The reason this is being (re)posted now is that I gave this talk at a Polyglot Vancouver meetup last night. Freed from the constraint of a conference schedule I actually took about 90 minutes to go through this talk this time (followed by another 30 minutes of questions).
Do you have a copy of the presentation in beamer's "handout" mode? I think that is what it is called. It is the mode that condenses the 140+ pages into 20-30 by collapsing all the reveals.
Everything you need to know about cryptography in 1 hour (2010) [pdf]
21–30 of 104 posts
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#22The reason this is being (re)posted now is that I gave this talk at a Polyglot Vancouver meetup last night. Freed from the constraint of a conference schedule I actually took about 90 minutes to go through this talk this time (followed by another 30 minutes of questions).
As someone who is completely new to cryptography and knows very little, where would you recommend I start? I've recently been reading about bitwise operations to become familiar with how to (somewhat) interpret what a cryptograhic algorithm is doing in a program, since bitwise operations seems to be popular in almost all crypto algorithms.
Dan Boneh's free "Crypto 1" on coursera. A new session will be starting on the 30th of June.
I've taken it myself and this is hands down one of the best MOOCs (and class overall) I've ever taken.
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#23> PROBABLY AVOID: Elliptic Curve signature schemes. Including Ed25519?
Probably. As I said elsewhere, this is subject to the caveat that sometimes you need the performance characteristics of ECC; I'm providing advice for general-purpose computing environments which do not have any such constraints.
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#24Here is the video of the talk: http://www.fosslc.org/drupal/content/everything-you-need-kno...
The comments say that there's an Ogg download but I can't find it. Any pointers?
Someone posted the bliptv link above: http://blip.tv/fosslc/everything-you-need-to-know-about-cryp...
$ youtube-dl http://blip.tv/blahblah
$ ffmpeg -i file.flv file.ogvRe: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#25Earlier quoted context omitted.
It's pretty simple -- if the US government really really wants your secrets, they can kidnap you and torture you until you tell them what they want to know. Cryptography can protect data, but it doesn't protect humans; all it can do is make sure that humans are the only remaining point of attack.
That's not entirely true. Proper cryptography can keep them from learning that it's you they'll need to kidnap to get the secret, or even keep them from learning that there is a secret they might care about in the first place. Also, there are plenty of bad guys in the world that can't kidnap and torture you that it's still quite worthwhile to keep your secrets from.
You're over-thinking this. The point is simply that no matter how good the cryptography in a system is, if there are humans involved then you need to worry about human factors as well.
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#26Earlier quoted context omitted.
Do you have a copy of the presentation in beamer's "handout" mode? I think that is what it is called. It is the mode that condenses the 140+ pages into 20-30 by collapsing all the reveals.
I do now: http://daemonology.net/papers/crypto1hr-small.pdf
Many thanks. I wish Beamer made a bigger point of recommending distribution in handout mode or more accurately dissuading distribution in presentation mode.
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#27He recommends HMAC-SHA256 in this paper, but I think that AES-GCM is a better construction, as long as you understand the requirements for IV uniqueness. It offers significant improvements on top of the standard HMAC (privacy and additional out-of-band data) without adding much in terms of size.
I think you're confused? AES-GCM is an authenticated encryption mode. HMAC-SHA256 is just a cryptographic MAC. The two only share the same applications when the latter is combined with a non-authenticated encryption mode in an Encrypt-then-MAC construction.
The problem with the polynomial AE modes is they are trickier to implement (AES is actually small, as is SHA).
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#28Here's a provocative gem: > The purpose of cryptography is to force the US government to torture you.
As in the $5 wrench xkcd:
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#29He recommends HMAC-SHA256 in this paper, but I think that AES-GCM is a better construction, as long as you understand the requirements for IV uniqueness. It offers significant improvements on top of the standard HMAC (privacy and additional out-of-band data) without adding much in terms of size.
I think you're confused? AES-GCM is an authenticated encryption mode. HMAC-SHA256 is just a cryptographic MAC. The two only share the same applications when the latter is combined with a non-authenticated encryption mode in an Encrypt-then-MAC construction. The problem with the polynomial AE modes is they are trickier to implement (AES is actually small, as is SHA).
In many cases where you use an HMAC, you'll also want to encrypt as well (ie: web cookies, tokens, etc). Because of this, I find it's much better just to go with AES-GCM from the start rather than discovering that you don't want to leak your internal DB identifiers later and tacking on the encrypt-then-mac.
It also means that the implementation of the algorithm does the work of both authentication and privacy, whereas with HMAC-SHA256 (and HMAC-SHA256 + AES-CBC/CTR) you will see developers hand-rolling more of it, leaving more room for them to do it wrong.
I also prefer that AES-GCM is a mode itself, while encrypt-then-mac generally requires a developer to do research into the appropriate encryption mode and other details required to "get this right".
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#30> PROBABLY AVOID: Elliptic Curve signature schemes. Including Ed25519?
Probably. As I said elsewhere, this is subject to the caveat that sometimes you need the performance characteristics of ECC; I'm providing advice for general-purpose computing environments which do not have any such constraints.
Not that I really feel comfortable challenging you on anything crypto related, but it seems to me that Ed25519 is superior to RSA in every conceivable way even for general-purpose computing environments. It's more performant, easier to generate keys, the signatures are shorter, and there are fewer ways to shoot yourself in the foot (e.g. no padding issues). Is there a reason you don't actively advocate it other than the fact that it's not widely used?