dhx

@[email protected]
0 Followers
0 Following
1 Posts
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

David Hicks (dhx)

Web (IPv6 and IPv4):
https://david.hicks.id.au

E-mail (IPv6 and IPv4):
[email protected]

PGP:
Public Key: https://david.hicks.id.au/pgp/728F3435.asc
Key ID: 728F3435
Fingerprint: 2442 14B5 2E51 CB0F CA3B
9DB8 59E0 E7B7 728F 3435

Hacker News:
https://news.ycombinator.com/user?id=dhx

Last updated: 2012-03-05

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEJEIUtS5Ryw/KO524WeDnt3KPNDUFAlqcjdcACgkQWeDnt3KP
NDUoJQ//TTN8pul74acpaVWImkdxEzqU1xOtAn/JyrZtYLjO2XnMDJSF9fTYKD7o
AT19lV6kZnMo0p0lsNg5tnk5QMJ96rqPhpelAiXBYkdfz3VfVVj3X3AOdkg5XRbm
6Uy1sa8Omp6Jo21wtUOE+jtSYWwEiUFn9NPl3B1aNZSUo/LuMTJve1IidJuW705m
OCenqn/Ro8eZ6kUOUByWoDBbGlobAkZpBZEyzHCpczZ1nGj50mn4cssXxDG4St62
S+o9009ZMgjFtfIDTwI7gwaNCgn6ldBbwYwfMaPL2cs2Kxl05iqbM/KcsU/CLZE5
Dmh/0aPaYNJdg8PDjpItupxryNwwROB/lCigGsp+msiXtOJTENdCfojFF6ffiFTl
Lxqfmbe+bn3JcqTOXzExPD0NXstx7sdetQZSwVnuCQGH4JjcUpyzKmrEw4ATvpXb
VXWf00jXAMWhGHSQJLzecTXw8/iWWh0swIpLrokq3ISrMBwK2oAavZzPh4TpH5ao
Y+VL0LkqAaiEpLyBAJDUFFdrJbDv9P82fZ8NFEiK3plgm5xfv62UOzFVIG+ezdDY
PvfodliBtu/mLMc9YIjo5H59NtnmT4fXb8/LW5rNP7xSxWjMbCGiG3/pVSUx+FBN
v74Ykn2ioBPNM3ApFC3kBrlS1K8jIcNgCfMQcH0oc7y6+e84NwY=
=sBF3
-----END PGP SIGNATURE-----
This account is a replica from Hacker News. Its author can't see your replies. If you find this service useful, please consider supporting us via our Patreon.

Officialhttps://
Support this servicehttps://www.patreon.com/birddotmakeup
Show threaddhxNov 24

Amongst the numerous reasons why you _don't_ want to rush into implementing new algorithms is even the _reference implementation_ (and most other early implementations) for Kyber/ML-KEM included multiple timing side channel vulnerabilities that allowed for key recovery.[1][2]

djb has been consistent in view for decades that cryptography standards need to consider the foolproofness of implementation so that a minor implementation mistake specific to timing of specific instructions on specific CPU architectures, or specific compiler optimisations, etc doesn't break the implementation. See for example the many problems of NIST P-224/P-256/P-384 ECC curves which djb has been instrumental in fixing through widespread deployment of X25519.[3][4][5]

[1] https://cryspen.com/post/ml-kem-implementation/

[2] https://kyberslash.cr.yp.to/faq.html / https://kyberslash.cr.yp.to/libraries.html

[3] https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplic...

[4] https://safecurves.cr.yp.to/ladder.html

[5] https://cr.yp.to/newelliptic/nistecc-20160106.pdf

Cryspen | Verified ML-KEM (Kyber) in Rust

We implemented ML-KEM in Rust and formally verified its correctness with hax