Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Joy of Cryptography

joyofcryptography.com

Post reply on HN
Print view View original

61–70 of 105 posts

Re: The Joy of Cryptography

#61

Post by unscaled »

rmbyrro wrote: post #57
tptacek wrote: post #40

Earlier quoted context omitted.

No cryptography engineer seriously believes the NIST P-curves are backdoored, and they are in widespread use. Ed25519 is a signing scheme; it isn't a replacement for the RSA in classic TLS --- you'd be thinking of Curve25519, its sibling. The benefit of the 25519s isn't "no magic numbers", it's a structure that makes it easy to implement relatively safely. And all these curves work over prime subfields. This is all 1…

I wouldn't contest that no crypto engineer "seriously believes NIST P-curves are backdoored", but I know some high profile crypto engineers who seriously think and demonstrate how they might be flawed and could have been backdoored since day one. [1] [2] It's almost impossible to prove they were backdoored, but considering the sensitivity of the subject, I understand why many consider this unknown a reason to distrus…

Backdoored or not, the P-curves (or more specifically the standard algorithm we use for them) are hard to use and easy to misuse. djb dedicated an entire page listing all the theoretical issues with the P-curves and other elliptic curves[1], but their main weakness in practice is that they are just too prone to bad implementation and misuse.

The most well-known failure has to be the PS3 jailbreak [2]. Sony just failed to implement their RNG (or alternatively copied their RNG code from xkcd #221), which rendered their ECDSA-based crypto completely worthless.

Another famous case is the long list of JWT/JWE libraries which were vulnerable to invalid curve attacks, again completely destroying the security of their NIST p-curves (when used for encryption) [3].

Really, I don't think nobody should be using NIST P-curves if they have any choice, unless you verified your implementation yourself. And I don't even want to claim to be able to do it.

(I don't think tptacek ever said you should use the NIST curves[4], so there's no controversy there)

[1] https://safecurves.cr.yp.to/

[2] https://www.youtube.com/watch?v=LP1t_pzxKyE

[3] https://auth0.com/blog/critical-vulnerability-in-json-web-en...

[4] https://latacora.micro.blog/2018/04/03/cryptographic-right-a...

Re: The Joy of Cryptography

#62

Post by upofadown »

garmaine wrote: post #41
marcan_42 wrote: post #36

Earlier quoted context omitted.

RSA is still in wide use in both old and new deployments (e.g. it is still the majority of TLS handshakes). Elliptic curves are faster and use smaller keys, but they're also a more fragmented ecosystem; plus, in particular for the older NIST curves, there is the unshakable fear that they're backdoored by the NSA (since they use magic unexplainable numbers, which RSA does not). Thankfully ed25519 gave us an alternativ…

By cryptography being deployed today I meant new protocols. Like if the people who are actually in the position of picking cryptographic primitives, virtually no one reaches for RSA. Sorry if that wasn’t clear.

To be clear, there is no rational reason not to reach for RSA unless you need the smaller keys of elliptic curves or you are afraid of quantum cryptography and have to avoid elliptic curves as well.

Re: The Joy of Cryptography

#63

Post by NikolaNovak »

copperx wrote: post #19
k__ wrote: post #13

Earlier quoted context omitted.

Somehow discrete math was the only math I understood in CS. Calculus, on the other hand, completely eluded me.

How did you graduate with a CS degree?

Not op but for fwiw, in my university you only needed about as much calculus for ComSci as you would learn in IB/AP High school courses with a good prof anyway. Maybe a bit more but it was mostly a repeat.

(I recall one day in 3rd year calculus course realizing "wait a second... I don't need to be here!". I just kept signing up for calculus every year since 11th grade and suddenly realized I don't need, don't want, and don't like the class nor the prof I was in, and that was one pain less I could instill upon myself :)

Re: The Joy of Cryptography

#64

Post by __MatrixMan__ »

WoahNoun wrote: post #56
__MatrixMan__ wrote: post #27

Earlier quoted context omitted.

If the whole of math were represented by the surface of the planet, "discrete math" would be more than half of it. Calculus (i.e. differentiation/integration on the reals) on the other hand, would be a city. Perhaps a very populated city, but just one. It's a shame that match curriculum for non-math-majors is an all-roads-lead-to-calculus affair. I think we scare a lot of potentially talented people away from math wi…

Well this isn't true at all. I'm shocked anyone would upvote this nonsense.

How about we play a game where you make a list of mathematical objects which are continuous, and I make a list of ones that aren't.

I'll start with sets and you can start with the real numbers, and we'll see whose list is longer.

To a certain degree the whole game is nonsense, there's a countable infinity of axioms and a countable infinity of theorems that follow therefrom, so we're never going to get anywhere rigorous with this, but just like it's not unreasonable to say that there are more multiples of 2 than there are of 2000, I think it's fair to say that continuity games on the reals represents a relatively small share when compared to mathematics in general.

Re: The Joy of Cryptography

#65

Post by __MatrixMan__ »

garmaine wrote: post #31
__MatrixMan__ wrote: post #27

Earlier quoted context omitted.

If the whole of math were represented by the surface of the planet, "discrete math" would be more than half of it. Calculus (i.e. differentiation/integration on the reals) on the other hand, would be a city. Perhaps a very populated city, but just one. It's a shame that match curriculum for non-math-majors is an all-roads-lead-to-calculus affair. I think we scare a lot of potentially talented people away from math wi…

I'm not sure why you think that? Basically all of physics, chemistry, and other physical sciences is calculus. Calculus is the mathematics of rates of change, and basically all physical science is the study of change. Discrete math is very important to computer science. But in the rest of the world, calculus (and differential equations) dominate.

Maybe we're having a definition difference. My understanding of the term "discrete math" is that it refers to any math whose characters aren't part of a continuum.

Anything to do with numbers besides the reals. Anything to to with finite sets. Anything to do with groups, rings, polynomials, trees, graphs, ordinals, lattices, compass-straightedge-constructions, polygons, knots, categories, sheaves, topological spaces, vector spaces, and anything to do with oddities like map coloring or plane tiling, and a lot else too.

It's a course in "everything else" for students that are being pigeonholed into a mathematical specialization by the fact that it's been fashionable to use real numbers to describe the world since Newton.

Re: The Joy of Cryptography

#66

Post by __MatrixMan__ »

kevin_thibedeau wrote: post #35
__MatrixMan__ wrote: post #27

Earlier quoted context omitted.

If the whole of math were represented by the surface of the planet, "discrete math" would be more than half of it. Calculus (i.e. differentiation/integration on the reals) on the other hand, would be a city. Perhaps a very populated city, but just one. It's a shame that match curriculum for non-math-majors is an all-roads-lead-to-calculus affair. I think we scare a lot of potentially talented people away from math wi…

All of the advanced technology you use on a daily basis depends on calculus for it to be designed and fabricated.

I didn't say it wasn't useful, just that it's not representative of mathematics as a whole.

Re: The Joy of Cryptography

#67

Post by __MatrixMan__ »

123pie123 wrote: post #49
garmaine wrote: post #31

Earlier quoted context omitted.

I'm not sure why you think that? Basically all of physics, chemistry, and other physical sciences is calculus. Calculus is the mathematics of rates of change, and basically all physical science is the study of change. Discrete math is very important to computer science. But in the rest of the world, calculus (and differential equations) dominate.

Double integration - brings not very nice memories back of my hand aching from writing upto 5 pages of workings out

It was especially bad in quantum mechanics where they made us do it the hard way (using calculus) before showing us the easy way (using noncommutative algebra).

Re: The Joy of Cryptography

#68

Post by smaudet »

copperx wrote: post #19
k__ wrote: post #13

Earlier quoted context omitted.

Somehow discrete math was the only math I understood in CS. Calculus, on the other hand, completely eluded me.

How did you graduate with a CS degree?

As others have mentioned 'calculus' can mean one of five or six classes (I, II, III, advanced, diffyQ, probably more), basic differentiation is not hard, most of calc is some tricks a computer can learn or do better.

At least to my knowledge there is no 'theory of calculus' which allows one to solve generic integrals or differentials, calc is as much an unrelated art to comp sci as learning to play chess will help with accounting.

Re: The Joy of Cryptography

#69

Post by ASalazarMX »

ZoomZoomZoom wrote: post #59

Again I complain on the irritating habit of non-descriptive naming of files. book.pdf Really? I'm saving the file for a later review and this name will guarantee I either completely lose the file or will spend more time than necessary to locate it. The other option is to rename the file on saving, which is some work which needs to be performed by each user, instead of being done just once on the source. I think this…

Your observation is very valid, that's one of my pet peeves too, but renaming the file before saving it is also very easy. Your observation, while helpful, feels excessively negative.

Re: The Joy of Cryptography

#70

Post by bccdee »

slig wrote: post #16
mcpherrinm wrote: post #14

Earlier quoted context omitted.

It depends on the protocol and mode, but it’s usually transmitted in the clear along with the encrypted message.

Thanks! I thought it had to be somehow not transmitted in the clear.

The IV isn't secret, but in CBC mode it does need to be securely random, otherwise you open yourself up to a class of attacks based on IV prediction. In other modes (CTR, for instance) you can use any nonce you like, so long as you're not reusing it.
Post reply on HN