The Side Channel

forest

02:11

TIL Py is pronounced "roo".

forest

03:06

Holy shit. I just read the scroll log. I wrote the last line after reading about eSTREAM candidates on Wikipedia and had no idea that @FutureSecurity just mentioned it. That is an incredible coincidence.

Future Security

Ha. Did you notice that pypy is pronounced "pyroo?"

forest

Yeah, it was mentioned in the article.

I found it when searching for cryptanalysis on Trivium.

Hit the Wikipedia page on eSTREAM, and looked at a few of the candidates.

@MetaCryptoSE The answer to that question will set precedent as to whether or not answers can be deleted due to being (exceptionally) incorrect.

I think it will have a big impact on Paul, given that some of his answers are no better (just longer and a bit more incoherent) than that one.

@EllaRose Previous meta questions tend to have settled on the idea that an answer, however incorrect, should not be deleted. Whether or not I agree with that is beside the point, but the fact is that the new meta question is about changing that.

Future Security

It might not effect Paul, though. He manages to fake knowledge well enough that he gets mixed up/down votes. Most of his answers don't have the same consensus that they are 100% wrong.

Ella Rose

Please post your feelings as responses on the meta Q!

forest

I'll write up a more detailed answer to that meta question later. My personal belief is that moderators should delete answers that are blatantly and patently incorrect. If it's simply on-the-line, then don't delete it, but if it is nothing but wrong and so obviously so that all moderators agree it is wrong, they should delete it.

Ella Rose

03:15

ah ok

Well, the issue for me is the community requests to delete it

not everyone has done so, but there are more than one or two such flags on it

forest

@FutureSecurity Some of his answers certainly fall under "completely incorrect", even if others are just sprinkled with BS here and there.

@EllaRose Is the issue about aligning moderator actions with the community, or cleaning up terrible and blatantly incorrect answers?

Ella Rose

The former!

forest

Because I've flagged certain answers more than once and got the flag declined for "pointing out inaccuracies etc etc". So the former would imply changing that.

Ella Rose

There is a statement by SEJPM that no amount of flags requesting deletion will be acted upon, and I don't feel that is right

with the kicker that if 20k rep users vote to delete, it can be deleted

(which 2 of the requisite 3 have done so already)

forest

@EllaRose The way the rules are written currently, flags cannot be used to point out mistakes. Are any of the flags used for anything but that in this case?

If not, then the appropriate (as per the current rules) is to deny the flags.

Ella Rose

03:18

"very-low quality" is a built-in flagging reason

forest

Sure, but it still can't (ostensibly) be used for mere inaccuracies.

Ella Rose

@SEJPM and by extension

oops, didn't mean to ping the potato

forest

I guess my bigger question is whether or not this meta question is about how we are interpreting the rules, or what the rules should be?

Ella Rose

Just wanted to link to his statement regarding VLQ vote implying request for deletion

forest

For the former, I think it's cut and dry that all the flags are a result of the answer's inaccuracies, and should be summarily denied. For the latter, I think the opposite.

Future Security

03:19

I don't want Paul's answers deleted. I want his posts to be locked down, so he can't edit or delete them, and maybe insert something along the lines of "This is a stupid answer and this user deserves to be ridiculed." above his original answer.

forest

heh

@FutureSecurity Well he has started deleting his really heavily downvoted answers.

Ella Rose

@FutureSecurity Please stay on the positive side of the "Be Nice" side

forest

@FutureSecurity Just do s/this user/this answer/

Ella Rose

...and that obviously goes for you too, @forest

Future Security

I don't like using the word "stupid". I was being hyperbolic.

Ella Rose

03:21

Saying it's wrong is one thing, saying that the user should be labeled as stupid is completely different

forest

Sure. I try to criticize answers, not people.

Paul's answers are often stupid. I don't think Paul, as a person, is stupid.

But if the integer factorization question gets deleted as a result of the community pointing out that it is blatantly incorrect, it should apply to other answers as well.

And flags pointing out major inaccuracies should not be declined.

Future Security

I'm kind of disappointed by the lack of nuance in the English language for describing bad ideas. I try to be precise with language. Best to communicate as well as possible.

Ella Rose

There are multiple ways for users to recommend a posts deletion, from the low-quality review queue to the vote-to-delete button next to the flag/share links. So it is not completely unprecedented or radical to let the community decide that content should be deleted, it is built-in functionality

Future Security

Smart people have bad ideas. (That guy who invented Spritz for example.) Good people do malicious things. Damage is done with intent to help. And humans can rationalize cognitive dissonance too easy to even realize what they're doing.

forest

I worry that, if I submit a VLQ flag for particularly notorious answers, I'll get an eventual flag ban as flags are denied for "pointing out inaccuracies".

Future Security

03:35

I wish it were easier to pinpoint the problems with bad ideas. It's hard to get that across if people think you're being mean. If you try to be polite then your criticism isn't taken seriously enough. Lose, lose.

forest

The problem is when constructive criticism is repeatedly rebuked.

Future Security

That's not the only problem. If someone says enough incorrect things then they can get away with lies. You can't put equal energy into debating every falsehood. Readers aren't going to read every criticism. People are going to be sympathetic to the liar or ignorant person, then assume that there is some truth in there.

Related: The "no one thinks they're the bad guy in the story" trope gets converted to "everyone has good intentions".

Good intentions aren't sufficient. A person also needs to make a good effort to avoid conscious or subconscious bias. Everyone practices some form of willful ignorance.

Paul apparently does research ideas in cryptography. (He's not good at it, but it seems he sometimes does) He's not trying hard to test his own ideas. He's looking for things that make him feel like he's been right the whole time.

Tangent to tangent: I also hate the phrase "Don't attribute to malice what can be attributed to stupidity."
A) "Stupid" isn't a sufficiently meaningful adjective.
B) Some people absolutely are malicious
C) People who aren't malicious can just be selfish
D) It doesn't matter why someone does one particular thing. Only the outcome matters.
E) What does matter is how they think about things in general. Faulty reasoning, bias, malice, and ignorance ALL need to be addressed. If you're not willing to improve then you'll some day end up making things worse.

forest

04:47

Although I agree with D, some schools of philosophy do not. In particular, any non-consequentialist moral frameworks put more weight on intention.

Future Security

05:02

That sounds like a bad idea.

Future Security

05:30

Obviously any philosophy thought experiment needs to involve either Hitler or track-based vehicles. If in an alternate reality Hitler has the exact same intentions but just fails so hard that he ends up doing good, then there is going to be a point in the alternate timeline that diverges radically from our own. If there was a universe where he had good intentions but produced exactly the same outcome then that universe is going to at least appear to be identical to our own.

forest

Precisely.

And I think he did have good intentions, but he was so wrong that his plans to help protect the Germans ended up killing totally innocent scapegoats.

He genuinely thought Jews, communists, etc. were dangerous and pure evil.

Just like many people in his time in that region.

Future Security

The problem with the genuine belief idea is that it paints a person, no matter how disgusting, as someone totally altruistic just with mistaken beliefs. It's one of the things that make self described "centrists" and "independents" dangerous. Coupled with a "Who's to say which side is right and which side is wrong. Both sides have good points." (or "Both sides are wrong.") makes them complicit.

It's reductionism that people like to use because on the surface it makes them look smarter, more likable, calmer. It's really tempting to go that route too because it's the path of least resistance. Out of all my former beliefs, reflexive "moderation" middle-grounded-ness made me a better person is the most cringe worthy.

forest

05:53

I don't believe in "evil", just selfishness.

If someone does something bad for their own benefit (e.g. rape), that's selfishness. If someone does something bad because they believe it is correct (e.g. jihad), then that's not selfish but is still wrong. Note that I don't use the term "selfish" to imply a lower level of harm. Something can be selfish yet reprehensible.

jww

Hi Everyone. A quick question that is probably not site worthy... Is the IETF's Poly1305 specified in RFC 7539 compatible with Benstein's specification? Or will it produce different results like ChaCha?

Future Security

06:14

No idea. Personally I would only rely on stuff from Bernstein's site.

I guess I think evil is a product of selfishness. Not all selfishness is evil. I'd also add that evil can be a product of laziness. (But maybe laziness is a subset of selfishness.)

Future Security

06:30

Still worth checking yourself for selfish laziness. Don't pretend to be neutral when there are rights violations happening. Don't make software with massive vulnerabilities just because it's easier not to care. Rewind your VHS before returning the rental. Don't pretend you did sufficient research when you only stop after the first thing that confirms your opinion. Scoop your dog's poop. etc.

In those examples the laziness is clearly selfishness as well. But I think because people act like if we're asking more from them and they don't put in the extra work they're not truly responsible for the consequences of those (in)actions.

Also this week I tried engaging one of those people that think "I don't need to study cryptanalysis before designing a cryptographic algorithm. Someone else should prove my algorithm is bad. I shouldn't have to prove it's good."

Immediate defensiveness. I tried to be a bit more tactful than just saying "Other people dedicate years of their lives to learning and are responsible and humble. You're not special enough to get things right your first try." I dropped it because he wasn't going to even think about what I said.

I've seen question askers like that on crypto and security SE recently too. They got some weird idea that they stubbornly cling to and when someone tries to clarify it for them they ignore most of the content and try to debunk the answer...

forest

06:47

Laziness is a product of selfishness. It's the selfish desire for sloth as a vice.

Of course, laziness need not be a vice, as anyone using vim can tell you.

@jww Have you tried looking up Poly1305 test vectors?

Future Security

07:10

Tired. I'm going. Agree on the first part. Maybe the word choice "vice" is former indoctrination slipping in. It has baggage. Implies automatic evilness. Promotes thought crime morality. Suggests victimless crimes with no negligence or intent always deserve punishment. Doesn't the word imply rule violation as "evil" rather than having morality depending on the situation?

Vice taxes are silly. I just noticed that the term never applies to the vice of greed. We don't vice-tax polluting, deceptive advertisement, or worker exploitation. Hmm.

forest

Say, doesn't the limitations of Lyapunov time mean that Brownian motion can be considered a source of randomness that is just as unpredictable in the theoretic sense as, say, a beam splitter-based "quantum" TRNG?

@FutureSecurity I used the word vice from the virtue ethics framework.

Also I used to be Catholic, so I'm familiar with the cardinal sins.

kelalaka

@MaartenBodewes do you wanna look at this for an answer? after 10 days a response...

kelalaka

09:47

@forest While I liked your solution, AFAIK the OP of [this question](https://crypto.stackexchange.com/questions/66750/how-to-encrypt-email-address-using-fpe) wants to keep the same format and sizes for the e-mails.

One solution is encrypting the characters as 8-bit number, however, not all characters are printable. I couldn't find out an FPE implementation does this. Maybe the solution is encrypting by defining domains for [idealista](https://github.com/idealista/format-preserving-encryption-java)

forest

@kelalaka I'm not sure you can keep the same format and size. If you keep the same size, then you may end up using characters that violate the email standard, e.g. using @ two times. Unless OP would want a Vigenère cipher, skipping the @ and .?

kelalaka

I think he already considers skipping @ but not .

forest

Editing my answer now with a suggestion.

That's the example OP gave.

kelalaka

I know but it is weird example. Delete one o....

forest

Scunthorp problem huh?

kelalaka

09:58

maybe, I don't have experience with such filters. My first reading was without the second o

forest

So who is going to deliver the bad news to Thomas Pornin?

kelalaka

Bad news, the promotion ads?

forest

No, that he might have to change his name. :D

kelalaka

where, why?

Ah, I got it now :)

forest

:p

Maeher

10:43

@SEJPM I added ads for both EC and Crypto. The Crypto Chairs chose an exceptionally terrible design this year with a background image that is almost incompressible with png. Had to play around with the colors a bit... It's still larger than the supposed 150kB limit, but so were my ads from last year and they still showed up, so we'll see once people actually voted.

@MetaCryptoSE What I find amazing is that the answer sits at only -9. Why don't more people downvote shit like that?

forest

Not enough people notice it.

Maeher

Maybe we could get it removed as spam. It is basically advertisement for some weird scam artist...

kelalaka

@forest you should design a downvote ad :)

forest

heh

Maeher

The only reason the scam is not particularly dangerous is because the supposed prices are so outrageous that nobody could afford it anyway.

kelalaka

10:53

@forest you are on the run.

forest

@Maeher I still don't get how the scam even works.

I've literally never seen anyone put so much effort into asking for $10bn.

I could understand putting effort into scamming someone for a hundred or even a thousand dollars. I can also understand a joke claiming to ask for 10 billion.

But that one just makes no sense. That's why I think it's a lunatic, not a scammer.

Maarten Bodewes

13:20

@kelalaka I've closed the question you've pointed out, thanks for reminding me of it. Strangely enough it escaped my radar.

Tom K.

13:40

hey people of crypto.se. can any one of you weigh in on this?

1

A: What is the impact of the reported weak IV in 7 Zip?

In CBC mode, the IV have to meet two properties: uniqueness: here it's the case with a probability of 1-2⁻⁶⁴ with time(null); unpredictability: this property is mandatory if the user can choose the message to encrypt, which is not the case here. The IV generation is definitely not good (mostl...

That'd be great

b degnan

14:08

@TomK. Look at forest's discussion in chat from a few days ago: chat.stackexchange.com/transcript/message/48643496#48643496

Anonymous

Hmm, would a question about explaining a diagram be on topic here? (On the site that is, not in the chat)

Tom K.

@bdegnan: Well, that mainly quotes the tweets. It's not much of a discussion. Or am I missing the point here?

b degnan

@TomK. I'm sure by this point, forest et al. have opinions. As you put it in chat, someone will eventually get over to that question likely (I've not kept up with the discussions)

Maeher

14:29

@J.J What kind of diagram?

Anonymous

@Maeher A diagram of stream ciphers that is very lacking on detail.

Anonymous

Sorry, wait.

Maeher

I'd say that depends a lot on what exactly that diagram is and what your question about it is.

Anonymous

Anonymous

Well, look at this for example, it tells me f*ck all about stream ciphers.

SEJPM

14:31

@Maeher thanks!

Anonymous

"keystream generate" what does that even mean?

Anonymous

I guess I jsut need to find a lower level diagram.

Anonymous

So probably not worth a question.

Maeher

That seems to be somewhat simplified description of a stream cipher.

Anonymous

But, I am confused on the difference between synchronous and self-synchronising I guess.

Maeher

14:34

You have some algorithm that given a short key (and a nonce that is omitted in the diagram) generates a keystream of the same length as the message. That keystream is xored with the message.

on the righthand side the same happens, except that the stream is xored with the ciphertext to recover the message.

Maarten Bodewes

14:46

@Maeher For some stream ciphers the IV is simply included in the key, if it is used at all (RC4), maybe this is a very old diagram.

@J.J I think that picture is almost perfect for explaining stream ciphers. Of course the key stream generator is not explained, it is specific to the stream cipher or streaming mode of operation.

Maeher

Well yeah, the derivation of an RC4 key from a longterm key and a nonce would need to be part of the "Keystream generator" in that case. Otherwise you get an insecure encryption scheme.

People who conflate encryption and signatures are the bane of my existence. -.-

2

Maarten Bodewes

Really? I wish those were the bane of my existence; other topics I rate slightly more important :)

Maeher

Sometimes I just want to be able to scream at people over the internet.

Maarten Bodewes

WELL YOU CAN. But I know at least one mod that will destroy comments like that :)

Maeher

@MaartenBodewes As my students quickly learn: Few things are more important than proper terminology. :D

b degnan

14:56

@Maeher Truth

Maarten Bodewes

15:11

@bdegnan That would be "true" :P

Sorry, I'm in one of my moods again.

@Maeher I still get a bit agitated when people switch around "secret key" and "private key".

Or "key exchange" when using "key agreement". I mean, the keys aren't exchanged when doing DH, right?

Yes, the public keys are exchanged, not the secret key, which is what it is about.

Maeher

@MaartenBodewes public keys, abbreviated a "pk" and private keys abbreviated as ... damn

Maarten Bodewes

@Maeher We'll rename this site "Cryptology" :)

@Maeher Yes, and 2^10 is almost one thousand too. That way madness lies. Just renaming something because the acronym doesn't suite you.

Fortunately, a private key is also secret, so that direction is at least relatively correct.

Maeher

@MaartenBodewes I actually prefer "encryption key" and "decryption key" in the case of public key encryption and "signing key" and "verification key" in the case of signatures.

Tom K.

@bdegnan alrighty then. thanks for the input.

Maarten Bodewes

Still, I'd write down "private key" in full and explain that K_s means K_priv.

Or use K_priv.

Maeher

15:20

In the same way I don't generically call encryption/verification "public key operation" I prefer to specify what a key is used for rather than whether it is public or not.

Maarten Bodewes

Before you know it you're dealing with pubKey.encrypt(). That's very object oriented of course, but generally not what you want :)

Maeher

@MaartenBodewes I'm not quite sure what you mean.

Maarten Bodewes

Maybe I don't get your statement either and the comments are disconnected because of that. You mean that you name the public key e.g. key establishment key if you use it to encrypt a master key?

Maeher

@MaartenBodewes No. this just referred to my comment above chat.stackexchange.com/transcript/message/48694424#48694424

I don't know how to quote stuff here....

Maarten Bodewes

Ah, yeah, no I see. Yes, I'd say those kind of names are OK in explanations. Otherwise they need to be even more on topic I guess.

Maeher

15:28

The public key of an encryption scheme is an encryption key (ek) in my notation and the secret key is a decryption key (dk).

Maarten Bodewes

In a protocol I would expect more specific names, I mean. E.g. key establishment key instead of encryption key.

Yeah. Although I'd rather use use K_enc and K_dec.

Maeher

Eh... \renewcommand{\ek}{K_{enc}}

Maarten Bodewes

I think mathematicians use too short names for their variables. I don't see why longer names make sense during programming and not in math books. Are you going to give the decryption operation the same name, but with a slanted character?

Maeher

Mathematicians write on blackboards. Writing long names on blackboards takes longer :D

(I'm not a mathematician.)

Maarten Bodewes

Hence the mathematicians are always depicted with a blackboard full of formulas that are hard to understand in the background. Standard Holywood practice. No mathematician without a full blackboard :)

Maeher

15:35

Though it is actually true that long names often simply take up too much space in papers and also (in my opinion) make things harder to read.

Reusing the same characters in different fonts though... well that's just brilliant. :D Especially if the things are unrelated.

So would you prefer everybody always used "Generator" instead of "g"?

Maarten Bodewes

Common practice is Gen instead of g. That's clear enough for me. Encryption and decryption operations are Enc and Dec.

Using g is a bit too short for me.

Too much like a generic function name - after f you get g (although you could say that a generator is a function of course)

Maeher

@MaartenBodewes As long as you explain your notation, I don't care that much. But group elements get single letter names in any writeup of mine.

Maarten Bodewes

Yeah, I guess that makes sense.

Maeher

I have to admit though that we did have the problem of running out of letters in an early version of some protocol. :D

Though that's more a sign that the protocol might be overly complicated.

Maarten Bodewes

:)

Although just explaining that e.g. a private key is used for AES in a transport protocol or that K means 1024 in your document doesn't make either less wrong.

We're almost not using K = 1024 anymore though, we only keep using it for computer memory nowadays.

So I guess we're slowly moving into the right direction.

kelalaka

16:48

@forest is it possible to identify a tor browser uniquely?

Future Security

17:00

@MaartenBodewes What do you mean? There's nothing confusing about the abbreviation Pk for public key and pk for private key. /s

Maeher

@FutureSecurity \mathrm{pk} and \mathsf{pk}

And the key of a PRP is then of course a permutation key or \mathfrak{pk}.

Ella Rose

19:09

Two instances of "signing is encrypting with the private key" today... sigh

3

kelalaka

newbies...

Ella Rose

19:25

@Maeher Feel free to post your feelings as a response on the meta question!

I think I might make a "cryptographic pet peeves" list of stuff like "encrypt with the private key", mixing up secret/private key, etc

kelalaka

19:37

Post it as a banner candidate :)

Ad not banner

Future Security

23:37

Oh. I don't think I ever shared this here before. Some guy thought it would be a good idea to write his own XorShift based RNG. The thing is... running "make install" replaces the real /dev/urandom with his implementation. Link

2

Transcript for