Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I implemented my own crypto

loup-vaillant.fr

Post reply on HN
Print view View original

201–210 of 409 posts

Re: How I implemented my own crypto

#201

Post by dankent »

DanBC wrote: post #164
madez wrote: post #152

Earlier quoted context omitted.

You can do crypto as a side-hobby and safely put it into production. Of course, you can also do it wrong, but it is with little work possible to do it correctly. Normally I wouldn't speak against what you said because the critique is only very minor, but I heard this too often. Your warning is too strong. People should try their own crypto and with little care it is not unsafer. Maybe giving a list of do's for that w…

> Of course, you can also do it wrong, but it is with little work possible to do it correctly. GCHQ loves people who think this. Have a look at some of the game console cryptography. These are companies with strong financial incentive to get it right. They're large well funded multinational organisations. They still get it wrong.

Have any studies been done on relative security of crypto algorithms that are either:

a) Well known, well studied but also attractive targets for attackers to study

b) Unknown (aside from the developer) until an attacker encounters a specific piece of encrypted data

It is a common assumption that well-known methods are better (and it is the assumption I work under) but does empirical data on security breaches back that up? There are plenty of examples of security breaches where 'standard' methods were being used. Are there similar examples where people using previously unknown methods have been compromised?

GCHQ and others invest a huge amount of resources in finding vulnerabilities in well known encryption methods. When they find one, everyone who used that method is vulnerable.

I have no doubt that if they really wanted a piece of data that I had encrypted with a homemade method, they would be able to break it.

However, are they going to invest the resources to do that if I am not being specifically targeted? Are they going to invest the resources to crack hundreds of different people's home-made encryption methods? Thousands? Hundreds of thousands?

If am being specifically targeted by something like GCHQ, they will get what they want one way or another.

Re: How I implemented my own crypto

#202

Post by baby »

masklinn wrote: post #96
baby wrote: post #79

Earlier quoted context omitted.

is it doing a sign extension though? If it promotes without adding a bunch of 1s it should be fine.

It's probably the latter part (conversion to "whatever the expression's type ends up being) doing the sign-extension, see moefh's sibling comment with a uint64_t final destination, the int -> uint64_t is sign-extending. I should have quoted the proper part I was replying to ("I don't think you're talking about integer promotion here")

I just checked that myself, it is not the casting to uint64_t since the sign-extension happens even before that. The problem is that the result from the shift is stored in a register, which is probably 64-bit on your machine, and to do that it is sign extended from a signed int to a signed 64-bit value. Wrote more about that here: https://www.cryptologie.net/article/418/integer-promotion-in...

Re: How I implemented my own crypto

#203

Post by dsacco »

madez wrote: post #180
DanBC wrote: post #164

Earlier quoted context omitted.

> Of course, you can also do it wrong, but it is with little work possible to do it correctly. GCHQ loves people who think this. Have a look at some of the game console cryptography. These are companies with strong financial incentive to get it right. They're large well funded multinational organisations. They still get it wrong.

Just look at the major used crypto libraries and their CVE's. Everybody gets it wrong. I consider that a sane and sound assumption. But then you can combine stuff as I've for example written in another comment to roll your own crypto in five minutes, which is not-unsafer. There is cult around "Don't roll your own crypto" that is thought-policing.

It's not thought policing. Would you consider us adamantly telling you not to develop and deploy your own rockets or medical software without significant expertise and third party review to be "thought policing"?

Furthermore, your argument is fallacious. That expert professionals make mistakes does not tell you anything about the likelihood of an amateur to make a mistake. You can't draw any logical conclusion from that statement on its own.

Re: How I implemented my own crypto

#204

Post by dankent »

ZoFreX wrote: post #179
DanBC wrote: post #164

Earlier quoted context omitted.

> Of course, you can also do it wrong, but it is with little work possible to do it correctly. GCHQ loves people who think this. Have a look at some of the game console cryptography. These are companies with strong financial incentive to get it right. They're large well funded multinational organisations. They still get it wrong.

Game companies are a great example because: 1) they invest 6 or 7 figures in this (piracy prevention is big money) 2) they still get it wrong 3) they not only get it wrong, they get in wrong in ways that teenagers still in high school can break, let alone the NSA

Game companies are also a great example of a situation where a large group of people with time on their hands (teenagers still in high school) are motivated to look for vulnerabilities in the method used.

Re: How I implemented my own crypto

#205

Post by oblio »

honestoHeminway wrote: post #113
bandook_raja wrote: post #32

Earlier quoted context omitted.

Rust doesn't even exist on a plethora of platforms which C targets. I have high hopes with D and give or take ~2 years, it'll be able to progress forward in lots of domains. Not sure about other languages.

Any language that needs evangelists is clearly not able to progress on its own merits and archievments.

Perl had evangelists, Ruby (on Rails) had evangelists, C++ had evangelists, Java had evangelists (some would say Java even had apostles and Messiahs...), almost every language has evangelists.

Re: How I implemented my own crypto

#206

Post by dankent »

dsacco wrote: post #197
dankent wrote: post #195

Earlier quoted context omitted.

If a vulnerability is found for the outer encryption method, additional encryption of the inner message by a different method may provide some defence. If that is the goal, though, it would be better to use two well studied encryption methods rather than something homemade.

Right, that observation is correct on the surface. But the reason why that's almost never done is because the goal of a cryptographic algorithm is to contribute enough safety margin on its own. Instead of encrypting twice, it's better to encrypt with a greater number of rounds, or to come up with a superior algorithm. In practice you sacrifice an unreasonable amount of performance double encrypting in a production en…

You find it fantastically unrealistic that a vulnerability could be found for a well known and widely used encryption method?

Re: How I implemented my own crypto

#207

Post by dankent »

dsacco wrote: post #203
madez wrote: post #180

Earlier quoted context omitted.

Just look at the major used crypto libraries and their CVE's. Everybody gets it wrong. I consider that a sane and sound assumption. But then you can combine stuff as I've for example written in another comment to roll your own crypto in five minutes, which is not-unsafer. There is cult around "Don't roll your own crypto" that is thought-policing.

It's not thought policing. Would you consider us adamantly telling you not to develop and deploy your own rockets or medical software without significant expertise and third party review to be "thought policing"? Furthermore, your argument is fallacious. That expert professionals make mistakes does not tell you anything about the likelihood of an amateur to make a mistake. You can't draw any logical conclusion from t…

If you're telling me I can't develop and deploy my own rockets for fun (providing I don't cause risk to others) then yes, that is thought policing.

(btw, I do develop and deploy my own rockets for fun)

Re: How I implemented my own crypto

#208

Post by etatoby »

I have read the article and I still don't understand what was the purpose of such a project.

What's wrong with ZIP or 7-Zip + AES encryption? Or GPG with a GUI? Or any other existing tool that's already stable and multi-platform?

Re: How I implemented my own crypto

#209

Post by arcticbull »

wolco wrote: post #151
mrschwabe wrote: post #108

Earlier quoted context omitted.

Another angle is that a compromised security protocol used by a 100,000 developers is far more fruitful than having to assign a human specialist to crack & reverse engineer 100,000 uniquely thought-out implementations.

This is the point people miss. Same as wordpress vs creating your own blog. The more popular the software the larger the interest and the bigger exploit if successful.

It is less likely, though, and more likely to get fixed everywhere fast.

100,000 easy to crack implementations with obvious errors isn't really more secure than 1 super difficult, super well optimized/secured implementation, is it?

Re: How I implemented my own crypto

#210

Post by hornd »

viraptor wrote: post #72
ktta wrote: post #46

I've always seen 'rolling your own crypto' as not being recommendation against writing your own library, but creating your own primitive. Sure, writing your own library is very difficult, but you have a simpler set of problems, which proper testing, another set of eyes and enough tools will take care of the big problems. Now, implementing your own primitive and recommending to use it is bad . For a primitive to be de…

Even just using crypto primitives is dangerous unless you've got experience. There's an old post from matasano about it https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...

I strongly disagree with this sort of attitude. It scares people away from learning how cryptography works. We should be encouraging everyone to write their own crypto: it's a fantastic learning experience. Just don't use your first go in production.
Post reply on HN