The DMZ

Xander

00:06

@RoryAlsop Fantastic, thanks!

Rоry McCune

07:23

mornin' all

HamZa

morningz

SmokeDispenser

morning all

Matthew

morning

Rory Alsop

08:04

Morning

M'vy

monring

Gilles

08:22

morning

AviD

mourning

Journeyman Geek

moo

Adi

mornin'

SmokeDispenser

oh noes, the morning-train wrecked

HamZa

@SmokeDispenser c-c-combo breakeeer!

SmokeDispenser

08:31

that wasn't me, either @AviD or @JourneymanGeek

Journeyman Geek

totally @AviD

SmokeDispenser

btw, lookat this nice team up: security.stackexchange.com/a/120098/92273

yeah, @AviD is the usual suspect.

Matthew

Brent still hasn't grasped that this isn't a discussion forum

AviD

wat

also, wat

I had nothing to do with that q

Rоry McCune

no you broke the "morning" thread by being dolorous :op

AviD

08:43

I??

it was this one:

14 mins ago, by SmokeDispenser

oh noes, the morning-train wrecked

Rоry McCune

21 mins ago, by AviD

mourning

AviD

funny selfmeta

@RоryMcCune still counts

Rоry McCune

@AviD I was just saying that's what people were referring to :op

AviD

@RоryMcCune nuh uh

Rоry McCune

12 mins ago, by Journeyman Geek

totally @AviD

AviD

08:45

@SmokeDispenser also I would say the close reason there is not the best.

SmokeDispenser

@AviD, I voted against closure.

@AviD feel free to start a reopen vote;)

AviD

no, I think it should be closed, it was the reason that is suboptimal.

SmokeDispenser

well, yeah, I'm not sure. I answered.

thus I should not VTC

HamZa

09:02

@SmokeDispenser I've seen several people answer and still VTC :P

Not that I universally agree

cremefraiche

sometimes this site, man

40 upvotes and going on a wrong answer from two days ago

when will the madness end!?

literally tells OP that what he is trying to do is impossible when it most certainly is possible, because even a neophyte like me can do it

SmokeDispenser

@cremefraiche link?

cremefraiche

10

A: How to know if a file is decrypted or not

You absolutely can tell with varying degrees of certainty if a file, or even string, was successfully decrypted. Most of the challenges at cryptopals depend on it. I have begun to make a tool for ciphertext bruteforce and analysis that automates this very task. You can find it here if you want to...

le sigh

o

didn't mean to link to my answer

I'm not even in it for the upvotes anymore.. I'm just trying to battle crypto misinformation

SmokeDispenser

@cremefraiche, the accepted answer is right

cremefraiche

"You really can't, if you're just encrypting / decrypting text."

that is wrong

SmokeDispenser

09:14

nope

think of it this way: I'm doing ciphertext = e(k1,e(k2, plaintext)).

how do you tell that d(k1,ciphertext) is correct?

Rоry McCune

lexical analysis

you can't get 100% but you can provide degrees of confidence (assuming you know the language used in the original message)

SmokeDispenser

@RоryMcCune w/o any knowledge of the plaintext?

Rоry McCune

so you can say (I've applied decryption key "x" and now x percentage of the words are english language words)

sure if the plaintext is just random garbage that won't work

but if the plaintext is a set of english language words, you could say what percentage of words match known words with each key

so it depends on the exact parameters as to whether it's possible or not

cremefraiche

i don't think OP has even considered e(k1,e(k2,plaintext)), I was working on the assumption of e(k1,palintext).

Rоry McCune

so e.g. github.com/peterc/whatlanguage as a lib that can detect language based on an input string

you could apply that to the "decrypted" text and assuming a decent length of text in a known language, you could at least provide an educated guess as to which was right

cremefraiche

09:20

i do that here rory =D (shameless plug) github.com/theRoda/uniciph

Rоry McCune

(before the crypto people say it, I know this doesn't apply where the cipher can provide multiple "valid" responses depending on key, I'm assuming a relatively basic non-tricky cipher)

cremefraiche

hacking with python guide got me into the english detection

I don't get how a n00b like me can do some crypto challenges and bruteforce classic crypto, but dude saying it's impossibru is going down as the definitive word in that thread

bleh

need more crypto buffs with smarterer words and such

too bad bruce schneier doesn't curate D=

Rоry McCune

well yes I'm not a crypto person nor do I even play one on TV, but I can see scenarios where it works/doesn't work. and my guess in that it's a small part of a university class is that this will fall into the "does work" category

Sergio Andrés Figueroa Santos

@cremefraiche It's a matter of conditions. If your plaintext is known to be English words, your answer fits for

Matthew

In the general case of "random binary data", you can't tell, but this specified text, so yes, it's possible

Sergio Andrés Figueroa Santos

09:26

[bad enter key!] ... fits for Caesar cipher, for instance. Not that much for OTP. If the plaintext is "random" or its distribution is not known, as @Matthew said, the accepted answer is right

cremefraiche

I guess he doesn't actually specify what the file is

Sergio Andrés Figueroa Santos

In crypto the answers usually look like "no, you definitely can't do that at all... unless we change a small condition. Then it's easy as cake"

cremefraiche

OP says he is talking about caesar and XOR

i don't see the practical case of someone encrypting random binary data. if we are talking practical crypto, there will be patterns in the plaintext that can be analyzed

Rоry McCune

reading the question again it mentions files in specific file formats, so you could likely even do it trivially by testing each key and then running linux "file" against it, and if it's not "binary data" flag as probably decryption

but if we take the question in the context provided "it's part of a university course and they're expected to implement it" then the accepted answer is definitely not right, unless the tutor is very nasty person who assigns unachieveable tasks

cremefraiche

file headers, footers, sigs, exif, strings, etc. there will be a pattern in the cleartext, and a well made oracle can find it if it's there. i made a crappy oracle as an undergrad. imagine what the guys in the big leagues have

telling someone it's impossibru just seems misinformed. /endrant

Sergio Andrés Figueroa Santos

09:32

@cremefraiche, exactly. With Caesar and English words (or recognizable file formats, however they mix that with Caesar), your answer holds (always in terms of high confidence). With XOR (OTP, I'd understand), the accepted answer holds.

Rоry McCune

likely the best way to phrase an answer is my favourite opening phrase from my Sec.SE answers "It Depends...."

cremefraiche

heh, always must qualify ;]

XOR is just as bruteforceable as caesar, sergio

Rоry McCune

@SergioAndrésFigueroaSantos don't you think that that ignores the context of the question? it seems a shame to send a college student down a line of "this can't be done" when logically that's very unlikely to be the case in the context of a solution they've been asked to implement for a course excercise?

cremefraiche

sinlge byte XOR and repeating key OR

*XOR

@SergioAndrésFigueroaSantos cryptopals.com/sets/1

Rоry McCune

I wish I had enough time to go do cryptopals

cremefraiche

09:37

I've gone up to most of step two a while ago, but haven't had time lately either.

reallllly want to get to the step 6 bleichenbacher

Matthew

@RоryMcCune Just phone them up! :-)

Rоry McCune

@Matthew heh yeah I guess if I got stuck I could drop them a line :) I'd be torn between doing it in a language I know (Ruby) or trying to use it as excercises to learn a new one (likely Go)

Matthew

@RоryMcCune Go is such a daft name for a language. I always think of the game with the tokens and grid...

cremefraiche

is Go getting picked up out in the field?

like, wasn't google into it?

so many languages I have no idea if they will become relevant to me (ocaml, go, swift, rust, groovy, lua, clojure)

just as long as I don't have to work with vb.net

Rоry McCune

09:53

@cremefraiche Docker is written in go

it's generally quite popular amongst people making cross-platform command line apps

as it's good for that

cremefraiche

well huh

i like cross-platform

@RоryMcCune like built-in sys libraries?

s/sys/os/

Rоry McCune

@cremefraiche well docker was one example I've come across, keybase was another but there's a huuuuuuge list of them github.com/golang/go/wiki/Projects

cremefraiche

oh dang, keybae too

*keybase

oh look at all those crypto projects

nomnomnom

going to have to start using the Go IDE at codinggame more

i've done an if/else

it was weird for me

Matthew

10:55

why? Does it have odd syntax?

SmokeDispenser

11:21

\o @RoryAlsop

Rory Alsop

11:38

o/ @SmokeDispenser

SmokeDispenser

My repgain is slowing down. I'm kind of slacking or the questions got bad in the last three days. I wrote almost no answers :)

Journeyman Geek

11:58

When I was super serious about repgain on SU, I tried to answer one question a day

at this point tho, I kinda cruise, and answer interesting stuff anywhere

Rory Alsop

I have odd bursts of non-mod activity, but I'm not that good at consistently answering - bit like @JourneymanGeek

Journeyman Geek

@RoryAlsop that was mostly pre mod tho ;p

I throttled back a bit over the past year or so

Rory Alsop

My answering was goodish until I got 5 sites. Now most of my SE time is modding. Hence why I only have 5 sites over 10k ...

Journeyman Geek

lol

I have only one site over 10K

M'vy

@cremefraiche do that guy stole your cat picture: security.stackexchange.com/questions/120120/…

SmokeDispenser

12:52

ofc that is off-topic on SE ;)

StackExchange

13:08

Community Of Professional Developers Now In Russian

Nicolas Chabanovsky on April 11, 2016

We're thrilled to announce that the Russian-speaking community of software developers and programming enthusiasts, Stack Overflow in Russian, has been graduated. Congratulations colleagues for such incredible success!

Thomas Pornin

Hello people

Journeyman Geek

lo

Rоry McCune

hi @ThomasPornin

Thomas Pornin

I am just back from 10 days away. Apparently there was some drama?

I got an invite for a rebel chat system.

Rоry McCune

@ThomasPornin ah yeah you missed it all :) stuff happened

Thomas Pornin

13:16

Can you summarize it for me (but less summarized than "stuff happened") ?

Rоry McCune

I'm actually not sure I can :) whilst maintaining accuracy/lack of apparent bias

if I summarized I'd risk inadvertantly offending one of the participating parties

Simon

pornu shut top and join the rebellion

Thomas Pornin

"You rebel scum"

Simon

Believe it or not, there was drama regarding flags.

Thomas Pornin

Un-be-lie-va-ble.

Simon

13:18

I knew you'd find it hard to believe.

Rory Alsop

@ThomasPornin - good afternoon!

M'vy

heya

Thomas Pornin

@RoryAlsop I am a bit jet-lagged; I don't really know the time of day.

M'vy

Well, it still depends the country

Ohnana

what locale did you grace with your presence?

Thomas Pornin

13:30

I was in Japan.

silverpenguin

@ThomasPornin the best place on earth e_e

Simon

Lucky bastard!

@silverpenguin Hey fugly manatee, shoot me your email and then quickly delete it you donut.

silverpenguin

@Simon its on linkedin :P

Simon

Blargh, I'll get it tonight then.

Got it

Check your emails

silverpenguin

ok just waiting for it to come through (I have a central inbox)

StackExchange

14:06

I just spent 20 minutes deciding whether to start an email with 'Hi' or 'Hey', so I think it transferred correctly.

3

SmokeDispenser

can we close this down?

M'vy

14:22

You got it

SmokeDispenser

thanks, @M'vy

SmokeDispenser

14:55

mods, migrate to crypto?

Rory Alsop

@SmokeDispenser not 100% sure we need to. A chunk of it seems to be around implementation.

Thomas Pornin

@RoryAlsop I think it is better in Sec.SE than Crypto.SE

SmokeDispenser

haha

I was just typing to suggest asking you :)

Matthew

15:11

-2

Q: Esclation priviliges ubuntu?

Im now at post-exploit phase,i want to do escalation priviliges in ubuntu to get root,i tried some exploit like https://www.exploit-db.com/exploits/15704/ but it give a message error ''failed to get root'' im in a traineeship so i want to apply escalation privileges!im trying to do it in a vulne...

SmokeDispenser

15:22

@Matthew, what about it?

Matthew

@SmokeDispenser The OP had modified. Was still crap. @schroeder has replied to them pointing this out, since my initial attempt didn't stick

SmokeDispenser

@RoryAlsop, @ThomasPornin, I answered, maybe OP can clear some things up. Yet, I'm off line in 20 minutes for the evening. Feel free to ping me if you find something horrible in the A.

I might be able to sneak small edits in from my mobile.

also, isn't the right term privilige escalation, @Matthew?

why didn't @schroeder edit that when he was editing anyways? Am I horribly mistaken?

Matthew

Privilege Escalation, yes

Thomas Pornin

@SmokeDispenser I was writing my own answer at that time. I have not read yours yet.

SmokeDispenser

@ThomasPornin, did just see that. will read yours and may be delete mine.

yours are better, usually

@ThomasPornin, after reading your answer, I'll leave mine up, they cover different corners:)

off line for now, if something comes up, let me know by ping:)

schroeder

18:16

my visa was approved!! Everything's official!

Jacco

18:26

need some advice: I recently contacted the author of a well known and widely used open source project and informed him about a number of issues with the encryption module that ships with their product.

Today I got a response that is quite defiant: it questions the seriousness of the issues I raised and demands that I show them a working exploit or, basically, shut up and don't bother him.

along the lines, he places question marks at my level of knowledge.

I could publicly post my findings, but I would rather give them the time to solve the issue behind the curtains. Does anyone have any advice on how to convince a person who thinks his flawed code is not flawed, unless I can show a working exploit, that they need to fix their encryption class?

Thomas Pornin

@Jacco It is a psychological issue, not technical.

Rоry McCune

that's a personality issue most likely, if he's defensive then it doesn't sound like he's too open to issue reports of this nature

annnd ninja'd by a bear

how did I not hear him creep up behind me...

Thomas Pornin

@RоryMcCune Because ninja. Duh.

Jacco

bears are silent creatures, especially ninja bears.

Rоry McCune

Thomas Pornin

18:33

@Jacco: if the product is open source, then escalating to publication is fair game.

Jacco

the thing is, it is a PHP project with lots of attention from 'junior programmers' who adore this project.

Thomas Pornin

You explained the issues as best as you could. Give him a week or two to think things over, then publish the exact same explanations on your favourite place.

Ah, PHP.

Jacco

So I fear that raising the issue on their platform will lead to a lot of downplaying the issue.

Thomas Pornin

Well, it naturally sets a high bar for what is an issue "worthy of attention".

Facts are facts. Just publish and let people wail and whine.

Jacco

The issue is not 'everything is broken' severe, but it still needs to be addressed. (in this case, using the same key for mac and encrypt, among several other issues)

Rоry McCune

18:36

@Jacco you could always publish anonymously if you don't want the hassle of fanboys

Jacco

The other thing is, I've several more issues lined up, with other parts of the project.

Hmm, I might go for the anonymous posting. That would save me the attack on my person.

Thomas Pornin

@Jacco Using the same key for encryption and MAC is not necessarily a big issue. It is a big issue if the encryption uses CBC and the MAC is CBC-MAC.

@Jacco The person you already contacted will still know that it's you.

Jacco

it uses CBC, with encrypt than mac

SEJPM

@ThomasPornin would CBC-MAC with length preprending also be vulnerable?

Jacco

I don't think he will publicly shame me (I think/hope he is professional enough on that side)

SEJPM

18:39

@Jacco .... you really assume people behave professionally on the internet?!?!?!

Jacco

maybe I'm still naive.

Thomas Pornin

@SEJPM It would take some serious looking-at, at the very least.

@Jacco But is the MAC some HMAC, or CBC-MAC?

Jacco

hmac using sha256

Thomas Pornin

@Jacco Then it is probably fine (well, at least for that point)

Jacco

My problem is that I'm (obviously) not a cryptographer, I'm merely 'the security guy' in my company. So i'm hardly good enough to explain the implications of things of things to somebody who is determined not to accept what I tell, unless there is no other way around it.

Thomas Pornin

18:43

It is kinda sloppy to use the same key for encryption and MAC, but HMAC/SHA-256 is "sufficiently different" from whatever encryption they are using (I am guessing AES or Rijndael-256) to avoid nasty interactions.

If using AES-CBC + HMAC in encrypt-then-MAC order, then any issue will be in IV management. See if they generate a fresh IV for every message; the IV must be random and uniform (with a strong random generator); and, crucially, the IV must be included in the HMAC input.

If they botch the IV then it is worth reporting and/or public mocking.

Jacco

There are quite some other issues, none of them is overly serious, but it has all clearly been written by people who are not experienced at writing secure code. (I do a lot of code reviews, I can spot the difference).

Thomas Pornin

But if they use a properly random per-message IV, and use the IV as part of the HMAC input, then they got most things well.

@Jacco If they were experienced with secure code, they would not use PHP to begin with...

Jacco

IV generation is ok, on most platforms. But since quality is not checked, it can be bad without any sort of warning.

Let's just say that this code is used a lot within the PHP community.

the iv is base64 encoded (don't ask me why), prepended to the cipher text and the combination is then fed into the hmac.

SEJPM

@Jacco PHP, even the crypto lib devs don't get crypto right :(

@Jacco encoding doesn't matter

Jacco

Encoding is just not needed, but it doesn't hurt (except in that, at the cost of no extra security, it adds complexity).

Anyhow, is summary you guys recommend not trying to continue trying to convince the guy, but make raise the issue publicly within a week or so?

Thomas Pornin

18:53

@Jacco For the specific case of key reuse between AES-CBC and HMAC/SHA-256, I would recommend not raising the issue at all, because there is indeed no known weakness in that.

For other security issues, it depends on these issues.

Jacco

Other issues are on a separate part of the code base (the remember me functionality).

Ok, then I'll just leave this issue be.

Iszi

19:13

@ThomasPorninThis looks like it's for you.

0

Q: is it possible to find the original value of a hashed string, if you don't have the entire hash

I'm wondering if there is a faster way than bruteforcing to find the original contents of a string if you have/know: 60 % of the original string (30/50 characters) the amount of characters the string has. know a range of the 8 first possible characters in the hashed string is it possible to f...

sha256

Thomas Pornin

@Iszi Done.

Iszi

@ThomasPornin So, I'm a little unclear. Strictly, it should be impossible to uniquely identify the original input if you're missing any piece of the hash. But in practice, how many possible inputs actually map to feasible inputs? i.e.: When it's known that the hash is of a password, you're only interested in inputs that actually map to characters that can be easily typed. Taking this into consideration, how likely is it that you could find the original input when you're missing X hash bytes?

Thomas Pornin

@Iszi Even with the whole hash value, it is not possible to uniquely identify the original input, because hash functions are not injective.

SHA-256 has a 256-bit output, hence 2^256 possible output values. If you have more than 2^256 possible inputs, then it is a mathematical certainty that several hash to the same value.

If you work with a set of possible inputs that is smaller than the square root of the hash output space (i.e. less than 2^128 for a 256-bit hash), then it is expected that they all hash to distinct values, in which case, if you find a matching input, then it probably is "the" input.

Iszi

19:28

@ThomasPornin In general, it's true that any given output of a hash function may have multiple inputs. This is assumed because the length of the output is fixed, while the size of the input may be arbitrary. However, when it comes to passwords - where the likely input size is far smaller than the hash size - is it not probable, if not even certain, that any match found within that input size will be the match?

@ThomasPornin I think this answers the above, but please clarify if not.

Thomas Pornin

@Iszi Assuming the hash value "randomly" assigns outputs to inputs, this is the setup for the so-called "birthday paradox".

Birthday problem

In probability theory, the birthday problem or birthday paradox concerns the probability that, in a set of randomly chosen people, some pair of them will have the same birthday. By the pigeonhole principle, the probability reaches 100% when the number of people reaches 367 (since there are only 366 possible birthdays, including February 29). However, 99.9% probability is reached with just 70 people, and 50% probability with 23 people. These conclusions are based on the assumption that each day of the year (except February 29) is equally probable for a birthday. While this makes for an amusing...

SEJPM

@ThomasPornin how well do you know the chacha20-poly1305 spec?

Thomas Pornin

@SEJPM I have not implemented it.

There is a RFC, but it is unclear whether it is "the" spec.

SEJPM

@ThomasPornin cause Google?

Jacco

@ThomasPornin, I just realized, the open-source project I mentioned earlier uses one (1) 128-bit key for everything that needs a secret key of sorts within the code.

SEJPM

19:33

4

Q: Nonce encryption with Poly1305-Chacha20

I have seen that a couple of companies (like Google, Apple HomeKit) are adding "ChaCha20-Poly1305" as an encryption option. Poly1305 requires algorithm to encrypt the nonce. The Poly1305-AES specification uses the AES algorithm to encrypt the nonce, but also says "There is nothing special about ...

aes chacha poly1305

Thomas Pornin

@SEJPM Normally, "the" spec is the one that is written by the original author or standardization body. Google did not invent either algorithms, but picked them up from their original descriptions which were a bit lacking on the "specification" side.

Now Google is pushing for the definition of a SSL/TLS cipher suite that uses these algorithms, but it still is a draft.

SEJPM

@ThomasPornin so the spec at that point was: "Whatever DJB's code did?"

Iszi

@ThomasPornin Still a bit confused here then. Is it a good thing or bad thing for a hash function to have unique outputs for all inputs which are smaller than or equal in size to its output size?

Thomas Pornin

@SEJPM More or less. DJB's article tend not to nail down issues such as endianness.

@Iszi With the "smaller than or equal in size", it is not good or bad, it is just impossible.

SEJPM

endianness.... what a pesky little implementation detail, stopping the awesome crypto guys from doing awesome work

Thomas Pornin

19:38

There are 2^257-1 possible sequence of bits of 256 or less bits.

SEJPM

@Iszi did you clean up the pinwall? it looks so empty :(

Thomas Pornin

What is "bad" would be trying to skew a given hash function in order to get more injectivity than what you expect from a truly random function.

Iszi

@SEJPM Pins probably timed out. Dunno what the timer is, but I haven't pinned in awhile and I guess nobody else has either.

Thomas Pornin

@SEJPM There is a problem with standards. On the one hand, writing a good standard is a lot of effort, and there are a lot of bad standards around. On the other hand, lack of standard is also a problem.

SEJPM

2

A: Please show who pinned or unpinned a message

I haven't checked the specific issue, but be aware that pins are auto-removed after 14 days, because we found this feature to be abused too much. If you feel so strongly about a particular message, why don't you just post it again and pin the new one?

Iszi

19:41

@SEJPM Oh, 14 days? Pretty sure it hasn't been that long. Then yeah, someone probably cleaned it when I wasn't looking.

Rоry McCune

@SEJPM I cleared it :) I was hoping the drama to which it referred was over...

so the pins were redundant

SEJPM

@RоryMcCune so no awesome stories on the pinwall for now? :(

Thomas Pornin

As far as I can see, one of the gripes of DJB against crypto standards is that they do not cover implementation issues such as resistance to cache timing attacks.

Rоry McCune

@SEJPM well that last set of pins wasn't a story... will need to see what comes up to make a new one :)

SEJPM

@ThomasPornin and he hopes to address crypto sidechannels by avoiding specs?

Iszi

19:42

@ThomasPornin So, for a hash function with 256-bit output, it is expected that the number of unique outputs among all 256-bit inputs will be less than (2^257)-1 and that's... not necessarily good nor bad, but "okay"? (Or is it just more like "mathematically inevitable"?)

Thomas Pornin

Pushing a reference implementation, to be included "as is", kind of solves that issue, but raises other ones, such as what happens when your target system is not a PC running a Linux derivative.

@Iszi It is mathematically expected that, with a 256-bit hash function, the set of all 256-bit inputs (size 2^256) will yield a fraction of the set of all 256-bit outputs (about 63% of that set, so a bit more than 2^255 distinct outputs)

SEJPM

@ThomasPornin #pclinuxmasterrace

Thomas Pornin

@SEJPM When the "reference code" is a C++ source code with a GNU-specific Makefile, it tends to limit your options.

Crypto researchers in general tend to think in terms of the hardware they have on their desk, not the hardware that is permeating the industry.

SEJPM

@ThomasPornin I guess the issue is not "C++" here but "ASM", "intrinsics" and "GNU-specific Makefile"?

Thomas Pornin

@SEJPM C++ is an issue because its support relies on some runtime components that are not available on all platforms.

I have done implementations on a HSM where code had to be written in "plain C" and even some of the most basic C functions were missing.

Iszi

19:47

@ThomasPornin So, for 74% of all 256-bit inputs, there's at least one other 256-bit input that will produce the same output?

Eh, I might have borked my logic a tiny bit on that.

Thomas Pornin

@Iszi With 63% instead of 74%, and "outputs" instead of "inputs", that's what is expected.

We don't expect to be able to prove it.

SEJPM

Intriguing, I always thought C++ was as good as plain C when it comes to "compiles everywere", utile thing to keep in mind

Thomas Pornin

@SEJPM Even beyond the C/C++ debate, there are some platforms where neither is an option. E.g. on Android you must go Java; on some smartcards that will be (reduced) Java or (reduced) C#.

Or something else.

On really small platforms you will use assembly anyway.

SEJPM

@ThomasPornin huh, android should run C++ IIRC

Thomas Pornin

@SEJPM In previous incarnations it was Java-only, so that the underlying hardware platform would not matter (e.g. MIPS vs ARM). This might have changed in recent versions.

Iszi

19:52

@ThomasPornin Here's where I went... You said all 256-bit inputs will only generate 63% of the possible unique 256-bit outputs. That implies 37% of all inputs generated an output that covered in the aforementioned 63%. So, I take this to mean (corrected math a bit): at least 37%+1, and up to 74%, of all possible inputs have a "twin" - another input that will generate the same output.

SEJPM

@ThomasPornin it's called "Android NDK"

Thomas Pornin

@Iszi I think your logic is trying to dance a salsa with its shoelaces tied together.

Mmh...

In fact the number is also about 63%

Iszi

@ThomasPornin Say you have 10 single-digit numbers which range from 0 to 9. Now let's say only 60% of all possible single-digit (base-ten) numbers are represented in that range. We could have 0123450000 or we could have 0123450123.

SEJPM

@ThomasPornin you sure it's not 42?

Thomas Pornin

That is, for any given 256-bit input x, the probability of another 256-bit y distinct from x yielding the same 256-bit hash output should be about 1-1/e, which is about 0.63212.

Iszi

19:58

Okay, if e is getting involved I'm tapping out.

Thomas Pornin

That's probabilities for you. e is always involved.

Iszi

Still, even saying 63% of all likely passwords are vulnerable to collision? (Am I really interpreting this wrong?) That seems bad.

Thomas Pornin

@Iszi For passwords, the set of plausible inputs is much smaller than 2^256.

You can consider yourself lucky if you could educate your users to go beyond 2^40.

Iszi

@ThomasPornin Yeah, I was about to mention something like that.

Thomas Pornin

Collisions, in general, are not a problem for password hashing -- you should think in terms of preimages, not collisions.

There is a widespread tendency of panicking and running in circles when one utters the term "collision" but that's unwarranted most of the time.

Iszi

20:03

@ThomasPornin Is that really just because the search space for likely passwords is so much smaller than the hash's output space?

Thomas Pornin

@Iszi No, it really is because the attacker's problem is really a preimage attack, not a collision attack.

The attacker is trying to find a preimage for a given hash output.

Whether there are two or more possible preimages is not a problem, as long as finding one of them is hard.

Iszi

@ThomasPornin True, but collision resistance is still a factor in preimage resistance.

Thomas Pornin

A flawed but amusing argument would even be that collisions are here a benefit, because then the attacker finding a matching password might not hit "the" password that the user might have reused elsewhere.

SEJPM

@ThomasPornin, while we're at password hashing: How large does a random salt need to be for password hashing? Unique (e.g. a few bytes)? Unpredicatble (e.g. 16 bytes)? Collision-resistant (e.g. 32 bytes)?

Thomas Pornin

@Iszi Not really. See MD5: very poor collision resistance, but still very strong for preimages. (MD5 is bad for passwords because it is fast, not because of collisions.)

@SEJPM For salts, uniqueness is what you want. Random generation is a nice way to have uniqueness; 128 bits are enough for that.

Salts do not need to be unpredictable.

Iszi

20:09

@ThomasPornin I'm not sure how that's flawed. From the perspective of defending one application, certainly - you don't want any vulnerability that expedites the attackers ability to impersonate a user on your site. But how is it flawed from the end-user's perspective? In theory, it does still limit the search space the attacker needs to try on a second site but there's still a crap-ton of brute-force involved regardless.

Thomas Pornin

@Iszi It is flawed because having more collisions does not actually change the search space. I think it has been discussed on Security.SE (I remember having written an answer).

Iszi

@ThomasPornin So, it would be a speed-bump like MAC filtering on a Wi-Fi AP?

Thomas Pornin

@Iszi To get 1000 matching passwords instead of 1, you need to make dictionary attacks 1000 times easier, so you do not actually make it harder to guess "the" password.

In fact you just provide the attacker with a way to make a short list of 1000 potential passwords.

Time to go home. See ya later.

Iszi

@ThomasPornin Understood. But the point remains that the password the attacker initially found, and presumably where he stopped working the first time 'round, won't work on another site that uses a different hashing mechanism (or salt, for that matter). Overall, it doesn't make finding the password any "harder" but it makes the attacker's initial work less re-usable.

Iszi

20:44

Sorry guys. Couldn't help myself on this one.

I'd put a UDP joke in here, but I'd have no way of knowing if you got it. — Iszi 3 mins ago

schroeder

I lol'ed!

SEJPM

@Iszi nice one

Iszi

@schroeder He kind-of did include a source there. Said "From the Nmap page". Essentially "RTFM".

schroeder

@Iszi I know, but a link to source is handy else we have to do a text search

Iszi

20:59

@schroeder Okay if I edit in this one? ;-)

SEJPM

Apparently, people figured out how to build a qunatum computer that should scale and be programmable, right now only 5 Qubits, but if it's scalable it will be more rather sooner than later: arxiv.org/abs/1603.04512

schroeder

@Iszi lol

Bob Ebert

@SEJPM I saw a documentary on it. The computer is huge

SEJPM

@BobEbert size isn't as much of an issue as engineering here (I guess)?

Bob Ebert

accessibility is a big advantage when it comes to technology though

SEJPM

21:14

@BobEbert engineers will probably figure out how to reduce the size sooner than later?

Bob Ebert

lol I didn't say they wouldn't, I was just pointing out that the computer they are building is huge, like 3 meters*3

SEJPM

@BobEbert because physicists tried to build it with whatever they could get their hands on and not with optimized and worked-out engineering processes?

Bob Ebert

I have a question regarding nmap, is there a way to import result from another nmap scan? Lets say the first scan was Syn scan, could I import the results to make a new scan version scan?

SEJPM

#ConspiracyTheory: The NSA knew about this before publication which is why they decided it's time to move to PQC.

Iszi

21:32

@SEJPM PQC?

Nevermind. Found at link.

SEJPM

@Iszi post quantum crypto

Iszi

Oh, the other PQC.

SEJPM

@Iszi what did you think PQC stands for?

"programmable quantum circuit"?

Iszi

Something to do with @Simon's mom.

Feel free to point out any worthwhile flaws in my analogy here:

1

A: Why is UDP port scanning slower than TCP port scanning?

The difference is in the very nature of the two protocols. TCP is a connection-oriented protocol. This means that systems must establish and confirm a stable connection - for TCP, the process is commonly known as the "three-way handshake" - before data is actually transferred. As the process mus...

Gilles

22:06

0

Q: PCI Scan failing at TCP Source Port Pass Firewall testing

I'm trying to get PCI scan PASS for my website, Scan failing at this step. The host responded 4 times to 4 TCP SYN probes sent to destination port 20 using source port 80. However, it did not respond at all to 4 TCP SYN probes sent to the same destination port using a random source port ...

iptables tcp

Does this message makes sense? I don't understand the point of that scan test.

schroeder

I think it makes sense - it's a scan I've seen before

it's an easy countermeasure to keep recycling SYN requests if from the same IP\port - it means that there aren't any resources consumed and there is low chance of operational impact - but it the src port is randomized, then there is still the chance that the buffers will crash due to resource hogging

Gilles

thanks. I don't get it though: what does “the buffers will crash” mean? An easy countermeasure for what? How is failing that test bad?

schroeder

22:32

oh sorry - it's a SYN flood thing - you create a flood of TCP handshake requests that you don't end up completing, so the target is left with a ton of half-open sockets and ends up consuming all its resources waiting for traffic that never comes

an easy mitigation is to recycle the socket when the request is coming from the same IP\port (cuz if it's legit, then there is no reason to keep the old one alive)

but there is danger if the same IP can open multiple half-open sockets just by changing the source port

Gilles

@schroeder oh, so it's protection against DoS?

schroeder

yes

Gilles

Why does PCI include this? I thought PCI was about protecting confidential data

schroeder

PCI covers a little more than just that in version 3.1 is also concerned that you have basic security in place

Rory Alsop

@Gilles it's PCI trying to move a little beyond basic tick boxing

Gilles

22:41

I see, thanks

etherealflux

@Iszi I don't see anything comparing UDP to Hitler

3/10, very poor, see me after class

Rory Alsop

@etherealflux I call Godwin!

etherealflux

@RoryAlsop You reach his voicemail

Rory Alsop

@etherealflux dammit - need to leave a message

etherealflux

today I set my wireless card to Monitor and turned on airodump

i could feel the Mission Impossible theme within me

Transcript for