Top all-time · #5934
Chosen Plaintext
Personal blog · chosenplaintext.casecurityprogramming
Chosen Plaintext is a personal blog at chosenplaintext.ca about security and programming. Since 2015, 13 different Hacker News readers have linked it 14 times, most often “The radix 2^51 trick (2017)”. The last post was in 2017, but the archive is still widely read.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN commenters link Chosen Plaintext's posts on security and low-level coding: JWT pitfalls, timing attacks, constant-time code for crypto, and a radix-2^51 arithmetic trick. The comments cite these posts as references.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- The radix 2^51 trick (2017)6 people · 6 mentions · first linked 2020-05-29
- A beginner's guide to constant-time cryptography (2017)5 people · 5 mentions · first linked 2017-04-23
What Hacker News says?
The none issue was highlighted by Tim McLean 2 years ago [0] and comes up in any trivial search about JWT. Surprised that anyone who chooses to use JWT is still getting caught by it as, as you say, any half decent library mitigates this. For me, the log out / cross device session management issue seems to force a pattern of short expiry with self refreshing tokens. Commonly used devices feel always logged in, wherea…
Comment linking /2015/03/31/jwt-algorithm-confusion.html
on “JSON Web Tokens should be avoided”Submitted The radix 2^51 trick (2017) as a story · 518 points
HN discussionRandom time jitter can be denoised with statistics and a large enough sample size. Even if it weren't when you sleep the machine now has more resources to process requests and an attacker can observe this to deduce information about the secret. Ultimately you want the resources consumed by computation handling secret information to always be equivalent. Of course this means swimming upstream of decades of programmin…
Comment linking /articles/beginners-guide-constant-time-cryptography.html
on “Timing Attacks”Submitted The radix 2^51 trick (2017) as a story · 431 points
HN discussionThe only thing I could think of is when writing crypto code, you want your execution time to be constant for all inputs to avoid timing related attacks (e.g. https://www.chosenplaintext.ca/articles/beginners-guide-cons... )
Comment linking /articles/beginners-guide-constant-time-cryptography.html
on “Branchless Coding in Go”Submitted A beginner's guide to constant-time cryptography (2017) as a story · 119 points
HN discussiontaking architecture that explicitly removed carry flag for performance and then trying to to emulate carry flag anyway was stupid in 2021 and is still stupid today even on x64 you get better performance when you don't use carry flag and just use limbs https://www.chosenplaintext.ca/articles/radix-2-51-trick.htm... - risc-v is even more so
Comment linking /articles/radix-2-51-trick.html
on “The Zilog Z80 has turned 50”Submitted The radix 2^51 trick as a story · 51 points
HN discussionSubmitted A beginner's guide to constant-time cryptography as a story · 5 points
HN discussionSubmitted The design flaw in PBKDF2 as a story · 3 points
HN discussionSubmitted Escaping callback hell as a story · 3 points
HN discussion- ot · 2022-11-22
Submitted The radix 2^51 trick as a story · 2 points
HN discussion Submitted The radix 2^51 trick (2017) as a story · 2 points
HN discussionSubmitted A beginner's guide to constant-time cryptography as a story · 1 points
HN discussion
