Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptographic Right Answers

latacora.singles

Post reply on HN
Print view View original

191–200 of 243 posts

Re: Cryptographic Right Answers

#191

Post by lvh »

exabrial wrote: post #189

Can you expand on the DSA/ECDSA problems? One this I greatly dislike is having "only one option" of RSA. In my opinion, it's better to have a variety of secure algorithms available and that are well studied, so if a new attack emerges we're not completely hosed. Also, while I don't believe NIST is a mouthpiece for the NSA, I'm curious why they haven't proposed some alternatives to P-256, given some of the difficultly…

Cryptographer joke: DSA stands for Disastrous Security Apparatus.

A lot of the problems with (EC)DSA are around nonce use. The k in ECDSA has the worst intersection of possible cryptographic randomness requirements: despite the name, it's not just "don't reuse me" (though that's disastrous too), it's also "be unpredictable and secret". An attacker that can reliably predict part of (let alone all of) your k has pretty much won already. The other issue is the failure mode: when this fails, it's not just easy to detect and exploit (well, full-k-reuse is easy at least), the attack also results in the key being entirely compromised. DSA is a no-good footgun. Contrast: EdDSA and friends, the recommendation in this document, is real hard to mess up.

I'm not sure what you mean by "I dislike having the one option of RSA"; this set of recommendations does not tell you to use RSA, it tells you the opposite.

Having multiple options is fine, but having multiple options as a recommendation for people writing cryptosystems is a disaster, and that's what this document is for. We've tried "agility". It was a bad idea. Cryptanalysis isn't hampered much by a set of recommendations. People are studying SIDH and LWE long before either is an everyday cryptosystem.

It takes a long time for NIST to make new recommendations, and I think there's a fair argument to be made that P256 isn't really broken enough to warrant a new spec yet? I mean, you can in fact write secure software that uses P256; if you've used a browser to hit Google today you probably already have.

Re: Cryptographic Right Answers

#192

Post by lvh »

Promarged wrote: post #162
cperciva wrote: post #127

Earlier quoted context omitted.

I regret the error (but not the recommendation; don't make your own custom RSA-based transport protocol). I think this is our largest point of divergence. If the world had sane TLS libraries, I would absolutely say "run TLS with all the backwards compatibility crap turned off" -- but we don't have sane TLS libraries. I am not confident in my ability to turn off all the unwanted "features" of SSL/TLS stacks, and I'm n…

Is there not a recommended replacement library for OpenSSL? I'm thinking of LibreSSL for example that has leaner API but probably not the same amount of resources as OpenSSL.

Go's tls library is fine, but that's not really an OpenSSL replacement. Just use OpenSSL. BoringSSL is fine if you're its audience, but if you are you don't need me to tell you that :) Finally: LibreSSL is the result of a set of circumstances that have changed.

If you're looking for a recommendation: just use OpenSSL and keep it up to date.

Re: Cryptographic Right Answers

#193

Post by lvh »

michaelt wrote: post #167
tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

happy to answer any questions. I'm working on some open source hardware, and I'm considering embedding the SSL keys into a cheap hardware crypto element[1]. The element I'm considering [2] only offers ECDH and ECDSA with the NIST P256 curve. However, this article says "Don’t do ECDH with the NIST curves" and "really, especially avoid conventional DSA and ECDSA". How bad is it really? I mean, the article's pretty uneq…

The reason for the recommendation is this: if you're using $SAFE_RECO, I don't need to think twice if what you're doing is fine.

If you're doing ECDSA or ECDH over P256, it might be fine. It might also be a complete disaster. So, we don't recommend it -- and if you must, you should have someone audit it for you, because you're not in the safe zone anymore.

(Examples of disastrous failures: P256 off-curve attacks, unsafe k choices for ECDSA.)

Re: Cryptographic Right Answers

#194

Post by lvh »

evrydayhustling wrote: post #161
tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

This guide is amazing. It's incredibly useful to be offered one happy path that lets non-experts (myself included) get started easily. BUUUUUT I can't help reading these and being reminded of Vernor Vinge's "Net of a Million Lies", where people looking for shortcuts end up getting traps. We know that state actors have haunted academic and industry efforts to disseminate info and implementations of cryptography, inser…

Surely HN counts as some form of public scrutiny. If all of us are compromised, then yeah, you're fucked. But we've tried not speaking up and telling people to leave it to the pros and we got like a decade of CBC padding oracle bugs so that didn't work out and now we're trying to at least give people a fighting chance to stay on our professional opinion of the straight and narrow.

Disclaimer: I'm a co-editor of the new version of the document and also a principal at Latacora and therefore clearly an NSA stooge ;-)

Re: Cryptographic Right Answers

#195

Post by lvh »

jfindley wrote: post #179
tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

I was slightly surprised to see scrypt so high up the list, given its vulnerability to cache timing side channels. Is this because you think the side channel isn't that important, or that getting the params for argon2 right is complex enough that you're cautious about recommending it more strongly, or is there something else that I'm missing? Apologies if you answered this elsewhere - I had a look and didn't find any…

Any of them are fine. I don't think cache timing side channels or any of the other fun scrypt trivia (like PBKDF2-induced trivial collisions) are how you're gonna get popped.

If you wanna do Argon2id that's fine too :-)

Re: Cryptographic Right Answers

#196

Post by lvh »

JoachimS wrote: post #175
tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

I find the recommendations for HMAC to be somewhat imprecise. Latacora states for symmetric signtures to use "HMAC". But then under "Avoid" for the same category lists HMAC-MD5, HMAC-SHA1. RFC 2014 defines HMAC with different hash functions such as HMAC-MD5 and HMAC-SHA1. All are valid HMACs. There are other versions of HMAC with for example SHA-256, SHA-224, SHA-512/256 etc defined.

That's a good point; as I recall reading it it was supposed to say HMAC-SHA256. But, to be clear: HMAC-MD5 isn't really busted, I just would prefer not to see it in new code.

Re: Cryptographic Right Answers

#197

Post by lvh »

web007 wrote: post #145
tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

Is it problematic that we're moving to a djb crypto monoculture, with 25519 and ChaCha and Poly1305 and even NaCl all as recommendations? Or is he the hero we need to fight bad or weakened crypto? I've loved the CryptoPals series, even just reading the challenges for the more advanced parts while I poke at the easier stuff. Please keep them up, and hopefully I'll get all the way through "Shackling the Masses with Dra…

I don't think there's a problem with djb monoculture, and I geerally agree that the real enemy is "yet another !@#$%! CBC padding oracle attack". It's not like these things haven't been analyzed by third parties.

Re: Cryptographic Right Answers

#198

Post by jfindley »

lvh wrote: post #195
jfindley wrote: post #179

Earlier quoted context omitted.

I was slightly surprised to see scrypt so high up the list, given its vulnerability to cache timing side channels. Is this because you think the side channel isn't that important, or that getting the params for argon2 right is complex enough that you're cautious about recommending it more strongly, or is there something else that I'm missing? Apologies if you answered this elsewhere - I had a look and didn't find any…

Any of them are fine. I don't think cache timing side channels or any of the other fun scrypt trivia (like PBKDF2-induced trivial collisions) are how you're gonna get popped. If you wanna do Argon2id that's fine too :-)

I guess that's fair - thanks. I'd previously stayed away from scrypt as a password hash because of these attacks (although I've used it a bunch as a KDF for other things) - but on reflection I think you're probably right and if this is the worst issue you have you're doing fairly well overall.

Re: Cryptographic Right Answers

#199

Post by lvh »

andrewflnr wrote: post #111
tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

Just how much trouble can you get into with HMAC? I recently ran into some HMAC-based crypto that I thought was pretty sketchy based on the "no custom crypto" principle, but I'm wondering if my concerns were overblown. I haven't found any obvious holes in it, but I'm not an expert so I don't know if that means much.

HMAC will, hell or high water (assuming you're not doing HMAC-CRC32 or whatever :-)) give you a MAC. (It'll do slightly better; unlike, say, GMAC -- but that's a boring detail for now.)

You can shoot yourself in the foot with HMAC but it won't be because of HMAC; for example: if your messages don't contain a nonce or timestamp they might be replayable or something. But that's not an HMAC flaw.

So to answer your question: maybe? You can get in plenty of trouble with HMAC, but it won't be HMAC's fault.

Re: Cryptographic Right Answers

#200

Post by tptacek »

indigochill wrote: post #173
tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

I love Cryptopals almost as much as I love Microcorruption, although I'm not anywhere close to being ready for set 8 yet. Are these challenges going to be available somewhere I can find them months after I've forgotten about this HN thread? Or should I just send the mail once I get to that point?

Yep.
Post reply on HN