Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everything you need to know about cryptography in 1 hour (2010) [pdf]

daemonology.net

Post reply on HN
Print view View original

41–50 of 104 posts

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#41

Post by cperciva »

lisper wrote: post #30
cperciva wrote: post #23

Earlier quoted context omitted.

Probably. As I said elsewhere, this is subject to the caveat that sometimes you need the performance characteristics of ECC; I'm providing advice for general-purpose computing environments which do not have any such constraints.

Not that I really feel comfortable challenging you on anything crypto related, but it seems to me that Ed25519 is superior to RSA in every conceivable way even for general-purpose computing environments. It's more performant, easier to generate keys, the signatures are shorter, and there are fewer ways to shoot yourself in the foot (e.g. no padding issues). Is there a reason you don't actively advocate it other than…

Elliptic curves have had fewer decades of cryptographic analysis. There's a lot of structure still being explored and I'm not so confident that nobody will ever find a way to exploit it as I am with integer factorization.

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#42

Post by peterwwillis »

cperciva wrote: post #25
mseebach wrote: post #17

Earlier quoted context omitted.

That's not entirely true. Proper cryptography can keep them from learning that it's you they'll need to kidnap to get the secret, or even keep them from learning that there is a secret they might care about in the first place. Also, there are plenty of bad guys in the world that can't kidnap and torture you that it's still quite worthwhile to keep your secrets from.

You're over-thinking this. The point is simply that no matter how good the cryptography in a system is, if there are humans involved then you need to worry about human factors as well.

The easiest way to avoid the human factor is to get a scapegoat. You make it seem like someone else is responsible for, or knows about, the crypto or its data payload. They will then torture that individual indefinitely until they confess to something. It's better if they don't know you or anything about your scheme as that way it'll look like they're holding out a really long time on important information.

Then the only thing you need to worry about is that person dying, in which case the investigation continues. So similar to upping the number of rounds on PBKDF2 every year, you need a new scapegoat every year, or however long it takes them to break either the crypto or the scapegoat.

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#43

Post by lisper »

cperciva wrote: post #41
lisper wrote: post #30

Earlier quoted context omitted.

Not that I really feel comfortable challenging you on anything crypto related, but it seems to me that Ed25519 is superior to RSA in every conceivable way even for general-purpose computing environments. It's more performant, easier to generate keys, the signatures are shorter, and there are fewer ways to shoot yourself in the foot (e.g. no padding issues). Is there a reason you don't actively advocate it other than…

Elliptic curves have had fewer decades of cryptographic analysis. There's a lot of structure still being explored and I'm not so confident that nobody will ever find a way to exploit it as I am with integer factorization.

Thanks!

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#44

Post by zokier »

cperciva wrote: post #39
dfc wrote: post #26

Earlier quoted context omitted.

Many thanks. I wish Beamer made a bigger point of recommending distribution in handout mode or more accurately dissuading distribution in presentation mode.

I always do that now. The only reason I didn't this time is that the slides were from 2010, before I updated my Makefile to automatically build both versions.

> that the slides were from 2010

Considering this, what do you think has changed in the past 5 years? Eg the slides mention SHA3 as a future option, now it is finalized and afaik usable.

There is also one interesting thing about SHA3 which I learned recently, namely that it can apparently be easily used as MAC too:

> Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be performed by simply prepending the message with the key

from http://keccak.noekeon.org/

In this light, do you think it would be reasonable to add exception for "DON’T: Try to use a hash function as a symmetric signature." rule?

Another thing is that ECC seems to be on the rise (or is it just my perception?). Do you think a revised slide set would include something more about elliptic curves?

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#45

Post by latj »

cperciva wrote: post #21
dfc wrote: post #20

Earlier quoted context omitted.

Do you have a copy of the presentation in beamer's "handout" mode? I think that is what it is called. It is the mode that condenses the 140+ pages into 20-30 by collapsing all the reveals.

I do now: http://daemonology.net/papers/crypto1hr-small.pdf

Is there a website that has information like this listed so that it can be updated over time? And perhaps where items could be discussed?

For example, is the suggested key size still the same as 2010?

Thank you.

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#46

Post by Groxx »

cperciva wrote: post #8

The reason this is being (re)posted now is that I gave this talk at a Polyglot Vancouver meetup last night. Freed from the constraint of a conference schedule I actually took about 90 minutes to go through this talk this time (followed by another 30 minutes of questions).

I don't suppose there's a video of this available? Longer + decent Q&A sounds appealing.

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#47

Post by robryk »

cperciva wrote: post #16
drewcrawford wrote: post #11

Would be interested in hearing more detail about your objections to both Poly1305 and ECC.

Too many ways to screw things up, not enough decades of cryptographic analysis, and there are simpler tools available which have been around for longer. This is subject to the caveat that ECC offers benefits under certain specific conditions (e.g., you need small signatures or a small ASIC die area); but in those situations you want to talk to a cryptographer anyway. My talk was providing guidelines for software deve…

What are your thoughts on using NaCl? On one hand it gives harder-to-misuse primitives, on the other is uses elliptic curve crypto.

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#48

Post by uulbiy »

epsylon wrote: post #22
zatkin wrote: post #9

Earlier quoted context omitted.

As someone who is completely new to cryptography and knows very little, where would you recommend I start? I've recently been reading about bitwise operations to become familiar with how to (somewhat) interpret what a cryptograhic algorithm is doing in a program, since bitwise operations seems to be popular in almost all crypto algorithms.

Dan Boneh's free "Crypto 1" on coursera. A new session will be starting on the 30th of June. I've taken it myself and this is hands down one of the best MOOCs (and class overall) I've ever taken.

I agree, "Crypto 1" was excellent! On Coursera's website, in the upcoming section, it says that "Crypto 2" starts in 3 months. I hope that's true!

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#50

Post by Spearchucker »

Thanks for sharing the slides (and techpeace for the links to the video).

A question I have though is given that we (those of us who collectively don't identify ourselves as security rocket-surgeons) are always advised to stick with the high-level stuff and to stay away from stuff like AES (ref. slide 16), which nobody does anyway, then why is no mention ever made of established and known protocols? Examples like

- Needham-Schroeder (fixed version), http://en.wikipedia.org/wiki/Needham-Schroeder_protocol

- Otway-Rees, http://en.wikipedia.org/wiki/Otway%E2%80%93Rees_protocol

have proven to be really useful. Yes, there's a metric ton of work involved in implementing something like this, but going through it once is amazing practice for getting it right in future (that, at least, is my experience).

Why is it that we talk about symmetric and asymmetric encryption, but never go as far as the protocols that provide real context for their uses?

Post reply on HN