{"action":"created","issue":{"url":"https://api.github.com/repos/marumari/crypto-presentation/issues/1","labels_url":"https://api.github.com/repos/marumari/crypto-presentation/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/marumari/crypto-presentation/issues/1/comments","events_url":"https://api.github.com/repos/marumari/crypto-presentation/issues/1/events","html_url":"https://github.com/marumari/crypto-presentation/issues/1","id":120361554,"number":1,"title":"Feedback up to slide 87","user":{"login":"lgarron","id":248078,"avatar_url":"https://avatars.githubusercontent.com/u/248078?v=3","gravatar_id":"","url":"https://api.github.com/users/lgarron","html_url":"https://github.com/lgarron","followers_url":"https://api.github.com/users/lgarron/followers","following_url":"https://api.github.com/users/lgarron/following{/other_user}","gists_url":"https://api.github.com/users/lgarron/gists{/gist_id}","starred_url":"https://api.github.com/users/lgarron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lgarron/subscriptions","organizations_url":"https://api.github.com/users/lgarron/orgs","repos_url":"https://api.github.com/users/lgarron/repos","events_url":"https://api.github.com/users/lgarron/events{/privacy}","received_events_url":"https://api.github.com/users/lgarron/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-04T09:13:35Z","updated_at":"2015-12-04T15:40:13Z","closed_at":null,"body":"As of 1c9887a1ce1f933f88857d19fb21db7b30f7bdae.\r\n\r\nPretend that I wrote everything in a polite, charitable voice. :-P\r\n\r\n(But actually, some of these are worded as prescriptions. They are all meant as opinions, and you're welcome to disagree with any of them.)\r\n\r\n- General thoughts:\r\n  - Overall, great selection of content so far, with just the right amount of detail on each (maybe a *tad* too much on old, borkedy crypto).\r\n  - Nice, clean layout and design. A bit cheesy at times, but I like it.\r\n  - At the beginning, I would try hard to mention enough so that someone who walks away immediately will have the right ideas. Maybe a tl;dr with the good ol' \"Use TLS and PGP. Now let's explain how they are built.\"\"\r\n- 3 Learning Objectives: shorten the fourth bullet. Looks like corporate speak.\r\n- 6 Definitions:\r\n  - Cryptography: \"s/security/secure\"?\r\n  - Plaintext: \"is not encrypted\" (could be decrypted *shrug*)\r\n  - Algorithm: \"function\" is ambiguous. Try \"computation\"?\r\n  - Key space128-bit strings\r\n  - Brute-force attack: I like the wording of the definition, but you might also brute other sets like possible messages.\r\n  - In general, definitions seem to to follow just after their first usage. I'd reorder slides so that terms are introduced in order. If you want to highlight the most important term at the end, do that separately.\r\n- 13: Mixed tenses. Try \"until the beginning of modern cryptography\"?\r\n- 14 (Caesar cipher): perhaps add an arrow to indicate the shift?\r\n- 14 (Caesar cipher): I'd give the example a white background in addition to a drop shadow.\r\n- 15 -3, 23, and \"ROT-23\" are confusing. Perhaps swtich -3 and 23?\r\n- 15: \"no encryption is done\" is false, especially since your definition of encryption did not have constraints on difficulty. I'd make sure to include a qualifier like \"effectively no encryption\" or just straight say that this is easy to crack because the key space is small enough to brute-force by hand.\r\n- 16: It would be nice to have arrows between the lines to visually indicate that stuff is shuffled all over the place. Perhaps fade in 26 arrows and fade them out, but I'd include it. This could also be done with the Caesar cipher, where the shift just appears as a bunch of parallel slanted lines.\r\n- 16: You say \"randomly\", but the key has \"APRIL\" in it. (O my TV!) Given the subtleties of randomness, I'd use a word like \"arbitrarily\" or use an actual random permutation\r\n- 17: When you say \"also known as a permutation\", I actually assumed you were still talking about substitution ciphers (where keys are permutations of the alphabet).\r\n- 20 and 22 do not quite have the context to motivate them. I presume that's something you'll actually say out loud, but it would be nice if the slides led into these a bit more. (As a mathetician, I also have to say that a skewed distribution is not bad on its own. It's bad here because the distribution directly reveals something about the ciphertext.)\r\n  - Idea: give examples of distributions that reveal content, e.g. \"ATTACK AT DAWN\" and \"ATTACK AT DUSK\"\r\n- 23: \"The 1550s have us covered\": I'd be wary of even vaguely suggesting that 1550s crypto got something right.\r\n- 31 (Breaking Vigenère): Nice! The minusses and equals at the bottom are a bit hard to read, though.\r\n- 34 \"s/as they're/since the inputs are\"\r\n- 36: Allude to Vigenère, which is just an extremely frequent case of reuse (within the same message!)\r\n- 36: In case you haven't seen it yet: https://www.schneier.com/crypto-gram/archives/1999/0215.html#snakeoil (warning sign #6). May or may not want to throw in an admonition and joke about that.\r\n- 37: Modern crypto after only 18% of slides. Yay!\r\n- 39: Hmm, throwing non-repudiation in there looks weird to me. The other are the Three Big Crypto Guarantees. Non-repudiation is sometimes desirable and sometimes undesirable (signatures, yo!), and I think this slide doesn't sufficiently hint or motivate which is better.\r\n- 39 Since \"authentication/authenticity\" can refer to either integrity or identity, I like to use \"Identification\" for what you call \"authenticity\". But that's mostly preference.\r\n- 41 Write as \"128 to 256 bits\" or \"128 or 256 bits\" to avoid any confusion about the hyphen\r\n- 41: \"each party requires\" makes it sound like a demand of each party. I'd say \"needs\" and maybe tack on \"in order to encrypt/decrypt/participate\"\r\n- 41: I think of MACs as symmetric-key crypto, which can provide integrity and authenticity.\r\n- 41: Grammatically, \"using\" refers to the symmetric-key crypto.\r\n- 42: My friendly neighborhood cryptographer might be a funky person who doesn't trust NIST and wants me to use CROWDISH. Is that what I want? What about that Mozilla TLS config generator thing? SHould I use that for my website?\r\n- 43: Arguably, all three points are false. However, I think that's okay to gloss over.\r\n- 45: IV and nonce mentioned before being defined. Avoid / motivate or highlight on the current slide.\r\n- 47: \"to the same output\": Add \"if you use the same key\"\r\n- 49: I think this *should* scare people. A lot of purportedly \"secure\" chat apps make rookie mistakes like this (care for an RSA exponent of 1?). I would use this as a chance to drill \"don't roll your own crypto\", but distinguished from \"use established crypto\"\r\n- 54: Cutesy names and adversaries are now passé. Did you get this week's memo? :-P\r\n- 61: Do you  mean to imply that the question was the brilliant idea? I would swap this with the previosu slide.\r\n- 69 and 70: Maybe leve somehting at the top telling us this is still explaining Diffie-Hellman, in case anyone tuned out?\r\n- 73: My favorite slide! We have this one hanging in our office! :-D\r\n- 75: The subscripts don't provide good visual separation. The fact that Mallory is partially transparent sort of looks like you want us to understand that Mallory is passive. Strawman ideas: Use primes (e.g. p'), use bold, draw bxes around the two halves numbering them as exchange 1 and exhange 2.\r\n- 76: This is clear, though! (Are pink and yellow distinguishable enough to all colorblind folks?)\r\n- 81: label the keys again (preferably still in normal-size font, e.g. using arrows if necessary)\r\n- 81: Shouldn't encryption be blue (public) and decryption red (secret)?\r\n- 85: This is the first time the private key isn't a straightforward number or sequence of bits. I'd suggest something more explicit like \"these *together*\" or this *pair* of numbers is the private key\".\r\n- 85. If you're going to use sentences instead of non-punctuated phrases, I'd just use periods instead of semicolons. One idea per sentence.\r\n- 87: \"B\" is too small\r\n"},"comment":{"url":"https://api.github.com/repos/marumari/crypto-presentation/issues/comments/161999045","html_url":"https://github.com/marumari/crypto-presentation/issues/1#issuecomment-161999045","issue_url":"https://api.github.com/repos/marumari/crypto-presentation/issues/1","id":161999045,"user":{"login":"marumari","id":230528,"avatar_url":"https://avatars.githubusercontent.com/u/230528?v=3","gravatar_id":"","url":"https://api.github.com/users/marumari","html_url":"https://github.com/marumari","followers_url":"https://api.github.com/users/marumari/followers","following_url":"https://api.github.com/users/marumari/following{/other_user}","gists_url":"https://api.github.com/users/marumari/gists{/gist_id}","starred_url":"https://api.github.com/users/marumari/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marumari/subscriptions","organizations_url":"https://api.github.com/users/marumari/orgs","repos_url":"https://api.github.com/users/marumari/repos","events_url":"https://api.github.com/users/marumari/events{/privacy}","received_events_url":"https://api.github.com/users/marumari/received_events","type":"User","site_admin":false},"created_at":"2015-12-04T15:40:13Z","updated_at":"2015-12-04T15:40:13Z","body":"Thank you so, so much for the feedback thus far!  I'll crank away at it today.  :)"}}