« first day (3377 days earlier)      last day (1304 days later) » 

kelalaka
kelalaka
11:44 AM
A new interpretation of quantum mechanics suggests reality does not depend on the measurer
 
kelalaka
kelalaka
12:27 PM
0
Q: Attacks Relying on Poor Entropy

PersistenceI'm creating a quantum random number generator as part of my thesis. As part of the research phase, I'm trying to substantiate my aspertion that encryption is significantly weakened if a computer system has poor entropy available to it. However, I can't seem to find any specific attacks that expl...

cryptography random entropy
anything to add?
 
kelalaka
kelalaka
1:03 PM
@SqueamishOssifrage how much the bound* are correct since some probabilities go over 1
8
A: Does GCM (or GHASH) only provide 64-bit security against forgeries?

Squeamish OssifrageThe phrase ‘128-bit security’ is a bit glib to cover the online/offline distinction—the purpose of the explicit formulas is to quantify the forgery probability in terms of limits on the online and offline costs. The online costs depend on how scalable your application is; the offline costs depen...

Also, is there a specific reason for the two bounds?
 
kelalaka
kelalaka
1:38 PM
 
 
1 hour later…
Squeamish Ossifrage
Squeamish Ossifrage
3:03 PM
@kelalaka It's a bound. Any bound on a probability that is above 1 is vacuously true, because probabilities are always at most 1. It's not very useful if it's above 1, but in cryptography if you don't have a confident bound far below 1, you should basically assume things are real bad at that point. One arbitrary cutoff people sometimes use, e.g. in NIST's guidance about AES-GCM, is a maximum advantage of 1/2^32 over the entire lifetime of a key or application.
@kelalaka In retrospect it might have been better to omit one of the bounds from the table; part of the point I was making is that AES-GCM analysis is complicated and it took a lot of work, spread across several papers by different authors, to get it right, particularly for nonce sizes other than 96 bits. Really only the bound* column is the one that matters, since it consistently gives better bounds than the other one.
 
kelalaka
kelalaka
3:21 PM
@SqueamishOssifrage thanks, can I edit it like the actual bound for you?
 
Squeamish Ossifrage
Squeamish Ossifrage
What do you mean?
 
kelalaka
kelalaka
Since you don't edit now, should I edit it for you or better wait for you :)
into a better column name.
 
 
2 hours later…
Crypto HNQ
Crypto HNQ
5:40 PM
5
Q: NewHope and NIST's Post-quantum standardization

RickWhere can I find NIST's reasoning to eliminate NewHope from the 3rd round of the post-quantum competition? I see all the lattice KEMs finalists are based on modules. Is being a ring-based KEM contributed to their elimination? In this case, is there any recent development in cryptanalysis on idea...

lattice-crypto nist lwe ring-lwe newhope
 
 
3 hours later…
Squeamish Ossifrage
Squeamish Ossifrage
8:13 PM
@fgrieu If you have the latitude to change a single 16-byte block of associated data, I think you can also find a key with which a given ciphertext and associated data pair (unmodified ciphertext, one block of AD changed) is valid under AES-GCM, even if you don't know the original key.
(no control over what the plaintext will mean, of course, but you can pick a few bytes by brute force, e.g. enough to make it look like it has a prescribed 4-byte file type marker at the beginning)
 
kelalaka
kelalaka
9:12 PM
@SqueamishOssifrage Once sentence on AES-GCM vs ChaCha20-Poly1305. I think AES-GCM has lost of pitfalls on the usage and even on the proof of security.
 
Squeamish Ossifrage
Squeamish Ossifrage
9:30 PM
?
 
kelalaka
kelalaka
Like ChaCha20-poly1305 easier to use, have better security bounds
In order to select one when needed in TLS.
 
Squeamish Ossifrage
Squeamish Ossifrage
Yes, the only reason to prefer AES-GCM is that it is slightly faster if you have hardware acceleration.
 
kelalaka
kelalaka
9:47 PM
But that is not AES-NI.
 
Squeamish Ossifrage
Squeamish Ossifrage
yes it is?
 
kelalaka
kelalaka
Google says on mobile ChaCha20 is better security.googleblog.com/2014/04/…
 
Squeamish Ossifrage
Squeamish Ossifrage
Anywhere there's no AES and GHASH hardware acceleration, ChaCha20-Poly1305 will leave AES-GCM in the dust.
 
kelalaka
kelalaka
So, even There is AES-NI they are so close as said in the mail-archive.
I was looking a proof for your claim :)
 
kelalaka
kelalaka
10:27 PM
```'type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes```
```aes-128-gcm 424894.25k 1043350.95k 2163829.74k 3516518.06k 4446481.07k 4485147.31k```
```chacha20-poly1305 241187.20k 460090.26k 930199.47k 1718109.67k 1818076.04k 1829499.02k```
My machine OpenSSL
Not formating as I wanted.
 
Squeamish Ossifrage
Squeamish Ossifrage
In the chat message box, hit shift-return, then click on fixed font to the right.
3
 
kelalaka
kelalaka
10:49 PM
type                  16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
aes-128-gcm         424894.25k  1043350.95k  2163829.74k  3516518.06k  4446481.07k  4485147.31k
chacha20-poly1305   241187.20k   460090.26k   930199.47k  1718109.67k  1818076.04k  1829499.02k
avx and avx2 available.
 

« first day (3377 days earlier)      last day (1304 days later) »