You are dangerously bad at cryptography • Hacker News Board

Re: You are dangerously bad at cryptography

#101

Post by alinajaf » Mon, May 27, 2013, 7:24 PM UTC

tptacek wrote: post #81

dsl wrote: post #78

Earlier quoted context omitted.

http://nacl.cr.yp.to/ NaCl is well implemented cryptographic functions designed to be easy to use and fast. As opposed to something like OpenSSL that gives you nine million options, NaCl just does what is best.

NaCl and Keyczar are both good options. We also tend to recommend that people simply use PGP for data at rest, and TLS for data in motion. Neither are perfect, but both are subjected to intense scrutiny by researchers.

> We also tend to recommend that people simply use PGP for data at rest, and TLS for data in motion

When I complain about bad crypto (in API auth in particular) and my clients really really push for me to give them advice, I repeat this line verbatim.

They hate it because TLS with client-side certs for authentication (where you become the CA) is unfamiliar and has too many moving parts for them. They go and develop their hand-rolled API auth, I proceed to shoot holes in it and come across as a bit of dick (to be fair, I'm not hired as a security consultant, just a regular developer).

I can normally get a few developers on board, but have yet to convince a client to use TLS in this way in production.

Re: You are dangerously bad at cryptography

#102

Post by tptacek » Mon, May 27, 2013, 7:26 PM UTC

davidw wrote: post #93

tptacek wrote: post #67

Earlier quoted context omitted.

The world needs more broken crypto like a dissident strapped to a chair in a concrete cell in South America needs another car battery alligator clipped to their fingers. How about, if the world really needs more cryptography, the people who bring it to us take the time to become just a little bit literate in how crypto is actually attacked, instead of pretending like they understand it just because they were able to…

There's something that strike me as a bit off in what you write. I'm having trouble pinning it down, so here are some vague thoughts: * The world does need more crypto. There's market demand for keeping stuff safe/hidden/whatever. * It is hard to get crypto right. People like the author, and if I'm not mistaken, yourself, keep pounding that point home. Ok, we're convinced... but people still need to do this stuff, an…

The world might need more working crypto. The world doesn't need more broken crypto.

Broken crypto isn't just a step on the path to working crypto; it's an opportunity for people to get hurt.

The bet I'm making right now is that if people get a little bit of crypto literacy, they'll stop being so excited about deploying crypto in their applications. Implementing a bunch of crypto attacks has the effect of making you paranoid about cryptography. If generalist developers have one key problem with cryptography, it's that they're not paranoid about it --- in fact, the opposite: when they write crypto features, the crypto makes them feel safer. That's not how the crypto professionals I know feel about cryptography!

I strongly agree: things like NaCl and Keyczar are a great solution to this problem. Take the knobs away from the developers and just give them something that is likely to work, designed conservatively. Unfortunately, NaCl and Keyczar have nothing resembling the popularity of "I found this RSA implementation in Ruby and now I'm going to build an application with it". How do we fix that? I think part of the solution has to be to convince developers they should be more afraid of DIY crypto.

As for security: you should understand that when we write about it, we're writing about a competition. Attackers vs. defenders. Writing about competitions (or, in some of our cases, actively participating in those competitions) does something to the tone of your writing.

The software security field can be annoyingly competitive and status-oriented, too.

Re: You are dangerously bad at cryptography

#103

Post by [deleted] » Mon, May 27, 2013, 7:26 PM UTC

davidw wrote: post #93

tptacek wrote: post #67

Earlier quoted context omitted.

The world needs more broken crypto like a dissident strapped to a chair in a concrete cell in South America needs another car battery alligator clipped to their fingers. How about, if the world really needs more cryptography, the people who bring it to us take the time to become just a little bit literate in how crypto is actually attacked, instead of pretending like they understand it just because they were able to…

There's something that strike me as a bit off in what you write. I'm having trouble pinning it down, so here are some vague thoughts: * The world does need more crypto. There's market demand for keeping stuff safe/hidden/whatever. * It is hard to get crypto right. People like the author, and if I'm not mistaken, yourself, keep pounding that point home. Ok, we're convinced... but people still need to do this stuff, an…

[deleted]

Re: You are dangerously bad at cryptography

#104

Post by tptacek » Mon, May 27, 2013, 7:26 PM UTC

wzdd wrote: post #100

tptacek wrote: post #96

Earlier quoted context omitted.

The attack has nothing to do with hash collisions; it has to do with the fact that the MD-structured hashes spit out their entire state at the end of the operation, which means an attacker can simply reformat the hash back into the hash core's state and continue hashing with it.

I didn't think so, but I mentioned it because the Wikipedia article on Merkle-Damgård hashes ( http://en.wikipedia.org/wiki/Merkle–Damgård_construction ) talks about length extension attacks only in the context of hash collisions: "Length extension — once an attacker has one collision, he can find more very cheaply."

That's actually a relatively new finding, and a very cool attack (I assume we're talking about Joux multicollisions).

Re: You are dangerously bad at cryptography

#105

Post by tptacek » Mon, May 27, 2013, 7:28 PM UTC

papsosouid wrote: post #98

tptacek wrote: post #77

Note: we're still running these challenges: http://www.matasano.com/articles/crypto-challenges/ The current standings are: * level 0 (4362 players), * level 1 (335 players), * level 2 (123 players), * level 3 (40 players), * level 4 (21 players), * level 5 (23 players), * level 6 (32 players) We're still donating $20 to PIH or Watsi for everyone who finishes all 6 sets. The top languages finishers are using are (in o…

When you undo the C and C++ merger, how does the list look? They are very different languages, in particularly in that they attract very different people, so it is interesting to know which is actually being used rather than "C/C++".

If I had to guess, Java and/or PHP would be in the top 10 if I disaggregated. There are more C++ players than C players.

These are based on survey results, and the selection I presented was "C/C++", so I'm stuck guessing.

Re: You are dangerously bad at cryptography

#106

Post by teeja » Mon, May 27, 2013, 7:30 PM UTC

jd007 wrote: post #16

About the timing attack on HMAC that the article mentions. It takes thousands if not hundreds of thousands of requests to gather the data (and let's assume you can indeed extract the data out of all the noise cause by network latency etc...), and any properly designed API should have a throttle measure built in to prevent brute force attacks like this. A good, secure API is protected by a variety of measures, not jus…

"a throttle measure built in"

It's my understanding that bittorrent sync uses the latency of the network for such a throttle. Wild hair: a cyclotron-style router roundabout could hold millions of packets "in suspension" for n seconds.

Re: You are dangerously bad at cryptography

#107

Post by tptacek » Mon, May 27, 2013, 7:30 PM UTC

jarrett wrote: post #95

tptacek wrote: post #79

Earlier quoted context omitted.

Just accept the fact that people who say "don't use crypto" aren't saying "don't hash passwords", nor are they saying "don't generate random numbers", and move on.

Sure, but then what are they saying? "Dont use cryptography" is a quotation taken verbatim from the OP, and I've heard similar statements all around in the last few years. A reasonable person reading that statement would interpret it at face value: "Don't use cryptography" means that very thing. So what I'm suggesting is that the "don't use crypto" meme should go away and be replaced with something more helpful and m…

It really seems like this is an argument that seeks to make it harder to understand a problem, rather than easier. I'm just not interested in the semantic debate, sorry.

Re: You are dangerously bad at cryptography

#108

Post by teeja » Mon, May 27, 2013, 7:31 PM UTC

jd007 wrote: post #16

About the timing attack on HMAC that the article mentions. It takes thousands if not hundreds of thousands of requests to gather the data (and let's assume you can indeed extract the data out of all the noise cause by network latency etc...), and any properly designed API should have a throttle measure built in to prevent brute force attacks like this. A good, secure API is protected by a variety of measures, not jus…

"a throttle measure built in"

It's my understanding that bittorrent sync uses the latency of the network for such a throttle. Wild hair: a cyclotron-style router roundabout could hold millions of packets "in suspension" for n seconds.

Re: You are dangerously bad at cryptography

#109

Post by dbarlett » Mon, May 27, 2013, 7:38 PM UTC

tptacek wrote: post #65

scg wrote: post #59

> Measure the time each request takes to complete. Since string equality takes a tiny bit longer to complete when the first char matches, the message that takes the longest to return will have the correct first character. Always wondered if this really works in practice ... I imagined the time it takes to compare 2 strings should be negligible / indistinguishable in a full HTTP request over the wire. Among all the ot…

Roughly a hundred people have implemented a milliseconds-granular timing attack in our crypto challenges. Our challenge isn't totally realistic (in reality, you'd be timestamping as close to the wire as possible, and if you used Python, you'd be using it to postprocess samples you took in C) but I think if you get through it you'll understand why the attack is viable. Keep in mind that most target applications will a…

Even better - with some creative "cloud cartography"[1], you have a 40% chance of launching a VM on the same physical host as your target.

[1] https://www.cs.cornell.edu/courses/cs6460/2011sp/papers/clou...

Re: You are dangerously bad at cryptography

#110

Post by B-Con » Mon, May 27, 2013, 7:38 PM UTC

tptacek wrote: post #67

e1ven wrote: post #7

So, sure. I'll admit that I'm bad at cryptography. You win! But the problem is, the world needs more, not less, crypto. We need to integrate crypto into more places, not run and hide and declare it too hard every time we come across it. Is it easy to screw up? Sure. So is manually allocating memory. But we use higher level languages to help protect us from ourselves. So too can we use higher-level libraries to help p…

The world needs more broken crypto like a dissident strapped to a chair in a concrete cell in South America needs another car battery alligator clipped to their fingers. How about, if the world really needs more cryptography, the people who bring it to us take the time to become just a little bit literate in how crypto is actually attacked, instead of pretending like they understand it just because they were able to…

Honestly, one of the big problems is that people confuse crypto primitives with crypto schemes. Developers need schemes, not primitives. Some people, who know what they're doing, need the primitives, but they are by far and away the exception.

AES is a crypto primitive, AES-CTR-CBCMAC (aka, AES-CCM, but spelled out to emphasize the complexity of it) is a scheme. And even then you have key distribution problems, which is essentially clipping on another two or three car batteries.