cr.yp.to update

diff -ru .old-crypto/snuffle.html cr.yp.to/snuffle.html
--- .old-crypto/snuffle.html	2005-05-14 04:35:56.000000000 -0400
+++ cr.yp.to/snuffle.html	2005-05-31 11:23:14.000000000 -0400
@@ -11,6 +11,11 @@
 <a href="salsa20.html">Salsa20 hash function</a>
 to encrypt data.
 <p>
+At the end of 2005
+I will award a $1000 prize
+for the public Salsa20 cryptanalysis
+that I consider most interesting.
+<p>
 I've submitted Salsa20 to the ECRYPT Stream Cipher project.
 This submission consists of
 four formalities,
New: cr.yp.to/streamciphers
diff -ru .old-crypto/streamciphers.html cr.yp.to/streamciphers.html
--- .old-crypto/streamciphers.html	2005-05-30 09:04:15.000000000 -0400
+++ cr.yp.to/streamciphers.html	2005-05-31 11:19:49.000000000 -0400
@@ -78,6 +78,11 @@
 constant-time high-speed AES software for modern CPUs.
 </ul>
 A new cipher can avoid these structural errors.
+<h2>Notes on Salsa20</h2>
+My own submission.
+Quite conservative.
+Salsa20 is faster than AES,
+but I was expecting it to be the slowest stream-cipher submission.
 <h2>Notes on Rabbit</h2>
 Authors report, for a Pentium III-1000,
 278 cycles to load a 16-byte key;
@@ -100,6 +105,8 @@
 Each 16-byte output block involves 8 squarings and various other operations.
 <p>
 Initial impressions:
+The multiplier means large price-performance ratio for hardware,
+but Rabbit's software speed is quite attractive.
 From a timing-attack perspective,
 I'm concerned about Rabbit's use of integer squaring on,
 e.g., the Motorola PowerPC 7450 (G4e),
@@ -178,10 +185,9 @@
 314 cycles per block (39.25 cycles/byte, I believe) to encrypt a big block.
 <p>
 Initial impressions:
-This function sounds awfully slow,
-so it won't attract much interest.
+The reported speeds are too slow to attract any interest.
 On the other hand,
-I think it could be computed at considerably higher speed.
+I think that this function could be computed at considerably higher speed.
 <h2>Notes on Py</h2>
 Authors report, for a Pentium III,
 2727 cycles to load a key;
@@ -217,11 +223,11 @@
 on a 1400MHz Pentium 4, plus about 800 cycles for setup.
 <p>
 Initial impression:
-The cycles-per-byte count isn't even on the same scale as RC4;
-the authors are wildly misrepresenting RC4 speed.
-Furthermore,
 Polar Bear is a kitchen sink,
 with all sorts of opportunities for timing attacks.
+The cycles-per-byte count isn't even on the same scale as RC4;
+the authors are wildly misrepresenting RC4 speed.
+What advantages is Polar Bear supposed to have over AES?
 <h2>Notes on YAMB</h2>
 Key as large as 32 bytes.
 Nonce as large as 16 bytes.
@@ -244,6 +250,7 @@
 Uses Mersenne Twister, by Matsumoto and Nishimura.
 <p>
 Initial impression: So slow that nobody will look at it.
+What advantages is Fubuki supposed to have over AES?
 <h2>Notes on ABC</h2>
 Key length: 16 bytes.
 Nonce length: 16 bytes.
@@ -267,6 +274,12 @@
 918 cycles to load a 16-byte key;
 plus 57600 cycles to load a nonce;
 plus 24 cycles/byte to encrypt a big block.
+<p>
+Initial impression:
+What advantages is DICING supposed to have over AES?
+The paper says ``DICING is faster than AES about two times'';
+in fact, even if we ignore nonce-load costs,
+24 cycles/byte is slower than AES.
 <h2>Notes on NLS</h2>
 Page 17 of the NLS document
 reports, for a 1500MHz Centrino,
@@ -274,13 +287,11 @@
 plus 763 cycles to load a nonce;
 plus 6.983 cycles/byte to encrypt a big block.
 <p>
-Page 18 reports low-level operations:
+Low-level operations (page 18):
 addition, xor, constant-distance shift, table lookups.
-Uh-oh: the designers claim that table lookup takes constant time.
+The designers claim, incorrectly, that table lookup takes constant time.
 <p>
-The NLS document also reports about 10 cycles/byte for the Mundja MAC.
-That's twice the time taken by Poly1305.
-<p>
-No speed reports for other CPUs.
+Initial impressions:
+Timing-attack problems.
 </body>
 </html>
New: talks/20050601.pdf
diff -ru .old-crypto/talks.html cr.yp.to/talks.html
--- .old-crypto/talks.html	2005-05-30 09:16:34.000000000 -0400
+++ cr.yp.to/talks.html	2005-06-01 05:07:49.000000000 -0400
@@ -1083,7 +1083,7 @@
 <a name="2005.06.01">2005.06.01</a>
 09:00-09:40,
 invited conference talk
-[PDF slides not available yet]:
+<a href="talks/20050601.pdf">[PDF slides]</a>:
 ENIGMA 2005.
 <a href="http://www.enigma.com.pl/konferencje/ix_kkzk/index.htm">http://www.enigma.com.pl/konferencje/ix_kkzk/index.htm</a>;
 <a href="conferences/2005-enigma/www.enigma.com.pl/konferencje/ix_kkzk/index.html">mirror</a>.