Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tptacek's Review of "Practical Cryptography With Go"

gist.githubusercontent.com

Post reply on HN
Print view View original

31–40 of 255 posts

Re: Tptacek's Review of "Practical Cryptography With Go"

#31

Post by zatkin »

dfc wrote: post #13
zatkin wrote: post #9

For those of you who don't know what the acronyms stand for, I've compiled a list, in order by their appearance: AES - Advanced Encryption Standard CBC - Cipher Block Chaining PKCS - Public Key Cryptography Standards SHA - Secure Hashing Algorithm MAC - Message Authentication Code PBKDF - Password-Based Key Derivation Function NIST - National Institute of Standards and Technology FIPS - Federal Information Processing…

Welcome to HN. I see that you are new here so I would like to give you a little friendly advice. If you have to make a long list like this on HN use the pre/code formatting (two spaces at begining of line). Long lists like this take up a ton of space. I have a sneaking suspicion this is the a deliberate design choice so that people link to reference resources and use the comments for discussion. Compare: AES - Advanc…

You. I like you. Thank you! I've updated the list. I didn't see anything on the posting help page about putting two spaces in front to make it pre/code formatting. (Or maybe there was a second page I didn't look over.)

Edit: I just double-checked the help page and saw the note about code formatting. My apologies for overlooking that!

Re: Tptacek's Review of "Practical Cryptography With Go"

#32

Post by chipaca »

dsymonds wrote: post #30
GuiA wrote: post #19

From tptacek's comment, it sounds like the author of the book may just be an inexperienced practitioner of cryptography who's only crime is to be too eager to spread what they've learned. Someone who picked up the basics from a few Wikipedia articles here, a few papers there, a couple open source projects here and there... they're smart, so they're not completely clueless about the field, but they just don't have the…

An "inexperienced practitioner of cryptography" should not be writing a book about cryptography. It's great that such a person is learning, but you shouldn't be trying to pass on such information at that stage. (I don't know the author either)

Remember that being wrong about something feels exactly the same as being right about something, so (extending "being wrong" to "being ignorant") unless somebody tells them they won't know they still have stuff to learn.

Re: Tptacek's Review of "Practical Cryptography With Go"

#33

Post by _pmf_ »

riffraff wrote: post #28

can someone explain this? * This book, I am not making this up, contains the string: "“We can use ASN.1 to make the format easier to parse". Last time I had something to do with ASN.1 was years ago but it seemed to work well, libraries were full featured and cross-language interop was ok. What am I missing that makes ASN.1 bad ? Or is the critique to an attempt to write a custom ASN.1 serializer/parser?

> Last time I had something to do with ASN.1 was years ago but it seemed to work well, libraries were full featured and cross-language interop was ok. What am I missing that makes ASN.1 bad ?

Didn't you know? If a web developer out of high school cannot read a format at first glance, it's obviously over-engineered and useless and anyhow everybody should always use JSON anyways.

Re: Tptacek's Review of "Practical Cryptography With Go"

#34

Post by runn1ng »

> The book actively recommends public key cryptography, because of concerns about key distribution. Again: bad strategy. Cryptographers use public key crypto only when absolutely required. Most settings for cryptography don't need it! Public key cryptography multiplies the number of things that can go wrong with your cryptosystem.

Can I ask why? What is so dangerous with asymmetric crypto compared to symmetric crypto?

Re: Tptacek's Review of "Practical Cryptography With Go"

#35

Post by _delirium »

riffraff wrote: post #28

can someone explain this? * This book, I am not making this up, contains the string: "“We can use ASN.1 to make the format easier to parse". Last time I had something to do with ASN.1 was years ago but it seemed to work well, libraries were full featured and cross-language interop was ok. What am I missing that makes ASN.1 bad ? Or is the critique to an attempt to write a custom ASN.1 serializer/parser?

ASN.1 parsers have been the source of a decent number of exploits, producing a bad reputation. Although doing a little looking through CVEs that mention ASN.1, it looks like the vast majority come from one specific ASN.1 parser, the one in OpenSSL, so it might just be that OpenSSL's code is a mess.

Re: Tptacek's Review of "Practical Cryptography With Go"

#36

Post by dasil003 »

lkozma wrote: post #18
austinz wrote: post #12

I see the implementation of cryptosystems as an engineering endeavor little different than designing, for example, a commercial airplane, a bridge, or a radiation therapy machine. In all cases you have a system whose failure can result in anything from monetary loss to death (for an example of the latter, faulty cryptographic software used by dissidents in repressive countries). In all cases you use a combination of…

The reason why crypto might be even harder than the other engineering tasks you mention is that in those the "adversary" is indifferent, not actively trying to exploit every loophole you might have left. You might build a bridge that has some small weakness, but no-one will come and stack weights in the exact pattern that exploits the weakness and makes the bridge collapse.

Beyond that, failure of a bridge or an airplane is not likely to go unnoticed. Every failure will be investigated, documented and studied. Crypto failure by contrast can just easily be silent, deadly, and continuously unnoticed for extended periods of time.

Re: Tptacek's Review of "Practical Cryptography With Go"

#37

Post by arethuza »

jacquesm wrote: post #10
nairteashop wrote: post #7

Earlier quoted context omitted.

He actually posted this link yesterday as a comment: https://news.ycombinator.com/item?id=7581868

Ah cool! Thanks. It seemed a little strange to have his name used so prominently in the title here linked to something that did not have his name attached to it or in any other way easily associated. Call me paranoid ;)

Having a concern about the authenticity of a message seems appropriate in a discussion about security :-)

Re: Tptacek's Review of "Practical Cryptography With Go"

#38

Post by mehrdada »

runn1ng wrote: post #34

> The book actively recommends public key cryptography, because of concerns about key distribution. Again: bad strategy. Cryptographers use public key crypto only when absolutely required. Most settings for cryptography don't need it! Public key cryptography multiplies the number of things that can go wrong with your cryptosystem. Can I ask why? What is so dangerous with asymmetric crypto compared to symmetric crypto…

There's one, admittedly theoretical difference, at least: there is such a thing as perfectly (information theoretically) secure symmetric encryption scheme (regardless of the computational power of the adversary), but asymmetric crypto, by definition, relies on being computationally infeasible, not information theoretically impossible.

Even though it's theoretical, the side effects of this fact surface from time to time as engineering issues in asymmetric crypto: all information that the attacker might need to break asymmetric crypto is more or less in the ciphertext, intuitively suggesting it's easier for asymmetric crypto to catastrophically go wrong.

Re: Tptacek's Review of "Practical Cryptography With Go"

#39

Post by dylz »

jacquesm wrote: post #6

I'll take it on faith that Thomas really wrote this (it's his style), but would the real Thomas 'H' Ptacek please acknowledge that he indeed wrote this (it is labeled 'anonymous').

'anonymous' just means that the user was not logged into github when posting the gist.

Re: Tptacek's Review of "Practical Cryptography With Go"

#40

Post by mrhonza »

GuiA wrote: post #19

From tptacek's comment, it sounds like the author of the book may just be an inexperienced practitioner of cryptography who's only crime is to be too eager to spread what they've learned. Someone who picked up the basics from a few Wikipedia articles here, a few papers there, a couple open source projects here and there... they're smart, so they're not completely clueless about the field, but they just don't have the…

> I have no clue who the author of Practical Cryptography With Go is.

https://leanpub.com/gocrypto

Post reply on HN