The DMZ

forest

00:03

Supply chain attacks are one of those reasons we need to extend verification of commits all the way up the chain.

belkarx

00:44

Verification ... as in gpg signing (checking for reliability of committer) or security-checking

forest

@belkarx As in gpg signing.

Obviously that won't protect from all supply-chain attacks, but it'll ensure that e.g. Debian's copy of glibc can be directly traced to the upstream signed copy of glibc, which could be traced to individual signed commits. There's been an increased push towards this sort of system for a few years now. There's no reason why a mirror should have its own signing key but not verify the upstream signed code.

E.g. when I install a package on Gentoo (which is a source-based distribution), I know that what I'm compiling has a valid signature created by a private key owned by the Gentoo package repository, but I have no idea if they verified the code when they downloaded it from the upstream source (or rather, Portage can't check it automatically, yet).

github.com/openssl/openssl/blob/master/crypto/bn/bn_prime.c#L87

Interesting. OpenSSL devs are conflating false positive probability in generating primes with the security of that prime.

It looks like they're assuming that a false positive rate of 2^-128 means its security is somehow limited to 128 bits and that larger keys would want to have lower false positive rates.

/*
 * Use a minimum of 64 rounds of Miller-Rabin, which should give a false
 * positive rate of 2^-128. If the size of the prime is larger than 2048
 * the user probably wants a higher security level than 128, so switch
 * to 128 rounds giving a false positive rate of 2^-256.
 * Returns the number of rounds.
 */

nobody

01:27

@forest huh weird. Whats the recommended fp rate though? I'd expect something much much lower than 2^-128 to be fine.

forest

There's no set recommendation.

The 64 rounds is more than enough.

@nobody Let me put it this way: The chance of getting a false positive and generating a composite instead of a prime when 64 rounds are used is, at worst, the same as the chance of guessing a 128-bit key... on the first try!

If you're generating quintillions of new primes per second and even a single composite would be your downfall, maybe then it would be reasonable to increase the number of rounds, but I doubt all the primes ever generated by humanity gets even close to that number.

And as you increase the number of rounds, the amount of time it takes to verify the prime doesn't increase all that much because the total number of rounds is only executed when a prime is finally found. The majority of candidate numbers are thrown away in the first couple of rounds. Even if you had a billion rounds, most candidates would be discovered to be composite after only a few.

1

A: How to create most secure SSH keys and D-H moduli on standard Linux PC?

The RSA keys only need to generate two random primes of the appropriate size, so they can be generated fairly quickly. The DH moduli you generate will contain many primes, and these are safe primes which take longer to find (prime p is a safe prime if (p – 1) / 2 is also prime). Using safe primes...

Wrote more about it in an answer I just wrote (shameless plug alert)

I'm not sure what the actual complexity is (i.e. how the time increases as the size of the prime increases), because I suck at math:

in The Side Channel, 41 mins ago, by forest

Stupid question, but how would one determine the average number of Miller-Rabin rounds that would be needed to find a single n-bit safe prime, assuming typical prime distributions at n bits of size and the worst-case false positive rate of 1/4 per round?

Hopefully someone'll answer that without making me feel stupid. :P

The distribution of primes at n bits is something like one every log(n) / 2, and prime p is a safe prime if (p – 1) / 2 is also prime. The chance that a single M-R round has a false-positive and calls a composite a prime is 1/4 at worst. So the math isn't hard, but still...

ThoriumBR

09:54

@MechMK1 haha, imagine Mech using two different colored socks!

now serious, once one of my friends had to get an early flight, woke up a little later than expected, didn't wanted to wake up his wife and didn't turned on the lights... he put his socks, rushed to the airport, got to the client to a meeting and at the meeting he noticed he had two different socks: one black and one brown.

A. Hersean

Only buy black socks.

ThoriumBR

correct!

I only have black socks, ask my wife to never buy me any sock that isn't black and gift away all non-black socks I am given.

MechMK1

10:37

@ThoriumBR I like using things like "wearing differently colored socks" or "putting a hat on a goat" as substitute for the things our politicians really do :^)

Also, I also bulk-buy the same pair of socks so I can mix and match

If you buy 10 pairs, you an lose 18 arbitrary socks worst case and still have one matching pair. With 10 different pairs, you can lose 9 socks worst case and still have one pair.

Journeyman Geek

10:51

@MechMK1 My socks are the same sort and have which foot they are for ....

MechMK1

@JourneymanGeek Individual toes as well?

Journeyman Geek

naw

MechMK1

11:54

So. @MechMK1, what country do you live in? Perhaps you need to move to a place where you can trust someone? Otherwise, you face Camus' famous question. — EasyWhenUknowHow 2 mins ago

I kek'd

"What do you mean you don't trust the government?! Why don't you just kill yourself then?!"

A. Hersean

13:22

Why isn't security.SE flooded by questions like "OMG! #LAPSUS #Okta Am I gonna die???" ?

MechMK1

What the fuck does any of this mean?

Journeyman Geek

@A.Hersean hackernews is thataway

@MechMK1 Okta is a corporate 2 fa tool that allegedly got hacked by a group called LAPSUS

A. Hersean

OK, too soon then.

MechMK1

It could as well have been the result of an esports match

Journeyman Geek

Also the answer to "Am I gonna die?" is always always "Yes"

A. Hersean

13:27

Brace yourselves.

@JourneymanGeek Yeah, the real question is how.

MechMK1

@JourneymanGeek At least, it is to be expected given current scientific understanding

Journeyman Geek

@A.Hersean also when

A. Hersean

depends

MechMK1

@A.Hersean Hopefully not by a hypersonic dildo

Imagine having to live forever

What fucking bullshit that'd be

A. Hersean

Since perception of time scales logarithmically with objective time, maybe not.

Or not so much.

MechMK1

13:35

I'd rather die and experience eternal torture

Journeyman Geek

So... Jira?

Also there's different ways eternal life can be terrible

Consider eternal life without eternal youth, or excessive youth, or being bored cause you have done it all already

MechMK1

13:58

Imagine humanity being long extinct and you drifting in space for all eternity, forced to experience extreme cold yet being unable to die

nobody

14:45

@MechMK1 I really can't tell what that guy is getting at.

@James_pic This seems to be a general, still unsolved problem with systems. Some people say it will never be solved. I say, just make the system bigger, to encompass more things. — EasyWhenUknowHow 3 hours ago

Like what the hell does this mean?

A. Hersean

It means "I do not know what I'm talking about, I'm suffering from the Dunning–Kruger effect. Once everything has a NFT, then everything will be a NFT and the blockchain is complete. Once the blockchain is complete, everything will be solved."

2

The "Pray for our NFT overlord" subtext is implied.

Because the Blockchain (the father) and the NFT (the son) is omnipotent, It must be benevolent.

Because It is omnipotent and benevolent, it will solve everything once the time of Its completeness comes. Join me and let's ~~pray~~ mine together for the completion of the Blockchain.

belkarx

15:04

@MechMK1 Those options are virtually equivalent after a point

@JourneymanGeek Honestly stackexchange is really well moderated for what it is

Also would not want to be microsoft right now; they got 40gb of source leaked AND turns out they failed at patching a critical severity bug for the second time and users have to rely on a third party for patches

A. Hersean

At last: thehackernews.com/2022/03/…

Fire Quacker

18:11

Hmm... so this SPA provides a frontend for an API server, which gives it a token on authentication. Which the SPA stores as a... cookie? Created in JavaScript? No secure, no samesite... Also the SPA doesn't have any security headers (no HSTS, no CSP, nothing). And it's served on both HTTP and HTTPS, with no redirect...

forest

19:57

@belkarx Neato. What was in the leak?

Oh, Bing. I was hoping some Windows sources.

> So far, most of the attacks have targeted source code repositories, allowing the threat actors to steal sensitive, proprietary data, such as NVIDIA's lite hash rate (LHR) technology that enables graphics cards to reduce a GPU's mining capacity.

Serves NVIDIA right...

forest

21:09

patchew.org/Xen/[email protected]

So Xen disables access to PPIN (serial number of CPU via MSR). I wonder if KVM does as well.

I guess it depends on the default value of MSR_PPIN_CTL.

belkarx

@forest I know, truly disappointing. They got cortana too though

forest

Isn't Cortana that voice assistant thing?

Hey btw, anyone here running Linux who hasn't disabled MSR access who would want to test something for me?

nobody

21:36

@forest Does a VM count?

forest

If the host is also Linux, I suppose.

Just trying to find out a default MSR value, and I know how to do it in Linux, not Windows.

nobody

23:16

Uh, I don't have host linux unfortunately

forest

ok

belkarx

@forest Sure, what should I do

forest

@belkarx What kind of CPU do you have? An Intel post-Ivy Bridge?

belkarx

I'm on my laptop atm so intel core i7 8th gen

forest

If you could run rdmsr 0x0000004e and post the output, that would be great.

(That command doesn't make any changes. It just reads a value from the CPU and prints it.)

Running modprobe msr might be required beforehand.

belkarx

23:27

Yup did that and grabbed msr-tools

> rdmsr: CPU 0 cannot read MSR 0x0000004e

forest

ok

ThoriumBR

rdmsr: CPU 0 cannot read MSR 0x0000004e

mine too

forest

So your CPU must not support PPIN.

ThoriumBR

Intel(R) Core(TM) i7-8565U CPU

belkarx

@forest What sort of value is stored in that reg

forest

23:29

courses.cs.washington.edu/courses/cse451/18sp/readings/…

See 2.11.1, table 2-25 for the value.

belkarx

Thanks

forest

tl;dr PPIN a way to check a CPU's unique serial number. The MSR 0x4E is MSR_PPIN_CTL which determines whether or not MSR_PPIN (which is MSR 0x4F and contains the serial number) can be read. I'm just curious whether or not the typical BIOS touches it.

belkarx

Ah cool

forest

23:54

967

Q: Examples of common false beliefs in mathematics

The first thing to say is that this is not the same as the question about interesting mathematical mistakes. I am interested about the type of false beliefs that many intelligent people have while they are learning mathematics, but quickly abandon when their mistake is pointed out -- and also in ...

I'm not even smart enough to have these false beliefs, much less know the truth. :(

> Gluing of Morse-type trajectories in "Floer Homology of Cotangent bundles"

ffs even the questions on that site sound like another language.

Transcript for