Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptographic Right Answers

latacora.singles

Post reply on HN
Print view View original

101–110 of 243 posts

Re: Cryptographic Right Answers

#101

Post by marshray »

lvh wrote: post #9
RcouF1uZ4gsC wrote: post #4

>Client-server application security >Percival, 2009: Use OpenSSL. Percival actually recommended not using SSL and shipping the server public key with the client. From http://www.daemonology.net/blog/2009-06-11-cryptographic-rig... >Client-server application security: Distribute the server's public RSA key with the client code, and do not use SSL. What are your thoughts on that approach today.

Just use TLS. To quote a little bit more from that 'cperciva article: > If you're distributing client code which speaks to a server you operate, there is no need to use SSL; instead, you can distribute the server's public RSA key (or its hash) along with the client code, and "bootstrap" the security process that way. I do this in FreeBSD for the FreeBSD Update and Portsnap services, and I also do this in Tarsnap. It'…

> there is no need to use SSL; instead, you can distribute the server's public RSA key (or its hash) along with the client code

Imagine the following scenario:

All the hard negotiations are done and you're about to sign your biggest customer or even sell the entire business for big bux. This is, of course, contingent on a clean 3rd party security review.

The reviewer asks: "How does the system enforce key expiration policies? How do you rotate keys? How do you revoke a key that may have been compromised or recover from known compromise? Which private keys get used on network-facing servers? In what model of HSM do you store the root key?" ... and so on.

Re: Cryptographic Right Answers

#103

Post by zallarak »

Missing

1. Content security policy headers for web

2. "strict" Samesite cookie flags for CSRF and authentication tokens

Difference of opinion

Didn't argon2 win the last password hashing competition?

Re: Cryptographic Right Answers

#104

Post by lvh »

bsder wrote: post #98
tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

Um, how about elaborating on embedded? > you can use STROBE and a sound, modern, authenticated encryption stack entirely out of a single SHA-3-like sponge constructions. Or I can go grab TweetNaCl. Is there any reason to use something else? > Speaking of AKEs, there are, like, 30 different password AKEs you could choose from. Each with it's own specific (often multiple) footguns. I haven't found any good AKE implemen…

I think STROBE is quite a bit smaller than TweetNaCl once deployed, in gates or bytes, both ROM and RAM. More generally, there are lots of off-list recommendations that are still fine. The list doesn’t have AESCBCHMAC anymore but I’m unlikely to tell you Fernet is busted.

We could do an elaborate embedded post but the answers diverge a lot more because constraints are tighter. If you’re doing embedded you need a security person around.

Also I <3 SPAKE2. More than I ought to.

Re: Cryptographic Right Answers

#105

Post by lvh »

piracykills wrote: post #100
lvh wrote: post #99

Earlier quoted context omitted.

This is relevant: > But, seriously: you can throw a dart at a wall to pick one of these. Technically, argon2 and scrypt are materially better than bcrypt, which is much better than PBKDF2. In practice, it mostly matters that you use a real secure password hash, and not as much which one you use. It’s not so much a strict order of preference as it is a preference, any preference, so as to still be recommending things.…

I'm under the impression Argon2 is at least marginally better than scrypt as it has heavily analyzed side channel mitigations and such. Is scrypt better in some other way?

Argon2 and the PHC precipitated a lot of analysis that increased our confidence in scrypt, too. My point is that it doesn’t really matter, so optimize for availability. I like Argon2 for the stamp of approval, but dislike all the confusion around parameter selection and i-vs-d confusion. (I know argon2id exists.)

Re: Cryptographic Right Answers

#106

Post by jwilk »

deathanatos wrote: post #83
justincormack wrote: post #38

Earlier quoted context omitted.

It is getrandom(2) on Linux, similar to getentropy(2) on OpenBSD. It should be in 16.04, it is kernel 3.17+ although it was not added to glibc until recenrtly so you might have to use the syscall directly.

getentropy(2) exists on Linux. I do not know when it was introduced, but my Arch system has it. (I feel as if your comment implies that it is the BSD equivalent to getrandom(2).)

The getentropy() function first appeared in glibc 2.25.

http://man7.org/linux/man-pages/man3/getentropy.3.html

Re: Cryptographic Right Answers

#107

Post by throwaway1619 »

tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

Can you elaborate a bit on the recommendation of KMS (Amazon or Google's key management service)? It seems to me that bringing in a new external service as a dependency, and trusting that external dependency with your encryption keys, adds a risk that isn't necessary or present with NaCL or other well-reviewed cryptography libraries. How can you independently audit the correctness of KMS? What if Google or Amazon becomes evil, or incompetent, or are put under nation-state pressure, etc?

Re: Cryptographic Right Answers

#109

Post by CiPHPerCoder »

Spooky23 wrote: post #93

Any suggestions as far as the “most right” answers for those of us stuck with FIPS 140-2 due to upstream compliance requirements?

If you're stuck with FIPS 140-2, you should probably have someone on your payroll to answer your questions instead of an Internet document given to the broader audience of software developers.
Post reply on HN