Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Quantum-Safe” Crypto Hacked by 10-Year-Old PC

spectrum.ieee.org

Post reply on HN
Print view View original

111–120 of 187 posts

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#111

Post by Zamicol »

tptacek wrote: post #108
Zamicol wrote: post #104

Earlier quoted context omitted.

Cryptographic agility means to support multiple cryptographic primitives and to not be overly coupled to a single primitive. WireGuard is a great example of a product with cryptographic agility. https://www.wireguard.com/protocol Cryptographic agility says nothing about "version the whole protocol".

No, it's pretty widely recognized that WireGuard is in a sense a repudiation of "agility". You can look at, for instance, the INRIA analysis/proof paper to see how a bunch of disinterested cryptographers describe it: "many new secure channel protocols eschew standardisation in favour of a lean design that uses only modern cryptography and supports minimal cryptographic agility." If you want to say "minimalist agility…

All the works I've read of Schneier have given me the impression of the above definition, "support multiple cryptographic primitives and do not be overly coupled to a single primitive."

Serendipitously, I just tweeted about this 11 days ago: https://twitter.com/CyphrMe/status/1556660870901403648

"The moral is the need for cryptographic agility. It’s not enough to implement a single standard; it’s vital that our systems be able to easily swap in new algorithms when required."

Do you have a link to something that in your mind represents what Schneier is talking about?

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#112

Post by Spooky23 »

michaelt wrote: post #78
tptacek wrote: post #56

Earlier quoted context omitted.

If by "crypto agility" one means "we should research diverse cryptographic primitives and constructions so that we can be ready if something we rely upon breaks", nobody disagrees with that. But that's not what Schneier means. What he says instead is that "it’s vital that our systems be able to easily swap in new algorithms when required". That approach has a virtually unbroken track record of failure. It demands neg…

Doesn't every major cryptosystem have multiple ciphersuites, though? There's things like SSL, SSH and GPG, truecrypt, bitlocker, /etc/passwd, ntpsec - even git is trying to upgrade their hashes from SHA1 to something longer. There are only a handful of exceptions, like TOTP. Isn't it a must-have feature? Or has the feature become less important than it was 25 years ago when those protocols were being designed?

Look at TLS/SSL. TLS 1.2 was out for years until public vulnerabilities forced deprecation of SSL 3 and TLS 1.0.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#114

Post by Spooky23 »

kmeisthax wrote: post #107
RL_Quine wrote: post #28

Earlier quoted context omitted.

It’s pretty unlikely that sha2 will ever broken in a way which actually has a meaningful security impact to bitcoin, especially considering that almost every value in the system is sha2(sha2()) which nullifies a lot of attacks against hashes which need careful control of the input. Some newer tools in the system use a single hash (it’s unclear why a double one was used in the first place), but all the same it remains…

Consensus compatibility is nice, but Bitcoin has a unique problem: those old signatures own coins. Phasing out a signature algorithm means confiscating the coins in question, as the rightful owner will no longer be able to spend them anymore. Leaving them open would just let private actors break wallets to confiscate the coins themselves, with the added bonus that burnt or lost coins could be recovered, effectively i…

Not only that, but bazillions of coins are dead. My 4 bitcoins that were lost to a hard drive failure a decade ago are gone, and “reanimating” them wouldn’t even be theft.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#115

Post by kibwen »

DarkmSparks wrote: post #14
xt00 wrote: post #7

so the cynical view here would be that the backdoor was discovered before the algorithm could get widely deployed?

My super cynical view is that the whole genre of "quantum safe" cryptography is being promoted to try and encourage adoption of weak encryption... Its felt like FUD based on FUD for a while. Not that I really trust traditional encryption that much either. There wouldn't be so much effort going into bridging air gapped systems if even traditional encryption could be trusted... Hate making cynical comments tho, they al…

> My super cynical view is that the whole genre of "quantum safe" cryptography is being promoted to try and encourage adoption of weak encryption

Not a cryptographer, but surely if you're worried about this then you could first encrypt your data using classical algorithms and then encrypt the output of that via the PQC algorithms, to produce a ciphertext that is at least no less safe than the classical encryption alone.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#116

Post by est31 »

tptacek wrote: post #80
michaelt wrote: post #78

Earlier quoted context omitted.

Doesn't every major cryptosystem have multiple ciphersuites, though? There's things like SSL, SSH and GPG, truecrypt, bitlocker, /etc/passwd, ntpsec - even git is trying to upgrade their hashes from SHA1 to something longer. There are only a handful of exceptions, like TOTP. Isn't it a must-have feature? Or has the feature become less important than it was 25 years ago when those protocols were being designed?

Yes, and every one of those major cryptosystems has been a debacle, in large part because of the negotiations imposed by ciphersuites. It is not a must-have feature; it's a feature cryptography engineering best practice is rapidly beginning to recognize as an anti-feature. See WireGuard for an example of the alternative: you version the whole protocol , and if some primitive you depend on has a break, you roll out a…

If you have multiple WireGuard versions, in a migration setting, you also need to do some negotiation at the start, no? Wouldn't that be potentially vulnerable to downgrade attacks as well?

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#117

Post by tptacek »

est31 wrote: post #116
tptacek wrote: post #80

Earlier quoted context omitted.

Yes, and every one of those major cryptosystems has been a debacle, in large part because of the negotiations imposed by ciphersuites. It is not a must-have feature; it's a feature cryptography engineering best practice is rapidly beginning to recognize as an anti-feature. See WireGuard for an example of the alternative: you version the whole protocol , and if some primitive you depend on has a break, you roll out a…

If you have multiple WireGuard versions, in a migration setting, you also need to do some negotiation at the start, no? Wouldn't that be potentially vulnerable to downgrade attacks as well?

No: you simply don't speak the old versions.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#118

Post by tptacek »

Zamicol wrote: post #111
tptacek wrote: post #108

Earlier quoted context omitted.

No, it's pretty widely recognized that WireGuard is in a sense a repudiation of "agility". You can look at, for instance, the INRIA analysis/proof paper to see how a bunch of disinterested cryptographers describe it: "many new secure channel protocols eschew standardisation in favour of a lean design that uses only modern cryptography and supports minimal cryptographic agility." If you want to say "minimalist agility…

All the works I've read of Schneier have given me the impression of the above definition, "support multiple cryptographic primitives and do not be overly coupled to a single primitive." Serendipitously, I just tweeted about this 11 days ago: https://twitter.com/CyphrMe/status/1556660870901403648 "The moral is the need for cryptographic agility. It’s not enough to implement a single standard; it’s vital that our syste…

A modern cryptosystem wouldn't be designed to swap in new algorithms; it would pick a single set of algorithms and constructions, and version the whole system. Which is how WireGuard works: you can't run AES WireGuard, or WireGuard with the standard P-curves.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#119

Post by er4hn »

czbond wrote: post #10

You KNOW they first had to do this in the normal way (large scale, distributed servers)..... and cracked it in like a second. Then for grins, the engineer HAD to say "I wonder if I could do this on my old Mac mini". And it worked. And for embarrassment of the original design, the story, and clickbait... they did it on that old machine

if anyone would have a sense of the number of operations required, you'd hope it was a mathematician.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#120

Post by jabbany »

copperx wrote: post #106
kevincox wrote: post #65

Earlier quoted context omitted.

> especially considering that almost every value in the system is sha2(sha2()) Why does this give a meaningful improvement? Is this just security through obscurity? Presumably if this had significant benifits sha2 would have been defined this way to start with right? Or is it just that other users will be broken before this "double strong" version so that you have more warning? But isn't shaw defined as a number of r…

I'd love a mathematical explanation because my intuition also says it cannot be more secure.

My guess is the grandparent refers to this kind of attack: https://en.wikipedia.org/wiki/Length_extension_attack

Basically, many cryptographic hashes support fixed-length hashes of variable message lengths by breaking the message into blocks, chaining their hashes* and taking the final hash.

The weakness here is if you know the length of a prefix and its hash, you can generate more valid hashes of messages that contain the unknown prefix but with custom suffixes. This is relevant if you use the hash for authentication (i.e. MAC) as it allows producing certain types of custom messages that would also validate.

However, this has largely been a non-issue for a long time now as it takes very little tweaking of the protocol (stuff being authenticated) to make adding suffixes useless. Double hashing is one such mitigation, because the outer hash is now working over a fixed size input, meaning to attack it you'd need to the signed message instead of just appending to it.

*: This approach of chaining hashes of blocks is also used in other contexts that you may be familiar with ;)

Post reply on HN