Slashdot Mirror


User: Glorat

Glorat's activity in the archive.

Stories
0
Comments
164
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 164

  1. Re:Clearing up the deceptive intro on 1024-bit RSA keys In Danger Of Compromise? · · Score: 2

    Ok, gotcha on the NP-Completeness part. My new more informed conclusion is the factoring is maybe/probably NP-complete. Many have claimed it (and my prof didn't debunk me when I claimed it in a NPness project) but indeed I have seen no proof.

    I still find the use of "relies" too weird for me.
    If Kevin Tam "relies" on his health it means if my health is broken, I die. (RSA relies on factoring, if factoring is broken, RSA dies). Sounds correct for both sentences.

    The converse (not so good analogy here, ignore this paragraph if it doesn't make sense): If Kevin Tam's understanding "relies" on google's truth then if my understanding is wrong, google is wrong too. That doesn't follow. (If RSA relies on factoring and RSA can be broken, then factoring can be broken easily)

    That's why I disagree with the use of English you gave. If cryptographical publications rely on this kind of use, I'll avoid reading them as I'll just get confused no end!

  2. Re:Clearing up the deceptive intro on 1024-bit RSA keys In Danger Of Compromise? · · Score: 2

    Ignoring the flamebait... thank you, I was not aware of these other uses of the NFS. Would you happen to have references? Do you know if it can be applied to elliptic curve crypto?

  3. Re:Clearing up the deceptive intro on 1024-bit RSA keys In Danger Of Compromise? · · Score: 2

    This isn't a question of maths or crypto but English. If you disagree with what I am about to say, I will leave it at that. The correct sentence should be The security of RSA has not been proved to rely solely on the difficulty of factoring. That would be correct.

    You have stated the converse statement in effect. I am sure you agree with "If factoring is broken then RSA is broken". Hence RSA relies on the difficulty of factoring. (But, again, not *solely* on the difficulty of factoring).

    Now, onto a different subject. How dare you say factoring is not NP?? That is ludicrous. Search for google for "NP complete factoring" and see what it comes up with. I am 100% sure it is NP and 95% sure it is NP-Complete (only 95% because I have no proof for it, only what I read and professors tell me). It is purely a matter of whether P=NP. I believe P!=NP (a groundless belief as I said) hence RSA is safe from brute force based factoring attacks in the long run

  4. Re:Clearing up the deceptive intro on 1024-bit RSA keys In Danger Of Compromise? · · Score: 2

    I think you've got your logic backwards there. Ahh... memories of my first ever uni maths lesson explaining the differences between "if" and "only if". RSA does (trivially) rely on the difficulty of factoring. If factoring was easy then RSA is dead hence RSA relies on the difficulty of factoring

    What you are trying to say is that RSA does not *solely* rely on the difficulty of factoring which you would be correct in saying since currently it is surmised that factoring is the easiest break in point. And since factoring is NP-complete and I have a (groundless) belief that P!=NP, I feel RSA is safe from this point.

    But logically, my original statements stands

  5. Re:Would obscurity be a solution? on 1024-bit RSA keys In Danger Of Compromise? · · Score: 2

    I'll follow on although you sound like you know about the subject already. Firstly the cryptanalyst may well have more luck breaking the combined layered cipher than trying to break both individually The layered cipher may well be weaker! There is no law that says that if you perform two strong encryptions over a plaintext it is at least as hard as each encryption. This unknown is one reason against. (In practice, layering is "probably safe")

    The next thing is that I strongly doubt that even DES will be "broken" ever. It has been under scrutiny for too long and the only successful attacks are based on brute force and require vast amounts of data for a known-plaintext attack. Brute force... what does that mean? 56-bit breakable today. 128-bit breakable tomorrow. 256-bit breakable... when there are more than 2^256 electrons in the universe! Which there aren't

  6. Re:Clearing up the deceptive intro on 1024-bit RSA keys In Danger Of Compromise? · · Score: 2

    Oh yeah... forgot about that one =P
    Each extra bit doubles the time for a brute force attack so going from current 56bit keys, that's a lot of time.

    The other useful analogy (cos noone really gets big numbers into their head) is that at 256 bits, there are more key possibilities than electrons in the universe!

    Safe

  7. Re:Clearing up the deceptive intro on 1024-bit RSA keys In Danger Of Compromise? · · Score: 1, Flamebait
    You're accusing me of not reading the title but you obviously haven't read my title. I'll spell it out for you again... "Re:Clearing up the deceptive intro". It is the intro that is wrong. I even quoted the incorrect sentence: "1024-bit encryption should no longer be considered pristine".

    Got it now?

    Hypocrite.

  8. Re:Would obscurity be a solution? on 1024-bit RSA keys In Danger Of Compromise? · · Score: 5, Informative
    Two issues going on here!

    Ah... the old security through obscurity notion. Someone else can carry the debate here but trying to get security by trying to hide what layers of algorithms you are using is defeating the point of security research. A "secure algorithm" is basically one such that it does not matter whether the hacker has access to the algorithm or not. Cracking a "secure algorithm" should be as hard as cracking by brute force. If your security relies on obscurity, then you are asking for trouble in general

    As for layering in general. Well it works for the most part (e.g 3DES) although there are caveats (2DES would not be safe). But the real point is that layering is slow. Doing 1024-bit RSA encryption is slow. And try generating a 2048-bit key instead of a 1024-bit key. It takes ages (possibly minutes on some computers). You may be increasing security but decreasing performance.

    Now going back to the first point about a "secure algorithm", you are better of say doubling your key size and exponentially increasing the keyspace on your existing algorithm then either inventing your own layering scheme that may or may not work AND will be slow nad memory wasteful by using many algorithms. The short answer is, you don't need layering, just make larger keys.

  9. Clearing up the deceptive intro on 1024-bit RSA keys In Danger Of Compromise? · · Score: 5, Informative
    1024-bit encryption should no longer be considered pristine

    That intro is deceptive at best and is, well incorrect. Remember DES and other symmetric ciphers that currently use about 128-bit or so encryption are unaffected by this. Certainly, 1024-bit symmetric encryption (your typical secret password encryption) is going to be unbreakable for centuries based on current predictions. The intro should read asymmetric or public key encryption at 1024-bits

    Secondly, the advances being talked about are in factoring large numbers into their prime factors using the Number Field Sieve (NFS). This algorithm is the most advanced known factoring algorithm and if you believe the article improvements show that factoring 1024-bit length primes is doable for 1 billion dollars or so. (It was only a few years ago this kind of cost was attached to building a DES cracking machine... today I could probably crack DES on my uni computers given the software. 1024-bit factoring is only a matter of time before it is easy). However, not all public key schemes rely on the difficulty of prime factoring. Elliptic curves rely on a different hard problem

    Conclusion, the intro should read "1024-bit asymmetric encryption that relies on the difficulty of prime factoring (e.g RSA) should no longer be considered pristine"

  10. Re:Illegal? on Lab-Grown Meat Chunks - It's What's For Dinner · · Score: 2
    "Does that mean that it is actually _illegal_ to eat crayons, glue, boogers, pieces of carpet, lead paint chips and dirt?"

    +1 Funny... just. Since it's currently marked interesting by mods who haven't thought too far ahead, I suspect the Food administration must approve the stuff to be safe before people can legally advertise and sell the stuff as food. Crayons and the like are sold for a different purpose and whether or not you eat them is a "fair use" of your purchase.

    Hmm... wonder if there will ever be a FMCA (food millenium copyright act) making it illegal to circumvent anti-eating restrictions such as disgusting tastes and protective wrapping to actually eat certain food stuffs (-1 Offtopic) Apologies

  11. Clients can be independent of servers on More on Dell Dropping Linux Support · · Score: 2
    "Microsoft knows that as long as they control the desktop they can eventually take the server market. After all, what good is a server if the clients wont talk to it?"

    Eh? I would disagree with that or rather say that is too simplistic a view to take, especially without giving any argument as to why it should be so. I'll take the simplistic examples that a vast proportion of "Web-Servers" are running Apache on anything other than Windows (they use Solaris, Linux...) but the vast majority of clients are on Windows.

    What is the real issue between the client/server relationship? I would say the answer is protocols. As long as you have open protocols like HTTP, SOAP, java-based etc. then the opersating system of client and server can be independent. Now, one could argue if a monopolised company took over the desktop market, they could be forced to use certain proprietary protocols that only work on proprietary servers. But Microsoft aren't gonna gamble that much with their monopoly. Notice their protocol of choice for .NET is SOAP which is an open protocol

    So open protocols means that the desktop OS won't take over the server OS

  12. Re:Most secure web server on Computer Security Criteria · · Score: 2

    Yeesh... not sure what the mods are doing me modding me up. It wasn't meant to be a serious post, nor was it a serious gesture by my lecturer.

    The point I was trying to make (and my lecturer too I imagine - I slept thru much of it) is that the incidence of problems is not purely a function of "security" but also a function of "attack likelyhood". Of course these are dynamic variables and aren't even completetly independent variables but they do illustrate a point.

    If you are going to measure security, do you measure it by "measuring" empirical results to form your conclusion or do you go into the black art of measuring security by non-empircal means like how many holes you "think" there are.

    That's the serious point that *I* wanted to make. And if my parent miraculously got an overrated moderation count, this deserves a (+1) insightful =P

  13. Re:Most secure web server on Computer Security Criteria · · Score: 5, Interesting

    Here is another clue I got today from my uni lecturer. If you wanted to run a secure web server, would you run it on NT, Linux, Solaris or the Mac?

    *Up go hands of Linux advocates*

    Answer: Mac because it is the least available operating system and as such fewer attacks have been created for it, even if there are hypothetically more bugs. As such, you would be less likely to suffer a problem, all else being equal

    Back to the article, would a measurement take into account this type of situation? Does Mac get a high rating for low rate of incidents or a low rating because it (probably) has more bugs than Linux. Open question

  14. Re:Quality DOES matter. on Low-end Laptops? · · Score: 2
    Forgive me for stereotyping you in my mind when you said "I am perfectly happy and productive at a command-line interface". Well, I like 90% of the population and a happy Windows user. I shelled out money of my own pocket to buy Windows 2000 and it was worth it at the time. Once I started using 2000, there was no way I was gonna use Win98 on any machine I used so any old laptop I run would be forced to run Linux. Ok, the router bit was a joke but it was meant to highlight limitations

    You are right about the glamour of new products but MS play their cards well. I could make do with Win98 if that was all there was. But MS have done enough to make me want to get their latest and (not) greatest products sometimes.

    Or maybe I should resell the laptop to my uncle who only needs it for word processing. Hmm... that would work actually... The average Joe can get work done quite happilly on 3 yr old machines

  15. Buy your friend's "dead" laptop! on Low-end Laptops? · · Score: 3, Insightful

    I just had a brainwave. In the past, friends have come to me with their PC woes (I read slashdot right?) My cousin came to me with her dead laptop. It wouldn't boot up and in the end, she bought a brand new one and the old dead one she just left

    Why was her laptop dead? Well, hard drives in laptops die after 2-3 years typically in my experience. Your joe user see's the laptop die and goes to buy a new one since they are beyond warranty. However, techie you could take the laptop (offer money?) change the HD and voila! You have a cool 3yr old laptop to use as a router or firewall or something ;) Of course the warning is that at 3yrs old, don't trust the battery much... but you never know, it might run linux =P

  16. Re:Where do they go for outsourcing? on India Plans A Supercomputing Grid · · Score: 3, Interesting

    It is interesting to note that here in the UK, the laws for immigration have changed significantly. Laws are getting tougher for assylum seekers but being relaxed for immigrants that would help the UK economy... and many of these are Indians because they are smart and well educated. Indeed, I have heard of many a project that have been outsourced to India because skilled labour is so much cheaper there. India have the skills and manpower to pull this off

  17. Re:China just doesn't get it. on China Wants Out of Spam Blocks · · Score: 2

    Some of us Chinese happen to like the idea of a Free State and Free Internet. Shutting the *people* out of the internet is just reactive and bullying and doesn't help the people at all. If you want the Chinese to become free, you should be helping them to get as much of this "free information" as possible, not banning 1 billion people from it. And their reasoning for firewalling is control, not monetary.

    As for spam. Read the *&^%ing article. The people are trying to take steps to *reduce* spam. That is a good thing. It shows the policy of blocking China mail servers is having an effect.

    In a population of 1 billion, I can assure you that less than 0.01% of the population does not promote spam so be careful who you have a gripe with and who you want to penalise

  18. Re:FUD on More Mayhem From MSFT's Mundie · · Score: 2

    Aw... I would loved you to have gone to see their demo and try to get the sales rep hour their $2000 a seat solution would be better than the free software solution =P

  19. Re:GNOME vs KDE for the newbie on GNOME 2.0 Beta · · Score: 2

    I will try that =P
    I'm getting larger HD on my laptop so I can try Linux once again.

    Just one thing. I will be using Mandrake (newbie distribution) and last time the darn package manager insists that Gnome requires Nautilus to be installed *and* Nautilus has all those hooks into Gnome :(

    Suggestions always welcome

  20. GNOME vs KDE for the newbie on GNOME 2.0 Beta · · Score: 4, Interesting

    I know this dicussion can start the many flame wars so let me ask this from a personal perspective

    I am a relative Linux on the desktop newbie (although very comfortable deploying on servers) and still prefer the ease of use and performance of the Windows interface. One day, I installed Linux to try out and had a go at both KDE and GNOME (about a year ago) but didn't like it. Today, I sadly develop on Windows to be deployed on Linux

    I found KDE took ages to start up, GNOME was slightly better but Nautilus while featureful was horribly slow. Both were rather confusing with respect to my favourite shortcut keys and mouse commands (especially clipboards and window control) although I hear KDE has a "Windows emulation" mode it wasn't convincing

    So the things that are on my mind are:
    - Have the environments improved a lot in the past 12 months in terms of usability and performance and startup speed?
    - Is it getting much easier for the Windows user like me to get into?
    - What are the main goals that GNOME are trying to accomplish over their new releases? KDE?

    Otherwise, I guess I'll keep my "desktop environment" to nothing but an xterm console and only use Linux when I have to

    Thanks

  21. Re:FYI: The whole letter - this bit confuses me on NOA to Sue for Flash Advance Linkers · · Score: 4, Funny
    "distributing illegal imports of the Flash Advance Linker ... and subject to seizure under 19 USC 1595a(c)(2)(c) by US Customs."

    Nintendo demands that you ... turn over your remaining stock to Nintendo.

    What? Has Nintendo suddenly become part of US customs?!

  22. Re:Please... on Americans And Chinese Internet Censorship · · Score: 2

    Democracy only works in an educated society. Without education, people don't understand politics and don't understand their vote and are easily swayed. Also, you can't just say, right, everything is FREE market now. Free to grow eoncomically or free to go to disastor? The Chinese government understands that there would be chaos if democracy and the free market was suddenly imposed on them.

    Just look at the USSR as an example! The Free Market and democracy was dumped on the Russians very quickly. It has caused economic disaster. People are just as poor, if not more so. The rubel value vanished. The people are still as unhappy as before and there are still internal wars (Chechnya). It is wrong to say that democracy and free market are right, per se. You have to back it up carefully

  23. Re:Please... on Americans And Chinese Internet Censorship · · Score: 2

    Oh screw the mod points I was gonna distribute in this thread.

    Please bear in mind that Taiwan IS officially PART OF CHINA. Taiwan is not a country of their own but part of the Chinese republic so "One Nation, One Governement" is at least plausible.

    But in reality, the poster is right. China won't go in and suppress Taiwan or Hong Kong. If there is one thing the Chinese goverment, it isn't dumb. It understands its internal dynamics. In actuality, China won't be taking over Taiwan and Hong Kong, it will be the other way round. You see. Hong Kong will be performing the silent invasion of China over the next decades and for the better. Slowly and peacefully

  24. Re:17 CD's not on my Compaq... on Not A Graceful Recovery For HP Customers · · Score: 2

    I have a Compaq Presario. It comes with a recovery partition of about 1-2Gbs (can't remember... having a 6Gb hard drive meant I wiped it). It did save my life once =) Now I honestly wonder why this HP needs 10GB of recovery data. That's really mad unless it also contains the image portions for the pre=installed Microsft Encarta!

    Incidentally, my Compaq didn't come with a Win98 CD either although I do have the Win98 license in the form of a sticker stuck to the bottom of my laptop. I honestly didn't worry about the lack of Win98 CD since I never needed to upgrade drivers and in that one even when I *really* broke things, the recovery partition worked well.

    Now, one day, my HD died completetly and I had it replaced. Of course, now I ended up without OS. What did I do? Installed Mandrake Linux on it. Duh!

  25. My department has the source code! on Judge Says Microsoft Must Give States Windows Code · · Score: 3, Interesting
    Absolutely. I asked my computer support group (CSG) at my university and apparently, our department has cheap(/free?) licenses to all sorts of MS products such as Visual Studio, Win 2000 etc. etc. AND I was told we also had the source code to some of these products! Unfortunately, they are under a strict licence so the likes of me can't just waltz in and take a copy. What it does mean is that
    • The court request is perfectly reasonable
    • Source won't become public domain
    • Microsoft might not actually fight it!
    • If the courts feel so inclined, they could hassle a university for the "evidence"