Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everything you need to know about cryptography in 1 hour (2010) [pdf]

daemonology.net

Post reply on HN
Print view View original

71–80 of 104 posts

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#71

Post by cperciva »

pbsd wrote: post #70
cperciva wrote: post #66

Earlier quoted context omitted.

I think you're right about me being in a minority here. I also think there's an unfortunate amount of neophilia in the cryptographic community, partly because you don't get publications by not doing anything new.

Academics do love their new fancy stuff. Here's the thing: elliptic curve cryptography is not particularly new anymore. I'd buy this neophilia argument if it were concerning pairings, ideal lattices, or the stuff people are doing with these nowadays (FHE, obfuscation, etc). Elliptic curves were proposed, and have since been studied in the context of cryptography, in 1985. They're 30 years old! For comparison, finite…

I don't think it's fair to compare on the basis of years alone. Elliptic curves weren't getting nearly as much attention back when there were a dozen patents covering everything.

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#72

Post by seanewest »

cperciva wrote: post #66
tptacek wrote: post #64

Earlier quoted context omitted.

I am not as knowledgeable on these topics as Colin. But in this weird specific set of cases, I think my take is also closer to the conventional wisdom among cryptographic engineers; if you got a panel of them to stand in for me, I think their comment would sound close to mine.

I think you're right about me being in a minority here. I also think there's an unfortunate amount of neophilia in the cryptographic community, partly because you don't get publications by not doing anything new.

neophilia: love of or enthusiasm for what is new or novel

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#74

Post by pdf_reader »

cperciva wrote: post #56
tptacek wrote: post #51

I disagree with two big points in this talk, but I'm sorry to say they're the same two things I disagreed with last time, so this is going to be a boring comment. First, dedicated AEAD cipher modes are superior to manually composing AES-CTR and HMAC-SHAx. AEAD modes provide both authentication and encryption in a single construction. AES-CTR+HMAC-SHAx involves joining two constructions to do the same thing. Colin poi…

You are entitled to your opinions, no matter how wrong they are. ;-)

The slide starting on PDF page 83 seems wrong? If I know (x, E_k(x)) for some x (or even without knowing them), then I can trivially compute (x', E_{k'}(x')) for k' and x' of my choosing.

Somewhat disappointing, since this slide is the only one in the presentation containing anything cryptographically "meaty".

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#75

Post by mgraczyk »

pdf_reader wrote: post #74
cperciva wrote: post #56

Earlier quoted context omitted.

You are entitled to your opinions, no matter how wrong they are. ;-)

The slide starting on PDF page 83 seems wrong? If I know (x, E_k(x)) for some x (or even without knowing them), then I can trivially compute (x', E_{k'}(x')) for k' and x' of my choosing. Somewhat disappointing, since this slide is the only one in the presentation containing anything cryptographically "meaty".

Not if E is ideal. The point is that an ideal block cipher is not vulnerable to related key attacks. It should be indistinguishable from a random permutation. Selected uniformly from S_n, where n is the cardinality of the key space.

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#76

Post by pdf_reader »

mgraczyk wrote: post #75
pdf_reader wrote: post #74

Earlier quoted context omitted.

The slide starting on PDF page 83 seems wrong? If I know (x, E_k(x)) for some x (or even without knowing them), then I can trivially compute (x', E_{k'}(x')) for k' and x' of my choosing. Somewhat disappointing, since this slide is the only one in the presentation containing anything cryptographically "meaty".

Not if E is ideal. The point is that an ideal block cipher is not vulnerable to related key attacks. It should be indistinguishable from a random permutation. Selected uniformly from S_n, where n is the cardinality of the key space.

From what is on the slide, I can compute (x', E_{k'}(x')) for x' and k' of my choosing by just running the encryption algorithm.

(I know that ideal ciphers are defined correctly elsewhere, and agree that their definition makes sense.)

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#77

Post by corpselord420 »

broken wrote: post #36
cschmidt wrote: post #28

Earlier quoted context omitted.

As in the $5 wrench xkcd: http://xkcd.com/538/

or Rubber-hose Cryptanalysis http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis

why yes that is indeed what the adults have been discussing

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#78

Post by cperciva »

pdf_reader wrote: post #74
cperciva wrote: post #56

Earlier quoted context omitted.

You are entitled to your opinions, no matter how wrong they are. ;-)

The slide starting on PDF page 83 seems wrong? If I know (x, E_k(x)) for some x (or even without knowing them), then I can trivially compute (x', E_{k'}(x')) for k' and x' of my choosing. Somewhat disappointing, since this slide is the only one in the presentation containing anything cryptographically "meaty".

I can trivially compute (x', E_{k'}(x')) for k' and x' of my choosing.

True, I oversimplified a bit. I was referring to situations where you don't know k' and x', e.g., x' = x and k' = k ^ \epsilon for some value \epsilon.

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#79

Post by pdf_reader »

cperciva wrote: post #78
pdf_reader wrote: post #74

Earlier quoted context omitted.

The slide starting on PDF page 83 seems wrong? If I know (x, E_k(x)) for some x (or even without knowing them), then I can trivially compute (x', E_{k'}(x')) for k' and x' of my choosing. Somewhat disappointing, since this slide is the only one in the presentation containing anything cryptographically "meaty".

I can trivially compute (x', E_{k'}(x')) for k' and x' of my choosing. True, I oversimplified a bit. I was referring to situations where you don't know k' and x', e.g., x' = x and k' = k ^ \epsilon for some value \epsilon.

Ok, so what is the revised statement? "Referring to situations" is pretty vague...

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#80

Post by fedor_brunner »

tptacek wrote: post #51

I disagree with two big points in this talk, but I'm sorry to say they're the same two things I disagreed with last time, so this is going to be a boring comment. First, dedicated AEAD cipher modes are superior to manually composing AES-CTR and HMAC-SHAx. AEAD modes provide both authentication and encryption in a single construction. AES-CTR+HMAC-SHAx involves joining two constructions to do the same thing. Colin poi…

I would love to know your opinion about ARX ciphers.

Direct implementation of AES from specification can be attacked using cache-timing side-channel. ARX ciphers are much easier to implement in software and also because they run in constant time, and are therefore immune to timing attacks.

What is your opinion of ARX ciphers Chacha20 (from Daniel J. Bernstein ) and Threefish, Skein hash (Bruce Schneier, Niels Ferguson) ?

Post reply on HN