Masayuki Hatta

Good ciphers in OpenJDK 10

2018-12-11T17:35:00+09:00

Until recently, I didn’t know the list of supported Cipher Suites in OpenJDK is widely different between JDK versions. I used getSupportedCipherSuites() on OpenJDK 10 to get the following list, and check the strength of encryption.

My criteria is:

At least 128bit.
No NULL ciphers.
No anonymous auth ciphers.

Then I got the following. The red ones are supposed to be weak.

Name	Encryption	Mode
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384	256bit
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256	128bit
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	256bit
TLS_RSA_WITH_AES_256_GCM_SHA384	256bit
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384	256bit
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384	256bit
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384	256bit
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384	256bit
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256	128bit
TLS_RSA_WITH_AES_128_GCM_SHA256	128bit
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256	128bit
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256	128bit
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256	128bit
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256	128bit
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384	256bit
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384	256bit
TLS_RSA_WITH_AES_256_CBC_SHA256	256bit
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384	256bit
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384	256bit
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256	256bit
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256	256bit
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA	256bit
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA	256bit
TLS_RSA_WITH_AES_256_CBC_SHA	256bit
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA	256bit
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA	256bit
TLS_DHE_RSA_WITH_AES_256_CBC_SHA	256bit
TLS_DHE_DSS_WITH_AES_256_CBC_SHA	256bit
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256	128bit
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256	128bit
TLS_RSA_WITH_AES_128_CBC_SHA256	128bit
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256	128bit
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256	128bit
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256	128bit
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256	128bit
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA	128bit
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA	128bit
TLS_RSA_WITH_AES_128_CBC_SHA	128bit
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA	128bit
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA	128bit
TLS_DHE_RSA_WITH_AES_128_CBC_SHA	128bit
TLS_DHE_DSS_WITH_AES_128_CBC_SHA	128bit
TLS_EMPTY_RENEGOTIATION_INFO_SCSV	0bit
TLS_DH_anon_WITH_AES_256_GCM_SHA384	256bit	anon
TLS_DH_anon_WITH_AES_128_GCM_SHA256	128bit	anon
TLS_DH_anon_WITH_AES_256_CBC_SHA256	256bit	anon
TLS_ECDH_anon_WITH_AES_256_CBC_SHA	256bit	anon
TLS_DH_anon_WITH_AES_256_CBC_SHA	256bit	anon
TLS_DH_anon_WITH_AES_128_CBC_SHA256	128bit	anon
TLS_ECDH_anon_WITH_AES_128_CBC_SHA	128bit	anon
TLS_DH_anon_WITH_AES_128_CBC_SHA	128bit	anon
SSL_RSA_WITH_DES_CBC_SHA	56bit
SSL_DHE_RSA_WITH_DES_CBC_SHA	56bit
SSL_DHE_DSS_WITH_DES_CBC_SHA	56bit
SSL_DH_anon_WITH_DES_CBC_SHA	56bit	anon
TLS_RSA_WITH_NULL_SHA256	0bit	null
TLS_ECDHE_ECDSA_WITH_NULL_SHA	0bit	null
TLS_ECDHE_RSA_WITH_NULL_SHA	0bit	null
SSL_RSA_WITH_NULL_SHA	0bit	null
TLS_ECDH_ECDSA_WITH_NULL_SHA	0bit	null
TLS_ECDH_RSA_WITH_NULL_SHA	0bit	null
TLS_ECDH_anon_WITH_NULL_SHA	0bit	null
SSL_RSA_WITH_NULL_MD5	0bit	null
TLS_KRB5_WITH_DES_CBC_SHA	56bit
TLS_KRB5_WITH_DES_CBC_MD5	56bit

2nd Denousen: Abe vs. Shueso

2013-03-24T04:50:00+09:00

The 2nd Shogi Denousen has began. This is the first cut-throat match between top-notch professional Shogi players(yes, there are such people) and the best crop of computer Shogi engines, 5 on 5.

Shogi is a distant cousin of Chess. Unlike Chess, you may re-use captured pieces anywhere on the board anytime. It brings quite lot of additional complexities, and even after the defeat of Garry Kasparov in 1997, many considered that (at least top-level) human Shogi players have a great lead on computer Shogi engines.

The situation had changed dramatically when a newcomer Shogi engine called Bonanza, developed by a Japanese chemist Kunihito Hoki, won the 16th World Computer Shogi Championship. Bonanza appeared totally out of the blue —- Hoki incorporated some new ideas developed in the field of computer Chess, and Bonanza beated existing engines with no mercy. Bonanza could even corner some professional Shogi players in 2007. Later Hoki released(but not strictly open-source) the source code of Bonanza, and the standard of computer Shogi has risen considerably since then. Finally, in the 1st Denousen last year, Kunio Yonenaga, long retired but possibly one of the greatest Shogi players in the history, was defeated by Bonkras, a clustered version of Bonanza developed by Eiki Itoh of Fujitsu.

The first match of Denousen this year was held yesterday between Kouru Abe, an 18-year old prodigy from Aomori, and Shueso, which finished in 5th at the 22nd World Computer Shogi Championship. I hoped a close game, but Abe could beat Shueso quite easily. Shueso somehow could not bring its ability into full play, to my great disappointment. Next weekend(Mar. 30), we will see the second match between Shinichi Sato, another young pro, and Ponanza, developed based on Bonanza by Issei Yamamoto of The University of Tokyo.

BTW, Debian already has the package of GPS Shogi, which won the 22nd World Computer Shogi Championship and considered by many the strongest Shogi engine available now (there is also gnushogi in Debian, but gnushogi is quite weak).

You may have fun with

    $ xshogi -fsp gpsshogi

Unfortunately, we don’t have good modern GUI for Shogi yet…

Recipe for Debian Haskell packaging

2013-03-21T06:12:00+09:00

The following is what I usually do when I want to debianize a Haskell stuff from Hackage. This is a personal recipe, by no means official procedure or such. I may be wrong, badly at that.

Check pkg-haskell repository whether your intended package already exists or not. Somebody might work on it already.
Find the webpage of your intended package at HackageDB, then download “Cabal source package”. Untar it. The tarball filename should be changed to fit the Debian source package convention. For example, if the original name is something like foobar-1.0.tar.gz, then it should be haskell-foobar_1.0.orig.tar.gz.
File ITP. reportbug is your friend.
Run cabal-debian in untared dir:
```
$ cabal-debian --debianize --quilt
```
We do have the upstream tarball, so use —quilt. See http://wiki.debian.org/UsingQuilt. It might give you warnings about changelog. debian/changelog doesn’t exist yet, so ignore it.
Now read

http://wiki.debian.org/Haskell/CollabMaint/Processes

and

http://wiki.debian.org/Haskell/CollabMaint/PackageTemplate

carefully. Then do things as they say. These two are short, but well-written instructions.

Edit the generated debian/control appropriately. Do not forget to make your debian/copyright machine-friendly. See http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/.

Test whether your package is flawless and really buildable. Do lintian. Use pbuilder.

$ lintian haskell-foobar_1.0-1_amd64.changes

# pbuilder --build haskell-foobar_1.0-1.dsc

Read http://wiki.debian.org/Haskell/CollabMaint/DarcsBasic.

Darcs is quite easy to use, and you don’t have to be the master of Darcs to merely debianize things anyway. Basically, what I usually do is
```
$ darcs record -a; darcs push --repo=debian
```
Darcs is well-suited to Haskell-related development, but seems you can use Git, too.
Change debian/changelog. “UNRELEASED” in the first line should be “unstable” or “experimental”. Do not forget to close ITP.

Finally, do

$ debuild -tc; debcommit -r; debrelease; darcs push --repo=debian

That’s all folks!

Snow, Baby, Snow

2013-01-14T15:48:00+09:00

{% img http://www.mhatta.org/images/snowytokyo20130114.jpg 320 200 %}

It rarely snows these days in Tokyo. Until now.

Toying with Octopress

2012-10-24T00:45:00+09:00

Well, now you see…

(Note: I gave up Octopress for Pelican/Hugo in 2017)