320 reputation
16
bio website
location
age
visits member for 1 year, 7 months
seen Apr 16 at 13:44

Apr
15
comment Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?
@e-sushi: It depends on "how" you interpret "the genre of Heartbleed". If I may again employ my analogy, it would be in my interpretation a certain disease (in the general sense), say TB, and not the particular case of Mr.xyz who is known to have had the disease but whose actual personal behaviour is subjected to speculations.
Apr
15
comment Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?
@e-sushi: There are conspiracy theories about the actual bug. One doesn't know what is really behind the scene. But let me stress in connection of the analogy in my last post that an analogous question would be whether a certain medicament could have the power/capability of (better) curing patients (in general) having a certain particular disease and not whether that medicament could have cured a "particular" patient "independent" of his behaviour (in particular whether he actually observes the prescription of his doctor).
Apr
15
comment Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?
@e-sushi: I suppose the human factor, while it is certainly important in reality, could be excluded for purposes of the present discussion. Analogy: In medicine whether for the treatment of a particular disease one medicament is generally more effective than another is evidently a sensible and important question. On the other hand, one could argue that, if a patient having that disease doesn't actually take the medicament prescribed by his doctor or even ignore to consult a doctor, then the question of which medicament is better would be irrevant. Do you see what I mean with the analogy?
Apr
15
comment Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?
@HenrickHellström: I believe one could for all practical purposes assume that the goal of a reasonable given project is anyway complete. Though I barely know anything about the details, I read somewhere (if my memory doesn't betray me) that there are software to aid (check, control) systematic top-down development of specifications akin to top-down development of program codes. Thus, while nothing can be absolutely perfect in reality, a specification of an arbitrarily degree of completeness for the practical purposes of code developemnt should be feasible IMHO.
Apr
15
comment Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?
@e-sushi: I suppose "irresponsible human behaviour" is entirely outside the realm of reasonable discussions here. But the question is rather whether a concretely existing bug (independently of "how" it has occured) in a given code of the genre of Heartbleed could presumably highly likely have been much more effectively and earlier detected with the help of a good verification system (together with good specification and good PL).
Apr
15
comment Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?
@e-sushi: Are you denying the value of program verification that scientists have attempted to develop and improve since decades? Nothing in this world can be perfect but one could in all cases attempt to reach a reasonablely good near-perfection. An analogy IMHO would be airplanes, none of which is absolutely secure but nowadays barely any passenger fears to travel with machines of the common airline companies. In the present case it seems to me that under better premises (better specification, PL and with verification) such a bug very likely would have been discovered very much sooner anyway.
Apr
15
comment Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?
@HenrickHellström: The goal of OpenSSL is certainly fairly limited and should be clearly definable and, if one uses a better PL like ADA to program instead of C, then the checking whether the code correctly implements a specification shouldn't be infeasible and for issues that the verification software finds to be hard to handle one is quite likely to find alternative ways of implementation or specification. The question remains whether the specification itself is correct, but I surmise one could employ a hierarchy of specifications and step by step with verification obtain the final one.
Apr
15
comment Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?
@HenrickHellström: But wouldn't the very attempt to verify show up that difficulty and hence force the program to be designed in a different way somehow (or is this impossible)?
Apr
2
comment Is substitution with random prefix codes secure?
@rath: I have deleted (2) corresponding to your suggestion.
Mar
30
comment Is substitution with random prefix codes secure?
I have duly correspondingly formulated my new question with the best care I could manage to do to limit its scope to the least minimum and posted it under the title "Any good means to enhance the security of encryption processing with random prefix codes".
Mar
29
comment Is substitution with random prefix codes secure?
I understand you mean that one should limit the scope of a question to the least minimum possible. So I'll have to ask a new question in the present context. Thank you very much for the guidance.
Mar
28
comment Is substitution with random prefix codes secure?
But IMHO in crypto one rarely uses one single algorithm (in the narrow sense) but a combination of confusion and diffusion in the terms of Shannon. So if one appropriately combine prefix-coding with e.g. certain transpositions, would that be a good defense against known/chosen text attacks? (In fact I have attempted to do such a combination in a humble scheme of mine recently (s13.zetaboards.com/Crypto/topic/7164646/1). Actually, it was because I was not very sure whether prefix-coding is "self-sufficient" that I did the original posting in order to learn more about its real strength.)
Mar
28
comment Is substitution with random prefix codes secure?
@figlesquidge: Done. Thank you.
Mar
28
comment Is substitution with random prefix codes secure?
Oh, I should have replaced "claim" with "claim according to my interpretation", since I am not 100% sure of the correctness of my interpretation (as I said, my understanding of the article is only partial). If the real claim is not correct, then the other phrase of mine would make sense IMHO.
Mar
26
comment Encryption of numeric value using playfair
If the matrix doesn't have 5, then you simply cannot process that character with that matrix. Perhaps you were expected to think of the use of a larger matrix than the one shown in the lessons.
Mar
14
comment How to best mix two arbitrary/random n-bit words?
The specific application that interests me currently would certainly be deemed too mundane from a theoretical point of view. In a certain encryption processing I am considering there are two n-bit words, x and y, one on the plaintext side and one on the ciphertext side (but neither is directly plaintext or ciphertext). I like to combine them into z and sum the z's of all preceding blocks into a value s and use that to chain the blocks. It's my thinking that, if z is "somehow" optimal in capturing the randomness of x any y, then the chaining would also be fine. Would that satisfy your query?
Mar
14
comment How to best mix two arbitrary/random n-bit words?
What I would prefer to have is not to use, if possible, a rather complex computation like a crypto-secure hash function but some more simple computations in practice, of the genre of xor you mentioned. For it is not extremely high crypto security that is demanded in the cases I have in mind but, roughly speaking, certain comparatively good security that could be obtained with some not too expensive computing expenses.
Mar
12
comment How to best mix two arbitrary/random n-bit words?
I am merely using an example to answer your question of defining "optimally". That is, the notion of "better" exists in the present context. My problem as such is evidently indepent of what one could best do with that specific potential application.
Mar
11
comment How to best mix two arbitrary/random n-bit words?
Let's consider the following case: Suppose one encrypts 2 natural language texts (there are estimates of some 1 bit pro character, if I don't err) with a certain block cipher to obtain 2 sequences of blocks. Now one desires to combine these sequences into one sequence with the goal that the resulting sequnce is hopefully better in the sense of entropy. (If I don't err, measuring entropy is difficult, but it seems nonetheless not incorrect to expect/demand that the resulting sequence should have higher entropy.)
Mar
11
comment How to best mix two arbitrary/random n-bit words?
ok. Let's say one has in some crypto processing obtained x and y and then need to combine them into z for going further, how should one do that optimally?