Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Quantum-Safe” Crypto Hacked by 10-Year-Old PC

spectrum.ieee.org

Post reply on HN
Print view View original

101–110 of 187 posts

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#101

Post by tptacek »

bawolff wrote: post #92
tptacek wrote: post #56

Earlier quoted context omitted.

If by "crypto agility" one means "we should research diverse cryptographic primitives and constructions so that we can be ready if something we rely upon breaks", nobody disagrees with that. But that's not what Schneier means. What he says instead is that "it’s vital that our systems be able to easily swap in new algorithms when required". That approach has a virtually unbroken track record of failure. It demands neg…

Well i agree generally, if we are talking about these new, basically experimental, post quantum algorithms, i feel like the balance shifts a bit since they are still so new (on the other hand maybe using them is just premature at this point)

The universal answer to this concern is to run a conventional key exchange alongside the PQC key exchange.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#103

Post by stjohnswarts »

DarkmSparks wrote: post #14
xt00 wrote: post #7

so the cynical view here would be that the backdoor was discovered before the algorithm could get widely deployed?

My super cynical view is that the whole genre of "quantum safe" cryptography is being promoted to try and encourage adoption of weak encryption... Its felt like FUD based on FUD for a while. Not that I really trust traditional encryption that much either. There wouldn't be so much effort going into bridging air gapped systems if even traditional encryption could be trusted... Hate making cynical comments tho, they al…

This is a place where Hanlon's razor applies much better than assuming they want weak encryption.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#104

Post by Zamicol »

tptacek wrote: post #80
michaelt wrote: post #78

Earlier quoted context omitted.

Doesn't every major cryptosystem have multiple ciphersuites, though? There's things like SSL, SSH and GPG, truecrypt, bitlocker, /etc/passwd, ntpsec - even git is trying to upgrade their hashes from SHA1 to something longer. There are only a handful of exceptions, like TOTP. Isn't it a must-have feature? Or has the feature become less important than it was 25 years ago when those protocols were being designed?

Yes, and every one of those major cryptosystems has been a debacle, in large part because of the negotiations imposed by ciphersuites. It is not a must-have feature; it's a feature cryptography engineering best practice is rapidly beginning to recognize as an anti-feature. See WireGuard for an example of the alternative: you version the whole protocol , and if some primitive you depend on has a break, you roll out a…

Cryptographic agility means to support multiple cryptographic primitives and to not be overly coupled to a single primitive.

WireGuard is a great example of a product with cryptographic agility. https://www.wireguard.com/protocol

Cryptographic agility says nothing about "version the whole protocol".

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#105

Post by avodonosov »

jasonkimberson wrote: post #96
avodonosov wrote: post #90

I initially read "Hacked by 10-Year-Old", as if a child hacked it.

Me too, lol

Probably it's because of the word "hacked". I mostly saw it used in meaning the [human] activity of designing an approach, rather than executing code. Computers do not hack. (Unless we speack of AI, maybe)

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#106

Post by copperx »

kevincox wrote: post #65
RL_Quine wrote: post #28

Earlier quoted context omitted.

It’s pretty unlikely that sha2 will ever broken in a way which actually has a meaningful security impact to bitcoin, especially considering that almost every value in the system is sha2(sha2()) which nullifies a lot of attacks against hashes which need careful control of the input. Some newer tools in the system use a single hash (it’s unclear why a double one was used in the first place), but all the same it remains…

> especially considering that almost every value in the system is sha2(sha2()) Why does this give a meaningful improvement? Is this just security through obscurity? Presumably if this had significant benifits sha2 would have been defined this way to start with right? Or is it just that other users will be broken before this "double strong" version so that you have more warning? But isn't shaw defined as a number of r…

I'd love a mathematical explanation because my intuition also says it cannot be more secure.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#107

Post by kmeisthax »

RL_Quine wrote: post #28
jabbany wrote: post #27

Earlier quoted context omitted.

Probably both yes and no. As of right now bitcoin depends pretty heavily on SHA256 and with hash functions being quite important cryptography primitives, there's always ongoing work on breaking them (tremendous upside to anyone who can manage to break common ones), so it's pretty feasible that eventually it will be broken. (We've already seen the fall of MD5 and SHA-1 in recent-ish years) However, cryptocurrencies ar…

It’s pretty unlikely that sha2 will ever broken in a way which actually has a meaningful security impact to bitcoin, especially considering that almost every value in the system is sha2(sha2()) which nullifies a lot of attacks against hashes which need careful control of the input. Some newer tools in the system use a single hash (it’s unclear why a double one was used in the first place), but all the same it remains…

Consensus compatibility is nice, but Bitcoin has a unique problem: those old signatures own coins. Phasing out a signature algorithm means confiscating the coins in question, as the rightful owner will no longer be able to spend them anymore. Leaving them open would just let private actors break wallets to confiscate the coins themselves, with the added bonus that burnt or lost coins could be recovered, effectively increasing the supply of coins on the market. And Bitcoin has a lot of early-adopter money supply locked up behind dead hard drives - it would crash the market.

Other systems that use ECDSA don't have this problem because they rely on CAs and central authorities. For things like, say, the TLS PKI; if you miss the flag date to change ciphers you aren't forever locked out of your domain. Your site just goes down until you bother to upgrade your servers and rotate keys.

Is there any known/stated policy as to how to handle phasing out a signature algorithm in Bitcoin?

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#108

Post by tptacek »

Zamicol wrote: post #104
tptacek wrote: post #80

Earlier quoted context omitted.

Yes, and every one of those major cryptosystems has been a debacle, in large part because of the negotiations imposed by ciphersuites. It is not a must-have feature; it's a feature cryptography engineering best practice is rapidly beginning to recognize as an anti-feature. See WireGuard for an example of the alternative: you version the whole protocol , and if some primitive you depend on has a break, you roll out a…

Cryptographic agility means to support multiple cryptographic primitives and to not be overly coupled to a single primitive. WireGuard is a great example of a product with cryptographic agility. https://www.wireguard.com/protocol Cryptographic agility says nothing about "version the whole protocol".

No, it's pretty widely recognized that WireGuard is in a sense a repudiation of "agility". You can look at, for instance, the INRIA analysis/proof paper to see how a bunch of disinterested cryptographers describe it: "many new secure channel protocols eschew standardisation in favour of a lean design that uses only modern cryptography and supports minimal cryptographic agility."

If you want to say "minimalist agility is good and you're just saying maximalist agility is bad", that's fine, we're just bickering about terms. But that's pretty obviously not what Schneier is talking about.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#110

Post by staticassertion »

tptacek wrote: post #13

If you'd like to hear someone who can barely do long division† discuss this vulnerability with one of the leading isogeny cryptographer researchers and the world's most isogeny-enthusiastic cryptography engineer, have I got a podcast for you: https://securitycryptographywhatever.buzzsprout.com/1822302/... There's even a transcript, if you want to read things like: So I watched the, uh, I watched Costello's tutorial,…

Can anyone do long division other than children and those who pursue math academically? Seems impossible to imagine.
Post reply on HN