distorted.org.uk wiki - User contributions [en-gb]

Mdw's guitars

2020-11-02T14:08:16Z

Mdw:

* Æmilia (Gibson Les Paul Studio in BBQ Burst, with Grover locking tuners)
* Julia (Ibanez RG2570EX in Royal Blue Flat (I think))
* Antonia (Ibanez RG550 in Black, pre 1994, with maple fingerboard; bridge pickup replaced with Seymour Duncan JB)
* Claudia (Ibanez RG7620 in Black)
* Lucretia (ESP LTD EX-307 in Black Satin, with Schaller locking tuners)
* Cælia (Steinberger Spirit GT-Pro in Black)
* Maria (Aria AK430CE)
* Lavinia (Tanglewood TW45DLX)
* Valeria (Ibanez BTB205(?) in Pewter)
* Cornelia (Steinberger Spirit XT-25 in Black)

Mdw's guitars

2020-10-09T17:41:33Z

Mdw:

Mdw's guitars

2020-10-09T17:41:12Z

Mdw:

* Aemilia (Gibson Les Paul Studio in BBQ Burst, with Grover locking tuners)
* Julia (Ibanez RG2570EX in Royal Blue Flat (I think))
* Antonia (Ibanez RG550 in Black, pre 1994, with maple fingerboard; bridge pickup replaced with Seymour Duncan JB)
* Claudia (Ibanez RG7620 in Black)
* Lucretia (ESP LTD EX-307 in Black Satin, with Schaller locking tuners)
* Cælia (Steinberger Spirit GT-Pro in Black)
* Maria (Aria AK430CE)
* Lavinia (Tanglewood TW45DLX)
* Valeria (Ibanez BTB205(?) in Pewter)

Mdw's guitars

2020-10-09T17:40:25Z

Mdw:

* Aemilia (Gibson Les Paul Studio in BBQ Burst, with Grover locking tuners)
* Julia (Ibanez RG2570EX in Royal Blue Flat (I think))
* Antonia (Ibanez RG550 in Black, pre 1994, with maple fingerboard; bridge pickup replaced with Seymour Duncan JB)
* Claudia (Ibanez RG7620 in Black)
* Lucretia (ESP LTD EX-307 in Black Satin, with Schaller locking tuners)
* Caelia (Steinberger Spirit GT-Pro in Black)
* Maria (Aria AK430CE)
* Lavinia (Tanglewood TW45DLX)
* Valeria (Ibanez BTB205(?) in Pewter)

Mdw's guitars

2020-10-09T17:06:52Z

Mdw: Created page with "* Aemilia (Gibson Les Paul Studio in BBQ Burst, with Grover locking tuners) * Julia (Ibanez RG2570EX in Royal Blue Flat (I think)) * Antonia (Ibanez RG550 in Black, with maple..."

* Aemilia (Gibson Les Paul Studio in BBQ Burst, with Grover locking tuners)
* Julia (Ibanez RG2570EX in Royal Blue Flat (I think))
* Antonia (Ibanez RG550 in Black, with maple fingerboard; bridge pickup replaced with Seymour Duncan JB)
* Claudia (Ibanez RG7620 in Black)
* Lucretia (ESP LTD EX-307 in Black Satin, with Schaller locking tuners)
* Caelia (Steinberger Spirit GT-Pro in Black)
* Maria (Aria AK430CE)
* Lavinia (Tanglewood TW45DLX)
* Valeria (Ibanez BTB205(?) in Pewter)

Ecuador

2019-05-26T21:39:48Z

Mdw: Fix quote

A work-in-progress song, probably for [[Electric Beauty]]. The first parts were apparently written in 2013.

<blockquote>
Info war’s a kiss away; 
Now you want a place to stay: 
Jewels shining twice as bright 
Need warm bodies in the night.

And just a slip of the tongue, 
Just a slip of the pen 
is all it takes 
To bring your efforts to an end.

<blockquote>
You hear the helicopters landing 
And soldiers’ footsteps echo down the hall. 
You told her when you came you were a liar, 
And now you'll play your tune in Ecuador.
</blockquote>
</blockquote>

Further fragments:

<blockquote>
Another sermon from the mount 
Comes just in time to swing the count: 
The scarlet whore will send a rose 
To say what everybody knows.
</blockquote>

Ecuador

2019-05-26T21:39:25Z

Mdw: Fix quote

A work-in-progress song, probably for [[Electric Beauty]]. The first parts were apparently written in 2013.

<blockquote>
Info war's a kiss away; 
Now you want a place to stay: 
Jewels shining twice as bright 
Need warm bodies in the night.

And just a slip of the tongue, 
Just a slip of the pen 
is all it takes 
To bring your efforts to an end.

<blockquote>
You hear the helicopters landing 
And soldiers’ footsteps echo down the hall. 
You told her when you came you were a liar, 
And now you'll play your tune in Ecuador.
</blockquote>
</blockquote>

Further fragments:

<blockquote>
Another sermon from the mount 
Comes just in time to swing the count: 
The scarlet whore will send a rose 
To say what everybody knows.
</blockquote>

Ecuador

2019-05-17T11:04:27Z

Mdw:

A work-in-progress song, probably for [[Electric Beauty]]. The first parts were apparently written in 2013.

<blockquote>
Info war's a kiss away; 
Now you want a place to stay: 
Jewels shining twice as bright 
Need warm bodies in the night.

And just a slip of the tongue, 
Just a slip of the pen 
is all it takes 
To bring your efforts to an end.

<blockquote>
You hear the helicopters landing 
And soldiers' footsteps echo down the hall. 
You told her when you came you were a liar, 
And now you'll play your tune in Ecuador.
</blockquote>
</blockquote>

Further fragments:

<blockquote>
Another sermon from the mount 
Comes just in time to swing the count: 
The scarlet whore will send a rose 
To say what everybody knows.
</blockquote>

Ecuador

2019-05-17T10:30:01Z

Mdw: Switch to second person

A work-in-progress song, probably for [[Electric Beauty]]. The first parts were apparently written in 2013.

<blockquote>
Info war's a kiss away; 
Now you want a place to stay: 
Jewels shining twice as bright 
Need warm bodies in the night.

And just a slip of the tongue, 
Just a slip of the pen 
is all it takes 
To bring your efforts to an end.

<blockquote>
You hear the helicopters landing 
And soldiers' footsteps echo down the hall. 
You told her when you came you were a liar, 
And now you'll play your tune in Ecuador.
</blockquote>
</blockquote>

Further fragments:

<blockquote>
Another sermon from the mount 
Tells ... ? 
? 
Says what everybody knows.
</blockquote>

Ecuador

2019-05-15T13:46:28Z

Mdw:

A work-in-progress song, probably for [[Electric Beauty]]. The first parts were apparently written in 2013.

<blockquote>
Info war's a kiss away; 
Now he wants a place to stay: 
Jewels shining twice as bright 
Need warm bodies in the night.

And just a slip of the tongue, 
Just a slip of the pen 
is all it takes 
To bring his efforts to an end.

<blockquote>
He hears the helicopters landing 
And soldiers' footsteps echo down the hall. 
He told you when he came he was a liar, 
And now he'll play his tune in Ecuador.
</blockquote>
</blockquote>

Further fragments:

<blockquote>
Another sermon from the mount 
Tells ... ? 
? 
Says what everybody knows.
</blockquote>

Ecuador

2019-05-15T13:46:08Z

Mdw:

A work-in-progress song, probably for [[Electric Beauty]]. The first parts were apparently written in 2013.

<blockquote>
Info war's a kiss away; 
Now he wants a place to stay: 
Jewels shining twice as bright 
Need warm bodies in the night.

And just a slip of the tongue, 
just a slip of the pen 
is all it takes 
To bring his efforts to an end.

<blockquote>
He hears the helicopters landing 
And soldiers' footsteps echo down the hall. 
He told you when he came he was a liar, 
And now he'll play his tune in Ecuador.
</blockquote>
</blockquote>

Further fragments:

<blockquote>
Another sermon from the mount 
Tells ... ? 
? 
Says what everybody knows.
</blockquote>

Ecuador

2019-05-15T13:16:16Z

Mdw: Created page with "A work-in-progress song, probably for Electric Beauty. The first parts were apparently written in 2013. <blockquote> Info war's a kiss away; Now he wants a place..."

A work-in-progress song, probably for [[Electric Beauty]]. The first parts were apparently written in 2013.

<blockquote>
Info war's a kiss away; 
Now he wants a place to stay: 
Jewels shining twice as bright 
Need warm bodies in the night.

And just a slip of the tongue, 
just a slip of the pen 
is all it takes 
To bring his efforts to an end.

<blockquote>
He hears the helicopters landing 
And soldiers' footsteps echo down the hall. 
He told you when he came he was a liar, 
And now he'll play his tune in Ecuador.
</blockquote>
</blockquote>

Further fragments:

<blockquote>
Another sermon from the mount 
Tells ... ?
?
Says what everybody knows.
</blockquote>

Constant-time subrange copy

2016-10-18T00:52:39Z

Mdw: Created page with "'''Objective:''' Given the address <code>p</code> and length <code>psz</code> of a source buffer, the address <code>q</code> and length <code>qsz</code> of a destination buffe..."

'''Objective:''' Given the address <code>p</code> and length <code>psz</code> of a source buffer, the address <code>q</code> and length <code>qsz</code> of a destination buffer, and a ''secret'' offset <code>o</code>, copy up to <code>qsz</code> bytes starting from <code>p + o</code> to the destination, without leaking <code>o</code>.

== Motivation ==

There are two obvious applications for this algorithm.

* RSA PKCS #1 v1.5 decryption. After applying the RSA private-key operation, the buffer contains <code>00</code> || <code>02</code> || ''PS'' || <code>00</code> || ''M'', where ''PS'' is a string of eight or more random nonzero padding bytes. This scheme is, unfortunately, unaccountably popular despite it being broken in 1999. There's a standard countermeasure if the payload ''M'' is supposed to be a random key, which involves substituting a fresh random key if the padding is bad; but doing this means that the ''entire process'' needs to run in constant time.

* TLS MAC tag extraction. A TLS record, prior to or after encryption, consists of a payload, a MAC tag, and between 1 and 256 bytes of padding. Unfortunately, having the MAC ''inside'' the encryption and padding was a terrible mistake, leaving the whole scheme open to chosen-ciphertext attacks. Checking the tag first means finding and extracting it, but that has to be done without leaking how much padding there is.

== Algorithm ==

This algorithm is an improvement on the one used in Langley's code in OpenSSL. It proceeds in two stages.

* Firstly, copy the wanted bytes from the source to the destination. This requires a full pass over the source, but that's unavoidable if we want to equivocate on the secret offset. The trick here (from OpenSSL) is that we get the right bytes, but not necessarily in the right places: they might end up rotated, by <code>o</code> mod <code>qsz</code> bytes.

* Secondly, undo the rotation so that the destination contains the correct data. OpenSSL does the obvious <code>qsz</code>² loop; but there's a better way: if we equivocate on each bit of the offset separately, we can undo the rotation in <code>qsz</code> log <code>qsz</code> copies.

== Code ==

WIP...

Constant-time algorithms

2016-10-17T23:26:08Z

Mdw:

Writing crypto code was never easy. Unfortunately, nowadays you don't just have to implement the algorithms so that they give the right answers, and make sure that the random numbers are actually random: you also have to make sure that all of your secrets don't leak out the side of your program through instruction timing, an exciting menagerie of cache effects, branch-predictor state, execution unit utilization, or other side channels.

The best approach we have at the moment for avoiding this kind of leakage is 'constant-time programming'. This discipline involves ensuring that no secrets are ever used to control conditional execution (for example, branches, but also other kinds of predicated instructions are suspect and should be avoided) or used to calculate memory addresses.

There doesn't seem to be a proper place anywhere else to collect constant-time programming lore; so these pages are, for the moment, it. This is ''not'' intended to be a gentle introduction: see, for example, Peter Schwabe's excellent talk at ShmooCon 2015 ([https://cryptojedi.org/peter/data/shmoocon-20150118.pdf slides], [https://www.youtube.com/watch?v=Q9e6fANUQDY video]) for that.

== Masking fundamentals ==

Making do without conditional execution just isn't going to cut it. In place of conditional assignments, we often use ''mask variables'', which we can arrange to be either zero or all-bits-set -- i.e., two's complement −1. Then we can replace

if (cond) z = x;
else z = y;

by

/* set m_cond somehow */
z = (x&m_cond) | (y&~mcond);

The remaining trick is to set up the mask. The best way I know to do this is to start by arranging for the ''top'' bit in some variable to be set or clear according to the desired condition and then performing an arithmetic right shift; the other bits don't matter and can be anything. An arithmetic shift is often free in ARM code, and cheap in x86; unfortunately, C doesn't admit the existence of such a thing.

I'm assuming throughout that we're working with unsigned integers of some ''known'' bit width, say <code>NBITS</code>. Then

static inline unsigned signprop(unsigned x)
{ x >>= NBITS - 1; x ^= 1; x--; return (x); }

calculates the desired result, and will be recognized as an arithmetic right shift by both GCC and Clang. It isn't recognized by '''armcc''', and I don't know how to write a ''portable'' arithmetic right shift which '''armcc''' will compile efficiently.

== Boolean canonification ==

Suppose that you have a variable <code>x</code> you know to be zero or nonzero according to some desired condition, and you want to turn it into a mask. If we can get the nonzeroness to the topmost bit then we can use <code>signprop</code> above and we're done.

The following is the best I've come up but it's not very nice.

static inline unsigned nonzerop(unsigned x)
{ x |= x << 1; x >>= 1; x--; return (~signprop(x)); }

Here's how it works.

* The OR arranges for <code>x</code> to be not equal to 1. If <code>x</code> was zero to begin with, it stays zero; otherwise it has some bit set ''other'' than the bottom bit.

* The shift makes sure that the ''top'' bit is clear while preserving <code>x</code>'s zero-ness. If the original <code>x</code> was zero, then it's still zero; otherwise it's some nonzero value -- but it's top bit is definitely clear.

* The decrement sets <code>x</code>'s top bit if and only if it was zero to begin with.

* Now <code>x</code> is ready to be passed to <code>signprop</code> to turn it into a mask; only the sense is wrong, so we must invert it.

This compiles down to four (sequential) instructions, which isn't brilliantly efficient, but I don't know of a better way. Fortunately, many useful cases don't need full-on boolean canonification.

== Other important algorithms ==

* [[Constant-time table lookup]]
* [[Constant-time subrange copy]]

Constant-time algorithms

2016-10-17T23:01:16Z

Mdw:

Constant-time algorithms

2016-10-17T22:57:59Z

Mdw: Created page with "Writing crypto code was never easy. Unfortunately, nowadays you don't just have to implement the algorithms so that they give the right answers, and make sure that the random..."

Writing crypto code was never easy. Unfortunately, nowadays you don't just have to implement the algorithms so that they give the right answers, and make sure that the random numbers are actually random: you also have to make sure that all of your secrets don't leak out the side of your program through instruction timing, an exciting menagerie of cache effects, branch-predictor state, execution unit utilization, or other side channels.

The best approach we have at the moment for avoiding this kind of leakage is 'constant-time programming'. This discipline involves ensuring that no secrets are ever used to control conditional execution (for example, branches, but also other kinds of predicated instructions are suspect and should be avoided) or used to calculate memory addresses.

There doesn't seem to be a proper place anywhere else to collect constant-time programming lore; so these pages are, for the moment, it. This is ''not'' intended to be a gentle introduction: see, for example, [https://www.youtube.com/watch?v=Q9e6fANUQDY Peter Schwabe's excellent talk at SchmooCon 2015] for that.

== Masking fundamentals ==

Making do without conditional execution just isn't going to cut it. In place of conditional assignments, we often use ''mask variables'', which we can arrange to be either zero or all-bits-set -- i.e., two's complement −1. Then we can replace

if (cond) z = x;
else z = y;

by

/* set m_cond somehow */
z = (x&m_cond) | (y&~mcond);

The remaining trick is to set up the mask. The best way I know to do this is to start by arranging for the ''top'' bit in some variable to be set or clear according to the desired condition and then performing an arithmetic right shift; the other bits don't matter and can be anything. An arithmetic shift is often free in ARM code, and cheap in x86; unfortunately, C doesn't admit the existence of such a thing.

I'm assuming throughout that we're working with unsigned integers of some ''known'' bit width, say <code>NBITS</code>. Then

static inline unsigned signprop(unsigned x)
{ x >>= NBITS - 1; x ^= 1; x--; return (x); }

calculates the desired result, and will be recognized as an arithmetic right shift by both GCC and Clang. It isn't recognized by '''armcc''', and I don't know how to write a ''portable'' arithmetic right shift which '''armcc''' will compile efficiently.

== Boolean canonification ==

Suppose that you have a variable <code>x</code> you know to be zero or nonzero according to some desired condition, and you want to turn it into a mask. If we can get the nonzeroness to the topmost bit then we can use <code>signprop</code> above and we're done.

The following is the best I've come up but it's not very nice.

static inline unsigned nonzerop(unsigned x)
{ x |= x << 1; x >>= 1; x--; return (~signprop(x)); }

Here's how it works.

* The OR arranges for <code>x</code> to be not equal to 1. If <code>x</code> was zero to begin with, it stays zero; otherwise it has some bit set ''other'' than the bottom bit.

* The shift makes sure that the ''top'' bit is clear while preserving <code>x</code>'s zero-ness. If the original <code>x</code> was zero, then it's still zero; otherwise it's some nonzero value -- but it's top bit is definitely clear.

* The decrement sets <code>x</code>'s top bit if and only if it was zero to begin with.

* Now <code>x</code> is ready to be passed to <code>signprop</code> to turn it into a mask; only the sense is wrong, so we must invert it.

This compiles down to four (sequential) instructions, which isn't brilliantly efficient, but I don't know of a better way. Fortunately, many useful cases don't need full-on boolean canonification.