I couldn’t get www.samkerr.com, since that domain is taken, so I registered myself at www.samuelkerr.com. So, please update your bookmarks as I’ll be updating there from now on!

www.samuelkerr.com

A PUF is a device that when given a “challenge,” will always generate the same “response.” In this way, an authority can give a user a challenge and, based on whether or not he produces the correct response, can determine his identity. Generating responses to challenges is also very fast; much faster than systems using exponents and modulus to prove identities through advanced cryptography. These responses are actually hardwired into the PUF device due to the internal circuitry. Since generating a response takes very little computer power and energy, PUFs are a very viable way for low-power and mobile devices to securely identify themselves.

The idea of a PUF might sound interesting, but wouldn’t it be easy to simply make a copy of a PUF, record several responses, and then impersonate the PUF? A good idea, but PUFs can deal with this easily. You see, Physically Unclonable Functions cannot actually be copied accurately. That is because there is some element of randomness introduced into the PUF so that every PUF gives a different response to the same challenge. The most common way to introduce this randomness is to use manufacturing inconsistencies. For example, you may design the PUF to have 100 nm long wires connecting the internals of the PUF, but if the manufacturing equipment has a tolerance of even 5%, the wire could be 95 nm, 105 nm, or anywhere between those two numbers. Since the tolerance is uncontrollable, two PUFs produced on the same manufacturing line using the same design files will provide very different responses to the same challenges. PUFs are designed to leverage these inconsistencies and amplify them so that even small inconsistencies will cause large differences in the output from all other PUFs.

PUFs are a very cool technology, but as for my first foray into Verilog and FPGA design, they were quite difficult. There are several different designs of PUFs, so first I had to decide which would be the best design to implement. All of them were about the same difficulty, so my group and I decided to implement a ring-oscillator based PUF, as presented by Suh and Devadas of Cornell. At first, it seemed easy enough to implement, but the more I coded and the closer my deadline got, the more difficulty I encountered. Namely, I had big problems with the design software thinking it knew what I wanted and removing large pieces of my code. Normally, it would have been doing me a favor, but in this case I did not want some specific optimizations and it took me forever to notice this was happening. I had some trouble learning and understanding some aspects of Verilog, but this was to be expected, since I hadn’t ever used it prior to this project.

As of now, the PUF device has been successfully implemented and my team has started to integrate it into the rest of our project. I won’t go into the rest of the project here, but when the paper is published (or not), I’ll upload a copy of the final paper, which you can then read for yourself. Or maybe I’ll give a summary in another post.  We’ll see I suppose!

I’d highly recommend reading the AnandTech article since it has a lot better description (and pictures) than I could do, but the one thing that I’m really excited about is the new 32nm Gulftown chips. There supposed to have 6 cores and will come in 2010. Even better, they will drop right into my X58 motherboard after a quick BIOS update. That will save me a lot of money since I won’t have to buy a new motherboard.

Don’t get me wrong, I love my quad-core i7 cpu, but 6 cores is better than 4, right?

This is Xilinix Spartan FPGA, the kind I'm using.

This was my first foray into FPGAs and it drove me crazy getting my tools all set up properly. I thought I’d post some thoughts.

To get started with FPGAs, my research group purchased the Xilinx Spartan-3AN Starter Kit. We chose this kit because the board it comes with has all sorts of useful peripherals, such as USB, RS-232, Ethernet, VGA outputs and an LCD character screen. All these extras will really help to speed up development and make learning a lot easier.

Last spring, I had decided I wanted to give FPGAs a try, so I purchased a book called “FPGA Prototyping by Verilog Examples“. This book is actually really helpful now since it uses the exact same chip that my board comes with. It has tons of sample code and examples, and I think it’s really going to help me learn.

I was really excited when I first got this board, but that’s always when the problems start don’t they? Well, firstly, the software that came with the board (an IDE and Xilinx utilities) was version 9.1, but the current version is 11.1. Ok, I’m sure I won’t be able to really tell a difference anyways since I’m just starting out.

The software only runs on Windows XP and RHEL officially. I recently installed Windows 7 and Arch Linux on my computer, so this might cause problems. Well, it did. The software refused to install properly on Windows 7, so I tried it on Linux. The software installed fine on Linux, but I couldn’t get the drivers to connect tot he chip itself to work. I worked on this problem to no avail for about 10 hours, absolutely drove me crazy! But what good is software if it can’t talk to the board? Not much. As such, I’m now using Windows XP on my Mac through Boot Camp. Turns out when they say Windows XP and RHEL only, they really do mean only.

I can program a little Abel, but I’ve never actually used Verilog before. I’m pretty excited to learn a new language though, especially an HDL (Hardware Description Language) since it’s completely different from what I normally work with.

Maybe you’re asking, what did I do for hello world in a circuit? I did a simple 1 bit comparator! Basically, when 1 of 2 DIP switches is on, an LED is on. If both switches are off, the LED is off. This was actually kind of tricky to do since I had to find the correct pin numbers of the FPGA to communicate with. Luckily, there was a really good starter manual available that mapped all the LEDs to their corresponding pins.

I think starting to work with FPGAs will be a really exciting project and probably teach me a lot along the way. Once my research group moves a little farther along, I’ll post some updates about how we’re using the FPGA and how work is progressing.

These rhinos are hot on the trail of some cryptography!

I find the task very interesting, but I quickly got tired of coding even a 10-letter “sentence”. Then I thought to myself, wait, I can program! This specifically seems like something that could quickly be done with a Python script. So I decided to spend a little time typing, and 5 minutes later, no more ciphering by hand! Below are the results for your own amusement!

For my assignment, we were told to use the Beaufort cipher, which is similar to the Vigenere cipher, both of which are several hundred years old. The Beaufort cipher takes some plaintext M and a key K of length t, and then performs the mathematical operation C[i]=(m[i] + k[i mod t]) mod 26 for each letter i of the plaintext. An interesting fact is that this operation will both encrypt and decrypt, making it a reciprocal cipher.

Anyways, here is the Python code that I wrote to perform encryption/decryption:

k = [10,4,24]
t = len(k)

def asint(theChar):
    return ord(theChar)-ord('A')

def asletter(theNum):
    return chr(theNum+ord('A'))

def applyBeaufort(plaintext):
    results = []
    for i in range(len(plaintext)):
        results += [asletter((k[i % t] - asint(plaintext[i])) % 26)]
    return results

That code isn’t bulletproof, obviously, and makes a few assumptions:

• All text will be entered as a capital letter.
• The key will be specified as a list of numbers.

These two points aren’t really that hard to correct, but they’re the 20% of work that will take 80% to do right. I just wanted to give you a quick sample.

Want to see if it works? Alright, here you go!

About to encrypt!
Using plaintext: RANTSRAMBLESANDRHINOS
['T', 'E', 'L', 'R', 'M', 'H', 'K', 'S', 'X', 'Z', 'A', 'G', 'K', 'R', 'V', 'T', 'X', 'Q', 'X', 'Q', 'G']
-------
About to decipher!
['R', 'A', 'N', 'T', 'S', 'R', 'A', 'M', 'B', 'L', 'E', 'S', 'A', 'N', 'D', 'R', 'H', 'I', 'N', 'O', 'S']

That’s all for now, I hope you enjoyed this little tidbit about the Beaufort cipher and maybe even find the code snippet useful!

My new distro of choice

Well, that’s when I discovered the wonderful Arch Linux. I don’t plan on looking back.

What really turned me on to Arch Linux at first was its mission statement, aka The Arch Way.

Arch Linux defines simplicity as a lightweight UNIX-like base structure without unnecessary additions, modifications, or complications, that allows an individual user to shape the system according to their own needs. In short; an elegant, minimalist approach.

I was still a little skeptical though, because I wanted to see how Arch is compared to other distributions. Well, Arch thought about this already. A wiki page is provided comparing and making a case for Arch versuses all the other big and a few small distros. It definately convinced me to at least TRY Arch.

Alright, Arch Linux seems like it won’t provide me with a bunch of features that I don’t want, but does this mean that I’ll have a hard time learning how to use and set it up properly? I consider myself a pretty competent Linux user, but I definately don’t know everything that is needed to set up a whole operating system. Good documentation is invaluable and is key for users to learn how to use your project. On the opposite hand, bad documentation is almost worse than no documentation. Jeff Atwood has a few words on this, which he calls “undocumentation”.

After a quick look around Arch’s website, I found not one, but TWO installation guides for the distribution. There was a beginner guide as well as an official guide, with the former holding your hand through installation and the latter explaining a lot more details but expecting you to know what to do with them. I found it helpful to work through both guides simultaneously, as they were both very complemenetary.

Since Arch wants you to install everything yourself, once you’re done with the basic installation, you are presented with just a command prompt. No Gnome, no KDE, no X. Oh boy, I’ve had bad experiences messing around with X before, so I was a little worried about this step. The fact that I have 2 monitors of different sizes didn’t really make things any better (actually it made it MUCH harder).

Luckily, the install guide covered this topic pretty well. I did have to search forums and the wiki quite a bit since I had a somewhat unique setup with dual monitors and I’d never configured X before. This was definately the hardest step of the installation, but after I got it all set up properly, I have a Gnome installation with no clutter and customized just the way I want.

Another potential problem that I was worried about was how software management would be. Since Arch is a minimalist, I was concerned that managing packages might fall entirely on my shoulders. If this was the case, I don’t think I would have used Arch, since while it gives me more control, I’d much rather just have a package manager handle everything for me automatically. I was very pleased to see that Arch has the pacman package manager. Installing software is as simple as ‘pacman -S package’. The repositories are also current and seem to have a very large selection of software available.

I’m still getting my system setup to my liking, but so far, I’ve liked nearly everything I’ve seen about Arch. This is probably due to the fact that Arch really just provides powerful tools for you to build a Linux system to fit your exact needs. I’d highly recommend it to you if you’re looking for a new distro (or even if you’re not!).

I’m sure you’ve noticed that I haven’t maintained my previous post frequency. My apologies, but this is because school has started, so I have now have classes and homework. Boo, right?

While my posts will most likely occur less frequently, I am in no way ending my blog.

I moved into a new apartment and have had to re-setup my computer and office. While hooking my computer up, “Isn’t it a little hypocritical that I promote Linux, but don’t have it installed on my computer?” Well, the answer is yes, so these past few days, I’ve been hooking up my computer for Linux.

I’m trying to find a new distro other than Ubuntu, since I find it somewhat cliche, even though it’s very good. I ran into some hardware recognition problems with Fedora and now I’m currently using Mint, but I don’t really like the look of it.

I expect that I’ll spend some time browsing distrowatch.com to find a cool new distribution to use; I’ll let you know what I find!

I’m taking compilers, cryptography, and differential equations this semseter, so I expect to post the intersting things I find out in these classes. Stay tuned!

What does this mean? This has to do with public key cryptography, where some secret numbers are chosen, multiplied together, and the results are what are called ‘keys’. Given just these keys, it is theoretically computationally impossible to find the original secret numbers.

In this way, it is possible to verify someone’s identity and/or encrypt a message using a public key, which you publish publicly. Then to retrieve the information or decrypt the message, you need a special private key, which only one person has.

In this way, for the TI-83+, TI could block any code that wasn’t written and signed by TI. Well, now that the public key has been cracked, anyone can sign their code and make it look like it was written by TI. Now you can write whatever you want and make your calculator think that it is official code, allowing you to do all sorts of fun, non-normal things.

Now I don’t do much (actually any) programming for the calculator, but this is still a really interesting from a mathematical perspective.

If you’re interested, here are the numbers that have been cracked:

6,857,599,914,349,403,977,654,744,967,
172,758,179,904,114,264,612,947,326,
127,169,976,133,296,980,951,450,542,
789,808,884,504,301,075,550,786,464,
802,304,019,795,402,754,670,660,318,
614,966,266,413,770,127

is the product of

5,174,413,344,875,007,990,519,123,187,
618,500,139,954,995,264,909,695,897,
020,209,972,309,881,454,541

and

1,325,290,319,363,741,258,636,842,042,
448,323,483,211,759,628,292,406,959,
481,461,131,759,210,884,908,747

For a more detailed look at the mathematics of this, take a look here at the July 31st, 2009 entry.

I hope you find this interesting! And if you have a TI-83+, happy hacking!

After thinking about it, pretty bad from a financial point of view, but as for my important data, really not that much.

I feel like most of my important data would be safe, thanks to cloud computing.

Cloud computing is basically putting copies of your data on internet servers run by schools, companies, or individuals you trust. (You SHOULD trust them, but I guess you don’t HAVE to.) You are assuming that they better understand how to manage your data and have more stable computers than you do. Google has a lot better plan for outages and other factors than I do.

Thinking about it most of my data is hosted by:

• Purdue – All my school projects have to work on Solaris, which I don’t have, so I just do all my work remotely with ssh.
• Hosted version control – I have online Git and Mercurial repositories through GitHub and BitBucket which I use for homework and my own projects.
• Google – Gmail is my main source of email.
• Banks and/or credit cards – My bank and credit card company have copies of any data I could want.
• WordPress – This blog you’re reading!

So really, if I lost my computer and all the data on it, I would lose all my games and all the customizations I’ve done on my machine, but critical data would remain in the cloud somewhere. I think this is a pretty cool concept.

However, this introduces all sorts of issues related to trust. For instance, do you trust your cloud hoster to:

• Not close up shop?
• Not use your data inappropriately?
• Not sell your data?
• Not give your data away for free?
• Keep backups in case things go wrong?
• Have enough security so a hacker can’t get to your data?

Keeping online copies of your data in the cloud exposes you to a whole host of potential problems. Imagine if Gmail, Yahoo Mail, and Hotmail all decided to discontinue providing email, sold your emails, or mined your emails for information? I don’t know about you, but I have some pretty sensitive information in my email account that I’d rather not have the whole world and I sure wouldn’t want to get a new email and deal with getting people to use that instead of the old one. I’m pretty sure this would cause a rip in the time-space continuum (That’s right, I went there.)

For Purdue services, I feel pretty confident about keeping my data there since if there’s any downtime, my professors are pretty good about extending deadlines. But other services which I have no face-to-face contact with, I don’t know if one day they might just go rogue and I’d be in some trouble.

But on the other hand, where else am I really going to get these services from? I don’t have the time, skills, or desire to run my own mail server. Banks are always going to have my records. Online version control is by definition not on my computer. It appears to be a real no-win situation. I guess I’ll just have to hope Google isn’t evil, which is even their motto. (Or at least it used to be until April).

Cloud computing makes it possible to worry less about losing your data, but also introduces all sorts of security issues. It seems that Spiderman had a few good words for cloud providers: “With great power, comes great responsibility.”

While I like curling up with just one book and reading straight through it, I’ll often find myself working on reading three, four, or more books at the same time (not the exact same time, but switching between them). That’s about the time when I notice my lack of bookmarks (or maybe just my inability to use them reliably). I’ve lost my place, so I put the book down saying I’ll come back later. Well, Crime and Punishment is still sitting on my dresser two-thirds done, and I’m not about to re-read 500 pages just to refresh myself with the story.

Fed up with losing my place and abandoning books, I’ve decided to use this as a time to learn some web programming and make a dynamic website that will keep track of what books I own and how far along in each one I am. Not only this, but it will have bar graphs! Yay!

The first step of doing this project was deciding what sorts of information to track. For right now, I’m going to track:

• Title
• Author
• Total Page Count
• Current Page

It should be easy to add other information as necessary, such as publisher or date information.

I’d like to display this information in the form of a chart, with each book getting its own row and bar graph progress bar. Since web design isn’t my greatest strength, I enlisted the help of my friends at Stack Overflow and some resources from Google (I can’t find them, but will link if/when I do.) to help me implement bar graphs and to provide a table that looked a lot better than the standard HTML <table> tag.

The strategy that I went with was making the <div>, <li>, and <ul> tags look like <table>, <tr>, and <td> tags, using CSS. This introduced some difficulties though since using <li> means I have to build the table column-by-column, rather than row-by-row. It would have been really easy to build the table row by row since I could just fetch the entire table using PHP mysqli calls, and then for each iteration of the loop, create and fill out a row. Instead, building the table column-by-column meant selecting an element from each book one at a time, printing that element, then moving on to the next element. I’m not sure how good this approach is from a performance perspective, but from an ease to programmer prospective, it was a major pain in the butt.

This is a screenshot of the final result

I’d like to just give you access to all my code, but since it contains sensitive information (i.e. my passwords, ip addresses, and database info), I’ll just post the most interesting parts of the code below.

First things first, here’s the CSS style sheet:

.graph {
 position: relative; /* IE is dumb */
 width: 200px;
 border: 1px solid #B1D632;
 padding: 2px;
}

.graph .bar {
 display: block;
 position: relative;
 background: #B1D632;
 text-align: center;
 color: #333;
 height: 20px;
 line-height: 20px;
 border:2px solid #C9C9C9;
}

.graph .bar span { position: absolute; left: 1em; }

.table
{
 background:#333;
}
.table ul
{
 float:left;
 margin:0;
 padding:0;
 border:1px solid #C9C9C9;
}
.table ul li
{
 list-style:none;
 padding:5px 10px;
}
.table ul li.title
{
 font-weight:bold;
 background:#333;
 color:#fff;
}
.table ul li.even
{
 height:20px;
 background:#fff
}
.table ul li.odd
{
 height:20px;
 background:#FFFFE6
}

.entryForm
{
 float: left;
 padding: 5px;
}

The above code provides the CSS implementation for bar graphs as well the code for making the nice fancy tables.

I’d edit and post the PHP code, but it’s about 250 lines long and I don’t think you want to read all that (if you do, let me know and I’ll send you a copy). Instead, here are copies of the meat of the program without a lot of the extra fluff (error checking and security stuff).

<!-- This is an example of a column in the table -->
<div>
<ul>
	<li>Progress</li>
<?php
 $progress = $mysqli->query("SELECT *** FROM ***");
 $status = "even";
 while($currentProgress = $progress->fetch_array(MYSQLI_NUM))
 {
 echo '
<div>
 <strong style="width: ';
 echo $currentProgress[0]*100;
 echo '%;"></strong></div>
';
 if($status == "even")
 $status = "odd";
 else
 $status = "even";
 }
 mysqli_free_result($progress);
 ?></ul>
</div>
<!-- This is the input section -->
<div>
 <form method="post" action="index.php">
 Title: <input type="text" size="25" maxlength="250" name="title" />

 Author: <input type="text" size="25" maxlength="250" name="author" />

 Page Count: <input type="text" size="25" maxlength="25" name="pagecount" />

 Current Page: <input type="text" size="25" maxlength="25" name="currentpage" />

 <input type="submit" value="Add new book" name="submit" />
 </form></div>
<div>
 <form method="post" action="index.php">
 Book ID: <input type="text" size="25" maxlength="250" name="updateid" />

 New Page Count: <input type="text" size="25" maxlength="250" name="newpagecount" />

 <input type="submit" value="Update Page Count" name="submit" />
 </form></div>

The above two blocks of PHP code are just a small part of the web site (application?), but they are the most interesting parts.

The first part opens the table up, adds a new column, then iterates through each record in the database and plots a progress bar. New columns can easily be added to the table by following a template like that one, and that’s just how I created the other columns.

The second block of code creates all the ways for the user to interact with the database. Don’t worry, there’s some security to properly handle, shall we say, evil input. (Though since I said that, I’m sure someone will destroy it all.)

I was thinking about it, I could talk about my work forever, but I’m sure it’d be much more entertaining for you to just play with it yourself. Well, here it is.

Feel free to add some books, delete some books, update some books, whatever you like really! (No SQL injection though please!)

I had a lot of fun creating this and it was the first thing I made of any value that used a database and I think it turned out better than my last tool. I’m not completely sure (call me out if you disagree), but I think this could be considered a web application. After all, it takes input from the user, stores it, processes it, and gives feedback to the user, just like a desktop application would. And if Jeff Atwood is correct, soon all applications will be web based like this, but that’s a whole separate post  (since I disagree with him).

I think for any project, it’s important to recognize that you’re done, but also how you can and will improve the project. If I decide to work on this some more, I plan to:

• Make the interface prettier.
• Improve the bar graphs. (red at 0% read and green at 100% red)
• Make the input boxes not bounce all around the page.
• Have better input validation. (no current page > pagecount or have either values less than 0)
• Put some more security on it. (right now, anyone can delete your book lists, as I’m sure will happen on my website)
• Possibly add an interface to be able to send SMS messages to the app to update it. (much more convenient).

Now that I have this cool web app to manage my books and how far along I am in them, will I be better able to manage my library? Truthfully, probably not, but that wasn’t the final goal of this project (it should have been though!). I learned a lot and that’s a pretty good outcome. I probably won’t update my book database daily whenever I read, but it will be handy to keep track of books I’ve finished reading or maybe if I know I’m going to be putting a book down for a while. Maybe now is a good time to give Crime and Punishment another try…