168400+ entries in 0.103s
PeterL: I will check in later once I am back at my computer with my key
to verify
this conversation has been with
the real PeterL
☟︎ mircea_popescu: PeterL so if you feel like writing a mpfhf reverser... afaik nobody has
to date.
mircea_popescu: this scheme is both slow and bulky. it is not likely useful for gossipd-style comms. it is certainly valuable for signing material, especially because rsa signature is much more padding-vulnerable
than encryption ; and perhaps for some limited encryption work.
mircea_popescu: c (in
that order), where R and S are produced by mpfhf(m') with R len set
to c (bitness same as bitness of len(Pm). Pm will be
the padded message sent
to RSA.
The recipient will have
to undo mpfhf with known R and S
to obtain m.
mircea_popescu: anyway, let it be said
that
there's nothing wrong with oaep as far as we know, but for
the sake of argument a mpfhf based padding scheme would conceivably work like
this : 1. given message m, of length l, generate r = random bits, of length l' up
to l but not less
than 256 bits. 2. compose m' = r + m + c (in
that order), where c is l - l` (and its bitness is always same as
the bitness of len(m')-256). 3. compose Pm = R + S +
☟︎ mircea_popescu: i mean
the bitsize ; it's not just
that
though, partially known secrets, low exponents etc all conspire
to empwer
the latice reduction.
PeterL: do you mean
the bitsize of n and e, or
the actual numbers?
PeterL: in " n / e^2 bits of entropy ", what are n and e,
the key modulus and exponent?
PeterL: mircea_popescu linking
to a pdf, what is
the world coming
to!?
mircea_popescu: and since we're apparently doing rsa likbez : if r used in padding above contributes less
than n / e^2 bits of entropy
to
the final, padded message, coppersmith has a few words
to
tell you.
mircea_popescu: PeterL
terrible,
terrible
thing, which is why irl rsa is always padded.
mircea_popescu: (and, of course, for short messages ie shorter
than n i can just compute
the e-root).
mircea_popescu: and upstream,
to make clear what "semantic security" means : rsa is deterministic, if i wish
to see if your "encrypted" string really was message m, all i have
to do is encrypt m myself. if
the results match i have cryptographic confirmation.
mircea_popescu: because hash and hash' are used
to stretch/reduce
the bitlength of
their parameters, something like mpfhf (which permits arbitrary sized outputs/inputs) could work well ; but is also slow.
mircea_popescu: oaep works like
this : given hash and hash' hash functions, calculate X as hash(m00) xor G(r) and Y = r xor hash'(X).
a111: Logged on 2017-02-14 19:19 asciilifeform: specifically, for every byte you intend
to send, you instead send
two: x, y. which you generate by obtaining rng byte r, and payload byte b, and x := b xor r, y := r
mircea_popescu: basically it
takes a random string, jumbles it with
the original message, and spits out
two halves.
the hope with it is
that it provides all-or-nothing security, in
the sense
that
to recover any bit of
the message you need
to correctly process
the entire pair of jumbled strings.
mircea_popescu: now, alf's scheme is probably valid padding,
though it is very expensive. it works like so :
to encrypt a message m
to key X, you : a) generate
two one-time keys, A and B. you encrypt some bits of m
to A and some
to B, randomly chosen. you pile
together :
the bits of m encrypted with A,
the bits of m encrypted with B,
the schedule of which is which, and
the keys A and B into one large m'
PeterL: that is what we were
trying
to fix, no?
mircea_popescu: now :
textbook rsa (the sort of
thing you seem
to be discussing, above) has no semantic security and on
top of
that is malleable.
mod6: meanwwhile, I'll add a preface
to
the HOWTO doc on
the minimum requirements.
thanks
to diana_coman for gathering
them up once upon a
time.
PeterL: no, recipient goes
through his list of keys A and B until he finds
the one
that decrypts it
mircea_popescu: PeterL and
then you add key A and B
to
the message at
the end so recipient can un-pad ?
mod6: edivad's environment is indeed some sort of non-developer version of linux
that has almost no
tools pre-installed. also, had some non-english version, which my V does not work with. Yesterday asked him
to remove gpg v2, and install v1.4.10.
PeterL: this is
the padding algorithm described by alf:
take random bits r and message x, encrypt r
to key A and encrypt (r XOR x)
to key B
mircea_popescu: PeterL
the other problem
this discussion reveals, of course, is
that you aren't using any padding ?
mircea_popescu: PeterL
the broader point here being
that you can't warn
the user about
things he can't control. you gotta provide for it yourself.
PeterL: aha,
that seems like a logical solution.
mircea_popescu: PeterL
the logical approach would be
to include a checksum neh ?
PeterL: if you have an encrypted
text c,
then c ^ d mod n will give an integer, without previously knowing m, how will you check for congruence?
mircea_popescu: or how shall i best put it,
that's not equality but modulo congruence. whereby 7 = 5 mod 2
PeterL: oh, wait, no, I didn't see
the extra ^ e in
there
PeterL: well, won't
that calculation always result in an integer?
mircea_popescu: so you are
telling me
that m ^ e ^ d mod n always has an integer solution for randomly chosen parameters.
☟︎ PeterL: not
that using
the wrong key will give you
the plaintext message, but
that if it uses
the wrong key and happens
to match
the cs for
that key, it will pass
the pile of garbage on
to all
the peers
PeterL: so I guess "too small" would be something like
two or less?
mircea_popescu: 0 length isn't usually what one
thinks of when seeing "too small". same istrue if 1 byte string ?
PeterL: using
the wrong key will result in a random byte string, so with a cs of 1 byte, you have 1/256 chance of looking like it was
the right key
☟︎ PeterL: if you have a 0 byte cs,
then every message looks good
☟︎ a111: Logged on 2017-08-08 23:33 mircea_popescu: PeterL +# IMPORTANT NOTE: if
the cs is
too small, messages have a chance
to get decrypted by
the wrong key << what is
the logic behind
this ?
PeterL: so yes, using
the fermat
test would be bad
PeterL: I
tested
the fermat
test, and with 100 numbers of 1024 bits deemed prime by
the fermat
test, 50 were found
to be composite by miller-rabin
PeterL: I looked at miller-rabin, and switching over
to
that algorithim is quite simple
PeterL: hi,
thanks for
the !!up, my key is on another computer
edivad: but i've done
two
times becouse
the first has gone wrongly
to
the standard output
edivad: i know, it wasn't a smart move, but if you see a spike of
traffic now you know
that it wasn't a ddos attempt
mircea_popescu: anyway, forward your
thanks
to phf for allowing your exericse.
mircea_popescu: well so if you
thought
that you could have asked before rather
than after eh.
edivad: ok
thanks, intially i
thought
that maybe doing 400-500 mb of
http traffic could be seen as a bad
thing
mircea_popescu: they also end up on archive.is, because
the bot archives links and
the odds of a whole day going by without a single log reference are small.
edivad: I've done it yesterday for a friend
that asked me a dvd with
the logs inside,
to read
them when on holiday with no internet access
edivad: is allowed/polite
to scrape all
the btcbase.org/log website?
edivad: a
thing
that i've not asked and now i remembered
edivad: thanks BingoBoingo for
the help
jhvh1: BingoBoingo:
The operation succeeded.
BingoBoingo: !~later
tell
trinque maybe look into
the edivad deedbot registration
thing? Guy is having a hard
time
edivad: when i'll login again in IRC, what command should i use
to authenticate?
edivad: tried now
to install
the common bitcoin core dependencies with apt
edivad: let me copy
the entire error log
edivad: gcc is already
the newest version (4:5.3.1-1ubuntu1).
edivad: in
this case what is missing?
mircea_popescu: and in random other lulz : it's funny how
the libertards worshipping at
the watergate shrine usually omit
to mention
that by
then washington post had been a libel
tabloid for years. somehow dillard stokes' name never comes up. somehow
they don't seem
to notice it always was simply us sturmer.
BingoBoingo: edivad: Just remember
that hunger can be
the most devious
thief of all as evidenced by kakobrekla's 500 BTC car. Every situation is different, but many of
them rhyme.
edivad: now
that i've registered my pgp key, should i be able
to authenticate signing something?
edivad: well, I have a spare brazilian passport in
the drawer, so when I've read
the universal plan, I instantly got some very powerful energy for a future exit plan
BingoBoingo: Painting done well is a perfectly respectable
trade.
edivad: but
then after a month i realized
that I was needing a better plan
edivad: since it was
the first work experience, I was even able
to enjoy it
edivad: in
this summer holidays aside of ruinous altcoin
trading I've done some painter job paid 5 euros/hour
edivad: mircea_popescu: because
the universal plan for wealth makes some great guidelines, but
then since every situation is different, I'm
trying
to understand if
there is a better approach for who hasn't already a job and is studying
mircea_popescu: this is how growing up goes : you
take stock of situation, you make a plan, you implement it.