2024-04-28

2024-04-28 Sunday - rustls ("A modern TLS library in Rust")

My weekend reading, doing a deep dive into the Rust source code for the rustls library, and its support for post-quantum (PQ) key exchange.

A modern TLS library in Rust 

 

NOTE:  "This crate provides experimental support for X25519Kyber768Draft00 post-quantum key exchange."
  • https://github.com/rustls/rustls/tree/main/rustls-post-quantum
  • https://docs.rs/rustls-post-quantum/latest/rustls_post_quantum/ 
    •  Crate rustls_post_quantum
      • "X25519Kyber768Draft00 is pre-standardization, so you should treat this as experimental. You may see unexpected interop failures, and the algorithm implemented here may not be the one that eventually becomes widely deployed."
      • "However, the two components of this key exchange are well regarded: X25519 alone is already used by default by rustls, and tends to have higher quality implementations than other elliptic curves. Kyber768 was recently standardized by NIST as ML-KEM-768."
[image source: https://github.com/rustls/rustls/blob/main/rustls-post-quantum/src/lib.rs]

    • See line #71:  [X25519Kyber768Draft00]:
        • "This memo defines X25519Kyber768Draft00, a hybrid post-quantum key exchange for TLS 1.3."
  • IETF Draft: Hybrid key exchange in TLS 1.3 (version 10)
    • [Note: Expires 2024-10-07]
    • "Hybrid key exchange refers to using multiple key exchange algorithms simultaneously and combining the result with the goal of providing security even if all but one of the component algorithms is broken. It is motivated by transition to post-quantum cryptography. This document provides a construction for hybrid key exchange in the Transport Layer Security (TLS) protocol version 1.3."
    • 3. Construction for hybrid key exchange [selected quotes]
      • 3.1. Negotiation
        • "Each particular combination of algorithms in a hybrid key exchange will be represented as a NamedGroup and sent in the supported_groups extension. No internal structure or grammar is implied or required in the value of the identifier; they are simply opaque identifiers."
        • "Each value representing a hybrid key exchange will correspond to an ordered pair of two or more algorithms. (We note that this is independent from future documents standardizing solely post-quantum key exchange methods, which would have to be assigned their own identifier.)"
      •  3.2. Transmitting public keys and ciphertexts [selected quotes]
        • "Recall that in TLS 1.3 a KEM public key or KEM ciphertext is represented as a KeyShareEntry: ..."
        • "These are transmitted in the extension_data fields of KeyShareClientHello and KeyShareServerHello extensions: ..."
        • "For a hybrid key exchange, the key_exchange field of a KeyShareEntry is the concatenation of the key_exchange field for each of the constituent algorithms. The order of shares in the concatenation MUST be the same as the order of algorithms indicated in the definition of the NamedGroup."
    • 6. Security Considerations [selected quotes]
      • "The shared secrets computed in the hybrid key exchange should be computed in a way that achieves the "hybrid" property: the resulting secret is secure as long as at least one of the component key exchange algorithms is unbroken. See [GIACON] and [BINDEL] for an investigation of these issues. Under the assumption that shared secrets are fixed length once the combination is fixed, the construction from Section 3.3 corresponds to the dual-PRF combiner of [BINDEL] which is shown to preserve security under the assumption that the hash function is a dual-PRF."
      • "As noted in Section 2, KEMs used in the manner described in this document MUST explicitly be designed to be secure in the event that the public key is reused, such as achieving IND-CCA2 security or having a transform like the Fujisaki-Okamoto transform applied. Kyber has such security properties. However, some other post-quantum KEMs are designed to be IND-CPA-secure (i.e., without countermeasures such as the FO transform) are completely insecure under public key reuse; for example, some lattice-based IND-CPA-secure KEMs are vulnerable to attacks that recover the private key after just a few thousand samples [FLUHRER]."
      • "...this specification MUST only be used with algorithms which have fixed-length shared secrets (after the variant has been fixed by the algorithm identifier in the NamedGroup negotiation in Section 3.1)"

 

 

rustls Security Advisories:

 

Additional resources:

https://badssl.com/
"badssl.com is meant for manual testing of security UI in web clients."

https://github.com/chromium/badssl.com
"Memorable site for testing clients against bad SSL configs."


Cloudflare Research: Post-Quantum Key Agreement
https://pq.cloudflareresearch.com/
https://tldr.fail/
"On essentially all domains served (1) through Cloudflare, including this one, we have enabled hybrid post-quantum key agreement."

 

Noteworthy Articles:

  1. 2024-04-28: Google Chrome's new post-quantum cryptography may break TLS connections


References

NIST: 

2024-04-20

2024-04-20 Sunday - Suggested High Performance Laptops

 

[image credit: JoshuaWoroniecki on pixabay.com]

As an architect, I frequently need to explore various new/emerging technologies and architecture scenarios. To allow me to setup various configurations on my local machine - I want to have robust computing capabilities.

I'm continuing to research new laptop products, as they become available in 2024 - and will revise this blog post as I find better candidates.

Hopefully this information may be useful to other researchers, consultants, and teams.

Option #1

MSI Titan 18H"
(with most of my wish list configuration options (only missing RAID 1, with 2x 4TB SSD)

  • https://www.msi.com/Laptop/Titan-18-HX-A14VX
  • https://www.newegg.com/p/N82E16834156588 
  • https://www.amazon.com/MSI-Titan-Computer-i9-14900HX-Thunderbolt/dp/B0CY9RV1J9
    •  MSI Titan 18 HX 18" 
    • 120Hz 4K 18" UHD mini LED display, 3840 x 2400, HDR 1000, 100% DCI-P3
    • Intel Core i9-14900HX 24-Core (8P+16E, 2.20-5.8 GHz, 14th gen HX-series, "Raptor Lake")
    • NVIDIA GeForce RTX 4090, 16 GB GDDR6
    • 128GB DDR5 RAM (32 GB x 4)
    • 4 TB (2 TB x 2) NVMe Gen4x4 SSD [KM: Would upgrade to 4 TB x 2, RAID 1]
    • WiFi 7
    • LAN: Killer E3100G
    • WLAN: Killer WiFi 7 BE1750
    • Bluetooth 5.4
    • USB: 3 x USB 3.2 Gen 2 Type-A
    • Card Reader: SD7.0
    • Thunderbolt: 2 x Thunderbolt 4 w/ DP (1 also with PD3.1)
    • HDMI: 1 x HDMI 2.1
    • Ethernet: 1 x RJ-45 (2.5Gbps)
    • Audio Ports: 1 x Headphone/Microphone Combo Jack 
    • Speaker: Sound by Dynaudio, 4x2W Speakers 2W x2W Woofer
    • Keyboard: Cherry Mechanical KB SteelSeries per-Key RGB (99 Key)
    • Touchpad: Seamless EGB Haptic Touchpad
    • Webcam: IR FHD w/shutter 
    • Power adapter: 400-watt AC Adapter
    •  Battery: 4 cell (99.9Whr) Li-Ion
    • Windows 11 Pro 64-bit
    • 7.93 pounds 
      • Dimensions: 15.9 x 12.08 x 1.26 inches
      • Strange that it says 15.9

 

 

[image source: Amazon.com]


 

Option #2:

EXCaliberPC [2024] MSI Raider 18 HX

 

Option #3:

 EXCaliberPC [2023] MSI Titan GT77HX 

  • https://www.amazon.com/dp/B0BTM3M282/
    • 13VH-046US (i9-13980HX)
    • 128GB RAM
    •  8TB (2x 4TB) WD Black SN850X NVMe SSD (Seq. Read 7300MB/s, Seq. Write 6600MB/s) 
    • RTX 4080 12GB
    • 17.3" 4K UHD
    • Windows 11 Pro)


 

2024-04-17

2024-04-17 Wednesday - Health Effects of Overwork

[image credit: anykeep on pixabay.com]

 

 This blog post is a placeholder for organizing citations of articles and medical research reports on the effects of overwork (e.g., working more than 40+, 50+, 55+ hours per week - on a sustained basis). 

General articles:

  1. https://en.wikipedia.org/wiki/Effects_of_overtime
    • "Employees who work overtime hours experience numerous mental, physical, and social effects. In a landmark study, the World Health Organization and the International Labour Organization estimated that over 745,000 people died from ischemic heart disease or stroke in 2016 as a result of having worked 55 hours or more per week."
    • "... those working long hours (55 hours or more per week) were at 40% higher risk of developing atrial fibrillation compared to those working a standard 35-40 hour-week"
  2. https://en.wikipedia.org/wiki/Karoshi
  3.  

Professional research

  1. Long working hours and burnout in health care workers: Non-linear dose-response relationship and the effect mediated by sleeping hours—A cross-sectional study (2021-05-06, Journal of Occupational Health)
  2. Impact of work schedules of senior resident physicians on patient and resident physician safety: nationwide, prospective cohort study (2002-2007, 2014-2017, Division of Sleep and Circadian Disorders, Departments of Medicine and Neurology, Brigham and Women's Hospital, Boston, MA, USA)
    • "...exceeding 48 weekly work hours or working shifts of extended duration endangers even experienced (ie, PGY2+) resident physicians and their patients."
    • "Working more than 48 hours per week was associated with an increased risk of self-reported medical errors, preventable adverse events, and fatal preventable adverse events as well as near miss crashes, occupational exposures, percutaneous injuries, and attentional failures (all P<0.001)."
    • "Working between 60 and 70 hours per week was associated with a more than twice the risk of a medical error (odds ratio 2.36, 95% confidence interval 2.01 to 2.78) and almost three times the risk of preventable adverse events (2.93, 2.04 to 4.23) and fatal preventable adverse events (2.75, 1.23 to 6.12)"
    • "Working one or more shifts of extended duration in a month while averaging no more than 80 weekly work hours was associated with an 84% increased risk of medical errors (1.84, 1.66 to 2.03), a 51% increased risk of preventable adverse events (1.51, 1.20 to 1.90), and an 85% increased risk of fatal preventable adverse events (1.85, 1.05 to 3.26). Similarly, working one or more shifts of extended duration in a month while averaging no more than 80 weekly work hours also increased the risk of near miss crashes (1.47, 1.32 to 1.63) and occupational exposures (1.17, 1.02 to 1.33)."
  3. At-Risk Work Hours Among U.S. Physicians and Other U.S. Workers (American Journal of Preventive Medicine, Volume 65, Issue 4, October 2023, Pages 568-578)
    • "Systematic reviews by the WHO have shown an increased risk of morbidity and mortality related to ischemic heart disease and stroke among individuals working an average of ≥55 hours/week."
    • "The relationship between work hours, well-being, and health outcomes is complex. At least 2 pathways—a physiological stress response pathway (e.g., autonomic nervous system, immune function, hypertension, arrhythmia risk) and a behavioral stress response pathway (e.g., alcohol use, unhealthy diet, tobacco use, physical inactivity, impaired sleep)—may contribute to morbidity and mortality associated with long work hours."
    • "risk of burnout increases by approximately 2% for each 1 additional hour worked each week"
    • "recent studies have found that working ≥55 hours/week is associated with an increased risk of ischemic heart disease and stroke."
    • https://www.sciencedirect.com/science/article/pii/S0749379723001666
    • https://doi.org/10.1016/j.amepre.2023.03.020

 

 

Current backlog of additional links to review

 

 

 

 

2024-04-10

2024-04-11 Thursday - Book Review: Cracking the Data Science Interview

[image source: Amazon.com]

 

Cracking the Data Science Interview: Unlock insider tips from industry experts to master the data science field (Feb 29th, 2024)
https://www.amazon.com/Cracking-Data-Science-Interview-industry/dp/1805120506/

 
by Leondra R Gonzalez (Senior Data & Applied Scientist, Microsoft), and Aaren Stubberfield (Data Scientist, Microsoft)


[Link to my review on Amazon]

Review Title:
Packed with valuable guidance: A balanced survey of Data Science with great breadth and depth

Review thoughts:

  • It is difficult for most authors to strike the necessary balance when writing a book that covers so much ground - but this book achieves this quite well.
  • This book is well written - and earns the accolade I reserve for just a few books: Crisp!
  • The content is very well structured
  • The authors approach to teaching is actionable - with concrete skill building examples.
  • This book provides a good outline for helping people identifying gaps in their skills/knowledge
  • There are great suggestions for the reader to further explore various topics (versus overburdening the focused goals of the book)
  • Chapter-3 is a fast paced introduction to Python - and provides concise examples to gives the reader immediate skills in writing Python code.
  • One of the most important techniques the book teaches is covered in the section "Applying scenario-based storytelling".
  • Chapter-9's coverage of Feature Engineering is noteworthy for being well done in conveying the concepts with easy to understand examples.  
  • The illustrations are very nicely done.
  • code examples are concise, focused, and well explained.
  • The "when to use" and companion "tips" sections are very nice touches - that help the reader understand not just the WHAT and HOW, but also the WHY.
  • The "Assessment" and companion "Answer" sections are a great teaching technique to challenge the reader - and provide immediate guidance to clarify/correct any potential misunderstandings.
  • In Part-3, the discussion of "Assumptions", "Common Pitfalls", and the associated "Implement Example" entries - ARE WORTH THE PRICE OF THE BOOK ALONE.
  • Any manager or developer - will benefit from using this book's broad survey of topics - to expand their understanding of Data Science concepts and techniques.
  • As an architect, I learned quite a bit of useful Data Science concepts/techniques by working my way through this book.
  • If someone carefully worked their way through the full contents of this book - I believe they would have a good foundation established in preparing for a Data Science interview.


Suggestions for the next edition:

  • Create a "Data Science Awesome Jobs Board List" GitHub repository, as a companion to the book.
  • Add a new chapter to discuss common anti-patterns in data science.
  • Performance trade-offs/considerations would also be some very important information to perhaps consider adding in a next edition.
  • An Appendix of Suggested Reading/Books might be helpful (for example, in chapter-3, p-59, while text mining and NLP are noted as outside of the scope of the book - it is an important area of Data Science - and it would be helpful for the next edition to include some suggested books on topics that are designated outside of the book's scope).
  • On page-331, it would be helpful to also mention the recent open source fork of Terraform - OpenTofu.


There is one critical caution missing in "Part 3: Exploring Artificial Intelligence", "Chapter-11 Building Networks with Deep Learning" (for example, on page-317, in the section: "Introducing GenAI and LLMs"):
Any discussion of GenAI __MUST__ caution on the very real risks of hallucination and confabulation.

 


Copyright

© 2001-2021 International Technology Ventures, Inc., All Rights Reserved.