Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I implemented my own crypto

loup-vaillant.fr

Post reply on HN
Print view View original

291–300 of 409 posts

Re: How I implemented my own crypto

#291

Post by ivanhoe »

idlewords wrote: post #286
pierrebai wrote: post #278

Earlier quoted context omitted.

I wish the meme that crypto is hard would just die. The reason is that the statements is wrong and is probably encourage exactly what it wants to discourage. Crypto is hard is not factually incorrect. The problem is that it is trivially correct, because programming is always hard. Every algorithm and design is hard to get right. The correct statement, and the one that should be repeated instead is that crypto's stake…

No, crypto is actually hard. One difference from regular programming is that there really are no 'intermediate' errors. Experience shows that getting one small detail wrong is as bad as getting the whole thing wrong. I can't think of another programming domain where that holds.

Ariane 5 rocket crashed in 1996 because of one wrong int conversion, costing Euro Space Agency something like $500 millions... how about that for "one small detail"? :)

Re: How I implemented my own crypto

#292

Post by nix0n »

lisper wrote: post #258
tptacek wrote: post #240

I would like to clarify: The thing that I said was "table stakes" for implementing cryptography was passing the algorithm test vectors , which this author's previous post claimed as a security feature. If you're unfamiliar with the concept, a test vector is a series of strings and intermediate values used to ensure that your (say) OCB3 is the same as everyone else's OCB3. Had he asked, I'd further claim that not havi…

> You just have to know what a carry propagation bug is This is one of the things that drives me nuts about the crypto community. The natural response upon reading, "You just have to know X" if you don't already know is to go search for X. Well, if you go search for "carry propagation bug" you will find lots of examples of carry propagation bugs being found and fixed, but no explanation of what one is. The thing that…

Carry propagation bugs are something that can go wrong in a bignum implementation.

Bignum is what you need when you have one number that you're splitting between multiple variables (because it's a 256-bit number, and you want your library to work on 32-bit PCs, for example).

Carry propagation is if part of your result is too large for one part of your number and needs to overflow into the next part.

Actual carry propagation bug and bugfix available here: https://news.ycombinator.com/item?id=8857363

Re: How I implemented my own crypto

#293

Post by lisper »

Kalium wrote: post #275
lisper wrote: post #258

Earlier quoted context omitted.

> You just have to know what a carry propagation bug is This is one of the things that drives me nuts about the crypto community. The natural response upon reading, "You just have to know X" if you don't already know is to go search for X. Well, if you go search for "carry propagation bug" you will find lots of examples of carry propagation bugs being found and fixed, but no explanation of what one is. The thing that…

Is it possible that you are expecting the cryptography community to be one organized around being newbie-friendly and encouraging to beginners? The crypto community has repeatedly been burned by overeager beginners with false senses of competence making rather nasty mistakes. Consequences can be dire, from destroying companies to getting people killed. On the lighter end, you have things like Decrytocat. In some aren…

> Is it possible that you are expecting the cryptography community to be one organized around being newbie-friendly and encouraging to beginners?

Not at all. I'm not actually expecting anything. All I'm saying is that as a matter of common courtesy (in any field) if you're going to say, "You just have to know X" then you should do at least one of the following:

1. Check that if someone doesn't know X that they can get at least a lead on how to learn about it by searching for X.

2. Provide a pointer for someone who wants to learn about X to follow as a starting point

3. Provide a brief in-line primer on X

If none of those conditions hold then it's not constructive to say, "You just have to know X." What you're really doing in that case is not providing useful information, but rubbing your audience's nose in the fact that they are ignorant and you are not, and worse, that you acquired your knowledge through some privileged channel to which they do not have ready access.

Honestly, what possible reaction could you reasonably expect other than frustration?

Re: How I implemented my own crypto

#294

Post by lisper »

ivanhoe wrote: post #291
idlewords wrote: post #286

Earlier quoted context omitted.

No, crypto is actually hard. One difference from regular programming is that there really are no 'intermediate' errors. Experience shows that getting one small detail wrong is as bad as getting the whole thing wrong. I can't think of another programming domain where that holds.

Ariane 5 rocket crashed in 1996 because of one wrong int conversion, costing Euro Space Agency something like $500 millions... how about that for "one small detail"? :)

Mars Climate Orbiter too (http://www.cnn.com/TECH/space/9909/30/mars.metric.02/)

Re: How I implemented my own crypto

#295

Post by tptacek »

lisper wrote: post #293
Kalium wrote: post #275

Earlier quoted context omitted.

Is it possible that you are expecting the cryptography community to be one organized around being newbie-friendly and encouraging to beginners? The crypto community has repeatedly been burned by overeager beginners with false senses of competence making rather nasty mistakes. Consequences can be dire, from destroying companies to getting people killed. On the lighter end, you have things like Decrytocat. In some aren…

> Is it possible that you are expecting the cryptography community to be one organized around being newbie-friendly and encouraging to beginners? Not at all. I'm not actually expecting anything. All I'm saying is that as a matter of common courtesy (in any field) if you're going to say, "You just have to know X" then you should do at least one of the following: 1. Check that if someone doesn't know X that they can ge…

If someone posted a message on HN about doing DIY appendectomies with Arduino-controlled robots and I pointed out that you need to go to med school to do surgeries, you would not in fact be harping on me for not having explained why.

Re: How I implemented my own crypto

#296

Post by thaumasiotes »

Piskvorrr wrote: post #133
pkolaczk wrote: post #128

Earlier quoted context omitted.

What's wrong with xoring with a stream of random numbers? Isn't it how stream ciphers work? Get a good cryptographic RNG, initialize it properly with a long enough key and you should be fine.

Thank you, that's my point exactly. Nothing wrong with what you wrote - but note the subtle difference between "XORing a stream of random number s " (potentially viable, even unbreakable when using a OTP) and "XORing a random number" (essentially a Caesar cipher, kid-sister encryption).

> note the subtle difference between "XORing a stream of random numbers" (potentially viable, even unbreakable when using a OTP) and "XORing a random number" (essentially a Caesar cipher, kid-sister encryption)

No, that's not a difference. A "stream of numbers" is just one very large number. What you're worrying about is how large the numbers are, not whether there's one or more than one.

Re: How I implemented my own crypto

#297

Post by davidw »

tptacek wrote: post #295
lisper wrote: post #293

Earlier quoted context omitted.

> Is it possible that you are expecting the cryptography community to be one organized around being newbie-friendly and encouraging to beginners? Not at all. I'm not actually expecting anything. All I'm saying is that as a matter of common courtesy (in any field) if you're going to say, "You just have to know X" then you should do at least one of the following: 1. Check that if someone doesn't know X that they can ge…

If someone posted a message on HN about doing DIY appendectomies with Arduino-controlled robots and I pointed out that you need to go to med school to do surgeries, you would not in fact be harping on me for not having explained why.

I think it's perfectly normal to be curious about a field and want to know more without necessarily wanting to charge off and do it yourself.

Re: How I implemented my own crypto

#298

Post by lisper »

brians wrote: post #273
lisper wrote: post #258

Earlier quoted context omitted.

> You just have to know what a carry propagation bug is This is one of the things that drives me nuts about the crypto community. The natural response upon reading, "You just have to know X" if you don't already know is to go search for X. Well, if you go search for "carry propagation bug" you will find lots of examples of carry propagation bugs being found and fixed, but no explanation of what one is. The thing that…

Carry propagation is one pixel in the 4K movie that is safe crypto implementation. One reason not to link to trivia and factoids about safe crypto implementation is that it builds a dangerous false sense of competence. There are programs that teach this, but they take years. Nobody who's passed through that is interested in creating an easy scaffolding whose levels are unclear.

> Carry propagation is one pixel in the 4K movie that is safe crypto implementation

This is exactly the sort of thing I'm talking about. This is semantically equivalent to, "If you don't already know this, then you are too stupid, and my time is too valuable, for me to do anything beyond pointing out that you are stupid and my time is valuable." That may be true, but it's not helpful.

> There are programs that teach this

But you aren't going to tell me what they are or how to go about finding them? Again, this is not helpful.

Re: How I implemented my own crypto

#299

Post by lisper »

nix0n wrote: post #292
lisper wrote: post #258

Earlier quoted context omitted.

> You just have to know what a carry propagation bug is This is one of the things that drives me nuts about the crypto community. The natural response upon reading, "You just have to know X" if you don't already know is to go search for X. Well, if you go search for "carry propagation bug" you will find lots of examples of carry propagation bugs being found and fixed, but no explanation of what one is. The thing that…

Carry propagation bugs are something that can go wrong in a bignum implementation. Bignum is what you need when you have one number that you're splitting between multiple variables (because it's a 256-bit number, and you want your library to work on 32-bit PCs, for example). Carry propagation is if part of your result is too large for one part of your number and needs to overflow into the next part. Actual carry prop…

Thank you for that constructive response!

Re: How I implemented my own crypto

#300

Post by [deleted] »

tptacek wrote: post #236
baby wrote: post #131

Earlier quoted context omitted.

Writing your own crypto is the only way to become good at it, or to understand more about crypto. * DJB wrote NaCl * Frank wrote libsodium / libHydrogen * Brian wrote Ring * Thai Duong and Bleichenbacher wrote Tink * Eric Young wrote OpenSSL * Jason Donenfeld wrote Wireguard * Shoup wrote NTL * Emily Stark, Mike Hamburg and Dan Boneh wrote SJCL * Thomas Pornin wrote 6 SSL libraries and then BearSSL * Adam Langley wro…

This is a deeply misleading list. Daniel Bernstein, Daniel Bleichenbacher, Dan Boneh and Thomas Pornin are professional cryptographers and world-renowned experts. Even I would feel comfortable writing crypto if Bleichenbacher was watching behind my back. Frank "wrote" libsodium, but libsodium is effectively a port of NaCl. Frank had Daniel Bernstein watching behind his back. Eric Young wrote OpenSSL. Look how that tu…

[deleted]
Post reply on HN