Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Joy of Cryptography

joyofcryptography.com

Post reply on HN
Print view View original

71–80 of 105 posts

Re: The Joy of Cryptography

#71

Post by smus »

__MatrixMan__ wrote: post #65
garmaine wrote: post #31

Earlier quoted context omitted.

I'm not sure why you think that? Basically all of physics, chemistry, and other physical sciences is calculus. Calculus is the mathematics of rates of change, and basically all physical science is the study of change. Discrete math is very important to computer science. But in the rest of the world, calculus (and differential equations) dominate.

Maybe we're having a definition difference. My understanding of the term "discrete math" is that it refers to any math whose characters aren't part of a continuum. Anything to do with numbers besides the reals. Anything to to with finite sets. Anything to do with groups, rings, polynomials, trees, graphs, ordinals, lattices, compass-straightedge-constructions, polygons, knots, categories, sheaves, topological spaces,…

Have you studied math? No mathematician would call algebraic topology discrete math, nor for that matter almost anything else on that list.

Re: The Joy of Cryptography

#72

Post by ZoomZoomZoom »

ASalazarMX wrote: post #69
ZoomZoomZoom wrote: post #59

Again I complain on the irritating habit of non-descriptive naming of files. book.pdf Really? I'm saving the file for a later review and this name will guarantee I either completely lose the file or will spend more time than necessary to locate it. The other option is to rename the file on saving, which is some work which needs to be performed by each user, instead of being done just once on the source. I think this…

Your observation is very valid, that's one of my pet peeves too, but renaming the file before saving it is also very easy. Your observation, while helpful, feels excessively negative.

The only negative adjectives I used were "irritating" and "impolite". The first one is strictly my feelings, and if you don't share them, I can only congratulate you on your self-restrain. The second one is just my opinion, I could explain why I think so, but I don't think it's that big of a deal to waste time on further discussions. Just please, keep file naming in mind if you can. No one will come to any harm if you won't, though, so I guess it's not that important.

On the second thought, one part of my job is preparing products for the final consumption, so this attention to minutiae is probably a professional deformation.

Re: The Joy of Cryptography

#73

Post by tptacek »

marcan_42 wrote: post #46
tptacek wrote: post #40

Earlier quoted context omitted.

No cryptography engineer seriously believes the NIST P-curves are backdoored, and they are in widespread use. Ed25519 is a signing scheme; it isn't a replacement for the RSA in classic TLS --- you'd be thinking of Curve25519, its sibling. The benefit of the 25519s isn't "no magic numbers", it's a structure that makes it easy to implement relatively safely. And all these curves work over prime subfields. This is all 1…

No magic numbers is certainly one of the advantages of curve25519 and its siblings. The NSA already gave us one backdoored elliptic curve algorithm (Dual EC DRBG); there is no reason to trust them with magic numbers. They may be backdoored or they may not be, but every serious cryptography engineer knows there's no good reason for algorithm constants not to be generated according to public criteria if you aren't hidi…

Curves in the Web PKI are overwhelmingly NIST P-curves, which, again, are only deeply mistrusted on message boards, and when needed to get the BADA55 paper accepted.

New designs shouldn't use the P-curves, because it's too easy to implement them vulnerably (for all intents and purposes any random string is a workable Curve25519 point, and that's not the case for the P-curves --- you have to do fussy input validation). But that has nothing to do with conspiracy theories about how the curve was generated.

You don't have to take my word for this; you can just read the Koblitz and Menezes paper, which takes this question on in detail.

So, no, really, none of this is true.

Re: The Joy of Cryptography

#74

Post by tptacek »

rmbyrro wrote: post #57
tptacek wrote: post #40

Earlier quoted context omitted.

No cryptography engineer seriously believes the NIST P-curves are backdoored, and they are in widespread use. Ed25519 is a signing scheme; it isn't a replacement for the RSA in classic TLS --- you'd be thinking of Curve25519, its sibling. The benefit of the 25519s isn't "no magic numbers", it's a structure that makes it easy to implement relatively safely. And all these curves work over prime subfields. This is all 1…

I wouldn't contest that no crypto engineer "seriously believes NIST P-curves are backdoored", but I know some high profile crypto engineers who seriously think and demonstrate how they might be flawed and could have been backdoored since day one. [1] [2] It's almost impossible to prove they were backdoored, but considering the sensitivity of the subject, I understand why many consider this unknown a reason to distrus…

Dan Bernstein wrote a paper everyone refers to as BADA55 which essentially suggests that virtually every curve in common use other than his are potentially backdoored, even if they're derived from fundamental mathematical constants (in fact, demonstrating that possibility is the point of the paper). So I'd be careful about using Bernstein as a load-bearing citation for this argument.

Again: Koblitz and Menezes take up this topic in detail.

Re: The Joy of Cryptography

#75

Post by __MatrixMan__ »

smus wrote: post #71
__MatrixMan__ wrote: post #65

Earlier quoted context omitted.

Maybe we're having a definition difference. My understanding of the term "discrete math" is that it refers to any math whose characters aren't part of a continuum. Anything to do with numbers besides the reals. Anything to to with finite sets. Anything to do with groups, rings, polynomials, trees, graphs, ordinals, lattices, compass-straightedge-constructions, polygons, knots, categories, sheaves, topological spaces,…

Have you studied math? No mathematician would call algebraic topology discrete math, nor for that matter almost anything else on that list.

Yes, I have a degree in it.

I'd have to ask around but I know a few algebraic topologists and I'd bet that if pressed to describe their work as more-continuous or more-discrete they'd first tell you that this is a silly way to classify subfields in math and then they'd says it's probably more on the discrete side since it's all about categorizing topological spaces based on whether they have certain discrete properties:

- separable - countable - metric - compact

Sure the spaces themselves might be continuous, but topology is for telling those spaces apart based on where and how continuity fails. It's a discretization of things formerly suspected to be the the same.

Re: The Joy of Cryptography

#76

Post by Terry_Roll »

bdamm wrote: post #26
Terry_Roll wrote: post #25

I've often thought the use of prime numbers to be the weakness in cryptography. Whilst theory is different in practice due to machine limitations, there are only so many prime numbers a machine can present in a limited timespan restricting the range of primes available to use. With this in mind, and then knowing what a webserver will typically use by simply browsing the website with different encryption algo's disabl…

No. First of all, primes are only used to arrive at a session key, and once you have a session key you're in the land of symmetric algorithms, which provide security by permutations rather than vectoring into prime spaces. The content of a web page does not matter at all in terms of the security being provided. A 404 is just as secure as a valid home page, in terms of cryptography. (Not in terms of application securi…

So in a replay attack all the communication is recorded including the session keys, and whilst primes are infinite dont dispute this, where the theory (human) and the practical (cpu's) differs is the limitations in the machine hardware, in much the same way Spectre and Meltdown exploited the hardware to obtain secrets.

The point about the webserver was using methods to work out what the underlying webserver and version was and potentially the OS, after all not much point trying to decrypt an algo that is not used on the webserver, but metadata is given out by many webservers to suggest what type of webserver it is.

And then there is education, we see people believe many things because this is what's taught to them, we see this cognitive dissonance with religious people but also in "educated" people like some GP's or academics because its their life's work and I'm sure cryptography has consumed many hours of people thinking things through, without much time spent on other areas of weakness like the limitations of a cpu and memory registers.

After all how many crypto experts are fully conversant with the inner workings of a CPU design? If they were conversant with CPU designs would Spectre and Meltdown have been found years earlier?

Admittedly side channel attacks but I did say in my original post "Whilst theory is different in practice due to machine limitations" and this is the thing is the current implementation of cryptography on devices suitable when considering the design of CPU's and devices?

Re: The Joy of Cryptography

#77

Post by tptacek »

upofadown wrote: post #62
garmaine wrote: post #41

Earlier quoted context omitted.

By cryptography being deployed today I meant new protocols. Like if the people who are actually in the position of picking cryptographic primitives, virtually no one reaches for RSA. Sorry if that wasn’t clear.

To be clear, there is no rational reason not to reach for RSA unless you need the smaller keys of elliptic curves or you are afraid of quantum cryptography and have to avoid elliptic curves as well.

This is comically false. But for the weird appeal to quantum computers, it's exactly what a Slashdot commenter would have said about elliptic curves in 1998.

Re: The Joy of Cryptography

#78

Post by garmaine »

upofadown wrote: post #62
garmaine wrote: post #41

Earlier quoted context omitted.

By cryptography being deployed today I meant new protocols. Like if the people who are actually in the position of picking cryptographic primitives, virtually no one reaches for RSA. Sorry if that wasn’t clear.

To be clear, there is no rational reason not to reach for RSA unless you need the smaller keys of elliptic curves or you are afraid of quantum cryptography and have to avoid elliptic curves as well.

There is a massive performance difference—not just size, but computation as well. Especially if you want a constant-time implementation. There is also an order of magnitude more ways to screw up and not do input validation correctly, thereby introducing vulnerabilities. For all these reasons there aren’t really good libraries for RSA outside of TLS implementations, and that’s a lot of baggage to inherit if you are not doing TLS.

Re: The Joy of Cryptography

#79

Post by smus »

__MatrixMan__ wrote: post #75
smus wrote: post #71

Earlier quoted context omitted.

Have you studied math? No mathematician would call algebraic topology discrete math, nor for that matter almost anything else on that list.

Yes, I have a degree in it. I'd have to ask around but I know a few algebraic topologists and I'd bet that if pressed to describe their work as more-continuous or more-discrete they'd first tell you that this is a silly way to classify subfields in math and then they'd says it's probably more on the discrete side since it's all about categorizing topological spaces based on whether they have certain discrete properti…

I mean the notion of compactness is inspired pretty clearly from the continuum. I also have a degree in pure math and disagree strongly with your characterization of topology, which is literally defined up to homeomorphism which is itself defined by it's continuity. Arguably the whole point of topology is characterized by that which is preserved by continuous deformation, which clearly is inspired by more continuous math. I think you are using incredibly strong language and in a misguided way.

Re: The Joy of Cryptography

#80

Post by pkage »

ZoomZoomZoom wrote: post #72
ASalazarMX wrote: post #69

Earlier quoted context omitted.

Your observation is very valid, that's one of my pet peeves too, but renaming the file before saving it is also very easy. Your observation, while helpful, feels excessively negative.

The only negative adjectives I used were "irritating" and "impolite". The first one is strictly my feelings, and if you don't share them, I can only congratulate you on your self-restrain. The second one is just my opinion, I could explain why I think so, but I don't think it's that big of a deal to waste time on further discussions. Just please, keep file naming in mind if you can. No one will come to any harm if yo…

Using negative adjectives is not the only way to be negative.
Post reply on HN