TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Disco: Modern Session Encryption [pdf]

47 点作者 lainon大约 6 年前

4 条评论

haarts大约 6 年前
This doesn&#x27;t appear to be only a research project, there are two implementations already. One in Go (<a href="https:&#x2F;&#x2F;www.discocrypto.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.discocrypto.com&#x2F;</a>) and one in C (<a href="https:&#x2F;&#x2F;github.com&#x2F;mimoo&#x2F;disco-c" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;mimoo&#x2F;disco-c</a>).
评论 #19264917 未加载
eadmund大约 6 年前
This is really, really cool: using a single construction to provide … everything. It does feel a bit like putting all of one&#x27;s eggs in one basket, but I guess as long as it&#x27;s one really <i>great</i> basket that&#x27;s okay.<p>It makes sense, too, given the assumptions we make about security of PRFs: if a PRF is secure enough to generate keys with PRF(state || 001), PRF(state || 002), … then intuitively (which isn&#x27;t a proof!) everything else follows.<p>All in all, a really neat result!<p>As an aside:<p>&gt; Disco is the natural merge of the two projects<p>I&#x27;ve gotten used to seeing the verb &#x27;ask&#x27; used as a noun instead of &#x27;request,&#x27; and just within the last week saw the verb &#x27;solve&#x27; used as a noun instead of &#x27;solution&#x27;; this is the first time I&#x27;ve seen the verb &#x27;merge&#x27; used instead of the noun &#x27;merger&#x27; in this context (although I&#x27;m familiar with it from version control).<p>American English has already lost its adverbs; I wonder if we&#x27;ll start to lose a lot of our nouns (!) too.
评论 #19266138 未加载
评论 #19263354 未加载
feb大约 6 年前
Very cool approach which relies on the sponge construction of Keccak&#x2F;SHA-3 fame.<p>The presentation at Blackhat 2017 explains well the core ideas as well as the context:<p><a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=bTGLO4obxco" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=bTGLO4obxco</a>
tatersolid大约 6 年前
This looks really promising, except for the “variety of handshake patterns from which the developer can choose”. Few details in the paper, but hopefully the choices are limited to just “we share a secret” or “use a pinned public key” or possibly “use PKI” choices. We don’t need non-specialist developers trying to decide what form of mutual authentication they should use; the library should make safe choices for the developer.<p>I also hope the wire protocol is strictly versioned with <i>zero</i> options. You want a new cipher suite, rev the whole protocol.
评论 #19263368 未加载