secfuck v18.51: who needs they entrussy revoked

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > secfuck v18.51: who needs they entrussy revoked

«‹›975 »

ewiley: Jul 9, 2003; More trash for the trash fire

spankmeister posted:

I use 3073, because it's twice as good

# ? Sep 20, 2019 16:13

Adbot: ADBOT LOVES YOU

# ? Jun 9, 2024 16:16

CommieGIR: Aug 22, 2006; The blue glow is a feature, not a bug; Pillbug

spankmeister posted:

I use 3073, because it's twice as good

Cyberpunk poo poo.

# ? Sep 20, 2019 16:19

Munkeymon: Aug 14, 2003; Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.

Wiggly Wayne DDS posted:

e: who uses 3072?

only the coolest of crypto cats

so not me obviously

# ? Sep 20, 2019 16:22

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

i only use one-time pads :colbert:

# ? Sep 20, 2019 16:33

Potato Salad: Oct 23, 2014; nobody cares

today, I write my second ever vuln disclosure

I'm not even trying to look for these, I'm just stumbling over bugs

holy loving poo poo Dell, Jesus Christ what the gently caress

# ? Sep 20, 2019 16:39

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

the NIST P curves aren't very good, should be using x25519 if your stuff supports it. Apparently P-521 is an absolute mess, so the recommended ordering is generally x25519, P-384, P-256

# ? Sep 20, 2019 16:47

Winkle-Daddy: Mar 10, 2007

my p curve is just fine tyvm

:colbert:

# ? Sep 20, 2019 16:51

Raere: Dec 13, 2007

cracking a 256-bit key sounds cool until you specify that it's an RSA key

# ? Sep 20, 2019 17:36

CommieGIR: Aug 22, 2006; The blue glow is a feature, not a bug; Pillbug

LMAO, I didn't even notice: The paper is by a Crownsterling researcher.

Its the Time AI guys again. The guys who got booed out at Black Hat.

# ? Sep 20, 2019 18:13

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

CommieGIR posted:

LMAO, I didn't even notice: The paper is by a Crownsterling researcher.

Its the Time AI guys again. The guys who got booed out at Black Hat.

That was the first thing I noticed, because it just makes it all the better.

# ? Sep 20, 2019 18:41

CommieGIR: Aug 22, 2006; The blue glow is a feature, not a bug; Pillbug

Volmarias posted:

That was the first thing I noticed, because it just makes it all the better.

Apparently someone noticed too that the guys screenshots match one of the original RSA cracking sessions, so this may even be a straight plagarism.

# ? Sep 20, 2019 18:55

Salt Fish: Sep 11, 2003; Cybernetic Crumb

CommieGIR posted:

Apparently someone noticed too that the guys screenshots match one of the original RSA cracking sessions, so this may even be a straight plagarism.

Not just someone but Tavis.

# ? Sep 20, 2019 19:12

Salt Fish: Sep 11, 2003; Cybernetic Crumb

Bruce:

quote:

Earlier this month I made fun of a company called Crown-Sterling, for...for...for being a company that deserves being made fun of.

This morning, the company announced that they "decrypted two 256-bit asymmetric public keys in approximately 50 seconds from a standard laptop computer." Really. They did. This keylength is so small it has never been considered secure. It was too small to be part of the RSA Factoring Challenge when it was introduced in 1991. In 1977, when Ron Rivest, Adi Shamir, and Len Adelman first described RSA, they included a challenge with a 426-bit key. (It was factored in 1994.)

The press release goes on: "Crown Sterling also announced the consistent decryption of 512-bit asymmetric public key in as little as five hours also using standard computing." They didn't demonstrate it, but if they're right they've matched a factoring record set in 1999. Five hours is significantly less than the 5.2 months it took in 1999, but slower than would be expected if Crown-Sterling just used the 1999 techniques with modern CPUs and networks.

Is anyone taking this company seriously anymore? I honestly wouldn't be surprised if this was a hoax press release. It's not currently on the company's website. (And, if it is a hoax, I apologize to Crown Sterling. I'll post a retraction as soon as I hear from you.)

https://www.schneier.com/blog/archives/2019/09/crown_sterling_.html

# ? Sep 20, 2019 19:15

Shame Boy: Mar 2, 2010

Salt Fish posted:

Is anyone taking this company seriously anymore? I honestly wouldn't be surprised if this was a hoax press release. It's not currently on the company's website.

when i was trying to find the full version of their stupid paper about prime numbers it was really fuckin' hard to find on their website too, so lol i think they're just incompetent all around

# ? Sep 20, 2019 19:29

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

it's tempting to register clownsterling.io

# ? Sep 20, 2019 19:47

Carthag Tuek: Oct 15, 2005; Tider skal komme,
tider skal henrulle,
sl�gt skal f�lge sl�gters gang

Lain Iwakura posted:

it's tempting to register clownsterling.io

# ? Sep 20, 2019 21:51

Nomnom Cookie: Aug 30, 2009

factoring a 256 bit rsa key sounds like an interesting exercise for an undergrad

# ? Sep 20, 2019 23:23

spankmeister: Jun 15, 2008

I used RSA 256 as toy keys to test out my distributed factoring code because I knew I could crack them in under a minute.

# ? Sep 20, 2019 23:25

Midjack: Dec 24, 2007

CommieGIR posted:

NSA Recommended

no thanks

# ? Sep 21, 2019 00:06

Schadenboner: Aug 15, 2011; by Shine

Nomnom Cookie posted:

factoring a 256 bit rsa key sounds like an interesting exercise for an clown, in a circus

# ? Sep 21, 2019 00:33

CommieGIR: Aug 22, 2006; The blue glow is a feature, not a bug; Pillbug

Midjack posted:

no thanks

I'm telling the NSA on you!

# ? Sep 21, 2019 00:38

Farmer Crack-Ass: Jan 2, 2001; this is me posting irl

Lain Iwakura posted:

it's tempting to register clownsterling.io

do it

# ? Sep 21, 2019 02:43

Chris Knight: Jun 5, 2002; me @ ur posts; Fun Shoe

welp
https://twitter.com/malwaretechblog/status/1175240305844424704

# ? Sep 21, 2019 04:21

evil_bunnY: Apr 2, 2003

Subjunctive posted:

please jiggle mouse to continue booting

# ? Sep 21, 2019 10:29

Workaday Wizard: Oct 23, 2009; by Pragmatica

do motherboards/cpus come with hardware prngs or not? also why not use uefi to store/restore prng seeds?

# ? Sep 21, 2019 10:59

Soricidus: Oct 21, 2010; freedom-hating statist shill

the latest amd cpus literally came with a hardware rng that always returns -1

# ? Sep 21, 2019 11:01

Jabor: Jul 16, 2010; #1 Loser at SpaceChem

why would they need a prng when you can just implement an identical one in software? if you're gonna build special hardware you might as well make it a real rng, that uses an unstable flipflop or something that randomly goes one way or the other

alternatively, keep a running counter, and generate your random bits by encrypting it with a key known only to you and the nsa

# ? Sep 21, 2019 12:03

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

Shinku ABOOKEN posted:

do motherboards/cpus come with hardware prngs or not? also why not use uefi to store/restore prng seeds?

nobody trusts rdrand because it came around right around the same time as the Snowden leaks

# ? Sep 21, 2019 12:24

geonetix: Mar 6, 2011

Soricidus posted:

the latest amd cpus literally came with a hardware rng that always returns -1

that number was carefully selected with several dice rolls by a committee

# ? Sep 21, 2019 13:26

BlankSystemDaemon: Mar 13, 2009

Cocoa Crispies posted:

nobody trusts rdrand because it came around right around the same time as the Snowden leaks

Who said you only have to trust one source?
On FreeBSD, it goes through the same whitening process as every other source of random data (*), each of which is then individually fed into one of the many queues Fortuna accepts - so that as long as there is at least one good source of randomness for the system, /dev/random is well-seeded.

*: Software interrupts, hardware interrupts, netgraph (BPF) network activity (such as broadcast fragments, broadcast arp, other noise on a normal network connection), ethernet jitter, VTI traffic, mouse (the small vibrations that naturally occur when moving it around), keyboard (the always-variable delta between when buttons are pressed), device attaches, plus a user-definable cache by default, and UMA data and filesystem access-time can be enabled.
Plus, there's a bunch of hardware PRNGs supported via various system busses.

# ? Sep 21, 2019 13:34

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

D. Ebdrup posted:

Who said you only have to trust one source?
On FreeBSD, it goes through the same whitening process as every other source of random data (*), each of which is then individually fed into one of the many queues Fortuna accepts - so that as long as there is at least one good source of randomness for the system, /dev/random is well-seeded.

*: Software interrupts, hardware interrupts, netgraph (BPF) network activity (such as broadcast fragments, broadcast arp, other noise on a normal network connection), ethernet jitter, VTI traffic, mouse (the small vibrations that naturally occur when moving it around), keyboard (the always-variable delta between when buttons are pressed), device attaches, plus a user-definable cache by default, and UMA data and filesystem access-time can be enabled.
Plus, there's a bunch of hardware PRNGs supported via various system busses.

yes I too just read the Wikipedia article, I just figured I�d summarize the important part and not do what you did

# ? Sep 21, 2019 13:39

mystes: May 31, 2006

infernal machines posted:

possibly the world's most effective malware scheme

there is basically no way to inoculate users against opening documents from someone they trust, doubly so as part of an ongoing conversation.

For some reason I didn't think about saying this earlier, but I feel like I should mention that this is a good reason for companies to completely disable VBA (I believe you can do this with policies), although this will probably make some people in the company mad.

# ? Sep 21, 2019 13:51

Soricidus: Oct 21, 2010; freedom-hating statist shill

but then how will we run our expense reporting tool

# ? Sep 21, 2019 13:59

scottch: Oct 18, 2003; "It appears my wee-wee's been stricken with rigor mortis."

mystes posted:

For some reason I didn't think about saying this earlier, but I feel like I should mention that this is a good reason for companies to completely disable VBA (I believe you can do this with policies), although this will probably make some people in the company mad.

there�s a gpo that disables all macros with mark of web and allows you to whitelist sites/network shares. there�s zero excuse for this poo poo infecting companies

# ? Sep 21, 2019 14:02

ewiley: Jul 9, 2003; More trash for the trash fire

mystes posted:

For some reason I didn't think about saying this earlier, but I feel like I should mention that this is a good reason for companies to completely disable VBA (I believe you can do this with policies), although this will probably make some people in the company mad.

I still get security questionnaires from our clients that are huge macro-enabled excel spreadsheets.

# ? Sep 21, 2019 14:29

Powerful Two-Hander: Mar 10, 2004; Mods please change my name to "Tooter Skeleton" TIA.

geonetix posted:

that number was carefully selected with several dice rolls by a committee

well then that's the problem right there, they rolled one time too many and got an overflow

# ? Sep 21, 2019 14:52

mystes: May 31, 2006

ewiley posted:

I still get security questionnaires from our clients that are huge macro-enabled excel spreadsheets.

You should only pass if you tell them it doesn't work on your computers.

# ? Sep 21, 2019 15:11

BlankSystemDaemon: Mar 13, 2009

Cocoa Crispies posted:

yes I too just read the Wikipedia article, I just figured I�d summarize the important part and not do what you did

Clearly you need to use FreeBSD instead of just reading the article. :smugbert:

# ? Sep 21, 2019 16:31

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

ewiley posted:

I still get security questionnaires from our clients that are huge macro-enabled excel spreadsheets.

microsoft's own preliminary license audit forms are exactly this

# ? Sep 21, 2019 17:20

Adbot: ADBOT LOVES YOU

# ? Jun 9, 2024 16:16

ate shit on live tv: Feb 15, 2004; by Azathoth

Soricidus posted:

the latest amd cpus literally came with a hardware rng that always returns -1

Are you sure it always returns -1?

# ? Sep 21, 2019 17:27

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > secfuck v18.51: who needs they entrussy revoked

«‹›975 »