The Side Channel

« first day (3379 days earlier) ← previous day next day → last day (1285 days later) »

1:52 AM

Q: What should the nonce value be for client-side encryption?

I am using the following chacha20poly1305 Rust library to encrypt some data in a desktop application. The user provides the key, which never leaves their device, to locally encrypt some data, and then the encrypted data is sent to a server for backup purposes. This library requires a nonce in ord...

8 hours later…

kelalaka

9:43 AM

zdnet.com/article/…

It is comming... Backdoored end-to-end for all.

The privacy is ending...

kelalaka

10:40 AM

Forbes: to enable law enforcement access to content where it is necessary and proportionate; and work with governments to facilitate this

forbes.com/sites/barrycollins/2020/10/11/…

1 hour later…

Maeher

11:58 AM

@kelalaka the rules are: 1. It must be about crypto. (It does not have to be useful, interesting, or correct.) 2. It's your work and you're literally allowed to publish it in that form. (This used to be an issue with the Springer lncs layout.)

@xorhash there are plenty of crackpot papers on eprint written in Word.

3 hours later…

b degnan

2:43 PM

@Maeher I'm not sure if it's the people or the papers, but I have found that I have higher reject rate (my personal reviews) when papers are in Word. I feel that probably means there's some bias somewhere, but I've never gotten an excellent paper in Word. :/

@kelalaka Esaki's paper on the tunneling diode is about 1 column long, and he got the Nobel Prize for it.

kelalaka

3:16 PM

@bdegnan any link? I found it with the help of the ...without the barriers.... It is about 1.25 pages.

2 hours later…

Squeamish Ossifrage

4:47 PM

A: Are the common hash algorithms already dead?

MD5 and SHA-1 are broken, since we can make collisions and even chosen-prefix collisions with these. But no, hash functions like SHA-2 and SHA-3 are not dead. On the contrary, they are alive and well. The fact (alluded to in the question) that it is quite (and increasingly) easy to find a common ...

> While k=256-bit variants are not safe from hypothetical quantum computers usable for cryptanalysis, those with k=512 are.

@fgrieu Why do you say that?

kelalaka

5:11 PM

I think it is due to the Brassard et al., but not mentioned the circuit size.

cr.yp.to/hash/collisioncost-20090517.pdf

A: What security do Cryptographic Sponges offer against generic quantum attacks?

Fix a hash function $H\colon \{0,1\}^m \to \{0,1\}^n$ built out of a sponge of capacity $c$. To raise the cost of both generic collision and generic preimage searches on classical or quantum computers above $2^\lambda$, pick $c = n = 2\lambda$: the capacity and hash length need only be double th...

fgrieu

@SqueamishOssifrage It's often hypothesized that QC can break some 128-bit symmetric crypto, and I hastily generalized to all in my "k=256-bit variants are not safe from hypothetical quantum computers usable for cryptanalysis". I'm not anxious for SHA-512 and SHA-3-512. And I'm ready to edit any of this.

And apparently, I need to, reading your answer...

Squeamish Ossifrage

5:36 PM

The main point is that nobody has hypothesized any quantum collision attack that is cheaper in any reasonable cost model than the best classical collision attacks. (If you measure only oracle queries as the cost model, then yes, but you need to store their answers in a quantum circuit of size 2^{n/3}! And that doesn't get into the communication costs in a circuit of that size.)

5 hours later…