The Side Channel

« first day (2693 days earlier) ← previous day next day → last day (2279 days later) »

Maarten Bodewes

00:26

KDF1 and KDF2 are little more than a hash over fixed data and a counter. You'd rather use a HMAC though, with the output of bcrypt as input key material. Beware of length extensions when using the hash. Usually not a problem, but you've got a "personalization string" as input which could be anything.

5 hours later…

DannyNiu

05:53

Where did the question about "virtual matrix encryption" went?

I wonder if it got answered.

1 hour later…

fgrieu

07:22

I updated the graphic on hash rate here. Noticeably, it appears we might have reached bitcoin's "peak hash" south of 2**91.6 hash/year, circa 25 September 2018

fgrieu

07:34

I'm not the only one to notice.

2 hours later…

kelalaka

09:24

@fgrieu that is very big number.

I always wonder the total power of smartphones.

But none tried.. github.com/hashcat/hashcat/issues/1474

1 hour later…

fgrieu

10:55

@kelalaka Given that the new sha256h/sha256h2/sha256su0/sha256su1 instructions on high-end ARM cores are reported to speed up things massively, answering thins might boil down to:

- how many phones have CPUs with these extensions, and with how many cores?

- cycles/hash/core (my bets are on about 10)

- CPU frequency sustainable (about 1 GHz)

kelalaka

Impressive speedup

@fgrieu thin about as general research capabilities of cell phones as client to distributed.net

Years ago, I've a final project to brute-force DES with cell phones, but the students was lazy.

fgrieu

Crunching my numbers with a thousand million active SHA-256-accelerated cores says we reach about 1/1000 of bitcoin's reported peak hash.

This demonstrate that ASICs rule.

Which we knew beforehand; but it is nice to have a confirmation.

Nowadays, brute force of crypto with anything but ASICs demonstrates only what is possible without ASICs.

That's true for RSA, too.

1 hour later…

kelalaka

12:07

Are there any ASIC for factoring?

Even my CPU doesn't have SHA instructions. I guess the bitcoin mining caused that 64-bit ARMv8 have it.

fgrieu

12:36

@kelalaka I do not know if there are ASICs for factoring. I know there is an incentive for these, and that some have been proposed by knowledgeable and generally reasonable authors, without rebutal that I am aware of.

kelalaka

as twinlkle

fgrieu

12:50

@kelalaka TWINKLE was one of the first proposed GNFS ASIC factoring design, but required still hypothetical AsGa wafer-scale technology. If I was in position to commission building something (I'm miles from that), I'd prefer TWIRL or SHARK, which seem more realistic in the short term.

kelalaka

@fgrieu It was from my history... I did not follow since then, thanks for the answer AFAIK, it was the first proposed.

8 hours later…

Meta Crypto SE

20:44

Q: December 2018 Moderator Election Q&A - Question Collection

Cryptography is scheduled for an election next week, December 3rd. In connection with that, we will be holding a Q&A with the candidates. This will be an opportunity for members of the community to pose questions to the candidates on the topic of moderation. Participation is completely voluntary...

SEJPM

OK, time to make this official. All good things must come to an end, so one gains time to conquer new fronteers. I’ll soon be signing off as Crypto.StackExchange moderator. It has been an honor to serve @StackExchange – even though all I got in return was this lousy T-Shirt. 😜