opinion-based.

Ohnana

@S.L.Barth x and y need to take a computer break

i think phillip's answer hit it on the head

you cannot, because legal stuff

although legal stuff is not good

S.L. Barth

Hm... it's also possible to report crime anonymously, in some jurisdictions. It would not be evidence, but it could lead to the investigation that gets a criminal convicted.

Ohnana

@S.L.Barth i'm starting a close vote, let's see what other people think of it

S.L. Barth

I'm undecided, so not going to flag. Let wiser people than me decide.

Thanks for thinking along!

Ohnana

@S.L.Barth exactly my thought

AviD

20:14

@JourneymanGeek the actual box, the case

@Simon why, wadidimiss?

Ohnana

@AviD scroll up like an inch

AviD

@RоryMcCune pls, insiders come to that conclusion

@Ohnana you dont know what resolution I have

or font size, for that matter

Ohnana

@AviD relative inch

AviD

@Ohnana @Simon is gonna be offended by that

@Iszi lol offensive use of humor there. Or humorous use of offensiveness.

Simon

20:41

@AviD Did you read it?

AviD

@Simon read what?

Simon

da drama

@AviD Start from here: chat.stackexchange.com/transcript/message/26226303#26226303

You did read the first part, since you were involved in it too.

AviD

@Simon was I?

Simon

Ya the "M" word thing.

AviD

@Simon DAMMIT HARDISSON!

Dammit Hardison!

►

Simon

20:46

wat

Anyway, I guess I should stop using "bad" words since it makes some people go all bananas.

Never go full bananas.

AviD

@Simon hey man, my monkey finds that offensive.

Simon

Would pineapple be less offensive?

I assume that could be offensive to apples?

AviD

offensive to @Adi.

Thomas Pornin

@Simon "Pineapple" is the usual nickname for fragmentation grenades, which are technically known as defensive grenades.

Ohnana

@ThomasPornin as opposed to the grenades you fight with?

Thomas Pornin

20:51

(Offensive grenades are pure explosive, so that you can throw them while marching on the enemy, while defensive grenades include fragments meant to be used while retreating, i.e. in a "defensive" way.)

Ohnana

oh i see

pull the pin and run at it = offensive, pull the pin and run = defensive

Thomas Pornin

This is an offensive grenade.

This one is defensive:

Gilles

@Ohnana pull the pin and don't run = suicidal?

Simon

@ThomasPornin Interesting, since those are usually the ones that you see in movies and they sure are using them as offensive ones.

Thomas Pornin

As you see, only the defensive grenade features the characteristic "pineapple" pattern.

Iszi

20:54

@Gilles Only if you also don't throw it.

Or have a shit arm.

AviD

@ThomasPornin thats not universal.

Transcript for