Post B7MOVca5t7HpbedVVQ by astrid@woem.space
(DIR) More posts by astrid@woem.space
(DIR) Post #B7MMsZWbDYwCsZokl6 by astrid@woem.space
1 likes, 1 repeats
these signatures are long :neocat_dizzy:
(DIR) Post #B7MMsZjiQnQhXFxECe by privateger@plasmatrap.com
1 likes, 0 repeats
@astrid@woem.space my message aint that important fr
(DIR) Post #B7MMsZwpe1vCBw5heC by astrid@woem.space
1 likes, 1 repeats
yeah instead of sleeping (unable to), i was... reading rfcs...
(DIR) Post #B7MMwlk3jkBxvc7Aps by privateger@plasmatrap.com
1 likes, 0 repeats
@astrid@woem.space what do you mean this is the lowest ML-DSA level
(DIR) Post #B7MN4r3BsqBGi1v1iC by astrid@woem.space
1 likes, 0 repeats
@privateger ahaha. haha. ha
(DIR) Post #B7MN4rDTGcP7DujEjg by privateger@plasmatrap.com
1 likes, 0 repeats
@astrid@woem.space who up signing they messages with ML-DSA-87
(DIR) Post #B7MN5mGz8E5EBJoLcu by astrid@woem.space
1 likes, 0 repeats
@privateger honestly tho if signatures now end like this, i'm actually fine with that
(DIR) Post #B7MNGRYCW7bp67wvjM by privateger@plasmatrap.com
1 likes, 1 repeats
@astrid@woem.space hmma cool 6 KB of straight b64
(DIR) Post #B7MNHY33qOhNXWuXGy by astrid@woem.space
1 likes, 0 repeats
@privateger there's also the fallback algorithm nist recommends if ML-DSA gets fucked up!(source is the openpgp draft rfc: https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-17.html#name-the-slh-dsa-algorithms)
(DIR) Post #B7MOVbr4aVH3M1ZYKe by astrid@woem.space
1 likes, 1 repeats
@privateger from my brief skim of both, and from my uninformed opinions, this is actually a case where the PGP spec is better-designed than the x509 spec!so for all of these algs’ private keys, they have the full expanded multi-kilobyte version, and a reasonably-sized 32/64/128 byte seed version that the giant version can be deterministically calculated from (one way, not reversible). whereas PGP decides to just store the seeds, x509 decided “let’s give the option to give either the seed, or the expanded key, or both!” ML-DSA-44-PrivateKey ::= CHOICE { -- imagine this to be a tagged union seed [0] OCTET STRING (SIZE (32)), expandedKey OCTET STRING (SIZE (2560)), both SEQUENCE { seed OCTET STRING (SIZE (32)), expandedKey OCTET STRING (SIZE (2560)) } }and whereas NIST is like “hey if you decide you want to store both you should probably make sure that they’re equivalent when you load them”, apparently the x509 spec just… doesn’t require that??????this explains it a bit better: https://keymaterial.net/2025/02/19/how-not-to-format-a-private-key/
(DIR) Post #B7MOVcLCmTNQrTfcIa by privateger@plasmatrap.com
1 likes, 0 repeats
@astrid@woem.space seed -> expanded key being deterministic but expanded key -> seed not being possible is just... kinda weird and feels more like an oversight :neocat_googly_woozy:also when both are present, according to RFC 9881, the recipient apparently only SHOULD perform a seed consistency checkif it performs that check and the values do not match, it MUST reject the keybut the check is only SHOULD??? :neocat_floof_explode:
(DIR) Post #B7MOVca5t7HpbedVVQ by astrid@woem.space
1 likes, 0 repeats
@privateger the funniest part is apparently, the seed->expanded algorithm was added later on in the standardization process... but some idiots had already built (and probably sold) HSMs for PQC that were incapable of doing that expansion algorithm. so supposedly, that's why they got pressured into doing this.
(DIR) Post #B7MOWgHbbtiJNQUfqq by privateger@plasmatrap.com
1 likes, 0 repeats
@astrid@woem.space oh my god bruh
(DIR) Post #B7MOZFUBhJFl8UbT2O by becomethewaifu@tech.lgbt
0 likes, 0 repeats
@astrid @privateger Yeah, see @soatok 's blog on openSSL and all the absolutely mind-numbing "you can do anything!*" shit they support, including this exact problem. * Including accidentally shooting your own foot off with a cannon nobody bothered to tell you was even aimed at them.
(DIR) Post #B7MOx1MLs2oIH2H1Sy by astrid@woem.space
1 likes, 0 repeats
@privateger well, the seed->expanded being one-way makes sense imo -- idk what the actual math looks like at all and it sounds really complicated, but if i had to guess, they probably just defined a PRNG or something for picking an expanded secret key, and the expanded secret key is probably some godawful giant impenetrable number that you really cannot reverse
(DIR) Post #B7MXZ7fRfJqITVsqbQ by astrid@woem.space
1 likes, 0 repeats
oh boy . pgp signatures are gonna be this long. on everything anyone pgp signs. it's gonna be comical lmfaoRE: https://woem.space/objects/0f333d0f-d68c-4158-9bc9-a471a4dc3619
(DIR) Post #B7MXZ7tcobBXBUWAhk by astrid@woem.space
1 likes, 0 repeats
Okay.[100 lines of PGP SIGNATURE]
(DIR) Post #B7MXZ84c9jyXjZewpk by astrid@woem.space
1 likes, 0 repeats
wait omg fuck it's gonna get worseif you have to send certificate chains of any kind, you now have to send a 2-4kb signature... for every step of the chaini wonder if presenting a long but technically invalid pqc cert chain would be a funny way to cause Shenanigans
(DIR) Post #B7MXZ8FbUslYHenixk by astrid@woem.space
0 likes, 0 repeats
hmm firfox seems to cap out at 8 cert chains? but i wonder if you could simply present more certs
(DIR) Post #B7MXZ8QErLGyodmDXU by astrid@woem.space
0 likes, 0 repeats
i actually don't know how tls works. time to read the rfc (it is a bad idea for it to read the rfc it has Gainful Employment)
(DIR) Post #B7MXZ8aWF7UpKWaQYy by astrid@woem.space
0 likes, 0 repeats
okay but it could make an argument that reading the tls rfc would be a method of professional development
(DIR) Post #B7MXZ8lVaGHpsbjCgy by astrid@woem.space
0 likes, 0 repeats
what in the shit of the fuck is this syntax 😭😭😭 enum { X509(0), RawPublicKey(2), (255) } CertificateType; struct { select (certificate_type) { case RawPublicKey: /* From RFC 7250 ASN.1_subjectPublicKeyInfo */ opaque ASN1_subjectPublicKeyInfo<1..2^24-1>; case X509: opaque cert_data<1..2^24-1>; }; Extension extensions<0..2^16-1>; } CertificateEntry; struct { opaque certificate_request_context<0..2^8-1>; CertificateEntry certificate_list<0..2^24-1>; } Certificate;
(DIR) Post #B7MXZ8wUvP4qQgryoy by astrid@woem.space
0 likes, 0 repeats
"we have dependent types at home"dependent types at home:
(DIR) Post #B7MXZ97UGXrqym0kwy by astrid@woem.space
0 likes, 0 repeats
wait what the fuck you can just send raw public keys without certificates??????
(DIR) Post #B7MXZ9HleK5hUeoxyS by astrid@woem.space
1 likes, 0 repeats
huh well rfcs sure are somethin huh https://datatracker.ietf.org/doc/html/rfc7250
(DIR) Post #B7MXZ9TSwpRs4wIJCy by astrid@woem.space
0 likes, 1 repeats
> The OpenPGP certificate type [RFC6091] MUST NOT be used with TLS 1.3.WHAT THE FUCK THAT WAS A THING?????
(DIR) Post #B7MXZ9pnbnJTCCk91E by astrid@woem.space
0 likes, 0 repeats
this is peak comedy. i have no regrets. this is the most hilarious thing i have ever read enum { client, server } ClientOrServerExtension; enum { X.509(0), OpenPGP(1), (255) } CertificateType; struct { select(ClientOrServerExtension) { case client: CertificateType certificate_types<1..2^8-1>; case server: CertificateType certificate_type; } } CertificateTypeExtension;
(DIR) Post #B7MXZAAiM22kF4WqcS by astrid@woem.space
0 likes, 0 repeats
and someone actually used this to make a whole ass system! this is truly the gift that keeps on giving https://news.ycombinator.com/item?id=12066092https://www.recompile.se/mandos
(DIR) Post #B7MXZAUv8uCrFjyz7A by astrid@woem.space
0 likes, 0 repeats
if you're wondering why i haven't done any coding recently it's because i have been going on tangents like this
(DIR) Post #B7MY1nG4cq0JZhggu8 by astrid@woem.space
1 likes, 0 repeats
@becomethewaifu @privateger @soatok PGP is the thing famous for doing this and now they're deciding *not* to! it's probably the sequoia group responsible for this change
(DIR) Post #B7MY9hXjl3HaANiiSu by becomethewaifu@tech.lgbt
0 likes, 0 repeats
@astrid @privateger Yeah, it's the same drawback as hash-function key derivation. And if the seed is the "canonical" key form anyways, what practical benefit is there to being able to reverse it?
(DIR) Post #B7MY9hoOl6bt03W1R2 by astrid@woem.space
1 likes, 0 repeats
@becomethewaifu @privateger yeah, the other thing is, just like with RSA, while the key may be 2048 bits, not all values in 0..2^2048-1 are valid RSA private keys.
(DIR) Post #B7MY9i063by3aKzMfY by astrid@woem.space
1 likes, 0 repeats
@becomethewaifu @privateger however, it seems like all seed values result in a valid expanded key