Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

keymaterial.net

Post reply on HN
Print view View original

31–40 of 67 posts

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#31

Post by aiaiaiaiaiaiai »

oleganza wrote: post #25
vitalnodo wrote: post #16

Just wondering — has anyone come across a course or resource that explores how cryptographic systems are built up from smaller building blocks? Like, using something like SageMath for algebraic structures, a prover like Lean to verify properties — to get a feel for how things actually fit together. There's something cool about trying to reimplement known standards just to understand them better (with the usual "don’t…

When I learned crypto 5-10 years ago, it turned out that a lot of "building blocks" are mostly hacks. Looking back from 2020s we see that some of the standards that we use for the last 20-30 years can in principle be thrown out of the window (they can't for compatibility reasons, though) and replaced with much cleaner and more universal replacements. If we do not talk about modern exotic stuff (post-quantum crypto, z…

Really nice summary! Thank you.

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#32

Post by James_K »

willvarfar wrote: post #20
thaumasiotes wrote: post #19

Earlier quoted context omitted.

What would that help with? I know KaTeX supposedly lets you copy-and-paste the text, but that won't get you text that is fit for any purpose.

(hopefully modern screen reading software is clever enough to OCR and summarise images as it does text. And if not, then that seems to be something that is now within reach of modern AI and just needs application.)

The image does have LaTeX source as it's alt text, so should be at least somewhat understandable for screen readers.

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#33

Post by [deleted] »

eXpl0it3r wrote: post #27
oleganza wrote: post #25

Earlier quoted context omitted.

When I learned crypto 5-10 years ago, it turned out that a lot of "building blocks" are mostly hacks. Looking back from 2020s we see that some of the standards that we use for the last 20-30 years can in principle be thrown out of the window (they can't for compatibility reasons, though) and replaced with much cleaner and more universal replacements. If we do not talk about modern exotic stuff (post-quantum crypto, z…

I'm absolutely clueless about crypto, isn't there also a trade-off between being mathematically superior and well optimized in software/hardware implementation?

[deleted]

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#34

Post by xyzzyz »

tgma wrote: post #13
bawolff wrote: post #11

Earlier quoted context omitted.

For historical context, TLS only really started to use the eliptic curve version of diffie-helman in the mid 2010s. Prior to that, plain diffie helman was more popular. (E.g. here is a thread from a decade ago complaining about lack of support https://security.stackexchange.com/questions/59459/how-widel... ). ECC also used to have patents which restricted adoption back in the day. There also used to be a lot of consp…

I believe the patent issue was by far the dominant friction for adoption in 2000s. On the NIST curve problem, well, maybe FUD, but evidently, they indeed backdoored the elliptic curve-based random number generator, so I would say some distrust is warranted. Irrespective of the curve issue, ed25519/x25519 is superior and has other nice properties like not catastrophically breaking if you can't generate a unique random…

> like not catastrophically breaking if you can't generate a unique random "k" for ECDSA

How does that work? I thought that this vulnerability was independent of the curve that is used. Ed25519 has a bunch of other nice properties related to resistance to programming errors, but I never heard of this one.

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#35

Post by oleganza »

eXpl0it3r wrote: post #27
oleganza wrote: post #25

Earlier quoted context omitted.

When I learned crypto 5-10 years ago, it turned out that a lot of "building blocks" are mostly hacks. Looking back from 2020s we see that some of the standards that we use for the last 20-30 years can in principle be thrown out of the window (they can't for compatibility reasons, though) and replaced with much cleaner and more universal replacements. If we do not talk about modern exotic stuff (post-quantum crypto, z…

I'm absolutely clueless about crypto, isn't there also a trade-off between being mathematically superior and well optimized in software/hardware implementation?

The tradeoff is not that simple (I wish it was :-).

Usually it goes like that: someone made something useful optimised for a specific use-case with certain time (or competence) constraints, within a total lack of decent alternatives. Then people adopt and use it, it becomes the standard. Then people want to do more things with it, and try to build around that thing, or on top of that thing and Frankenstein monsters get born and also become standard.

If you start from scratch you can do a crypto protocol that is both better designed (causes less UX pain and critical bugs) AND performs better on relevant hardware. Also do not forget that performance is easily solved by hardware: Moore's law and then custom hardware extensions are a thing.

Example: Keccak is so much better from the composition perspective, that when used ubiquitously you'd definitely have ubiquitous hardware support. But if everyone continues to use a mishmash of AES and SHA constructions on the pretext of "Keccak" is not as fast, then we'd never move forward. People would continue building over-complicated protocols, bearing subpar performance and keeping the reputation of dark wizardry inaccessible for mere mortals.

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#38

Post by oleganza »

looofooo0 wrote: post #29
oleganza wrote: post #25

Earlier quoted context omitted.

When I learned crypto 5-10 years ago, it turned out that a lot of "building blocks" are mostly hacks. Looking back from 2020s we see that some of the standards that we use for the last 20-30 years can in principle be thrown out of the window (they can't for compatibility reasons, though) and replaced with much cleaner and more universal replacements. If we do not talk about modern exotic stuff (post-quantum crypto, z…

sha-1 in git was just supposed to catch corruption, it was never intended to be used for security.

That's a valid point. However, modern hardware and crypto algorithms are fast enough that it pays off to have "do it all" protocols, with as little tradeoffs as possible.

Example: Git users do need both corruption protection AND secure authentication. If authentication is not built in, it will have to be built around. Building around is always going to be more costly in the end.

Unfortunately, 20-30 years ago considerations such as "sha1 is shorter + faster" were taken seriously, plus all the crypto that existed back then sucked big time. Remember Snowden scandal in 2013? That, plus Bitcoin and blockchains moving towards mainstream brought about review of TLS, started SHA-3 competition. Many more brains turned to crypto since then and the new era began.

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#39

Post by eXpl0it3r »

oleganza wrote: post #35
eXpl0it3r wrote: post #27

Earlier quoted context omitted.

I'm absolutely clueless about crypto, isn't there also a trade-off between being mathematically superior and well optimized in software/hardware implementation?

The tradeoff is not that simple (I wish it was :-). Usually it goes like that: someone made something useful optimised for a specific use-case with certain time (or competence) constraints, within a total lack of decent alternatives. Then people adopt and use it, it becomes the standard. Then people want to do more things with it, and try to build around that thing, or on top of that thing and Frankenstein monsters g…

> Also do not forget that performance is easily solved by hardware: Moore's law

"Just write slow algorithms, hardware will eventually get faster" doesn't really work when talking about performance implications now. If the hash algorithm used million of times doesn't perform on current user hardware, then the algorithm is simply not a good fit.

> and then custom hardware extensions are a thing.

That's the kind of trade-off I eluded to as well. As a developer of a tool (e.g. git), I'd pick hash algorithms that do have hardware extensions on the most common hardware and not use something, that may eventually get hardware extensions.

I guess developing such protocols right now for the future might still be advisable, but it seems odd to critic software that use well-optimized algorithms and fulfill the requirements.

Re: There Is No Diffie-Hellman but Elliptic Curve Diffie-Hellman

#40

Post by cvwright »

vitalnodo wrote: post #16

Just wondering — has anyone come across a course or resource that explores how cryptographic systems are built up from smaller building blocks? Like, using something like SageMath for algebraic structures, a prover like Lean to verify properties — to get a feel for how things actually fit together. There's something cool about trying to reimplement known standards just to understand them better (with the usual "don’t…

There are no proofs of the hardness of DDH or RSA etc. That’s why they’re called assumptions.

OTOH if you want to win a Turing Award…

Post reply on HN