The Side Channel

Maarten Bodewes

10:00 AM

Hey potato-head, I see you're monitoring this. Can you possibly do something about the following "users"?

Thảo Phương Lê

1 1

melody95, Hồ Chí Minh, Việt Nam

1 1

SEJPM

@MaartenBodewes what's the problem with them?

Maarten Bodewes

OK, this would bring the female involvement in crypto down even further, but I guess that's a hit we have to take.

Check their profiles. Spam

I'm not sure why you would create a user profile as spam that nobody is going to see, but yeah...

SEJPM

@MaartenBodewes ahh, you mean the about page?

Maarten Bodewes

Yeah, and the link on the second one.

Unless you actually want to buy a visa for vietnam of course.

SEJPM

@MaartenBodewes I see how the second one is spam, but the first one?

Maarten Bodewes

10:05 AM

Well, they only got as far as Visa there, I admit :)

"Tour du lich" seems to be a travel agency.

SEJPM

@MaartenBodewes the second profile has been cleaned network-wide

While sure, the first one has the name of a vietnam visa agency in it it's not actually advertising it

Maarten Bodewes

Well, that's the one that triggered me. I was just trying to see how we were faring wrt new users. The first one: you actually have to hit Google to make any sense of it.

SEJPM

like you could write $employer in your about

Maarten Bodewes

Don't have any :)

Aren't one either.

30 days without boss already, I'm afraid I'll stay unemployed for years :P

Will try and write a book.

fgrieu

@SqueamishOssifrage @FutureSecurity look especially at this comment and its link

That states: A related algorithm "GenPrime" was published by Joye and Paillier in 2006. The Joye–Paillier generator, like Lehmer's generator, starts from a new random number r coprime to L and then multiplies repeatedly by a constant g modulo L, obtaining r times a power of g. This can produce any number modulo L, and produces only a slight bias in the resulting primes. The guess was that Infineon was oversimplifying and generating merely a power of g; this produces far fewer numbers modulo L.
The authors wrote back promptly, confirming that this guess was correct but not revealing more det…

Maarten Bodewes

10:13 AM

@SEJPM I'll let the first one disappear into history :P

SEJPM

@MaartenBodewes you could try and apply to NCC Group to try and join the ranks of the bear ;P

Maarten Bodewes

@SEJPM I'm kind of afraid to do that after stealing his #1 position on crypto and encryption on SO :P

SEJPM

@MaartenBodewes I don't actually think he cares all that much about fake internet points ;)

Maarten Bodewes

Yeah, and I'm probably going to get to 1K AES points without actually implementing the algorithm, which is just wrong. It represents a lot of time but there are stronger persons than me out there, especially when it comes to math. The trick is to mix it with the ability to answer and program.

I got this great guy at the office that managed to implement PACE IM by just looking at the patent application (which was, funny enough, created by the parent company). Couldn't communicate a single word without confusing you.

@fgrieu I think I may have invented a quick way to generate random numbers in a range [0-N) using a DRBG. Are you interested in looking at it?

I meant to say "efficient" way rather than quick.

SEJPM

10:33 AM

@MaartenBodewes more efficient that rejection sampling and "n^2 sampling"?

fgrieu

@MaartenBodewes If there's an exposition, and no NDA is involved, I'll look at it. That could be in a question on the tune of "is this random number generation method biased", or privately (the address in my Aztec icon is horribly spammed but I can make an alert for DRBG in title!)

Alternatively, that could be as an answer to this existing question

doppelgreener

11:15 AM

→ 9 messages moved to Trashcan (removed by request)

fgrieu

@MaartenBodewes No problem. And no idea for a recommendation, sorry about that but my ties with academy are loose, and the one professor I know works for that huge SC manufacturer.

Maarten Bodewes

11:33 AM

I'll try the one that I know: Bart Jacobs. Only some ties there. No way to get through to Bernstein or Lange I'm afraid.

It's kind of interesting for ECC calculations :)

Thomas Pornin

11:59 AM

@MaartenBodewes I was not actually aware that there were per-tag rankings on SO.

For your DRBG method, it might be hard to find a professor with no tie whatsoever with the business/entrepreneurial world.

Maarten Bodewes

@ThomasPornin Not being aware of them is probably the right way of handling them. I'm getting annoyed by the level of questions on SO as well (I presume you are as well) so I hope somebody can take over from me. Because they are in desperate need of real crypto heads there. Artjom maybe.

@ThomasPornin I'll just try and publish my idea as a paper with a big thank you and disclaimer at the bottom.

But I first need to know if I should put in any more time in it. It must be relatively original.

Thomas Pornin

Also, you never tried to implement AES? What are you waiting for?

Maarten Bodewes

A reason, basically. And I haven't bought the book yet, shame on me.

Thomas Pornin

I did not buy the book either, though.

Reason is: writing an implementation is one of the best ways to learn how things work.

2

My usual suggestion for a learn-by-impl path is: MD5, SHA-1, SHA-256, HMAC, DES, AES, RSA, ECDSA, SSL/TLS, Weil/Tate/Ate pairings

Maarten Bodewes

I started with Skein / Threefish :)

In my first year we had a race who implemented SHA-256 fastest. I got beaten by a guy who's code still haunted us years later. Bright, but sloppy.

< 1 day.

His DES code used the wrong parity bits.

adjusted the wrong parity bits. Which was no problem as long as you gave it correct DES keys... and failed brilliantly a few years later.

@ThomasPornin I got a reply from Bruce himself; I send him the correct test vectors of the first version after an endianess error was found in their implementation. Unfortunately somebody send them the error one day before I could.

@ThomasPornin Are you also in the smart card development by the way?

Thomas Pornin

12:20 PM

@MaartenBodewes At one point I got to berate Bruce face-to-face about Skein, because the test vectors for the "small" versions did not match the "official" parameters.

@MaartenBodewes I don't usually do stuff for smart cards, but I have some notions of how things go on small archs. I did a bit of AVR8 assembly at some point. My usual targets are the systems one rank above, typically 32-bit microcontrollers with 32 kB of RAM.

At NCC, I am doing (among other things) reviews of implementations of cryptographic algorithms in a lot of languages on a large variety of hardware. Having a broad experience of development is very useful.

Maarten Bodewes

12:49 PM

Do you know if NCC in Amstelveen does crypto as well?

That's very close by Haarlem. And I'm (deliberately at the moment) between jobs.

Thomas Pornin

NCC has a team dedicated to cryptography and its members are somewhat scattered around the world (I am in Canada; one is in UK; others are in the US). In practice, we almost never meet customers face-to-face, but over the phone, so physical emplacement does not matter as much as you would believe.

The crypto-specific team is small, but there are many other people who do "security work" and occasionally (or regularly) dabble in cryptography.

Maarten Bodewes

Interesting. I've send you a linked in connection request. Do you mind if I ask you for some details using direct messaging?

Thomas Pornin

LinkedIn? Dammit, you mean business.

Transcript for