Hacker News new | ask | show | jobs
by ur-whale 21 days ago
People do crypto using floats these days?

Wow.

I mean I know djb managed at some point to coax an x86 CPU floating point unit to perform weird integer operations to speed up some of his algorithms, but I would never have expected people to use floats the "intended way" to implement crypto algorithms.
4 comments
mcpherrinm 21 days ago
So, in this case it wasn't correct to do so, but there is actually a current algorithm which uses floating point: Falcon (aka FN-DSA).

https://keymaterial.net/2026/05/13/so-you-want-to-deploy-fn-... talks about FN-DSA and has a section about how it's require to hand-implement floats to get constant-time operations.

link
AlotOfReading 21 days ago
It really should have been defined in terms of fixed point like HAWK was. Supposedly you'd need a large number of bits for it, but I'm not sure I find that argument particularly convincing given that floats are a kind of fixed point in log space, with a bunch of asterisks that don't help falcon much.
link
AlotOfReading 21 days ago
As a follow-up to this comment, I sat down and implemented a better method myself, then looked at the specification code to discover they did exactly the same thing.
link
ur-whale 21 days ago
> how it's require to hand-implement floats to get constant-time operations.

That and not be at the mercy of someone changing the current rounding mode behind your back.

Also hand-implement floats ... not likely to be particularly efficient, no ?

I took a quick glance at the section "About those floating points". Whomever designed that algorithm used the biggest footgun ever. I mean floating point numbers? For crypto?

Even if he can mathematically prove is algorithm is solid, he's going to lose 99% of his intended audience the moment he's going to use the words crypto and floating point in the same sentence.

link
dboreham 21 days ago
Well, no. That's the bug. The fix is to "not do that", although one does wonder what the original author was smoking!

https://github.com/cloudflare/circl/commit/f7d2180d6a77cfb28...

link
klabb3 21 days ago
Im not a security engineer at all and I have an instant gut reaction to floats in regular code. ”How big can this get? Is it deserialized? What arithmetic ops are happening? Any risk of rounding error propagation?” etc.

Now, I wouldn’t necessarily mean I deem it bad practice in security contexts since again, I don’t know. But if an expert doesn’t consider those things, I would be surprised (and a little scared).

link
xarope 21 days ago
Yes, this was a bit of a surprise to read when dealing with crypto: "This one lives in CIRCL's threshold RSA implementation... float64 has a 53-bit mantissa... the result is silently rounded before it is ever cast back to an integer. "

this is numerical methods 101, i.e. why 1+1 != 2

I'm a bit surprised that this is from cloudflare. Anybody from CF care to comment? Is this like prototype/super skunkworks code that somehow made it through?

link