Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS explained with carrier pigeons (2018)

baida.dev

Post reply on HN
Print view View original

11–20 of 21 posts

Re: HTTPS explained with carrier pigeons (2018)

#11

Post by Feoj »

nier wrote: post #5

There was a video of someone describing cryptography during a lecture with the example of a secret locked by Alice and sent to Bob. Bob has no way of opening Alice’s lock, so they simply add their lock and send it back to Alice. Then Alice removes her lock and sends the secret back to Bob, who now can remove their own lock and access the secret. What kind of cryptography is that? Does anyone know what lecture that wa…

Not exactly as you describe, but very similar and still a good explanation of simple key exchange is [1]. However I believe (Its a long time since college for me...) Diffie Helman as mentioned elsewhere is a bit more complex [2].

[1] https://www.youtube.com/watch?v=U62S8SchxX4 [2] https://www.youtube.com/watch?v=pa4osob1XOk

Re: HTTPS explained with carrier pigeons (2018)

#12

Post by [deleted] »

nier wrote: post #5

There was a video of someone describing cryptography during a lecture with the example of a secret locked by Alice and sent to Bob. Bob has no way of opening Alice’s lock, so they simply add their lock and send it back to Alice. Then Alice removes her lock and sends the secret back to Bob, who now can remove their own lock and access the secret. What kind of cryptography is that? Does anyone know what lecture that wa…

[deleted]

Re: HTTPS explained with carrier pigeons (2018)

#13

Post by ansc »

nier wrote: post #5

There was a video of someone describing cryptography during a lecture with the example of a secret locked by Alice and sent to Bob. Bob has no way of opening Alice’s lock, so they simply add their lock and send it back to Alice. Then Alice removes her lock and sends the secret back to Bob, who now can remove their own lock and access the secret. What kind of cryptography is that? Does anyone know what lecture that wa…

It's perhaps not exactly what you mean, but the paint example of Diffie-Hellman is pretty neat for coming up with a common secret: https://cdn.comparitech.com/wp-content/uploads/2019/03/diffi...

Re: HTTPS explained with carrier pigeons (2018)

#15

Post by dspillett »

nier wrote: post #5

There was a video of someone describing cryptography during a lecture with the example of a secret locked by Alice and sent to Bob. Bob has no way of opening Alice’s lock, so they simply add their lock and send it back to Alice. Then Alice removes her lock and sends the secret back to Bob, who now can remove their own lock and access the secret. What kind of cryptography is that? Does anyone know what lecture that wa…

> What kind of cryptography is that?

It isn't. That is an example where a physical system that would work[‡] does not when applied to mathematics, given as an example where physical world analogies do not translate to useful mathematical methods. It is used as part of the journey towards understanding remote key exchange and public key cryptography, such lectures usually follow the rough pattern:

1. That two-lock physical method is described, which won't work because there is no mathematical operation that can be applied and removed out of sequence like that which is also both not trivial to break/brute-force and doesn't require a pre-shared value which defeats the objective (if you can arrange to securely share that value then you can use that method to share the original secret).

2. But, what about modulo operations? Goes on to show how rotating through a prime modulus might have the same effect, pushing through to explaining a key exchange scheme like DH (where there are pre-shared parameters, but they do not need to be secret). Both parties end up with the same key without ever transmitting it, and can use that to encode the actual message(s).

3. But, key exchange like that, while effective and sufficiently difficult to crack assuming good parameter choices, relies upon both parties being in current contact or the latency is very high as it takes a few back-and-forths to decide the key that will be used to encode the message. What if I want to send a message to you right now, that you can read as soon as you receive it, without having to wait for you to be online so we can derive a secure key first?

4. Goes on to describe the scheme R, S, & A came up with (as did another group in GCHQ a little earlier, but their work was classified for decades so very few knew about it) using public & private key pairs and clever† application of co-prime numbers and modulo arithmetic, and the birth of public key encryption and signing.

--

[‡] ignoring the round-trip latency, and the need for truly indestructible boxes and locks!

[†] it might not seem so genius now as we've known about it for nearly half a century and other schemes are supplanting it, but it is one of those ideas that are relatively obvious once explained but not at all easy to come up with from scratch

Re: HTTPS explained with carrier pigeons (2018)

#16

Post by kqbx »

nier wrote: post #5

There was a video of someone describing cryptography during a lecture with the example of a secret locked by Alice and sent to Bob. Bob has no way of opening Alice’s lock, so they simply add their lock and send it back to Alice. Then Alice removes her lock and sends the secret back to Bob, who now can remove their own lock and access the secret. What kind of cryptography is that? Does anyone know what lecture that wa…

Sounds like you're describing a three-pass protocol: https://en.wikipedia.org/wiki/Three-pass_protocol

Note that this requires the encryption to be commutative - in the third step Alice has a message in the form e_B(e_A(msg)), where e_B and e_A are Bob's and Alice's encryption functions. Alice must be able to apply her key to obtain e_B(msg), removing the inner encryption. This can be achieved with some modular exponentiation magic.

I don't know of any practical applications of this, probably because it requires both parties to be online at the same time, so they may as well use the simpler Diffie-Hellman key exchange.

Re: HTTPS explained with carrier pigeons (2018)

#17

Post by [deleted] »

dspillett wrote: post #15
nier wrote: post #5

There was a video of someone describing cryptography during a lecture with the example of a secret locked by Alice and sent to Bob. Bob has no way of opening Alice’s lock, so they simply add their lock and send it back to Alice. Then Alice removes her lock and sends the secret back to Bob, who now can remove their own lock and access the secret. What kind of cryptography is that? Does anyone know what lecture that wa…

> What kind of cryptography is that? It isn't. That is an example where a physical system that would work[‡] does not when applied to mathematics, given as an example where physical world analogies do not translate to useful mathematical methods. It is used as part of the journey towards understanding remote key exchange and public key cryptography, such lectures usually follow the rough pattern: 1. That two-lock phy…

[deleted]

Re: HTTPS explained with carrier pigeons (2018)

#18

Post by hansvm »

dspillett wrote: post #15
nier wrote: post #5

There was a video of someone describing cryptography during a lecture with the example of a secret locked by Alice and sent to Bob. Bob has no way of opening Alice’s lock, so they simply add their lock and send it back to Alice. Then Alice removes her lock and sends the secret back to Bob, who now can remove their own lock and access the secret. What kind of cryptography is that? Does anyone know what lecture that wa…

> What kind of cryptography is that? It isn't. That is an example where a physical system that would work[‡] does not when applied to mathematics, given as an example where physical world analogies do not translate to useful mathematical methods. It is used as part of the journey towards understanding remote key exchange and public key cryptography, such lectures usually follow the rough pattern: 1. That two-lock phy…

> 1. That two-lock physical method is described, which won't work because there is no mathematical operation that can be applied and removed out of sequence like that which is also both not trivial to break/brute-force and doesn't require a pre-shared value which defeats the objective (if you can arrange to securely share that value then you can use that method to share the original secret).

That isn't exactly the issue. The key sharing problem is unavailable in both meat-space and math-space and so is irrelevant in context (it applies just as well to the physical locks). With key sharing not a concern, all you need is for your locks and keys to be commutative. That's easy#1 to do securely.

#1 Basically all "secure" cryptography other than a one-time pad is reducible to a "hard" problem, but last I checked those hard problems may have vulnerabilities we haven't discovered. Nobody has proven any of those techniques actually secure. However, that would be a criticism of all modern cryptography, not just commutative locks.

Re: HTTPS explained with carrier pigeons (2018)

#19

Post by jagged-chisel »

tiffanyh wrote: post #10
jagged-chisel wrote: post #8

Earlier quoted context omitted.

GP's description looks more like DH Key Exchange. https://upload.wikimedia.org/wikipedia/commons/thumb/4/4c/Pu...

That exact image is found in the link I shared, with additional detail :)

I sourced it from your link. I disagree that the above commenter is describing "PKI" and is specifically describing "DH Key Exchange" as evidenced by the image linked from the article you referenced.

Re: HTTPS explained with carrier pigeons (2018)

#20

Post by greendude29 »

Neat; but if I were non-technical person, the next question I would ask would be, why can't Mallory just forge Ted's certificate and use that to fool Alice or Bob? In this scenario, Alice or Bob would receive a box which has a certificate which looks very similar to what they remember Ted having.

What would be a good non-technical metaphor for that?

In reality of course, we use trustworthy browsers such as Firefox which (relatively invisibly) enforce certificate validity for us. I'm wondering where that would fit in the metaphor.

Post reply on HN