Long-Delayed Updates - Life, Projects, Work

I've been putting off updates here for quite some time, primarily due to lack of focus. I've been working on quite a few personal things lately:

• Attending free college courses on cryptography and algorithms
• Working out the design of the cryptoface library
• Getting my feet wet developing mobile/desktop games with Moai
• Beta testing games

On the work/career side, I've been busy as well:

• Designing a new cryptographic data interface
• Designing a new memory management interface
• Implementing a new web-request client
• Attending people/skill-management training
• Answering recruitment messages

While working on designing a new cryptographic data interface at work, I've had a chance to get a better handle on how certain sets of operations should behave and how one might best structure a generic system. This should help out with figuring out how to best setup how cryptoface will work out.

I also had to design a memory management interface... that was quite an eye-opener. The main objectives were to ensure that data in memory would not get flushed to disk and that any flushable memory would be protected. This issue of flushable memory was relatively easy, use unflushable memory to store a key to encrypt the flushable memory. The unflushable memory was difficult and yielded a problem: What about suspend-to-disk? It turns out that, for the relevant systems, on a suspend-to-disk operation, your 'unflushable' memory will end up on disk (unless you implement some crazy notification system that 'might' be implementable on a given platform). I plan on writing a larger article on how the memory management interface will make its way into cryptoface.

Earlier this year I attended free online courses on cryptography and algorithms. These were awesome, they took much more time than I anticipated, but they stretched my mind quite a bit. I was thinking that, given I work on cryptography so much, it would just be a refresher course. Not at all! I was also better prepared for analyzing the recent "padding oracle" attacks that have come up lately. Taking the algorithms class was a great refresher and helped give me a better appreciation than I did when I first had it at MSU as a freshman.

Recently I came upon the Moai development framework. It strikes me as a great fit of technologies:

• Lua
• Android
• Chrome (via NaCl)
• Desktop (Linux/Windows/OSX)
• iOS

Unlike many of the other frameworks out there, it is open-source! I took advantage of this during my exploration of one the physics system in place (box2d) and used some free time to patch it up with some documentation and unify the scaling system to better honor the virtual unit system. I plan on using it sometime in my free time to develop and publish a game for Android for my kids to play. What cooler way to get kid-kudos than be the one with the dad who "wrote a video game!"

This open-source experience also gave me an interesting insight into an area that I had not yet ventured into: getting approval for "outside" work. My prior long-running projects were grandfathered in through the acquisition process, but I had not yet envisioned writing game software.

I have also had the task of answering many recruiter messages on Linked-in. For the longest time I was receiving many opportunities that involve moving out to an area w/ at least double the cost of living... not my cup of tea... at least yet. (Quick stats from a site show that moving to California would cost me 55% more and I would only be making 25% more... not cool) I discovered about a month ago that there was a section to input text for recruiters/etc to see when considering to send a message. Lately I haven't heard from as many (yay!) but a few received still seem to not read this. I also typically get requests to forward this information to any I may think fit-the-bill. Sorry... even your offer of an iPad on recruitment pass-through isn't going to work well. My current network of people is pretty much where I'd like them to be: local! In addition, most of the talent I know well and would recommend well are those that I work with (a great team!) and dare not trade them off in return for getting someone new (though are two new contractors look to be doing quite well).

On the receiving end of this when observing the contractor-search process, it looks like the hiring process for skilled individuals is extremely difficult. It seemed the process was to funnel people through that look like they "might" have qualifications. We ended up with people who lacked entry-level computer science skills... quite annoying when we have 3rd party hiring staff "pre-screening"... as the smaller TrustBearer Labs, I was more involved and had to directly deal with such individuals, but at least then it was more understandable since we didn't have a big arm to work on the screening task. Not to dismiss the recruiter's negligence in the hiring process, it seems that the pool of qualified skilled software engineers is getting quite diluted... Which will make it a bigger challenge for me if/when I ever enter the active employment search role: I'll have to fight to differentiate myself from the crowd of others out there. At least there are sites out there that are trying to help in this area:

• Nerdability - My profile is http://nerdability.com/user/harningt
• Github - My public page is https://github.com/harningt

These work well since I do like to work on open-source software. Yet another benefit to the open-source industry, if you write good code, potential employers can see it before you work for them!

Hopefully this blog post will put an end to the long blocker on writing more posts.

CryptoFace Digest Design Oops

Designing an interface for managing a library of cryptographic digests seems so easy, right?

Select a digest from a list, process data, get a hash... all there is to it, right?

WRONG!

While pulling in another digest provider, Botan, I found some items that did not fit into the simple model. Namely the configurability of some of the uncommon and new digest algorithms:

• Customizable output size of the 3 Skein internal storage variants
• Customizable "personalization" value of Skein
• Custom number of rounds and output size for Tiger
• ...

This is even without the notions of composing digests in various fashions, such as in parallel or in a Feistel scheme.

In light of this, I anticipate changing my mechanism for obtaining and enumerating digest implementations. Changes will likely include moving the enumeration of digests to more of a secondary feature, making the move to a set of 'well-defined' digest identifiers to be mapped from strings, and making way for parameterized construction of digests to accommodate more complex notions, including hash-based MACs/etc.

The change will not be without complication, however in light of analyzing the problem and the Botan library, I think I may be able to make some elegant structures possible for dealing with complex algorithms... at least with the Lua engine. An example set of structures could be:

-- Simple sized sha2 filter
x = Filter(SHA2(256))
-- HMAC
x = Filter(HMAC(SHA2(256),"KEY")
-- Complex chain of hashes
x = Filter(Parallel(SHA2(512), Skein(512,1024,"Personalization")))
-- Take the filter and stream file-to-file using ltn12
ltn12.pump.all(
  ltn12.source.file("SOURCEFILE"),
  ltn12.sink.chain(x, ltn12.sink.file("SOURCEFILE.hash")))

Lumina and the Future of luaevent

My long-term goal of producing the luaevent replacement, Lumina (part of the "ehrCom" parent project), has been put off for quite some time. Given my recent time constraints for projects, I estimate that my time available to work on this re-engineering project will make it take quite a while. Given the vastness of the project and the intention to document the design before implementation make it far from usable in the near-term.

In the mean-time, luaevent is currently a great way to get fast event-based socket programming in Lua right now. Matthew Wild of the Prosody team had constructed a fork of luaevent a while back with patches he applied to luaevent when I didn't have the time to review and apply them to the main tree. I recently reviewed and applied the changes to produce new 0.3.0 and 0.3.1 releases. The 0.3.0 was missing some of the latest updates, so a 0.3.1 bugfix release was made.

I intend to keep luaevent up-to-date with any provided patches and review them in a reasonable period. That way the need for the forked version can go away and the original tree can be used.

The next major enhancements that I foresee luaevent having are:

• Enhanced build tool integration
• Autotools for Linux
• CMake for Linux and Windows
• Review of implementation to see if it can be better managed using new techniques learned from other Lua projects
• Mirrored API using libev