Everything you need to know about cryptography in 1 hour (2010) [pdf] • Hacker News Board

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#101

Post by archwisp » Sun, Jun 15, 2014, 2:08 AM UTC

tptacek wrote: post #99

archwisp wrote: post #95

Earlier quoted context omitted.

First off, do not interpret my comments as trying to provide any sort of advice to anyone. I am merely expressing frustration. I have to agree with Colin's [1] point. The standard libraries for the languages I see in assessments most often just don't include AEAD constructions. And when public libraries exist, they haven't been properly assessed.

Can you be more specific? Because this assertion didn't ring true to me based on my own experience, and less than 5 minutes of Googling appears to refute it: * OpenSSL supports AEAD through CCM and GCM (and OpenSSL's GCM uses PCLMUL and shouldn't have the obvious cache leak) * Botan supports AEAD through OCB, GCM, CCM, EAX, and SIV(!). * Java JCE with the Bouncycastle provider (extremely popular) does AEAD with GCM,…

Sorry for the slow reply. I haven't looked into setting up notifications for replies. (if that exists on HN?)

But .NET probably represents the largest block of applications I see. Seconded by (shudder) CF. I don't really have any hope for CF but crypto is hardly it's biggest problem.

As far as .NET goes, my first point was that the standard library does not support it; true in this case. I'm aware of CLR and Bouncy Castle as external libraries but neither of them inspires me with confidence.

Supposedly, CLR was released by Microsoft but why didn't they include it in the standard library or release any associated security assessment reports? Were there any?

I've heard the name Bouncy Castle thrown around quite a bit but that's about it. When I dig through their websites, it leaves me with a feeling not unlike trying to find information about Truecrypt. Granted, I haven't followed their project(s) very closely. But because of that feeling, I honestly trust OpenSSL more because people are scared about it.

So, maybe I'm just missing something but this is where I've arrived. Please correct me if I'm way off base.

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#102

Post by cpach » Sun, Jun 15, 2014, 8:16 AM UTC

archwisp wrote: post #101

tptacek wrote: post #99

Earlier quoted context omitted.

Can you be more specific? Because this assertion didn't ring true to me based on my own experience, and less than 5 minutes of Googling appears to refute it: * OpenSSL supports AEAD through CCM and GCM (and OpenSSL's GCM uses PCLMUL and shouldn't have the obvious cache leak) * Botan supports AEAD through OCB, GCM, CCM, EAX, and SIV(!). * Java JCE with the Bouncycastle provider (extremely popular) does AEAD with GCM,…

Sorry for the slow reply. I haven't looked into setting up notifications for replies. (if that exists on HN?) But .NET probably represents the largest block of applications I see. Seconded by ( shudder ) CF. I don't really have any hope for CF but crypto is hardly it's biggest problem. As far as .NET goes, my first point was that the standard library does not support it; true in this case. I'm aware of CLR and Bouncy…

Notifications are possible via this third party site: http://hnnotify.com – works great!

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#103

Post by tomp » Tue, Jun 17, 2014, 11:41 AM UTC

tptacek wrote: post #51

I disagree with two big points in this talk, but I'm sorry to say they're the same two things I disagreed with last time, so this is going to be a boring comment. First, dedicated AEAD cipher modes are superior to manually composing AES-CTR and HMAC-SHAx. AEAD modes provide both authentication and encryption in a single construction. AES-CTR+HMAC-SHAx involves joining two constructions to do the same thing. Colin poi…

I have a probably stupid question for you regarding ECC: in general, is ECC cryptography safe from attacks such as "Dual_EC_DRBG",where the curve itself was (potentially) constructed specifically to be breakable? I.e. if I use one of the publicly recommended curves, am I safe or could the curve also be broken by its author?

Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]

#104

Post by derefr » Tue, Jun 17, 2014, 5:07 PM UTC

Nimi wrote: post #92

aianus wrote: post #91

Earlier quoted context omitted.

You write a cookie to the client containing some random key and associate that key to the user on your backend in the shared db. Since it's just random data, you don't need to sign or encrypt the cookie and SSL takes care of protecting it in transport.

Does this random value need to be unpredictable? And leaving this specific example aside for a moment, I was trying to prove a larger point: people write crypto code for a reason. Some people will write it for no reason at all, yes. A lot of other devs will be dying to save themselves the time it will take to write any type of code, especially if it has to deal with something they aren't experts in, but they just can…

Here's a principle from which you could derive "use unique tokens to identify the user": effectively, TLS already has a mechanism of fingerprinting users, called "client certificates." Their current browser UI sucks (much like HTTP Basic Auth) so nobody uses them (much like HTTP Basic Auth), and instead provides poor reimplementations of them (much like HTTP Basic Auth.) If you think about what you need to simulate having a client cert--a persistable shared secret generated by the host and securely sent to the client--then "a long random key inside a cookie" is what you'll be naturally lead to.