Slashdot Mirror

You seem to have missed the bit that says:

We also discuss the potential impact of our attack on several published schemes. Quite surprisingly, for subtle reasons, the schemes we study happen to be immune to our attack.

In other words the paper says "Here is a devastating attack in paired hash functions that happens not to work on real-world uses of paired hash functions". In fact RIPEMD-160, the longest-lived unbroken hash function, gets its security precisely from being a cascaded hash (and is be immune to the attack described in the paper).

I found this when I googled Keith Henson http://valerieaurora.org/keith...

On example is her writing on compare-by-hash. It has been a while and I am currently not finding the original text anymore, but at a quick glance this paper seems to be the same thing: http://valerieaurora.org/revie... I have no idea (and currently no time to check) whether the emotional arguments and faulty statistics I found in the text I read are also in the PDF.

Now, compare by hash is perfectly fine if you do it right. In that case the computer producing bit-errors and the like while you do the hashing for a comparison is more likely than getting a hash collision. Yet for some reason Valery seems to not understand that, or at least did not back then.

It's been done. Unfortunately, it was done in the Synthesis kernel, which was made out of self modifying 68k assembly, and thus subsequently forgotten about. Apparently by going with adaptive scheduling they ended up with a soft-realtime system.

Here's her webpage:

http://valerieaurora.org/

with links to the white male privilege checklist:

http://www.amptoons.com/blog/the-male-privilege-checklist/

And here is here in her scantily clad attire at DEFCON designed to bait desperate sexless men into acts to further her feminist bullshit:

https://www.defcon.org/images/graphics/PICTURES/DAN-2.JPG

She's an ideological provocateur whose only relevance comes from her nutty feminist nonsense . You can read more her BS at her blog:

http://blog.valerieaurora.org/

Here's her webpage:

http://valerieaurora.org/

with links to the white male privilege checklist:

http://www.amptoons.com/blog/the-male-privilege-checklist/

And here is here in her scantily clad attire at DEFCON designed to bait desperate sexless men into acts to further her feminist bullshit:

https://www.defcon.org/images/graphics/PICTURES/DAN-2.JPG

She's an ideological provocateur whose only relevance comes from her nutty feminist nonsense . You can read more her BS at her blog:

http://blog.valerieaurora.org/

that the author of this article is a feminazi:

From her web page http://valerieaurora.org/ ...

http://www.amptoons.com/blog/the-male-privilege-checklist/

A white male privilege checklist. Frankly, I wouldn't be surprised if she baits men to create evidence to back her feminist bullshit.

http://valerieaurora.org/

Dress down a bit. Most of these guys don't get much action, and to have an attractive girl in potentially suggestive attire parading about is equivalent to sexual taunting.

Today's modern woman walk around with 90% of their tits hanging out and then have the nerve to get upset when men look. Let's be frank. Women enjoy it when men look otherwise they wouldn't dress the way they do. They enjoy the power that comes from knowing they are desired. They basically enjoy showing men what they can't have. If they don't like the harassment there is a simple solution: dress like a nun when you attend DEFCON. There, problem solved. Now you don't have to re-engineer male human nature.

I don't know if there are domain experts or a client-base whose desires a traditional engineering effort can be aimed at. So the internal crowd get to be the client-base and to provide feature requests or feature enhancements themselves.

I can't work out if that's a good thing. Perhaps they'll be doomed like Sun to have a closed culture (as Valerie Aurora pointed out http://blog.valerieaurora.org/2010/02/13/sleeping-with-the-enemy/) which will only scratch the itches that people within Facebook need for Facebook. On the other hand, they've built a substantial internal culture which mimics a successful free software culture.

Instead of churning out cores they schould tweak the x86 isa to use multiple cores efficently. 1/2-word Atomic compare and swap is not enough, you cannot make atomic lockless doubly linked lists with that. No wonder something as interesting as http://valerieaurora.org/synthesis/SynthesisOS/ is not possible on x86 without major hacks.

And how about Keith Henson. His article makes him look like a total hero, but...

Two of his daughters publicly claim they were raped by Mr. Henson. One of them changed her name from Henson to Aurora. (Remember her? Valerie Aurora, the Linux file system developer and ex-ZFS designer.) In December 2007, the child molesting accusations were published on-line by her in a quite extensive article that includes links to other (reliable) sources. Guess why his wife Carolyn Meinel left him...

Is all this even mentioned briefly on his page, under a "Controversies" heading? No.
Even the discussion page is locked!

http://valerieaurora.org/hash.html
Pay special attention to the reaction of the "slashdotter" to "minor weakness found", and compare it to your reaction.
Remember, attacks always gets better, never worse. The first attack that weakens an algorithm *is* a big deal.

Oh, and reducing complexity from 2^128 to 2^110 isn't as it may appear a reduction of 10% in time-to-break, infact it's a reduction of 2^18 or about a factor of a million, so it's more like if before it took a million years, now it takes ONE year. Luckily for you, AES256 was at a lot more than a million years before the break, so there's still some air left in it.

I could not agree more. Last year I met Valerie Aurora http://valerieaurora.org/ at LuGradioLive. She is by far the smartest and most talented geek I have ever met. The fact that she was a woman was awesome. This experience changed my perception of female geeks forever. To take a line from Real Genius, "She's smarter than you and I put together."