61–70 of 75 posts
I have signed up to the Coursera course and hope to brush up on basic topics and start doing more advanced crypto.
Earlier quoted context omitted.
I'm not a cryptography expert either, but I'll give this a crack... In as much as SHA1 is a "cryptographic hash function", Linus isn't taking advantage of a few of it's cryptographic properties in his usage of it in git. It would for example, make no difference to the workings of git if you could reverse-engineer the contents of an object from its SHA1. In the same way, it doesn't matter much to the operation of git…
Thanks for this, you answered my questions thoroughly. I'm not entirely convinced by this though: > [A signed commit] doesn't guarantee anything about the contents of that commit if the repository has been tampered with. I think most people would intuitively expect the signed commit to guarantee the contents of the tree being signed. The idea that you could "git pull" a repo from a compromised machine, verify the sig…
Earlier quoted context omitted.
Git assumes that a matching SHA1 means that the content is equal to the original content. Is that not crypto? For example, if you sign a tag, it appears to sign the SHA1 of the associated content. This is definitely outside of my expertise, so I'm sure that my understanding is incomplete. The larger questions for me are: - if git's SHA1 content-addressable design is not crypto, how do you distinguish crypto from soft…
I'm not a cryptography expert either, but I'll give this a crack... In as much as SHA1 is a "cryptographic hash function", Linus isn't taking advantage of a few of it's cryptographic properties in his usage of it in git. It would for example, make no difference to the workings of git if you could reverse-engineer the contents of an object from its SHA1. In the same way, it doesn't matter much to the operation of git…
Ok so I do want to crypto and (to the best of my ability) I already do. I follow best practices, read about the subject matter, did coursera's crypto 1 (and where the hell is pt2? 1 was awesome!). I use established algorithms and I use, well audited implementations etc etc. where available. I have a question about MACs. We're using HMAC based on SHA256 with 32-byte keys on our new system, but our security architect o…
Part 1 begins again in January and part 2 begins right after it's done.
(Can't really complain though, it's excellent and free)
Ok so I do want to crypto and (to the best of my ability) I already do. I follow best practices, read about the subject matter, did coursera's crypto 1 (and where the hell is pt2? 1 was awesome!). I use established algorithms and I use, well audited implementations etc etc. where available. I have a question about MACs. We're using HMAC based on SHA256 with 32-byte keys on our new system, but our security architect o…
It definitely does reduce the strength of the MAC, but it is okay if your security requirements require it. Keeping in mind that some generic birthday attacks already reduce HMAC strength to n/2 bits (IIRC), and SHA-256 has you down to 128 bits of security (with an online attack though). Truncation is mentioned in RFC 2104. I quote: 5. Truncated output A well-known practice with message authentication codes is to tru…
I know some of the older MAC techniques (ANSI X9.19) turn out to actually aid key recovery if you use shorter MACs, which is odd...
Earlier quoted context omitted.
A world full of brilliant cryptographers outraged at the NSA, trying to get the NSA off the IETF crypto review board, working on publishing results about NSA-sponsored crypto... and you want to talk about the MD2 and RC2 constants? What's the largest system that ever relied on MD2? Let's start there.
There were certificates (including a root CA) using MD2 until recently. MD2 itself was only retired in 2011 [1]. https://www.rfc-editor.org/rfc/rfc6149.txt
I'm curious to hear people's thoughts about git. Git is "crypto" to some extent, Linus does not appear to have tons of crypto expertise, and it uses SHA1 as a MAC AFAICT (which according to tptacek's earlier comment is invalid). And yet I've never heard about attacks on its crypto. This was interesting for me to think about because it seems like a counterpoint to the article, in that it is a very successful project t…
AFAIK the only "crypto" in git is GPG used to sign tags. The content addressable data store where all the objects are kept is basically a filesystem where every filename is the SHA1 of its contents. If you were to generate an object that was a SHA1 collision of an existing object and inject it via a commit (without access to filesystem, otherwise the point is sort of moot) then git won't overwrite the original object…
Earlier quoted context omitted.
i know you have the intellectual curiousity of a sausage, but some of us are simply interested. we don't all need to be motivated by logic. how would you derive it? tagging pairs of hex digits and sorting doesn't cut it. would rivest have used a hack that's a biased shuffle? i doubt it. and downvotes. happy xmas!
You're right. I was snippy, and in a particularly dumb way. Sorry about that.
also, did you see http://www.jakoblell.com/blog/2013/12/22/practical-malleabil... which i think could be added to an early crypto challenge? (but maybe you already cover the idea).
Thanks for all the free advice. It's much more effective to develop expertise in house then pay for engineers thanks to forums like this.