Hacker News Reader

Comment by cperciva | Hacker News Reader

I am the audience for this paper, and I recognized the names.

I still had absolutely no clue what the title meant until grandpa pointed it out. I agree with locacorten: Horrible title.

View on HN

The title of a paper doesn't need to tell you exactly what the paper has in it. (It can't, except in those cases where the content of the paper is perfectly expressible in a single snappy sentence.)

It does need to (1) give a clue whether you want to read it and (2) let you recall what the paper is about when you see the title on a later occasion.

In this instance, #1 goes like this: "Oh, it's by Lenstra. And it's got a cutesy title. It's got to be worth a look, if only to see what on earth the title means." And #2 ... well, do you think any interested party who read this paper is going to have any difficulty remembering what it's about, say, 10 years from now? I don't.

You can't get away with this sort of thing if you aren't as big a name as Lenstra -- or if your paper isn't about something vitally important that (in hindsight) is easily associated with the paper title. But that's OK. Most of Lenstra's papers have titles like "Fast Irreducibility and Subgroup Membership Testing in XTR" and "Factoring Multivariate Polynomials over Algebraic Number Fields".

You can't see "Whit" and immediately know "it's Whit Diffie", or given Whit Diffie expect that "Ron" means "Ron Rivest"? I got it instantly and have way less crypto than you.

Or are you saying, "Ron Rivest was wrong, Whitfield Diffie was right" is still a horrible title?

The whole paper had the feel of a rump session pub, didn't it?

The whole title is horrible because of its not even related to the outcome of the experiment/paper. Ron and Whit are neither both right nor both wrong, nothing in the article even came close to proving such a title. Using bad entropy is wrong.

What would be nice to see is the age of the affected certificates graphed in a scatter. It would be interesting to note if there are patterns of grouping. We all read the articles from Peter Goodman et al where he demonstrates horrible entropy [0,0,0,0,0,0,0,0].

I disagreed with your first point downthread.

Or are you saying, "Ron Rivest was wrong, Whitfield Diffie was right" is still a horrible title?

Yes. That title made me think "ok, what famous argument dud they have which this is referring to?" (the way "Torvalds was wrong, Tanenbaum was right" would) and I can't think of any famous arguments about whether people have enough entropy in their prime generation.

To an implementor, isn't one of the biggest differences between DH (super easy to implement) and RSA (considerably trickier) the difference between needing one prime number instead of two?

Anyways I take your point. The paper really doesn't have too much to do with the title.

To me, the biggest difference between DH and RSA is that DH is stateful and RSA is stateless. Next up is that with DH you're generating random exponents each time instead of doing it once during key generation.

The number of primes involved is way down on my list of important differences between DH and RSA.

Stephen was wrong, Kip was right! :)

Reply on news.ycombinator.com