News for hackers. Stuff that matters.
Re:Technical feasibility of decrypting https by replacing th... by sweis on Sunday July 14, 2013 @11:56AM (#6041181)
Here are a few for a start:

- "Cross-VM Side Channels and Their Use to Extract Private Keys" http://www.cs.unc.edu/~reiter/papers/2012/CCS.pdf

- "Cache-timing attacks on AES" http://cr.yp.to/antiforgery/cachetiming-20050414.pdf

- "Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds" http://www.cs.cornell.edu/courses/cs6460/2011sp/papers/cloud...

- "System-Level Protection Against Cache-Based Side Channel Attacks in the Cloud" http://pdos.csail.mit.edu/~taesoo/pubs/2012/stealthmem/steal...

In my mind, cache-timing attacks are fairly easily solved, but may be platform dependent. However, VM escapes in general are still a concern.

Re:Technical feasibility of decrypting https by replacing th... by e3pi on Sunday July 14, 2013 @12:19PM (#6041274)
> - "Cache-timing attacks on AES" http://cr.yp.to/antiforgery/cachetiming-20050414.pdf

Sixteen years later....

"....These pages will eventually be open to the public. Right now they are inaccessible pending resolution of my court case."

Re:

MCS 494, Cryptography, Spring 1997

This is an online introduction to cryptography. It is based on the web pages that I wrote for my MCS 494 course at UIC.

http://cr.yp.to/crypto.html

See:

The main repository of information on Bernstein v. United States used to be http://www.eff.org/bernstein, subsequently moved to https://www.eff.org/cases/bernstein-v-us-dept-justice. This page is now much more comprehensive; you should change your bookmark to point to http://export.cr.yp.to.

http://cr.yp.to/export.html

Re:Technical feasibility of decrypting https by replacing th... by tptacek on Sunday July 14, 2013 @12:23PM (#6041282)
Huh? His papers are public. The only thing unpublished on that site is an old crypto class from the '90s.
Re:Technical feasibility of decrypting https by replacing th... by e3pi on Sunday July 14, 2013 @01:38PM (#6041497)
Exactly. The question is, what possible legal justification argues for censoring the 90's course material regarding his Bernstein v. United States?
Re:Technical feasibility of decrypting https by replacing th... by tptacek on Sunday July 14, 2013 @01:49PM (#6041527)
There isn't one. He could publish it if he wanted to. He just doesn't want to. That page is ancient. And none of this has anything to do with this story.
Re:Technical feasibility of decrypting https by replacing th... by e3pi on Sunday July 14, 2013 @04:14PM (#6042065)
>There isn't one. He could publish it if he wanted to. He just doesn't want to.

Incorrect.

"....These pages will eventually be open to the public. Right now they are inaccessible pending resolution of my court case."

>And none of this has anything to do with this story.

Wrong again:

>...will make it harder for people to understand how crypto and hardware work, which is a shame. -tptacek

Advice:

In the future, as you reply to other's comments, read carefully with due consideration or you will continue to shoot yourself in the foot.

Re:Technical feasibility of decrypting https by replacing th... by tptacek on Sunday July 14, 2013 @04:22PM (#6042100)
I don't think you know what you're talking about. There are much more comprehensive US academic crypto resources than Bernstein's old page. Researchers routinely publish crypto research. The page you're pointing to is an artifact of '90s crypto policy.
Re:Technical feasibility of decrypting https by replacing th... by e3pi on Sunday July 14, 2013 @05:15PM (#6042276)
I know enough to know it requires years of study to participate with "...Researchers routinely publish crypto research." For many of us on HN, including myself, what is more valuable is what is canonical textbook and more accessible. I would welcome being facile in '90s crypto policy'.
Re:Technical feasibility of decrypting https by replacing th... by tptacek on Sunday July 14, 2013 @09:28PM (#6043137)
I'm not smart enough to understand what this comment is trying to say.
Re:Technical feasibility of decrypting https by replacing th... by Myrmornis on Sunday July 14, 2013 @10:58PM (#6043430)
It's saying roughly "I know enough to know that it takes years of study before you can read research papers in crypto. I am happy just to read canonical textbook resources, even if they are from the 90s"

I think you could have tried a little bit harder to understand it before posting. Obviously English wasn't the author's first language and there's a risk that the author might perceive an insult to his English language skills. It's really nice that HN is a discussion between people with a wide variety of native languages as I'm certain you'd agree.

Re:Technical feasibility of decrypting https by replacing th... by tptacek on Sunday July 14, 2013 @11:01PM (#6043441)
"Obviously English wasn't the author's first language"?
Re:Technical feasibility of decrypting https by replacing th... by Myrmornis on Monday July 15, 2013 @03:08AM (#6044138)
Are you saying it's not obvious? (e3pi hope you don't mind us discussing your post in this way!)
Re:Technical feasibility of decrypting https by replacing th... by damarquis on Monday July 15, 2013 @09:41AM (#6045419)
It is not clear that's what it is being said.