Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rolling your own crypto: Everything you need to build AES from scratch

github.com

Post reply on HN
Print view View original

31–40 of 92 posts

Re: Rolling your own crypto: Everything you need to build AES from scratch

#31

Post by dchest »

charlieyu1 wrote: post #27
nullc wrote: post #2

It's much more interesting to implement AES without the table lookups-- as doing so requires constructing a boolean circuit that computes the same result as the tables, more useful too since the table lookups result in security killing side channels. :) The author might be surprised at how often someone's random "learn 2 crypto" ends up in use in production. Kudos for the warnings, though I doubt that actually accomp…

Isn't table lookup constant time?

These are called "cache-timing attacks". In presence of caches, no memory lookup can be guaranteed to be constant time. Any memory lookups that use secret indices are thus not timing-safe, however non-secret indices are OK.

See https://cr.yp.to/antiforgery/cachetiming-20050414.pdf

Here's an implementation that doesn't use tables: https://github.com/openbsd/src/blob/master/sys/crypto/aes.c

Re: Rolling your own crypto: Everything you need to build AES from scratch

#32

Post by Beldin »

stingraycharles wrote: post #20
traceroute66 wrote: post #18

Earlier quoted context omitted.

> It’s absolutely worth it to roll your own crypto if you want to learn from it No. If you want to "learn from it", the first thing you should do is buy a copy of Bruce Schneier's Applied Cryptography . Just reading (and fully understanding !) that book will alone put you in a position where you already know more about cryptography than 90% of other people. If after that you still want to play around with rolling you…

That’s super personal. I am the type of person who learns by doing, much less reading, and I reject not being “allowed” to do it this way. I will of course study the reading material as I go, but “doing while learning” is an absolute necessity for me, as is studying existing codebases. You learn your way, I learn my way, but don’t tell me my way is wrong just because it’s crypto. I honestly think, as a community, we’…

> don’t tell me my way is wrong just because it’s crypto.

The way where people think they learn cryptography by making their own implementation is, indeed, wrong. Cryptography is about ensuring specific requirements in the face of active adversaries.

Self-implemented crypto misses many well-known caveats, causing them to be easily breakable. As such, it is not reasonable to consider them as something that aims learn about ensuring security properties in the face of active adversaries... but then that effort is not actually teaching about crypto, which is exactly that.

This is also the reason that the established wisdom for learning cryptography is to learn to break systems first. Almost everyone can make a cryptographic system they cannot break. For most folks, that means little. For those skilled at breaking crypto, that carries weight.

Re: Rolling your own crypto: Everything you need to build AES from scratch

#33

Post by dchest »

MarekKnapek wrote: post #25

Implementing AES from scratch is easy and fun, just read the spec and implement it 1:1, until ... you encounter GCM mode and its Galois Field "weird" math. Very. Not. Fun.

Here's a (not so fast) implementation of multiplication in GF(2^128) in 32 lines of code! :) http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/crypto/gmac...

Re: Rolling your own crypto: Everything you need to build AES from scratch

#34

Post by zgs »

MarekKnapek wrote: post #25

Implementing AES from scratch is easy and fun, just read the spec and implement it 1:1, until ... you encounter GCM mode and its Galois Field "weird" math. Very. Not. Fun.

Most cryptographic operations are easy to implement. The best part is when you make a mistake, you'll most likely get random nonsense out the end. Floating point code is much more difficult, often you'll get an answer that's almost correct or worse one that's correct most places...

Re: Rolling your own crypto: Everything you need to build AES from scratch

#35

Post by zgs »

charlieyu1 wrote: post #27
nullc wrote: post #2

It's much more interesting to implement AES without the table lookups-- as doing so requires constructing a boolean circuit that computes the same result as the tables, more useful too since the table lookups result in security killing side channels. :) The author might be surprised at how often someone's random "learn 2 crypto" ends up in use in production. Kudos for the warnings, though I doubt that actually accomp…

Isn't table lookup constant time?

No. At least not with modern caching (or very old page boundary crossings).

A constant time implementation has to avoid tables & compute the values directly (and slowly) or take special care to ensure that all of the table is hit/cached on each access.

Re: Rolling your own crypto: Everything you need to build AES from scratch

#36

Post by feanaro »

jonathanstrange wrote: post #16
bramblerose wrote: post #13

Earlier quoted context omitted.

The fundamental problem with cryptography (that doesn't apply as much to other areas) is that it's not a subject you can learn by playing with it. That's a result of the complexity of building a correct solution, the ease of building a solution that _looks_ correct at first glance but isn't, and the extreme adversarial nature of the problem. In most of software a "looks correct at first glance" solution is fine -- th…

You mostly learn cryptography by doing cryptanalysis, and that certainly is a form of playing with ciphers. To be fair, modern cryptanalysis also involves a bit of math and reading some papers. None of this is something that hobby cryptographers can't do. In fact, there is no real difference between "professional" and hobby cryptographers. Many of the professional ones started as hobby cryptographers, and there are p…

The "don't roll your own crypto" is a mantra mostly useful for deciding what to put into production, not as a general ban on even touching the stuff before you become some kind of mythical, long-bearded, tome-possessing wizard.

I thought this was pretty obvious but I guess this important context was not sufficiently disseminated given the prevalence of the latter position.

Re: Rolling your own crypto: Everything you need to build AES from scratch

#37

Post by tialaramex »

stingraycharles wrote: post #14
Mordisquitos wrote: post #6

Earlier quoted context omitted.

> you shouldn't use your (or their) self-made cryptography in production Absolutely, and that was the very first thing I thought when I saw the title. For some reason I've got the "don't roll your own crypto" commandment heavily ingrained into my brain (even though I've never been in any context where I might have tried), together with "don't let the frying pan handle stick out over the edge of the cooker in case a k…

It’s absolutely worth it to roll your own crypto if you want to learn from it. I feel like there is almost a stigma against articles like these because we’ve all been conditioned so much to avoid even thinking about it lol. I did some deep dive into AES and RSA at some point in a distant past, it was a learning experience that to this day allows me to make much better decisions when choosing algorithms.

> It’s absolutely worth it to roll your own crypto if you want to learn from it.

It's essentially a waste of your time. Because of Schneier's Law: "Any person can invent a security system so clever that she or he can't think of how to break it".

The thing that you might learn from, if you put the work in, would be breaking other people's stuff. Ideally you would find something that's actually in use and vulnerable enough that with some time you'll be able to break it, but that's tricky.

So, if you're a programmer try something like "Cryptopals": https://cryptopals.com/

I think Thomas Ptacek is wrong about a bunch of stuff when it comes to security (there's presumably some way to find HN back-and-forth between us if you decide you care about that), but he wasn't wrong about the Cryptopals exercises. By the time you're doing Set 2 exercises this is stuff real people, who were getting paid and thought they knew what they were doing, got wrong.

Re: Rolling your own crypto: Everything you need to build AES from scratch

#38

Post by stingraycharles »

Beldin wrote: post #32
stingraycharles wrote: post #20

Earlier quoted context omitted.

That’s super personal. I am the type of person who learns by doing, much less reading, and I reject not being “allowed” to do it this way. I will of course study the reading material as I go, but “doing while learning” is an absolute necessity for me, as is studying existing codebases. You learn your way, I learn my way, but don’t tell me my way is wrong just because it’s crypto. I honestly think, as a community, we’…

> don’t tell me my way is wrong just because it’s crypto. The way where people think they learn cryptography by making their own implementation is, indeed, wrong. Cryptography is about ensuring specific requirements in the face of active adversaries. Self-implemented crypto misses many well-known caveats, causing them to be easily breakable. As such, it is not reasonable to consider them as something that aims learn…

But you're approaching it from the wrong perspective: the idea isn't to use the crypto you implement yourself, the idea is to gain a better understanding of how the "magic" works. Of course my hand-rolled RSA/AES crypto is breakable, I know that because that's the default assumption.

It's akin to saying, "you're not allowed to build your own smoke detector because it will be unsafe!". Of course I know that, I want to understand the differences between a photoelectric and ionization smoke detector, how they work in practice, because reading some PDF schematics just doesn't cut it for me.

I honestly don't understand the line of reasoning of all this crypto gatekeeping.

Fun fact: while I was doing my crypto deep dive in 2015, my language of choice being Haskell, I found issues in several libraries, specifically around entropy, and even one library with modulo bias [1]. They were acknowledged and addressed. It was a super fun learning exercise, and seeing all these comments how it's supposedly almost illegal to do this misses the point of people exploring and learning in their own ways.

https://github.com/vincenthz/hs-crypto-numbers/commit/bceb54...

Re: Rolling your own crypto: Everything you need to build AES from scratch

#39

Post by recursiveturtle »

Beldin wrote: post #32
stingraycharles wrote: post #20

Earlier quoted context omitted.

That’s super personal. I am the type of person who learns by doing, much less reading, and I reject not being “allowed” to do it this way. I will of course study the reading material as I go, but “doing while learning” is an absolute necessity for me, as is studying existing codebases. You learn your way, I learn my way, but don’t tell me my way is wrong just because it’s crypto. I honestly think, as a community, we’…

> don’t tell me my way is wrong just because it’s crypto. The way where people think they learn cryptography by making their own implementation is, indeed, wrong. Cryptography is about ensuring specific requirements in the face of active adversaries. Self-implemented crypto misses many well-known caveats, causing them to be easily breakable. As such, it is not reasonable to consider them as something that aims learn…

Hear that? Learn from breaking crypto ... just not your own.

On a related note, Beldin here just contributed a new entry into cryptopals: the Gatekeeper hash, but only certain people can see the link.

Re: Rolling your own crypto: Everything you need to build AES from scratch

#40

Post by nigma1337 »

tialaramex wrote: post #37
stingraycharles wrote: post #14

Earlier quoted context omitted.

It’s absolutely worth it to roll your own crypto if you want to learn from it. I feel like there is almost a stigma against articles like these because we’ve all been conditioned so much to avoid even thinking about it lol. I did some deep dive into AES and RSA at some point in a distant past, it was a learning experience that to this day allows me to make much better decisions when choosing algorithms.

> It’s absolutely worth it to roll your own crypto if you want to learn from it. It's essentially a waste of your time. Because of Schneier's Law: "Any person can invent a security system so clever that she or he can't think of how to break it". The thing that you might learn from, if you put the work in, would be breaking other people's stuff. Ideally you would find something that's actually in use and vulnerable en…

When cryptopals is mentioned, i've also gotta mention "Cryptohack": https://cryptohack.org/

That's where i've learnt most of my crypto, although it might be more focussed on the breaking than the making part.

Post reply on HN