Earlier quoted context omitted.
Game companies are a great example because: 1) they invest 6 or 7 figures in this (piracy prevention is big money) 2) they still get it wrong 3) they not only get it wrong, they get in wrong in ways that teenagers still in high school can break, let alone the NSA
Game companies are also a great example of a situation where a large group of people with time on their hands (teenagers still in high school) are motivated to look for vulnerabilities in the method used.
How I implemented my own crypto
341–350 of 409 posts
Re: How I implemented my own crypto
#342Earlier quoted context omitted.
I think it's a bit of a stretch to say nobody implemented Argon2 because of the aforementioned rule when it's also been pointed out in this thread the vast number of times that people have rolled their own crypto libraries. That would suggest to me that there are other factors at play with your example. Possibly due to the relatively young age of that specific KDF, or perhaps it's lesser known compared to many of the…
I used Argon2 as an example because it was mentioned in TFA, as the author discovered that the test vectors were wrong because the reference implementation was wrong. That author noted that if someone else had implemented it from scratch they would've noticed this immediately when testing the test vectors.
The point of the rule is to discourage those who don't know what they're doing from compromising live systems. The kinds of people interested in Argon2 are the kind who are already security minded so will understand the point behind the rule and will understand it's fine to ignore that rule if you understand the caveats that rule implies.
The fact Argon2 hadn't been reimplemented can easily be explained for a number of other reasons too.
Most people with even a casual interest in security do understand that point behind the "don't roll your own" rule so I think it's odd to suggest that we are all too literally minded. As evidenced by the fact that a great many people do write their own hobby libraries.
Re: How I implemented my own crypto
#343Earlier quoted context omitted.
I wish the meme that crypto is hard would just die. The reason is that the statements is wrong and is probably encourage exactly what it wants to discourage. Crypto is hard is not factually incorrect. The problem is that it is trivially correct, because programming is always hard. Every algorithm and design is hard to get right. The correct statement, and the one that should be repeated instead is that crypto's stake…
No, crypto is actually hard. One difference from regular programming is that there really are no 'intermediate' errors. Experience shows that getting one small detail wrong is as bad as getting the whole thing wrong. I can't think of another programming domain where that holds.
Static type systems.
Re: How I implemented my own crypto
#344Earlier quoted context omitted.
Sure! Now replace flying planes with building your own planes .
Huh? Did you not read the last sentence? "In fact, the aviation community literally encourages people to build their own airplanes!" https://www.google.com/search?client=safari&rls=en&q=build+y... http://www.kitplanes.com/homebuilders-portal/firsttimebuilde...
If you're telling me that there's a mainstream part of general aviation advocating that random people build planes to take strangers for rides in (or, to complete the analogy to crypto, to give to random strangers to themselves fly), I'm going to push back on that.
Re: How I implemented my own crypto
#345Earlier quoted context omitted.
> We've had to wait till C99 to get stdint.h, clearly portability is kind of an afterthought in C. C provided "at least N bits" guarantees for its integer types since its first standard (for the curious: char at least 8-bit, short at least 16-bit, long at least 32-bit; in C99, long long as least 64-bit). This is the most that you can get if you want absolute portability, because there are architectures out there wher…
Sure but as as said in an other comment in this thread those "at least N bits" guarantees are not very practical. Suppose you want to give a unique id to users of your application. Clearly 16bit is a bit small, you might get more than 65535 users. You'll probably want 32bits to be comfortable (unless you're google or facebook I guess). So what type do you use? On any modern 32 or 64bit computer "unsigned int" would d…
I stand corrected on that point.
> Clearly people were not fine just using the minimum requirements of the standard.
Most of these typedefs are used to interop with some other standard or file format that requires that many bits exactly.
But even then I would argue that there was an overuse of such typedefs in C. I can think of several reasons for that:
First, there's a general lack of awareness that C does in fact provide "at least N bits" guarantee for most of its types. This comes up pretty often in questions on StackOverflow, and apparently there are still enough people surprised by the fact that e.g. long can never be 16-bit.
Partly, I think, it's because of the historical mess with int. Obviously, int is what people use by default, and the fact that it was 16-bit on many popular architectures in the past, and then became 32-bit on their successors, resulted in much broken code. I think that the lesson many took away from this is that all integer types in C are similarly broken, and switched to int32_t (or equivalent typedefs) just to avoid having to think about it.
Partly it's because of 64-bit ints. Standard C didn't have a 64-bit type for a long time. Popular implementations provided it as an extension, but in different ways - long long in most Unix compilers, __int64 in 32-bit DOS and Windows compilers. So if you ever needed 64 bits, you needed a typedef for that. Since most devs work on systems where word sizes are 8/16/32/64, they did the simplest and most obvious thing, and defined something like int64_t (as opposed to int64_least_t) - it just didn't occur to them that something beyond that was needed. And that set a precedent.
Then there was the part where long was made 64-bit in LP64 model, which meant that portable C had no "at least 32 bits, but no longer than it needs to be" type until C99. With the precedent established by int64_t, the logical step was to add int32_t, and int16_t as well for good measure.
And that's how we got where we are today. I would still argue that most of those libraries that use int32_t and similar types don't strictly need it. It's just a combination of historical factors, and also the fact that platforms where such types do exist comprise the vast majority of platforms, and all platforms that people care about. So there's no particular incentive to even think about how you'd write code for something else - why deal with the extra complexity, if you can just wave it off? Can't blame anyone for that.
Re: How I implemented my own crypto
#346Earlier quoted context omitted.
> We've had to wait till C99 to get stdint.h, clearly portability is kind of an afterthought in C. C provided "at least N bits" guarantees for its integer types since its first standard (for the curious: char at least 8-bit, short at least 16-bit, long at least 32-bit; in C99, long long as least 64-bit). This is the most that you can get if you want absolute portability, because there are architectures out there wher…
It's actually int_least32_t and int_fast32_t.
(Ironically, this also shows just how much these types are actually used...)
Re: How I implemented my own crypto
#347Re: How I implemented my own crypto
#348Earlier quoted context omitted.
I agree too! The point I'm trying to make is that even in critical software, where people's lives are in the balance, there can be minor errors that don't bring down the entire edifice. Whereas in crypto code, there seems to be only one kind of error possible.
I see a few kinds of intermediate crypto errors possible. You can weaken the crypto without breaking it, you can leak metadata, you can screw up protocols without compromising the algorithm, etc.. But yes in some sense you're completely right, perhaps just because the aim of a crypto algorithm is so narrow? The number of things you can do right with a pair of encrypt/decrypt functions is so limited that the number of…
By way of example: you could "weaken" an RNG so that where a construction expects a 256 bit nonce, you generate only 255 secure bits. If that construction is ECDSA, there's a good chance you've managed to disclose to attackers your signing private key. You could "weaken" a protocol so that attackers can replace an original plaintext with 16 uniform random bits. If the protocol is using CBC mode, you've allowed attackers to recover whole plaintexts.
There aren't a lot of errors that get routinely made in crypto code that don't have devastating consequences.
Re: How I implemented my own crypto
#349Re: How I implemented my own crypto
#350Earlier quoted context omitted.
Note that the author is not inventing crypto algorithms, rather implementing them (although the part about XChaCha20 being a mix of ChaCha20 and XSalsa20 is IMHO dancing on the line). Still a risky business, and tricky to get right, but several orders of magnitude safer than "hey, what if we just XORed everything with a random number? Unbreakable, eh?"
>XChaCha20 being a mix of ChaCha20 and XSalsa20 is IMHO dancing on the line No pun intended?