Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I implemented my own crypto

loup-vaillant.fr

Post reply on HN
Print view View original

101–110 of 409 posts

Re: How I implemented my own crypto

#101

Post by loup-vaillant »

ewanm89 wrote: post #83
baby wrote: post #41

Earlier quoted context omitted.

There is a difference between rolling your own crypto and rolling your own crypto. There is Monocypher, then there is this company that is trying to do some weird protocol using CRC, DES in CBC mode and MD5. The sentence was targeting the latter case.

No, it is targeting both. I see no mention of how monocypher implementation does anything 5o prevent side channel timing attacks, I haven't looked to see if there is any sensitive memory scrubbing. Of the bugs listed most are performance bugs by someone who doesn't know C very well yet have they done the things actually!my required in a crypto library like attempting to make sure all branches are the same instruction…

> I see no mention of how monocypher implementation does anything 5o prevent side channel timing attacks,

Oh come on, the chosen primitives are all designed for easy immunity against timing attacks. I haven't verified this formally, but I basically ripped off safe designs, and I tried to be careful about avoiding secret dependant branches and indices.

> I haven't looked to see if there is any sensitive memory scrubbing.

There's a whole test suite for that.

Look at the makefile, then select whatever sanitiser it lists (comment/uncomment the relevant CC line at the begining). Then run `./test.sh`. You can also run the relevant executables under Valgrind. Finally, there's a way to run it under the TIS-Interpreter, though that is veeery slow.

> by someone who doesn't know C very well

Could you tell me how you inferred that? That could help me improve.

Re: How I implemented my own crypto

#102

Post by [deleted] »

kbeckmann wrote: post #64
baby wrote: post #27

First let me say that I've followed your work a bit and I'm really impressed with the library. I'm currently planning on rolling my own crypto as well and your library is on my list of the things to look at. One question: > I was shifting a uint8_t, 24 bits to the left. I failed to realise that integer promotion means this unsigned byte would be converted to a signed integer, and overflow if the byte exceeded 127. Th…

I believe this[1] is the patch that fixes this bug. I tried to reproduce the behavior but couldn't succeed. Maybe I was doing something wrong. Would really appreciate it if someone here could show a test case where this matters. [1] https://github.com/LoupVaillant/Monocypher/commit/347189c50c...

[deleted]

Re: How I implemented my own crypto

#103

Post by ithkuil »

KineticLensman wrote: post #24
sigjuice wrote: post #3

Are there other fields where the slogan "don't roll your own XXX unless you are an infallible expert" is applicable?

"Hey y'all, hold my beer and look at this!" There are [1] several non-aviation examples: - Blood transfusion - Steam-powered bicycles - Rotary printing presses - Submarines - Luminescent paint - Hi-speed jet-powered railcars - Ropes /pulleys to help the user get out of bed [1] https://en.wikipedia.org/wiki/List_of_inventors_killed_by_th...

> - Steam-powered bicycles

On a first read I though "yeah, sure, looks quite dangerous indeed", then I read:

Sylvester H. Roper, inventor of the eponymous steam-powered bicycle, died of a heart attack or subsequent crash during a public speed trial in 1896. It is unknown whether the crash caused the heart attack or vice versa.

Re: How I implemented my own crypto

#104

Post by msl09 »

loup-vaillant wrote: post #82
ZoFreX wrote: post #75

I am terrified that I do not consider myself competent enough to write a crypto library, and yet there isn't a single mention - in this article, nor at the time of writing the comments here on Hacker News - of many of the pitfalls I know to avoid when undertaking such an endeavour. There is even a list of "you have to do A, B, C, and that's about it" that is missing some major - well known, even! - items. I know "don…

Could you list the main pitfalls you are thinking about? Also, I may have mentioned some of them in this earlier article: http://loup-vaillant.fr/articles/rolling-your-own-crypto

Hey, like you I decided to dive into cryptography coming from a different background. Although this quote is not directly related to your problem it can be safely applied to it:

"Almost certainly you will get the urge to invent new cryptographic algorithms, and will believe that they are unbreakable. Don't resist the urge; this is one of the fun parts. But resist the belief; almost certainly your creations will be breakable, and almost certainly no one will spend the time breaking them for you. You can break them yourself as you get better."[1]

The problem that Schneier is referring to is that doing a careful analysis (that is required if you want to use your crypto in production) is tedious, time consuming, and requires expertise in the area to know most blank spots of the algorithms (heck a single one is hard enough). That's why he recommends you to be have enough experience breaking many algorithms before you make any serious claim about your the safety of your crypto.

So all in all it's great that you got the interest in the area, there is a lot of work needed in OSS. But be very careful about claiming that your lib is ready for production. What you got is a bunch of volunteers to glance at your code. Few cryptographers (if any) will seriously try to break it.

[1] https://www.schneier.com/crypto-gram/archives/1999/1015.html...

Re: How I implemented my own crypto

#105

Post by ktta »

loup-vaillant wrote: post #98
ktta wrote: post #36

I'm amazed that the reference implementation of Argon2 had a bug. So that means anyone who deployed Argon2 today didn't really use Argon2 (I'm being pedantic), but something else? libsodium also got it wrong, so that brought down my opinion of it being a trusted and well-reviewed library. Now the question is, will they continue to use the same implementation or move to the fixed code?

Maybe the authors will fix the code in subsequent versions of Argon2. Right now, backward compatibility is deemed more important. The effects of this bug are practically negligible anyway. I bet a single bit of additional entropy in a password would compensate that a hundred fold. I'm a bit disappointed however at their not updating the specs. I signalled the bug in January, and the latest version of the appear to ha…

I'm also referring to the orgs who used Argon2 in production. If they move to the fixed version of Argon2 in libsodium, they'll have to make a plan to securely move to the correct implementation by hashing the passwords again. It can be done, but I'm wondering if they'll even bother.

Re: How I implemented my own crypto

#106

Post by jwilk »

kbeckmann wrote: post #64
baby wrote: post #27

First let me say that I've followed your work a bit and I'm really impressed with the library. I'm currently planning on rolling my own crypto as well and your library is on my list of the things to look at. One question: > I was shifting a uint8_t, 24 bits to the left. I failed to realise that integer promotion means this unsigned byte would be converted to a signed integer, and overflow if the byte exceeded 127. Th…

I believe this[1] is the patch that fixes this bug. I tried to reproduce the behavior but couldn't succeed. Maybe I was doing something wrong. Would really appreciate it if someone here could show a test case where this matters. [1] https://github.com/LoupVaillant/Monocypher/commit/347189c50c...

Compile this program with -fsanitize=undefined:

  #include 
  #include 
  
  int main(int argc, char **argv)
  {
  	uint8_t msg[] = { 255 };
  	size_t i = 0;
  	size_t c_index = 255;
  	return msg[i]
You get:

  runtime error: left shift of 255 by 24 places cannot be represented in type 'int'

Re: How I implemented my own crypto

#107

Post by ktta »

viraptor wrote: post #72
ktta wrote: post #46

I've always seen 'rolling your own crypto' as not being recommendation against writing your own library, but creating your own primitive. Sure, writing your own library is very difficult, but you have a simpler set of problems, which proper testing, another set of eyes and enough tools will take care of the big problems. Now, implementing your own primitive and recommending to use it is bad . For a primitive to be de…

Even just using crypto primitives is dangerous unless you've got experience. There's an old post from matasano about it https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...

Every line of code written can be a severe vulnerability, not just code dealing with crypto. In case of crypto, being well-informed is good enough to not mess up those kind of implementations (on a theoretical level). The problems mentioned can be pointed out and verified on paper. But you can't say the same thing for code.

Re: How I implemented my own crypto

#108

Post by mrschwabe »

rijoja wrote: post #94

Whenever I feel the need for a tin foil hat I start to wonder if there is a FUD campaign powered by the "establishment" to encourage people not to investigate this area of computer science so that security holes will remain unnoticed. But, yes I wouldn't start out on writing a crypto library, then again I wouldn't attempt to build an OS or a 3D stack or even an web server either. All cases where a security breach cou…

Another angle is that a compromised security protocol used by a 100,000 developers is far more fruitful than having to assign a human specialist to crack & reverse engineer 100,000 uniquely thought-out implementations.

Re: How I implemented my own crypto

#109

Post by jwl »

ZoFreX wrote: post #87
jwl wrote: post #60

Earlier quoted context omitted.

Yes, but are hackers going after common used libraries to get more vulnerable systems to attack or are they going to spend time on some unknown homebuilt crypto? In some cases, security through obscurity works well in practice.

> In some cases, security through obscurity works well in practice. This is not one of those cases. Absolutely not. I'm moderately competent at finding security bugs in things, but I doubt I could find any in OpenSSL. I am confident I could find some in your average hand-rolled code. The thing is people make the same mistakes. There's a set of well-known mistakes that are very easy to make, especially if you're not v…

You got to consider your most likely risk for attack. Targeted or at random by a botnet? For example, you are most likely more secure in practice by writing your own website than using Wordpress, simply because you are more likely to get hit by a botnet targeting every Wordpress site than someone going directly for you.

Re: How I implemented my own crypto

#110

Post by kpil »

KineticLensman wrote: post #24
sigjuice wrote: post #3

Are there other fields where the slogan "don't roll your own XXX unless you are an infallible expert" is applicable?

"Hey y'all, hold my beer and look at this!" There are [1] several non-aviation examples: - Blood transfusion - Steam-powered bicycles - Rotary printing presses - Submarines - Luminescent paint - Hi-speed jet-powered railcars - Ropes /pulleys to help the user get out of bed [1] https://en.wikipedia.org/wiki/List_of_inventors_killed_by_th...

Best Wikipedia page ever!
Post reply on HN