Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptographic Right Answers

latacora.singles

Post reply on HN
Print view View original

161–170 of 243 posts

Re: Cryptographic Right Answers

#161

Post by evrydayhustling »

tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

This guide is amazing. It's incredibly useful to be offered one happy path that lets non-experts (myself included) get started easily.

BUUUUUT I can't help reading these and being reminded of Vernor Vinge's "Net of a Million Lies", where people looking for shortcuts end up getting traps. We know that state actors have haunted academic and industry efforts to disseminate info and implementations of cryptography, inserting weaknesses -- resulting confusion is part of why we need guides like this.

How do we know when we can trust a "new media" guide like this one? Can non-practitioners adopt tests that inexpensively verify validity of suggestions like these? Is HN (now with "fight me" threads!) state of the art social proof, or are there other ways to incentivize expert review (without exposing those same experts to centralized influence)?

For clarity, I'm explicitly NOT suggesting this guide is a trap -- I sure has heck wouldn't know, but I don't think so and will be using it :) Just getting meta.

Re: Cryptographic Right Answers

#162

Post by Promarged »

cperciva wrote: post #127
tptacek wrote: post #120

Earlier quoted context omitted.

Quick update though: for client-server security, I copy-paste misquoted Colin and just now noticed it (because Colin noticed it for me). The 2015 document correctly says Colin's client-server recommendation is "custom RSA protocol", but when I formatted this document I managed to accidentally make it say the same as his recommendation for "website security". I regret the error (but not the recommendation; don't make…

I regret the error (but not the recommendation; don't make your own custom RSA-based transport protocol). I think this is our largest point of divergence. If the world had sane TLS libraries, I would absolutely say "run TLS with all the backwards compatibility crap turned off" -- but we don't have sane TLS libraries. I am not confident in my ability to turn off all the unwanted "features" of SSL/TLS stacks, and I'm n…

Is there not a recommended replacement library for OpenSSL? I'm thinking of LibreSSL for example that has leaner API but probably not the same amount of resources as OpenSSL.

Re: Cryptographic Right Answers

#163

Post by arkadiyt »

arkadiyt wrote: post #52
tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

Are these going to be published to the cryptopals website as well?

For anyone who finds this comment in the future - I've linked all the Set 8 challenges on this gist: https://gist.github.com/arkadiyt/5b33bed653ce1dc26e1df9c249d...

Re: Cryptographic Right Answers

#164

Post by lmm »

evrydayhustling wrote: post #161
tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

This guide is amazing. It's incredibly useful to be offered one happy path that lets non-experts (myself included) get started easily. BUUUUUT I can't help reading these and being reminded of Vernor Vinge's "Net of a Million Lies", where people looking for shortcuts end up getting traps. We know that state actors have haunted academic and industry efforts to disseminate info and implementations of cryptography, inser…

I don't think HN is good enough. On the (rare) occasions when tptacek does post something wrong, it gets massively upvoted anyway because it's tptacek. (I've even seen posts that boil down to "don't you know who I am?" get upvoted)

No-one is trustworthy enough to outsource the whole industry's security to - not tptacek, not djb, not AWS, and certainly not me. I think the key is to take not just the recipe but also the rationale. Someone who tells you "Don’t use RSA." might as well be working for the NSA. Someone who tells you "RSA has too many knobs. In modern curve systems, like Curve25519, everything is pre-set for security." is at least making a coherent argument that others can criticize - they might still be wrong, but the fact that they're being substantive is a positive step.

Re: Cryptographic Right Answers

#165

Post by technion »

Where might people see the path forward as far as adoption of some of these "right" solutions in the larger side of the enterprise?

In September 2017 I had an executive pay Gartner a lot of money for a report on encryption and the result was I was directed to use Blowfish. This is obviously a ridiculous example but it's nigh impossible to get libsodium past a marketing team because they want to hear the letters "AES".

Re: Cryptographic Right Answers

#166

Post by raesene9 »

Good stuff! One minor nit suggested by someone far smarter than myself is that "it is incorrect to describe the polynomial evaluation MACs like Poly1305 and GHASH as ‘cryptographic CRC’. There _are_ cryptographic CRC-like MACs, but nobody uses them because they're more of a pain than polynomial evaluation."

with https://crypto.stackexchange.com/questions/56448/can-keyed-c... as a reference :)

Re: Cryptographic Right Answers

#167

Post by michaelt »

tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

  happy to answer any questions.
I'm working on some open source hardware, and I'm considering embedding the SSL keys into a cheap hardware crypto element[1]. The element I'm considering [2] only offers ECDH and ECDSA with the NIST P256 curve.

However, this article says "Don’t do ECDH with the NIST curves" and "really, especially avoid conventional DSA and ECDSA".

How bad is it really? I mean, the article's pretty unequivocal, it sounds like using that crypto element isn't a very good idea?

[1] Motivation: Users can completely reprogram application processor without wiping (or being able to extract) the private key. [2] https://www.microchip.com/wwwproducts/en/ATECC508A

Re: Cryptographic Right Answers

#168

Post by Wingwing »

rsync wrote: post #147
jlgaddis wrote: post #114

Earlier quoted context omitted.

Thanks for the pointer to restic. I like and use tarsnap (and have for years) but the lack of choice of backends is a downside. I've been waiting for something I can use to backup my workstation and laptops to a server at home as well as a server I have at $work (ISP). I've tried out all the usual applications but have yet to find something I'm happy with. restic looks like it may fit the bill perfectly.

"I've been waiting for something I can use to backup my workstation and laptops to a server at home as well as a server I have at $work (ISP)." borg[1] has been referred to as "the holy grail of backups"[2] and is supported at rsync.net.[3] The end result is encrypted, zero knowledge remote backups on a ZFS filesystem that you can SSH to. I think everyone here knows all about rsync.net, but here are some examples:[4]…

This isn't zero-knowledge. Please use this opportunity to educate the public instead of muddying the term for the sake of marketing buzzwords.

Re: Cryptographic Right Answers

#169

Post by lvh »

brohee wrote: post #149
lvh wrote: post #72

Earlier quoted context omitted.

The audience for this document is software engineers. It woudl be impossible to write a document that serves every audience. Unless you're also suggesting that you should AES-CMAC a password reset token? And if we're going to go there, why not PMAC? Or OMAC?

OMAC1 and CMAC are the same thing actually.

I didn’t say OMAC1, and you didn’t engage with my point about recommedations.

Re: Cryptographic Right Answers

#170

Post by CiPHPerCoder »

Spooky23 wrote: post #129
CiPHPerCoder wrote: post #109

Earlier quoted context omitted.

If you're stuck with FIPS 140-2, you should probably have someone on your payroll to answer your questions instead of an Internet document given to the broader audience of software developers.

I suppose that’s is one way to look at it. Guidance from experts from a use case perspective is difficult to find, as documentation is always product centric. Additionally, many members of the HN community have exposure they aren’t aware of. If you represent that you “encrypt” data, many organizations consider data that isn’t FIPS unencrypted. A password database compromise of your scrypt protected passwords may be a…

Here's an idea: Wrap securely encrypted data in FIPS certified encryption.

FIPS-140-2: "Use AES"

So: aes_cbc_encrypt(crypto_secretbox(message, nonce, k1), iv, k2)

Post reply on HN