141400+ entries in 0.09s
diana_coman: that being said, whenever I find I don't even have
that poor picture as full and as clear as I'd like, I'm still left with little other choice
then
to go and read; possibly again, what can I do
diana_coman: asciilifeform, I suspect it's quite possible
that
the writer would end up with
that q so... no book
mircea_popescu: now,
the expectation is
that a full day of play will produce less
than say 2^15 or so messages.
mircea_popescu: in ~principle~ serpent doesn't expose
the key anymore
than it exposes
the cipher.
the claim is
that if you know about 2^100 or so plaintext-ciphertext matches you can extract
the key.
diana_coman: mircea_popescu, and
then when client enciphers with 1 from a set of 8 selected from
those 16: does
this mean reusing
that 1 key for as many 128 chunks
that particular eulora message has? or do you mean 1 per chunk ?
mircea_popescu: asciilifeform yes but
taking
the assumptions other way
to see how bad it looks.
mircea_popescu: but if memory serves
the "attack" on serpent used 2^100 plaintexts sorta deal
mircea_popescu: and suddenly
the fg entropy debit is relevant : eulora server will be capable
to produce iirc no more
than 64 serpent keys/second per installed FG.
mircea_popescu: the major advantage of which is
that user will be able
to enjoy security flowing from server even without own fg.
mircea_popescu: diana_coman i guess we'll define a "control packet" which is always
the first 128 bits of every comm, which will contain data such as "killed key #x moved
to #y" and also "running out of keys send moar".
a111: Logged on 2017-11-22 21:56 asciilifeform: my approach is a universal 'stretcher', predicated on having reasonably fast and high-quality
trng.
mircea_popescu: diana_coman
thereby all game packets will be multiples of 128 bits, and in principle a client can live off
the first original rsa op its entire life if it so wishes.
mircea_popescu: asciilifeform client just keeps a list. adds
to it when rsagram
mircea_popescu: anyway, so what's
the work mode here, every now and again server sends client a rsa-encrypted packet containing 16 aes keys ; client enciphers its comms
to
the server with one selected from a set of 8 selected from
those 16 ; and deciphers server's with one selected from set of 8 other
than previous set. now and again burns a key.
mircea_popescu: check it out, diana_coman has found de-facto work-around
to "my
theme overwrites
text up
top" : put an intro in, page or so before code :D
mircea_popescu: so basically we'll be reusing serpent keys, is
the idea ?
a111: Logged on 2017-11-14 14:55 mircea_popescu:
this is
the problem with "complexify
the code machine"
tendency. somehow it appears intuitively evident
that having a portion of
the code INSIDE
the machine is "a more complex,
therefore a more secure system". it is not. 100% of
the key belongs in
the key.
mircea_popescu: OTHER 1998 documents, of lesser political sensitivity, exist
there in original format.
mircea_popescu: asciilifeform
the "specificication" published on cambridge page is most likely a later fake. it's a 2006 item supposedly of a 1998 document.
diana_coman: mircea_popescu, let me see if I got
this right re "patch": simply apply serpent as it is and
then at
the next level up glue x keys
together and send as "key", glue
the corresponding x outputs
together and use as "output"; basically lump
together 16 serpents
mircea_popescu: asciilifeform right you are, it's in
the... 2006 spec.
mircea_popescu: asciilifeform i have
this itching half-memory
that serpent 256 was actually defined
mircea_popescu: it's bullshit all
the way down, "the 4096 bit block gets cut into 16 sub blocks
to be fit into rotorizers
that cut each block into 64 bits and process with
their 4 bit s boxes". because we're from
the fucking cartoons.
☟︎ mircea_popescu: anyway, whatever, diana_coman :
the correct implementation approach
to patch
the 256 bit serpent into 4096 bit rsa is
to cut every rsa block into 16 fragments, cipher each independently with diff keys,
then paste
the 16 keys
together make 4096 bit of key.
mircea_popescu: dja see why i'd muchly prefer a native
tmsr.rsa length symmetric cypher rather
than
this nonsense ?
a111: Logged on 2017-11-22 21:45 asciilifeform: anyway for 512bit key, you still keep
the 128bit block. but each
time you have incoming 128b plaintext, you shamir it rngistically into 512bits, i.e. 4 128b parcels
that must be xor'd
to reconstitute
the original. each of
these get ciphered with one of 4 independently-generated 128b keys.
diana_coman: ha, back when I was blissfully only *playing*
this game!!
a111: Logged on 2014-09-07 18:00 mircea_popescu: It gets worse. Nearly every AES implementation using AESNI will leave
two values in registers:
The final block of output, and
the final round key.
The final block of output isn't a problem for encryption operations — it is ciphertext, which we can assume has leaked anyway — but for encryption an AES-128 key can be computed from
the final round key, and for decryption
the final round key is
the AES-128 key. (For AES
mircea_popescu: apparently AES is one of
those
topics where someone could just pick up
the log discussion over 3 years and make anencyclopedia entry
a111: Logged on 2014-09-07 17:56 mircea_popescu: i wasn't aware
this is public knowledge.
a111: Logged on 2016-02-06 16:55 mircea_popescu: derp #1 : "What is wrong with existing block ciphers like AES? AES has been in widespread use for over a decade and
to
the best of my knowledge,
there is still no practical attack on it (unless someone has built a working quantum computer and not
told anyone about it). Its
totally free of patents and IP issues. Its been implemented in a huge variety of hardware and software (including
the Intel CPU
that I am using
to m
diana_coman: asciilifeform,
that makes perfect sense, yes
a111: Logged on 2017-11-22 20:14 BingoBoingo: ben_vulpes: Apparently
teaches girls
to respond
to favors with affection, Grill Scouts says bad family
ben_vulpes: writing niggers on
the wall is basically shooting babies,
trinque omfg be more sensitive
trinque: how did someone writing niggers in a school bathroom make
the news?
shinohai has enjoyed asciilifeform 's and diana_coman 's exchange and also goes
to
tea [~}
diana_coman: I
think I need
to read more on
this, so I'll hit
the books
diana_coman: yes, I had found
that one; for some reason I
thought you had in mind a different approach for expanding block + key size for serpent itself
a111: Logged on 2017-02-25 21:26 asciilifeform: so, for instance, you can prove
that a k-of-k (must have ALL parts) shamir split, where you
then
take each share and encipher with different method -- will NEVER be weaker
than
the strongest cipher used.
a111: Logged on 2016-12-24 01:03 asciilifeform: picture
the following 1-dimensional automaton,
that eats bitstring in sets of 2bits, and : '10' -> 'tape step left' ; '01' -> 'tape step right' ; '11' -> invert bit at current square; '00' ->
terminate.
diana_coman: ah, it was
the construction on
top you had in mind
diana_coman: hm, I probably did not know how
to search for it properly as I did look but still not very clear on it