Meta built large-scale cryptographic monitoring
engineering.fb.com
Meta built large-scale cryptographic monitoring
1–10 of 32 posts
Re: Meta built large-scale cryptographic monitoring
#2> Since there is a limit to how much data a symmetric cryptographic key can protect
Is this regulatory related or self imposed?
Re: Meta built large-scale cryptographic monitoring
#3Scribe[1], Scuba[2], Hive[3], and folly[4]. It's neat for sure, but speaking as an outsider without the resources to learn (much less create!) an entire universe of data infrastructure and SDKs, it feels like I'm in the corner eating dinner at the kids' table.
At any rate, I'm glad somebody out there is doing this stuff.
[1]: https://engineering.fb.com/2019/10/07/core-infra/scribe/
[2]: https://research.facebook.com/publications/scuba-diving-into...
[3]: https://research.facebook.com/publications/hive-a-warehousin...
Re: Meta built large-scale cryptographic monitoring
#4> Since there is a limit to how much data a symmetric cryptographic key can protect Is this regulatory related or self imposed?
Neither: it's because (overgeneralizing) there are bounds on the number of times nonces can be generated under a key without risk of collision, which in AEAD constructions is a devastating event.
Re: Meta built large-scale cryptographic monitoring
#5> Since there is a limit to how much data a symmetric cryptographic key can protect Is this regulatory related or self imposed?
Neither: it's because (overgeneralizing) there are bounds on the number of times nonces can be generated under a key without risk of collision, which in AEAD constructions is a devastating event.
[deleted]
Re: Meta built large-scale cryptographic monitoring
#6[deleted]
Re: Meta built large-scale cryptographic monitoring
#7What it's like to be a Facebook engineer in this context:
It's your oncall week, and all of a sudden you get an urgent task that you must resolve in the next few days: Figure out how to replace a crypto algorithm in some component your code depends on or else we tell your manager that you're not playing ball.
Re: Meta built large-scale cryptographic monitoring
#8> Since there is a limit to how much data a symmetric cryptographic key can protect Is this regulatory related or self imposed?
Neither: it's because (overgeneralizing) there are bounds on the number of times nonces can be generated under a key without risk of collision, which in AEAD constructions is a devastating event.
For a given nonce collision, how many blocks or messages can be decrypted?
Re: Meta built large-scale cryptographic monitoring
#9Earlier quoted context omitted.
Neither: it's because (overgeneralizing) there are bounds on the number of times nonces can be generated under a key without risk of collision, which in AEAD constructions is a devastating event.
For a given nonce collision, how many blocks or messages can be decrypted?
For some modes, you can break every message encrypted with that key.
Re: Meta built large-scale cryptographic monitoring
#10What it's like to be a Facebook engineer in this context: It's your oncall week, and all of a sudden you get an urgent task that you must resolve in the next few days: Figure out how to replace a crypto algorithm in some component your code depends on or else we tell your manager that you're not playing ball.
Never worked at facebook, but typically at a large companies, things like this are sent with instructions on how to go about doing that, and most often just making sure your dependencies are updated so next run of automated build/deploy will pick up the change.