Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So, you want to crypto

blog.existentialize.com

Post reply on HN
Print view View original

21–30 of 75 posts

Re: So, you want to crypto

#21

Post by phaus »

tptacek wrote: post #10
phaus wrote: post #3

>Do not let users use your product until it's been vetted. Its OK to let them use it so you can have a large user-base to test with, you just need to explain to them that it isn't proven secure. As in, explicitly tell them that they are under no circumstances to use it with sensitive information. Playing around with cryptography is the only way to learn it, you just have to remember to tell people that playing is exa…

Two things. First, while "playing around with cryptography" may be the only way to learn it, building cryptographic systems is just about the worst way to learn. Professional cryptographers start by cryptanalyzing targets and use that experience to inform their future designs. On the other hand, veteran implementors who have never taken the time to learn how to break crypto turn out protocols and designs that are rep…

I get that you need to learn how to break software as a major part of the learning process. I also understand that a broken system often can't be fixed, and that if your system breaks you might have to start from scratch. But does one go from becoming an expert at breaking systems to automatically churning out a secure cryptographic system? Or does one become an expert at breaking and then build a bunch of flawed crypto systems, as the learning process continues?

Maybe the process is just counterintuitive, but it seems that no matter how skilled someone might be at breaking systems, that building a sound system on the first try would still be incredibly difficult. I know that crypto systems aren't built iteratively, instead I'm talking about going back to the drawing board each time. Would there be value in that, or would it be a waste of time? I'm not yet an expert (and I am well aware that you are), though I aspire to be one day. Perhaps you would be kind enough to elaborate?

Re: So, you want to crypto

#22

Post by sillysaurus2 »

tptacek wrote: post #10
phaus wrote: post #3

>Do not let users use your product until it's been vetted. Its OK to let them use it so you can have a large user-base to test with, you just need to explain to them that it isn't proven secure. As in, explicitly tell them that they are under no circumstances to use it with sensitive information. Playing around with cryptography is the only way to learn it, you just have to remember to tell people that playing is exa…

Two things. First, while "playing around with cryptography" may be the only way to learn it, building cryptographic systems is just about the worst way to learn. Professional cryptographers start by cryptanalyzing targets and use that experience to inform their future designs. On the other hand, veteran implementors who have never taken the time to learn how to break crypto turn out protocols and designs that are rep…

Don't learn by building. You need to learn by breaking.

The best way to do this is to do the Matasano crypto challenges. The challenges are designed to get progressively more difficult, and since the goal of most of them is to break something, that means you'll learn how to employ progressively more sophisticated attacks. They're also great for a newbie, because in one challenge you'll implement something that seems impervious to attack, then in the following challenge you'll attack and break it, often via an unexpected attack vector. (The padding oracle attack comes to mind.)

You'll come away with an understanding of AES in ECB CBC and CTR modes; HMAC; timing attacks; attacks on RNGs; attacks on hashes; and a lot more. That's just off the top of my head.

For me, there were a dozen "aha!" moments in the first 30 challenges. Each of those moments now live with me and inform my future decisions. They will also make you much less confident in your ability to design secure cryptosystems, which is good.

Re: So, you want to crypto

#23

Post by tptacek »

andrewcooke wrote: post #16
tptacek wrote: post #12

Earlier quoted context omitted.

A world full of brilliant cryptographers outraged at the NSA, trying to get the NSA off the IETF crypto review board, working on publishing results about NSA-sponsored crypto... and you want to talk about the MD2 and RC2 constants? What's the largest system that ever relied on MD2? Let's start there.

i know you have the intellectual curiousity of a sausage, but some of us are simply interested. we don't all need to be motivated by logic. how would you derive it? tagging pairs of hex digits and sorting doesn't cut it. would rivest have used a hack that's a biased shuffle? i doubt it. and downvotes. happy xmas!

You're right. I was snippy, and in a particularly dumb way. Sorry about that.

Re: So, you want to crypto

#24

Post by pbsd »

tptacek wrote: post #18
pbsd wrote: post #17

Earlier quoted context omitted.

There were certificates (including a root CA) using MD2 until recently. MD2 itself was only retired in 2011 [1]. https://www.rfc-editor.org/rfc/rfc6149.txt

You are obviously right. Now I feel dumb. I concede the importance of MD2. Do you believe that the starting state for MD2 is a possible backdoor? Later: I'm batting .000 today on this stuff; it's not the starting state of MD2 that he's talking about, of course, and the misapprehension that he was is part of why I was dismissive. Go me.

It seems your edit did all the work for me. Being in the core of the MD2 compression function puts the Sbox in a good place to be a backdoor.

However I strongly doubt this is one. The attacks that have broken MD2 do not seem to hinge terribly on the Sbox (I may be wrong, it was only a cursory look). It's more likely to me that the Sbox was generated using a hard-to-replicate Knuth shuffle using the digits of Pi.

Re: So, you want to crypto

#25

Post by phaus »

EpicEng wrote: post #9
phaus wrote: post #3

>Do not let users use your product until it's been vetted. Its OK to let them use it so you can have a large user-base to test with, you just need to explain to them that it isn't proven secure. As in, explicitly tell them that they are under no circumstances to use it with sensitive information. Playing around with cryptography is the only way to learn it, you just have to remember to tell people that playing is exa…

But how many people are going to be interested in a crypto product which is unproven? Sure, perhaps a few technical types will give it a whirl, but most people just want something that works. If I'm in the market for something like this I'm certainly not going to use a product with a big disclaimer stating "Hey, we don't really know if this works yet, but help us test it out!" This is mission critical stuff, not some…

How many people would have been interested in a digital currency when it was worthless and not accepted as a form of payment anywhere?

Perhaps the general population won't be interested, but techies are often willing to play around with unproven technologies.

Re: So, you want to crypto

#26

Post by milhous »

I'm taking an Intro to Crypto course this spring. What's interesting is that it's offered through the Math department, and assumed it was a CS class.

We'll be using this text:

http://www.amazon.com/Introduction-Cryptography-Coding-Theor...

Is this any good? Apparently a best seller in the "Software Coding Theory" category on Amazon.

Re: So, you want to crypto

#27

Post by kbhomes »

milhous wrote: post #26

I'm taking an Intro to Crypto course this spring. What's interesting is that it's offered through the Math department, and assumed it was a CS class. We'll be using this text: http://www.amazon.com/Introduction-Cryptography-Coding-Theor... Is this any good? Apparently a best seller in the "Software Coding Theory" category on Amazon.

I had this same textbook for the Crypto course I just completed this semester. It's a very good textbook, in my opinion, as the descriptions and examples are really informative. Usually if I couldn't get the material through my professor's lectures, it was sufficient to look it up in the book. However, we did only briefly touch on cryptographic hashes and only a little on Legendre and Jacobi symbols, and not at all on the elliptic curve and other special topics towards the end of the text, so I can't comment on those.

The book does very good job of talking about different algorithms and concepts, often times with a very brief historical introduction, and includes thorough descriptions of various popular/important attacks of those concepts. In general it's a book I'd recommend for an introduction to cryptography. You also learn a fair introductory bit of number theory which I really enjoyed.

I also met Dr. Washington, one of the co-authors of this book, who was a very pleasant and energetic person who really enjoys the topic of cryptography.

By the way, where are you taking this course?

Re: So, you want to crypto

#28

Post by nicholassmith »

tptacek wrote: post #23
andrewcooke wrote: post #16

Earlier quoted context omitted.

i know you have the intellectual curiousity of a sausage, but some of us are simply interested. we don't all need to be motivated by logic. how would you derive it? tagging pairs of hex digits and sorting doesn't cut it. would rivest have used a hack that's a biased shuffle? i doubt it. and downvotes. happy xmas!

You're right. I was snippy, and in a particularly dumb way. Sorry about that.

But happy to admit it in a reasonable way. A responsible disclosure of errors if you will.

Re: So, you want to crypto

#29

Post by jknightco »

milhous wrote: post #26

I'm taking an Intro to Crypto course this spring. What's interesting is that it's offered through the Math department, and assumed it was a CS class. We'll be using this text: http://www.amazon.com/Introduction-Cryptography-Coding-Theor... Is this any good? Apparently a best seller in the "Software Coding Theory" category on Amazon.

I took an Intro to Crypto course offered through my University's Mathematics department and we used that exact text. I'm the kind of person that requires a very good text in order to do well in a course, and the book in question was of high enough quality that I did quite well.

Although I thoroughly enjoyed the Mathematical focus of the course, my particular teacher spent a good deal of the course discussing semi-related Number Theory topics at the expense of introducing some of the more interesting cryptography concepts. That said, we still learned the theory behind the important ones: DES, AES, RSA, and ElGamal, in addition to "classical" forms such as Caesar, Vigenère, and Hill.

Another downside of the course being a Math course and not a CS course: we used Mathematica for all of our "programming" projects, which felt awkward and clunky. I remember coding my solutions in Python first, making sure they were correct, and then translating them to Mathematica after the fact.

Good luck in the course! It'll be hard work, but its absolutely worth the effort.

Post reply on HN