Moodles

The best explanation I’ve ever seen of the Fourier transform is from 3Blue1Brown: https://m.youtube.com/watch?v=spUNpyF58BY&vl=en

Totally agree. For a negative example see all the companies desperately trying to find sone problem for blockchain to solve.

Call me selfish but I don’t make much of a distinction since there’s a good chance me and everyone I know are dead.

Indeed, I think a supervolcano like Yellowstone erupting is much more likely.

I think your reply is a little too strident. It’s not a “fake idea”. It’s just someone’s idea. I hadn’t heard of it but I googled it upon reading this thread and it seems to be the idea that people tend to collectively remember things inaccurately in the exact same way. That phenomenon alone seems pretty plausible and not that dumb or fake, right?

But what isn’t plausible is the part you left out that’s talked about in the video? That some people explain the Mandela effect through pseudoscientific bullshit like alternative timelines merging. You also seem to conflate the ridiculousness of what some people collectively remember with the Mandela effect concept as a whole. It’s a bit like saying hypnosis as an idea is dumb because people do dumb things when hypnotised? I also don’t understand what is deeply offensive about people misremembering that Mandela died in prison? They’re not saying (or even remembering) that he was a bad person, probably the opposite, they’re just ignorant of history.

But having said all that I am perplexed by the OP comment: “I can’t help but think the Mandela effect is an example”. An example of what? Cracks in spacetime? Because yeah that’s dumb, though probably a joke.

There’s absolutely no way this is the case.

Chess GMs at Magnus and Hans’ level wouldn't even need to cheat on every move and certainly not on any opening where something like the first 20 best moves are all memorised. These guys would only need the engine to tell with them one or two moves per game to pretty much always win.

Why did Magnus start the game and then resign? Maybe he thought it would make a statement. Maybe he needed to technically show up to the game to avoid a penalty.

Obviously the person you’re responding to doesn’t think covid is conscious and has motivations…

I’ve exercised probably 90% of days for the last ten years. Days when I don’t are just rest days or travel days. To be honest, I think it’s best just to make it a habit like brushing your teeth. Working out is just what you do, and it’s a weird day if you don’t. Being highly motivated is kind of fleeting and just boring routine is more important.

Perhaps I’m looking into the data too much, but it doesn’t surprise me that 0 is often the neutral white, black or grey, and that, because we use the base 10 number system, the pattern is the same for 10. These colours and numbers are both “clean”. It’s the same for 2: the most popular colours are blue, yellow, red then green, and that pattern is repeated for 20. Of course, this “pattern” is already broken since it should be 1 with the same pattern as 10 and 2 wirh the same pattern as 20. It would be interesting to see if patterns do indeed emerge with more data. I would certainly expect 100, 1000, 1,000,000 to often be white, black or grey.

For myself, I’ve always associated colours with days of the week. I don’t know if others have this, but it’s always felt more “obvious” what colours some days of the week are compared to others, like the feeling is stronger or the colour is more brilliantly defined. But I do wonder to what extent it may have just been me as a child tricking myself into thinking I’m special, and I’ve just forever embedded those colour memories, because it’s really not like if someone tells me “Wednesday” I automatically experience a powerful crimson red; I have to kind of ask myself: “what colour is Wednesday?” to experience it in my mind’s eye.

100%. I found the books “how to have impossible conversations” and “crucial conversations” helpful for me, but in a nutshell they’re basically “say things in a way that protect the other side’s ego”

Same in MMA: athletes are stuck competing either in the UFC, Bellator, etc.

What would happen (most likely) is that the wave function collapses and you find yourself in a universe where the random number you chose is not in fact a divisor and so, according to your algorithm, you now have to kill yourself. Probably, you don’t feel like doing it and so this algorithm does not work.

The client could in theory see the javascript running and detect this.

Thanks for the responses. I hope it was useful to go through. Yeah, I think the salient points are that the sid is not all 0 but mostly 0 in one case and Fermat's Little Theorem basically make the math work out. I suspect the authors thought of this clever attack because they were already thinking about fault attacks on RSA where perhaps similar concepts come up.

I predict with some confidence this will be made into a CTF soon if it hasn't already so we may as well work on the code now ;-)

Got it, thank you!

Right, but my question is, why is it the correct value? There's some math theorem which makes it true?

m_2 = c^d_q mod q

    = m^(e * d_q) mod q

    = m because?

Pretty elucidating, thanks.

Could you just elaborate on the part:

If m < q, m_2 = m and there is nothing left to add.

Why is this? What is d_p? d mod p?

The fact that you also are a little fuzzy on the details gives me some confidence that I do in fact have some imposter syndrome ;) Thanks for your response. I understand it takes some work to parse these papers and I'm lazily just asking questions here instead of reading the paper myself, but I think I'm quite good at asking precise questions to get to the bottom of stuff, so I hope it will help others who stumble across this thread.

We're in the bizarre circumstance of being able to get our target to use a partially corrupted version of their own secret RSA key to decrypt a message of our choosing (this never happens! Only with Mega!).

We overwrite the ciphertext of q^{-1} so that is fully corrupted (or at least, because it is ECB mode, a block of it is corrupted), right? By partially corrupted, do you mean "p and q are fine, but q^{-1} is not what it is supposed to be"? Does it matter how we corrupt q^{-1}? Is it just a bit flip in a single block? Do we have to corrupt it the same every time to make a new guess for q?

We set m, the plaintext message we get to choose, to the middle of the range of possible q's. Remember, q is smaller than m;

I'm not quite following this part. To clarify, are you saying (roughly, I know RSA has some checks that q is not outrageously small) q lies in the interval [0, 2^1024] and we, on our first guess, set m = (2^1024 - 0)/2 = 2^1023? Then the adversary encrypts this guess m using the public key N from the client. m, when decrypted by the client at this point, could clearly be either larger or smaller than q, right? Our choice for m is literally in the middle. But the client also pads the resulting m, so it will certainly be larger than q? But to clarify, q is only (almost certainly) smaller than m because of the padding that the client adds?

* If m < q, the message is going to miss our faulted qInv

I'm confused again, sorry. Is this m without the padding, right? Why, if m < q, does the RSA calculation not wrap around the modulus? I'm a bit confused how it pulls out only 0s, but this is probably related to my confusion at the last paragraph. Is it that it's that only 0s, but rather a small number followed by a ton of padding of 0s?

* If m >= q, our qInv fucks up the decryption; we decrypt (I assume) random gibberish

The whole reason we fault qInv is so this case screws up while the other doesn't, right? And so it doesn't really matter how we fault qInv each time? This case faults because the calculation wraps around the modulus? It would be good to see the actual calculation and why this is which I think is my main struggle right now.

I think I understand the attack at a high level but I’m still not sure on some details.

Could someone explain how the math works to provide the oracle? In particular, the exact values the malicious server inserts as the encrypted sid and q^(-1), and why, if the guess for q is lower than the real q the plaintext sid the client sends back is 0, and why it’s not zero if the guess is higher?

Am I right in thinking the attacker simply randomly flips a bit in q^(-1)? Why do they need to do this? Do they flip different bits on different guesses? And then how do they encode their guess for q in the encrypted sid? And why, exactly does this provide an oracle? How does the subsequent lattice search need only half as many guesses as binary search? Finally, does this attack require the victim to actually type their password in 512 times?

A lot of users will simply change their passwords by appending a 1, 2, 3, etc. at the end. Presumably if old passwords did sour and become compromised then Hashcat would easily crack the minor tweak on the new password.

To be fair to these companies, the reason they do passwords so terribly is because of such poor guidance and standards in the past. Even now NIST has SP 800-132 for guidance on generating a cryptographic key from a password for storage applications, which is different and often confused with guidance on storing passwords (which they don’t give advice for). There they say to use PBKDF. Also, compliance standards such as PCI don’t allow for modern storage like Argon2, so at best companies use something like bcrypt.

My naive security architect view is, I get the impression the people doing quantum engineering and those working as cryptographers have a very narrow overlap.

Correct. It's also the difference between theoretical security for infinite time vs security for something like 10^30 years. Is it really worth changing tried and tested algorithms and implementations already in place?

This is what I find most plausible as well. If we just look at facts we currently believe to be true, then we know there are enormous distances between planets and no fast way of travelling between them. Then for a lot of probabilities you want to assign to the likelihood of intelligent life emerging on a Goldilocks planet, the universe would look exactly like it does today. I.e. we’re all on isolated islands on a fast ocean, and it doesn’t matter how advanced our tech gets: we’re still all limited by the laws of physics so we all think we’re alone.

This is a beautifully succinct animation of how AES works: https://youtu.be/gP4PqVGudtg

WhatsApp group chats are E2E. I actually worked on this. It is true (unless they’ve changed it) that the precise security guarantees of the group protocol are different, but it is still ends-to-ends encrypted.

I remember seeing this bug years ago. As Filippo mentions at the end, I'm still not sure whether to attribute this to malice or incompetence as per Hanlon's razor. I have not really followed what's up with Telegram lately, but I recall they had a rather brusque attitude towards the cryptography community at the time: "we have maths PhDs!", "Here's an encrypted message with no other context whatsoever: 0x459457453494530453409abc74f, $1 million if you can break it. No? Didn't think so!". To be honest, their consistent hubris at the time combined with (as far as I'm aware?) no other suspicious code (in the sense of backdoors, not just weird crypto) since, actually leads me to think it might genuinely be incompetence rather than a deliberate backdoor. I do think it's true that the security community can be a little outraged and not very welcoming to newcomers in the space if they get anything wrong: even Signal, pretty much the gold standard, receives constant (in my opinion, unfair) criticism for not being federated. Though, given the high stakes, I suppose this can be forgiven.

He clearly knows he's talking to an actual expert who's calling him out, so he thinks faking getting angry and storming out is a good way for him to escape the situation.

He did not (he even said they've recovered 10,000+ private keys!). If a nonce is reused across different signatures or just known because randomness is bad, one can compromise the private key used in making the signature.

He's referring to the fact that with ECDSA signatures, if the randomness is bad on a single signature (i.e. you know the "k" value in the signature) then that is sufficient to reveal the private key used in making the signature. Similarly, if two signatures are made with the same nonce and private key, you can reveal the nonce and thus the private key. The maths is actually explained on the wiki page: https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signatu...

Here’s a video of Craig Wright being called out by an actual expert and it’s hilarious https://youtu.be/0thnCDgRJfM. He clearly has no clue how ECDSA signatures work.

So that generally means that governments need to step in, and help the people and companies to do the right thing.

That sounds pretty ominous. What policy would you suggest? Why would you be confident the government would be at all competent?