Awesome stupid idea: Power-based fault attack on solar powered pocket calculator that makes it give incorrect results by switching a room light on and off really fast with really specific timing.
Depends on the device. Some shut off almost instantly after removing it from light. Others have a rechargeable battery. (Or capacitor, not sure which.)
Well you don't need instantaneous responses. In fact that's how you would glitch out the circuits, by exploiting power getting cut from some but not all paths.
If I do publish that placebo RNG thing, for Java I'm going to use SHA-512 and joke/market it as being "512 times stronger than "SHA1PRNG". (That string being the only algorithm name that JVMs were required to implement in the old days.)
I'm going to make it incredibly clear to knowledgeable readers that it's a joke. But the type of person that swaps out the default RNG for an amateur userland implementation won't know that it's a joke.
I want to XOR or otherwise combine output from the OS RNG and output from a bullshit RNG. I can say it's as strong as the weakest of the two. Then hopefully I can trick misguided programmers into inadvertently using a secure RNG.
And seed it from a hash of the system time and environmental variable string.
I probably could make the same type of library for password hashing. One that bundles the Argon2 standard implementation, but does SHA-256(argon2Hash, bcryptHash, pbkdf2hash). Argon2 would have it's parameters set using the recommended procedure. PBKDF2 would just be set to use one iteration. Bcrypt would also be set to its minimum cost.
I have the problem of too many tabs open for browsing (occasionally) and PDF reading (frequently).
I fear that I'm like Paul but don't realize it. Almost imposter-syndrome-like fear. I've also taken no cryptography classes. I learned by reading anything interesting on the eprint archive feed. It all went over my head initially of course, but one day I woke up realizing I had become competent enough to at least catch other people's mistakes. I read so many PDFs...
I don't think you're like Paul. If you think you know more than you do know, that's not a problem, it just means you still have more to learn. The problem is if people tell you you are wrong and you insist that you are still right.
In addition, we're surrounded by people who are professional cryptographers who have come up with new schemes or released research papers.
I mean I'm a crypto novice but I still read PDFs and research papers as well, and often catch other people's mistakes. I haven't taken any cryptography classes either.
I think sometimes I hedge too much. But I'm also on the conservative side. I won't answer something I'm not fluent in. I will read reference material. I'll tell people why something is insecure but not assure them that their protocols/algorithms are safe.
@FutureSecurity I'm exactly the same in that respect.
It's one reason I have far more answers on Security.SE than on Crypto.SE.
Since I'm often not confident that I can answer a question correctly unless it's a basic question about secure protocol design, or something that I can look up. But the difference between us and Paul is that we don't consider ourselves experts.
That's why I don't want people being too polite to criticize wrong answers. Tell me I'm wrong early before I ingrain false ideas and make a fool of myself. If my answer was embarrassing enough then I can just delete or edit my post.
I don't think you have to worry about that here - if you're wrong, someone will almost certainly say something. Heck, you don't even have to be wrong, just less than exactly correct will usually garner criticism...
People joke that if you want "the internet" to iron out bugs in your programs you shouldn't post your ideas and ask if it's correct. You should post your code and assert it's right. Then people will angrily correct you. Gratis bug hunters.
I saw a lot of "History Channel" and "Science Channel" TV at one point in my life. I appreciate how much skill it takes to communicate well without using faulty analogies or invalid simplifications.
Compare that kind of genius with the type you see elsewhere in infosec, with people hoarding 0days and hinting at how insecure everything is that few people know...
It's so much more stressful.
@FutureSecurity Before or after it turned into aliens and conspiracies?
I hate that our culture rewards unskeptical believes... Other people make it unnecessarily costly to push back the nonsense. People still believe that horoscopes are true.
I came up with an explanation for a question I had a few weeks ago. Why are people so superstitious about TRNGs and cryptography? I figured it's a combination of not-invented-here and subconscious influence of superstition seeping into a science/math related field.
Well I include what Linux's /dev/random does in the "superstition" category. I can see the initial justification for it. It's kind of like using buffering to emulate a HWRNG. But the strategy of allowing RNG output to trickle out is worse than resetting the process.
I don't think it's actually that randomness is simple enough to understand. I think it's far too complex and unintuitive, so people swap out the unknown with the mystical.
I remembered today that the first post I saw from him included an oscilloscope screenshot. I realized he's a true believer in his intuition. References and equations are nothing compared to just eyeing the squiggles on the screen to make sure they're squiggly enough.
As his focus shifts he seems to slightly alter his methods but never realizes that his methods aren't good.
Well he does do some EE, so I imagine that's related to it.
I think the bigger problem though is his misunderstanding of entropy testing.
I mean, he concluded that NIST tests were useless because the program he compiled from their proof of concept reference implementation had a software bug.
I tried to explain to him that he's misunderstanding the tests, of course...
But he just switched to advocating for basic file compression as entropy testing...
The thing is, he has a good memory. When someone says something (that he agrees with), he'll remember it and use it later, if sometimes out of context. I think someone said something like divide whatever estimate you get via compression by two to be conservative, so now his go-to entropy testing method is "compress then divide the size in bits by two", as if that was an accurate empirical test.
iirc the comment was to divide the estimate that the testing tool outputs by 2, I don't think they specified using compression as an entropy estimation tool
I haven't seen that yet. He doesn't advocate compression algorithms exclusively. He also likes ent. (It has to be good, because the name of the utility is short for entropy!) When people pointed out that the idea behind "testing" entropy was flawed he switched to different utilities.
Which is funny because ent is far more limited than most other tests. :P
Plus there's the issue of him caring about output speed. Like why would anyone care if the entropy output of a TRNG is a trickle? All you need is 128 to 256 bits...
I mean I suppose faster does make entropy testing easier.
I mean at least he knows that OTPs are impractical and the pad can only be used once (he seems to flip between claiming that AES is guaranteed to be broken by the NSA to saying that it's secure and can be used to make a CSPRNG).
Personally I've only ever used an OTP for pen-and-paper crypto via snail mail.
Simply because it's far easier than anything else when you have no computer.
Of course, I generated the pad using a CSPRNG, so it was more of a stream cipher with a long-term cached and preshared keystream. :P
> CMIX uses a context mixing algorithm, like most of the top ranked programs. A context mixing algorithm uses a large number of statistical models to independently predict the next bit of input. The predictions are mixed using a neural network and used to code the bit using an arithmetic coder.
Argh, this is literally the worst technique to use with entropy!
Pretty sure that he followed the documentation of ent down the compression algorithm journey because he wasn't willing to admit you and others were right. I think it cites compression algorithms as an entropy estimation method.
Believers in things like horoscopes, psychics, pagan magic, chemtrails, etc. tend to operate the same way. They think that they are doing research and genuinely believe they've been rigorous. They just don't know what research actually should look like.
Pseudo-science emulates science to fabricate legitimacy. People don't see their own behavior as being like a cargo cult.
I think this is a little different. Whereas those kinds of people actively look for reasons to believe that the mainstream view is incorrect, I think Paul's behavior is different. It seems more like he treats the first conclusion he comes to as fact.
Honestly it seems like high-functioning autism (and I say that as a purely objective statement, not a judgement), which I have experience with from working with autistic kids in the past. There's a tendency to lock onto the first belief and treat it religiously.
There's a sort of revulsion to the idea of knowing that you don't know, but rather than filling in unknowns with religion or "it's a mystery", it's filled with the first logical conclusion that comes to mind. It's reinforced each time you talk about it or think about it, until the answer can be nothing else.
The unfortunate thing is that the traits can be harnessed for learning. The ability to "hyperfocus" and retain information with an almost eidetic memory can be very powerful, but only if it's possible to get over the revulsion (unconscious or otherwise) of there being a period where you don't know something.
It is utilized though. Academics, scientists, inventors consist of more autistic people than the rest of the population.
"Neuro-types" and "neuro-diversity" are terms used. Having that diversity is evolutionary beneficial in a social species.
Even having color blind people was an evolutionary benefit. They could spot things that non-color-blind people have difficulty noticing, like low contrast things or camoflage.
There is the "How do you tell the difference between an extroverted mathematician and an introverted one?" joke. Where the answer is "The extroverted one looks at the other person's shoes."
Eye contact aversion is an autistic thing. We just credit autism for the bad things and ignore it for others. Sort of like the Rudolf the red nosed reindeer thing. You're only a valid person when you're proven useful to a majority group.
It's useful when a certain population is autistic since those people can often see things that most people cannot and have a very different way of thinking.
Bye. Oh. I forgot. It turns out scrypt actually kind of does the placebo algorithm thing. The final step is to use PBKDF2 with the password, an "expensive salt", and one iteration.
I've seen plenty of people on the internet post that they've been forced to use PBKDF2 but I'm not familiar with the reason why. Presumably a bureaucratic reason. Maybe outdated regulations, certification requirements, or managerial reasons.
Sometimes there is a loophole (apparently) where they don't say how many iterations you're required to use or anything forbidding you from using another algorithm for password or salt derivation, so people minimize the amount of work CPU they allow PBKDF2 to use and give it to a better algorithm...
Which I find amusing. They follow the letter of the law but exploit a loophole so they're able to implement best practices. It's like the white hat deception idea behind my placebo RNG library concept.
I remember fgrieu did in one of his answers but couldn't find. It is like a comment in the text but not shown when rendered. So, with this, you can post source code but the is not displayed.
Edit
Does the state register (the LFSR) always have to remain with 16 bits (I'm assuming yes).
If so, are we shifting the register right by one (lfsr>>1) and inserting the output bit onto the left-most bit (lfsr>>1 | bit<<15) which allows us to wraparound within the same 16-bit address space.
...
I guess that sort of defeats the purpose. In my browser it's treating the greater than in the include statement as the closing bracket of the html comment.
As a comment in the text that is what I wanted. When I saw something beautiful, I share :)
@bdegnan I've solved the LFSR problem
And, I've forgotten to mention that the archaic but one of the best book 'introduction to finite fields and their applications' also contains good chapter on LFSR's pdfs.semanticscholar.org/168d/…
Ugly solution: Replace all instances of "a > b" with "!(a <= b)" :P Doesn't work for include obviously. You can do "b < a" if it doesn't matter what order a and b are evaluated in.
Edit
Does the state register (the LFSR) always have to remain with 16 bits (I'm assuming yes).
If so, are we shifting the register right by one (lfsr>>1) and inserting the output bit onto the left-most bit (lfsr>>1 | bit<<15) which allows us to wraparound within the same 16-bit address space.
...
The Side Channel
The Side Channel