NEW EPISODE!
The gang learns a bitter lesson about AI and bug finding! Returning champion Nicholas Carlini is back to talk about Claude for vulnerability research.
https://t.co/EKmiAoYBzX
https://t.co/WKFkhxAE1O
@tqbf It is.
This bug is also fun: https://t.co/ajoUhHPrBB
Did you know that South Korea invented their own block cipher and managed to get it to wolfSSL? Their cipher implementation of GCM mode is horribly broken. Kim Jung Un would love this!
You can read a detailed technical report on the software vulnerabilities and exploits discovered by Claude Mythos Preview here: https://t.co/AgU6ltV2qW
If you visibly know what you're talking about, mic-dropping SIDH in conversations about MLKEM mostly signals that you have contempt for your audience, who you count on not to understand the distinction between isogenies and lattices.
It would help a lot if people would stop name-dropping SIDH any time anybody talks about how well we understand MLKEM (the Euro-sourced NIST contest winner, which we understand *quite* well).
This sounds obvious but I can't count how many people I've seen show up to say PQC is untrustworthy because SIDH was broken with a laptop. SIDH being broken says nothing about how safe/unsafe PQC is generally.
PQC isn't like a design philosophy, like Feistel vs. SPNs or FFDH vs. ECDH. It's a property some constructions have that others don't, about perceived/believed resistance to QC.
A thing you see over and over again in HN-type discussions of post-quantum cryptography is the implication that "post-quantum" is a kind of cryptography. No. PQC is a functional attribute of many different kinds of cryptography.
Fun time to be working in information/software security. The field is going out with a bang! First AI, then an imminent CRQC. We need, like, a big SCADA event to hit the trifecta.
NEW EPISODE! In retrospect, if adderall'd up college kids can find vulnerabilities, it not that surprising today's foundation models can to. We talk to Nicholas Carlini about the Vulnpocalypse.
https://t.co/hRzyWsKRR0
https://t.co/lEfnjajXfP
Host (is it @tqbf) laughter at 28:19 cures cancer.
I joke CS is a karmic wheel but how did anyone now think imposing OSSL_PARAM at loss of C type checking was a good idea?
“It was not called PyRuby, it was called Topaz.”
Nextstep shoutout on point too.