Daniel J. Bernstein @hashbreaker

Designing cryptography (deployed now: X25519, Ed25519, ChaCha20, NTRU Prime) to proactively reduce risks. Coined the phrase "post-quantum cryptography" in 2003. cr.yp.to/djb.html Trying Mastodon: @[email protected] Joined July 2009

Tweets

2K
Followers

22K
Following

23
Likes

38

Daniel J. Bernstein @hashbreaker

2 days ago

For people asking how to host a discussion without inflicting @discord (and non-responsive @discord_support) on new users: I've had good experiences with @zulip (@zulip@fosstodon.org). Many active chats are on the central zulip.com servers; also easy to self-host.

2 3 29 3K 4

Daniel J. Bernstein @hashbreaker

2 days ago

Maybe @discord is ok for people who have already been using it for a while, but setting up new discussions there is a terrible idea. I received an invite link, created an account, crashed into ill-conceived @discord restrictions on new accounts. No response from @discord_support.

29 1 25 5K 2

Daniel J. Bernstein @hashbreaker

3 days ago

cr.yp.to/papers.html#la… has (1) an asymptotic thm; (2) proof; (3) formally verified proof. Had originally included #1+#3 in cr.yp.to/papers.html#lp…. Later realized that #2 still has value: gives idea of #3; illustrates proof size that's formally verifiable in a few person-weeks.

1 1 14 3K 7

Daniel J. Bernstein @hashbreaker

7 days ago

Reminder for the sales team: If eprint.iacr.org/2024/555 turns out to be wrong, relentlessly hype the failure. If it turns out to be right, relentlessly hype the exponent in the approximation factor. Always remember: any attack claim short of a full break is a win-win scenario.

1 16 49 11K 13

Daniel J. Bernstein @hashbreaker

7 days ago

One of many papers in the first issue of the new IACR Communications in Cryptology is my survey "Understanding binary-Goppa decoding": cr.yp.to/papers.html#go… First 20 pages are a minicourse on the decoder used for McEliece. Appendices cover tests and formally verified proofs.

1 5 46 5K 8

Daniel J. Bernstein @hashbreaker

a week ago

"Referees and other readers provided with a computer-checked proof spend much less time worrying about the possibility that the theorem is wrong" (quoted from Section 1 of "Papers with computer-checked proofs", cr.yp.to/papers.html#pw…, September 2023)

3 3 26 6K 12

Duncan Campbell @duncan_2qq

3 weeks ago

@rossjanderson Professor Ross Anderson, FRS, FREng Dear friend and treasured long term campaigner for privacy and security, Professor of Security Engineering at Cambridge University and Edinburgh University, Lovelace Medal winner, has died suddenly at home in Cambridge.

81 335 857 465K 106

Download Image

Daniel J. Bernstein @hashbreaker

4 weeks ago

Searching for ways to communicate without exposing your information to Google? Here's a PDF ("Portable Document Format"), created with standard tools, containing a red message that's invisible to (pre-123) Chrome users: cr.yp.to/2024/20240324/… Joint work with Jolijn Cottaar.

1 12 34 6K 22

Daniel J. Bernstein @hashbreaker

4 weeks ago

lib25519-20240321 released: lib25519.cr.yp.to lib25519-cr-yp-to.viacache.net Includes more speedups from Kaushik Nath, a simple use-s2n-bignum option, MacOS support, and more. Still generally needs formal verification and auditing, but AWS's s2n-bignum code is formally verified.

0 6 30 4K 4

Daniel J. Bernstein @hashbreaker

a month ago

Fun fact noted in the code: if you change first 0x30 in openssl_ed25519_lib25519.c to, say, 0x31 then the edtest script triggers double-free in the OpenSSL core when it calls openssl req. String contents corrupting pointer structures! Hopefully never attacker-influenced strings.

0 13 43 9K 10

Daniel J. Bernstein @hashbreaker

a month ago

Releasing beta for auditing: small-ish OpenSSL 3 "providers" to use lib25519 (gives big speedups, although still needs verification) for X25519 and Ed25519. Code: cr.yp.to/2024/20240314/… cr.yp.to/2024/20240314/… Current test scripts: cr.yp.to/2024/20240314/… cr.yp.to/2024/20240314/…

0 5 22 3K 4

cts🌸 @gf_256

a month ago

111 1K 9K 441K 1K

Download Image

Daniel J. Bernstein @hashbreaker

a month ago

I clicked on "Google's Threat model for Post-Quantum Cryptography". 2MB page; below web average. I was hoping it would explain how Google sees Kyber-768 as such low risk as to not move up to Kyber-1024 (384 bytes larger key, 480 bytes larger ciphertext): bughunters.google.com/blog/510874798…

2 12 32 5K 8

Dan Guido @dguido

a month ago

.@trailofbits is making a big investment in post-quantum cryptography (PQC) this year. If that's something you're ready to work on, we're doing security reviews *and* custom engineering.

3 9 48 8K 8

Tanja Lange @hyperelliptic

2 months ago

Math people: Here is a job opportunity with my new colleague Mireille Boutin at @TUeindhoven ; good conditions & exciting new group in the making: Assistant Prof in Applied Algebra and Geometry in Eindhoven jobs.tue.nl/en/vacancy/ass… No application deadline: first come first serve

0 5 14 3K 2

Daniel J. Bernstein @hashbreaker

2 months ago

2009: "Not covered in this talk: other types of DoS attacks. e.g. DNSSEC advertising says zero server-CPU-time cost. How much server CPU time can we actually consume?" cr.yp.to/talks.html#200… Also posed the question in some later talks. Most recent answer: athene-center.de/fileadmin/cont…

1 6 12 5K 3

Daniel J. Bernstein @hashbreaker

3 months ago

Columbia Accident Investigation Board, final report, 2003, volume 1 (history2.nasa.gov/columbia/repor…), page 191: "The Board views the endemic use of PowerPoint briefing slides instead of technical papers as an illustration of the problematic methods of technical communication at NASA."

0 8 40 4K 4

@[email protected] - @2600.com on Bluesky 🇸🇴 @2600

3 months ago

HOPE is on! Spread the word! Thanks @hackaday! hackaday.com/2024/01/20/hop…

0 15 18 4K 1

Daniel J. Bernstein @hashbreaker

3 months ago

Recent claims of exponents for supposedly well-studied lattice attacks considering memory-access costs: 2023.11, web.archive.org/web/2023112521…: 0.396! Oops, wait, 0.349! 2023.12, web.archive.org/web/2023121920…: 0.349, or 0.329 in 3D! 2024.01, web.archive.org/web/2024011908…: 0.311, or 0.292 in 3D!

2 1 20 4K 4

Daniel J. Bernstein @hashbreaker

3 months ago

Is there a name for the following failure pattern? (1) "Don't worry about flaws in defense X: we have Y as another layer of defense." (2) "Don't worry about flaws in Y: we also have X." (3) "This real-world attack exploited flaws in X _and_ in Y? Nobody could have expected that!"