Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I implemented my own crypto

loup-vaillant.fr

Post reply on HN
Print view View original

281–290 of 409 posts

Re: How I implemented my own crypto

#281

Post by baby »

tptacek wrote: post #279
baby wrote: post #246

Earlier quoted context omitted.

> are professional cryptographers and world-renowned experts They were not in the beginning. And implementing crypto helped them get there. That's my point. > Finally: you obviously know that "writing your own crypto" isn't the only way to become good at it. In fact, it's a terrible way to get good at it. The right way to get good at crypto is to learn how to break it. I strongly disagree with you on this, but I'll a…

I would suggest that for each of them, a 10+ year career in academic cryptography, in each case accompanied by significant new research results, is what helped them get there. Implementing a library, not so much. As for your second point: literally everyone can implement cryptography that appears secure to them. It's tautological.

> I would suggest that for each of them, a 10+ year career in academic cryptography, in each case accompanied by significant new research results, is what helped them get there. Implementing a library, not so much.

I believe that what made them exceptional (for most of them) is the combination of theoretical learning and hands-on programming. That's my entire point. I think we can agree to disagree. But that's an opinion I'll probably hold for the next years as this is the direction I want to take as well.

> As for your second point: literally everyone can implement cryptography that appears secure to them. It's tautological.

And the process of putting it out there and looking for ways to make it more secure is how you learn. Proof: he already learned a bunch about Frama-C and other C oddities and documented these via his blogpost. Plus he found a bug in the Argon2 implementation. That's a win.

Re: How I implemented my own crypto

#283

Post by calafrax »

mrschwabe wrote: post #108
rijoja wrote: post #94

Whenever I feel the need for a tin foil hat I start to wonder if there is a FUD campaign powered by the "establishment" to encourage people not to investigate this area of computer science so that security holes will remain unnoticed. But, yes I wouldn't start out on writing a crypto library, then again I wouldn't attempt to build an OS or a 3D stack or even an web server either. All cases where a security breach cou…

Another angle is that a compromised security protocol used by a 100,000 developers is far more fruitful than having to assign a human specialist to crack & reverse engineer 100,000 uniquely thought-out implementations.

exactly. a very shitty unique implementation is much less likely to be hacked than a near bulletproof implementation used by millions with a single flaw.

Re: How I implemented my own crypto

#284

Post by calafrax »

arcticbull wrote: post #209
wolco wrote: post #151

Earlier quoted context omitted.

This is the point people miss. Same as wordpress vs creating your own blog. The more popular the software the larger the interest and the bigger exploit if successful.

It is less likely, though, and more likely to get fixed everywhere fast. 100,000 easy to crack implementations with obvious errors isn't really more secure than 1 super difficult, super well optimized/secured implementation, is it?

> more likely to get fixed everywhere fast openssl bugs were around for a very long time

Re: How I implemented my own crypto

#285

Post by computerex »

dsacco wrote: post #263
computerex wrote: post #253

Earlier quoted context omitted.

> I would happily bet $10,000 that AES will not be broken in the next ten years. What are you talking about: http://cr.yp.to/antiforgery/cachetiming-20050414.pdf You'd lose the bet so hard. Don't take anything for granted. Even the most supposedly secure and widely used primitives should be scrutinized and are subjects to constant attacks.

> What are you talking about: http://cr.yp.to/antiforgery/cachetiming-20050414.pdf Read that paper again. Cache timing attacks (and more generally timing attacks) are a subset of side channel attacks, which are not a break in the fundamental design of a cryptographic algorithm. When Bernstein mentions that he considers it a design flaw, that's a misnomer in the mathematical sense: he means that AES is antagonistic to…

I know this is a side channel attack. I know people have used acoustic analysis to retrieve 4096 bit RSA keys, but the attack outlined in the paper is more feasible in real life situations, and systems do get compromised due to implementation details. AES might not be broken as a whole but that doesn't mean you can't attack specific usages.

AES isn't proven to be secure. I don't know about $10k, but I would not bet my life on any hash function not being broken.

Re: How I implemented my own crypto

#286

Post by idlewords »

pierrebai wrote: post #278
brians wrote: post #273

Earlier quoted context omitted.

Carry propagation is one pixel in the 4K movie that is safe crypto implementation. One reason not to link to trivia and factoids about safe crypto implementation is that it builds a dangerous false sense of competence. There are programs that teach this, but they take years. Nobody who's passed through that is interested in creating an easy scaffolding whose levels are unclear.

I wish the meme that crypto is hard would just die. The reason is that the statements is wrong and is probably encourage exactly what it wants to discourage. Crypto is hard is not factually incorrect. The problem is that it is trivially correct, because programming is always hard. Every algorithm and design is hard to get right. The correct statement, and the one that should be repeated instead is that crypto's stake…

No, crypto is actually hard. One difference from regular programming is that there really are no 'intermediate' errors. Experience shows that getting one small detail wrong is as bad as getting the whole thing wrong.

I can't think of another programming domain where that holds.

Re: How I implemented my own crypto

#287

Post by tptacek »

idlewords wrote: post #286
pierrebai wrote: post #278

Earlier quoted context omitted.

I wish the meme that crypto is hard would just die. The reason is that the statements is wrong and is probably encourage exactly what it wants to discourage. Crypto is hard is not factually incorrect. The problem is that it is trivially correct, because programming is always hard. Every algorithm and design is hard to get right. The correct statement, and the one that should be repeated instead is that crypto's stake…

No, crypto is actually hard. One difference from regular programming is that there really are no 'intermediate' errors. Experience shows that getting one small detail wrong is as bad as getting the whole thing wrong. I can't think of another programming domain where that holds.

Distributed databases.

Medical imaging.

Re: How I implemented my own crypto

#289

Post by tptacek »

baby wrote: post #281
tptacek wrote: post #279

Earlier quoted context omitted.

I would suggest that for each of them, a 10+ year career in academic cryptography, in each case accompanied by significant new research results, is what helped them get there. Implementing a library, not so much. As for your second point: literally everyone can implement cryptography that appears secure to them. It's tautological.

> I would suggest that for each of them, a 10+ year career in academic cryptography, in each case accompanied by significant new research results, is what helped them get there. Implementing a library, not so much. I believe that what made them exceptional (for most of them) is the combination of theoretical learning and hands-on programming. That's my entire point. I think we can agree to disagree. But that's an opi…

Why don't you ask them? Most of these people aren't hard to get ahold of. One of them you even share a Slack with. I would be surprised to learn that any of them believed doing a library implementation of pre-existing crypto constructions was an important part of their education, but I like to be surprised.

Re: How I implemented my own crypto

#290

Post by shallot_router »

Piskvorrr wrote: post #121
msl09 wrote: post #104

Earlier quoted context omitted.

Hey, like you I decided to dive into cryptography coming from a different background. Although this quote is not directly related to your problem it can be safely applied to it: "Almost certainly you will get the urge to invent new cryptographic algorithms, and will believe that they are unbreakable. Don't resist the urge; this is one of the fun parts. But resist the belief; almost certainly your creations will be br…

Note that the author is not inventing crypto algorithms, rather implementing them (although the part about XChaCha20 being a mix of ChaCha20 and XSalsa20 is IMHO dancing on the line). Still a risky business, and tricky to get right, but several orders of magnitude safer than "hey, what if we just XORed everything with a random number? Unbreakable, eh?"

>XChaCha20 being a mix of ChaCha20 and XSalsa20 is IMHO dancing on the line

No pun intended?

Post reply on HN