TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Why Bitcoin Core 0.10's release notes say “…libsecp256k1 is better than…OpenSSL”

137 点作者 bdr超过 10 年前

4 条评论

mjs超过 10 年前
Interesting position on testing: &quot;I generally don&#x27;t consider my own software adequately enough tested until its tests have turned up a bug in a compiler&#x2F;toolchain. So far I&#x27;ve not encountered a compiler bug for libsecp256k1 [...] so I may have to settle for discovering that a ubiquitous system library couldn&#x27;t square correctly.&quot;<p>(The bug was found via comparing the output of libsecp256k1 and OpenSSL on &quot;specially-constructed random inputs.&quot;)
评论 #8861787 未加载
评论 #8861423 未加载
评论 #8861818 未加载
lultimouomo超过 10 年前
The quoting is quite misguiding, the article and its title say:<p>&gt; we have reason to believe that libsecp256k1 is better tested and more thoroughly reviewed than the implementation in OpenSSL<p>which is something very different from generically being &quot;better&quot; (which has 0 information value, BTW).
评论 #8862250 未加载
avian超过 10 年前
&gt; The incorrectly squared numbers would be expected to be found randomly with probability around one in 2^128<p>1:2^128 is an incredibly low probability. Universe is only around 2^86 nanoseconds old. For all practical purposes, an event with a 1:2^128 probability is impossible.<p>They say that they found it with randomized testing (although one that explores &quot;a class of rare corner cases&quot;) and dismiss the claim that this is a class of bugs that can only be found by analysis of the implementation.<p>I think a test that manages to find a bug like this can not be called &quot;random&quot; (as in, throwing random inputs to a black box). Obviously I don&#x27;t know the details, but I am sure their test incorporated a great deal of detailed knowledge of algorithms used in the computation.
评论 #8862240 未加载
评论 #8862192 未加载
评论 #8862032 未加载
java-man超过 10 年前
no software is truly safe until the amount of testing code exceeds the amount of main code...
评论 #8861305 未加载
评论 #8863270 未加载