I started with RSA because the modular arithmetic is something I can grasp intuitively. From my very basic understanding, my expectation is that elliptic-curve cryptography is perhaps more vulnerable to 'backdoors' or derivable relationships when an adversary possesses the full details of your algorithm? That's probably gibberish... sorry.

Anything I miss?

Well, I seem to be out of my depth.

/me reads scroll log

shall we discuss lines in the sand?

@Jonathan Bernstein v US helped change cryptography's classification.

It's no longer classified as munitions, thankfully (ITAR is a related issue though).

There goes my sweet t-shirt concept...

@Jonathan ECC can be implemented in a way that makes backdoors possible (see Dual_EC_DRBG for an example), but safe curves with very simple structures are safe.

Check out safecurves.cr.yp.to for info on that.

But yes, RSA and the RSA problem is a lot more intuitive and easier to grasp, for sure.

@SqueamishOssifrage Don't most browsers let you disable 3rd party cookies now?

I'm imagining a target which is by design impractical, computationally exhausting, producing cypher text orders of magnitude larger than what is required, with the philosophy that overkill is in essence a minimum.

Plaintext expansion doesn't add to security.

(Generally it's good just to use a well-known algorithm, fwiw)

I'm spitballing, but I'm thinking mb sized, or even gb sized keys... or rather than a nonce, a curve unique to a key-message pair... no constants, nothing remains but the cypher text...

What would the purpose of that be?

You don't need keys that large unless it's a public key cryptosystem and the keys have a certain structure that requires they be larger for a 128 to 256-bit security level to be achieved.

The assumption, and I'm not qualified to state this, but let's say my premise is that what seems like strong enough, isn't nearly.

Call it future-proofing

The problem is that it requires a very deep understanding of cryptography to future-proof something. The designs we have today are thought to be future-proof to the extent that is possible.

Let my key take a year to generate, fill my hard drive, and leave my laptop useless except that it holds a single sentence incomprehensible without another single sentence.

Until it turns out that the design is such that it can be broken regardless of key size.

For plain symmetric encryption, something like AES (perhaps in GCM mode) is very, very strong.

I'm looking to understand what would be ludicrous strong.

We'll say, for curiosity

AES in GCM mode for symmetric encryption.

It's not just "good enough". It's really extremely secure.

could it hypothetically be implemented in such a way as it allows the user to choose an arbitrary level of strength?

With "strength" meaning what? Resistance to cryptanalysis? Size of key space? No malleability?

I think cryptanalysis is impossible to resist... the algorithm can't be secured, so near infinite data can be generated for analysis. My assumption is that there is a key space large enough to impede some forms of attack but I imagine this too could become meaningless... a shortcut could always fall out, perhaps... but eliminating as many vectors as possible is an option, if practicality is tossed out the window?

The algorithm can be secured by ensuring that it has been analyzed heavily.

The key space is already large enough to impede brute force attacks by anyone who is incapable of converting all the matter in the universe into energy with a few septillion years to spare.

So the only thing that matters is security against cryptanalysis.

then what is needed is new hardware, built from scratch, in a cave in the desert.

Hardware security and cryptographic security are orthogonal.

Not to mention, data-at-rest security isn't affected by hardware.

For AES, it's considered secure because the best minds in the world have put decades into attacking it, and it's still holding up very well. Proofs regarding various security-related properties of the round function also exist. There's no known way to break through all 10 (or up to 14) rounds of AES.

I don't mean to be dense. I'm suggesting perfect security is impossible because all current technology is already compromised.

terminals pretending to be personal computers.

The fields of information security and cryptography like to divide up threats so they can be attacked more efficiently. That way we can focus on one specific problem. Because of that, we can analyze the mathematical security of a cipher without having to worry about the security of an Intel x86 chipset, or the social engineering resistance of your ISP's sysadmins.

But is a wholistic approach conceivable?

Unfortunately not. It's necessary to look at each individual threat model to determine what steps are necessary to protect from the relevant adversary.

Theoretically, these orthogonal models could produce a single n-dimensional solution.

I'm not sure what that means.

new hardware, built from scratch, in a cave in the desert.

There can't be any universal solution, since what is secure for one person might actually be insecure for another person (e.g. the problem of repudiation vs non-repudiation).

that is the problem, or the line in the sand

it would never be allowed

It's certainly one of the problems. After all, a digital signature for PGP is very useful if you want to prevent someone from impersonating you, but bad for anonymity in the case that your keyring is stolen.

What would never be allowed?

any one person or organization's perfect security would be seen as an imminent threat to the power or supremacy of another

That might have been the case in the 80s and 90s, but not now.

Ever since Phil Zimmerman and his little book.

Because we live in a happy unified world?

Because it's impossible to suppress information on a public algorithm.

We even know of "perfect" algorithms, but we don't use them because our cryptographic algorithms are plenty secure, and because said "perfect" algorithms are difficult to use correctly and impractical.

I imagine nothing is impossible to suppress.

Once it's already out there, it is. And the cryptographic community is quite open.

That is, once we have enough knowledge that some "perfect" cryptosystem is right under our noses, multiple people will begin to discover it.

Maybe the community is just not a threat.

not even close

Because we are finite.

The cryptographic community (specifically cryptographers) is such a threat that the NSA (and the rest of the IC) try very hard to find ways around their algorithms by attacking endpoints. They even tried to subvert them with clipper chip during the crypto wars of the 90s, which the IC ultimately lost.

Are you sure they lost?

Well, strong cryptography is no longer illegal, so yeah.

Now, that doesn't mean they aren't also influencing e.g. 3GPP to weaken their cryptography.

I'm playing devils advocate here, I apologize. But for arguments sake.

The NSA BULLRUN program is certainly proving successful at subverting cryptography by utilizing corporate insiders to cause proprietary programs to use weak cryptography.

So it's not like the NSA and greater IC "lost", they just lost the "Crypto Wars(tm)".

I think the only real security we can establish is to raise educational standards. Like general education. People are fucking stupid. I should know.

Geniuses flip burgers all day everywhere.

Oh people are stupid, yes, but sometimes education isn't enough. After all, not everyone can be an expert in information security and cryptography just so they can call their grandmother on the phone. In that case, it takes the expertise of those designing PSTN (no security), GSM (no security), etc.

If generally people were smarter, public influence would be better directed, the right kind of priorities would be established, and there wouldn't be enough shadow to hide in.

@Jonathan One could put back doors into RSA-based cryptosystems too; elliptic-curve cryptography as a general field is no more vulnerable to back doors. The modern standard choice for key agreement and signature schemes—X25519 and Ed25519, respectively—are based on elliptic curves. You're probably thinking of Dual_EC_DRBG, which is an application of elliptic curves.

Smarter people also means smarter people will be absorbed by the state.

We need to change infrastructure.

We need to improve a lot of things before we, as a people, can be "secure" (whatever it means).

Right now, the best we can do is come up with a threat model and use the tools and information we have to solve it in the cheapest and most practical way possible.

@forest On principle I don't want to give them the impression users ‘consent’ to their mass surveillance. (I also figured if it mattered it would be available from a medium other than some sketchball academic ‘social networking’ scam.)

@SqueamishOssifrage Ah, I see what you mean.

It's a feeling I have... that the power lies in the masses, and they are repressed through their minds by way of what they are allowed to take in their eyeholes and mouths. That is if we fed people they could think. If the could think, they would create something better, in terms of a society. With a better society we would have 'security'

There's no one, simple solution to an adversarial game.

Sorry to waste your time.

cooperate.

is the solution

@forest ‘AES (perhaps in GCM mode)’ is bad pedagogy. I suggest you focus on the authenticated cipher AES-GCM as a unit, not broken down into the concepts ‘first you pick a block cipher, AES, from the catalog of acronyms; then you pick a mode of operation, GCM, from the catalog of acronyms; then you dump them into the acronym cauldron and out comes secure acronym soup!’. What matters is the security contract that AES-GCM provides.

@Jonathan Game theory would suggest otherwise. :P

I think Nash would agree with me

@SqueamishOssifrage Agreed. My point was just that AES, as a block cipher, is considered very secure. I didn't want to muddle the waters by also including the mode of operation (e.g. if AES-GCM is secure, then is an AES-CTR CSPRNG also secure? In that case, only AES matters.)

@Jonathan Cooperation only works if no agent defects.

As long as the intelligence and privacy communities have different goals, there can be no cooperation.

the best play we can all make is self sacrifice, self sacrifice, self sacrifice until the opponent grows a conscience

the truth is we are in this together

and our games defeat ourselves

We are in this together, but not everyone agrees on the best solution. Some say that the threat is terrorism (or economic downfall) and the solution is to know everything about everyone. Others say that the threat is mass surveillance and the abuses it leads to and that the solution is privacy.

my thought would be bake them a cake.

Although many people in the IC world are in serious need of a conscience, others genuinely think what they are doing is right, or at least justifiable.

Laced with cyanide? Might work if they can't say no to cakes.

sit down and talk

hug them

resolve differences

yeild

wot

why not? is what we've been doing working?

lets continue to destroy everything then

Yes it is. Cryptography is getting better. Information security is a booming field.

We have tools like GnuPG and OTR and VeraCrypt and Tor that we didn't have 20 years ago.

hmm

In the 90s, the only real way to maintain anonymity was to pop some box and use it as a proxy. It was trivial for a powerful agency to deanonymize people in such cases 99% of the time.

that might be true, but it doesn't seem to be in check... fuck

Now, we have a situation where said agency can deanonymize select people, occasionally, and usually only if they slip up or can be tricked into running an exploit.

it would be nice if things could deescalate to the level of games, where anonymity was for fun or for meaning not for necessity, not to preserve your life.

That would be nice.

towards that end everyone would need to accept and hold dear a universal love

which is true

That will never happen.

it's not strictly impossible

I think food would do the trick

Food?

food for thought, thought for action, action for change

Not sure I get it.

People are starving, so they act poorly. Those who can eat, surrounded by starving lunatics, think they have to covet their food? I could go on... but in general food is thought. Energy is required in the system, and there is plenty of energy available

Well, ending world hunger would go a long way, yes.

I don't think it would be sufficient though.

It would be the right start

in my opinion

It's not actionable.

We aren't able to end world hunger.

Can you defend that?

(please)

Step one: grow food.

Hunger is in part a social problem. We'd need to end civil wars. We'd need to end oppression. We'd need to end class warfare. We aren't going to be able to do that anytime soon.

Making the food is the easy part.

I bet world hunger could be wiped out by any single billionaire. It's a tractable problem they choose not to solve.

Manufacturing food, perhaps. But ending hunger would not be possible. How do you think they would get food to people in war-torn countries in the midst of a civil war?

Would they just barge in?

Hire suicidal delivery boys to send pizza to the worst parts of Syria?

drop shipping?

parachutes?

maybe education.

And how would you ensure the food is taken by those who it is intended for, and not for insurgents? How would you ensure the planes would not be taken out with SAMs?

Sheer numbers

How would you educate people in places where there are groups who want to kill folks who get certain kinds of education? Bulletproof and bomb-proof schools? Would they live there and never leave?

Sheer numbers just means more food for those with the means to steal the food.

Tape players?

In a country where those caught with such tapes would be executed?

Or worse yet, with citizens who don't think they need education?

I'd like to suggest numbers here again. You can oppress a people if you kill them all. They'd have a hard time doing that again I think

can't*

Manufacturing enough food to feed everyone is doable, just barely. Manufacturing enough food to fit every square inch of the planet is not something we as a species are able to do.

And, of course, what about flying food into zones where you aren't allowed to fly? What military will back you in sending food somewhere that some treaty prevents you from going?

Soon, you'd find yourself in need of your own private army costing hundreds of billions.

And then you find that you've just added to the problem.

I think the solution here is in how you structure your rollout

You do what you can which is a hell of a lot more than what is going on.

Eventually you'll get to everyone.

And food will be a given.

It's really not that simple.

If you drop down food in ISIS-occupied territory, you think the USA won't become your enemy?

It's not as complex as you're stating either, I believe. Somewhere in the middle I imagine.

The more important question is will Isis be your enemy?

If you feed those who they are fighting, then yes, probably.

self sacrifice until your enemy grows a conscience

Plus, parachuting down food everywhere on Earth would be horrible for the environment.

The enemy already has a conscience. It's just a conscience with a different moral compass.

that's only a solution for problem areas

ISIS believes they are doing what is right. So do the Kurds. And the US Army.

because the US is fucking terrible, the whole world is, people have a right to be angry, it's on us to be better

If by "us" you mean the US, then yes I agree. The US is the cause for a lot of suffering in the world, and they do little to alleviate it (and much to exacerbate it). But the US isn't the only problem.

so we lead the way

as the worst offenders

The USA will not get better by wishing it to be so. It won't get better by voting for it to be so. Even if you go and assassinate the problem people and attack the military, it won't succeed.

it will get better if we begin the 'healing' from within

feed our homeless

etc

That is a good thing to do and it will help, but it alone is not the one solution.

It's necessary, but not sufficient.

right, but I'm simply asserting the connection between food as energy for thought and action leading to change

Food helps, but like improving the homeless situation, it's not sufficient.

as a first step where no one is doing anything because the problem seems too large

I think it would be inspirational

increased productivity, increased resources, better standing, more freedom, better solutions, the slippery slope can be towards the better

once we overcome our backwards momentum

which is our backwards thinking, which is our whole worlds form of hangry

our world is hangry

on a side note: cryptography

the old ways will age out

"Old ways"?

conservative ways.

not like witchcraft, that shits here to stay

The conservative ways of cryptography keep us safe.

but cryptocraft sounds like fun...

trying to get off my soap box for a breather, and to give you a break too

the world is also not so scary. it's more that we would rather die than be discomforted.

we are immature. we are stupid.

there are very few adults

well, おやすみ, Nice to engage with someone.

おやすみなさい

<3 japan/ese じゃ！

So for secure multiparty computation, when only computing addition we can tolerate 𝑡 < 𝑛−1 corrupted parties. Why then can we only tolerate t < n/2 corrupted parties for multiplication?

(semi-honest)

@SqueamishOssifrage is RSA-PSS probably faster than RSA-FDH?

@SEJPM Ummm…unlikely, why?

@SqueamishOssifrage it seemed to me that RSA-FDH is so simple it should be fast (in the context of the current fast-RSA Q)

I would expect the cost to be dominated by modular exponentiation, which is the same for both of them.

oh yeah, right

Hmm, I should probably research how leaking static information on the private exponent (such as its hamming weight) can be exploited in timing attacks...

(ie how standard right-to-left modular exponentiation with constant-time multiplications / squarings falls to timing attacks)

"Note that unique signatures are efficiently re-randomizable." A sentence that simultaneously is absolutely correct and sounds obviously incorrect.