Cryptography 101 with Alfred Menezes
cryptography101.ca
Cryptography 101 with Alfred Menezes
1–10 of 20 posts
Re: Cryptography 101 with Alfred Menezes
#2Alfred Menezes has also written a Handbook of Applied cryptography that can be accessed and download for free:
Re: Cryptography 101 with Alfred Menezes
#3Alfred Menezes has also written a Handbook of Applied cryptography that can be accessed and download for free: https://cacr.uwaterloo.ca/hac/
And co-authored the "another look" papers at https://anotherlook.ca/
Re: Cryptography 101 with Alfred Menezes
#4Oh hey I took his crypto class in fourth year! Fantastic prof, I should check this out to refresh my memory.
Re: Cryptography 101 with Alfred Menezes
#5What I would like, but haven’t found yet, is a cheat sheet on what up to date encryption method or algorithm one should use for whatever need. A kind of requirement -> algorithm dictionary.
Like, I need to authenticate that a client is a known identity. What algo? How to use it? What to avoid? I need to sign a message or document. How? I need to verify said message. How? I need to store passwords. How?
I know some crypto, but discovering and learning about them is a bit of a pain. For how important crypto is, you‘d think someone would have bothered to teach developers how to choose and deploy these algorithms properly.
Re: Cryptography 101 with Alfred Menezes
#6What I would like, but haven’t found yet, is a cheat sheet on what up to date encryption method or algorithm one should use for whatever need. A kind of requirement -> algorithm dictionary. Like, I need to authenticate that a client is a known identity. What algo? How to use it? What to avoid? I need to sign a message or document. How? I need to verify said message. How? I need to store passwords. How? I know some cr…
If your needs are this simple, you may be better served by an opinionated crypto library like Monocypher [0] or libsodium [1]. Just look at the latter's FAQ page and you'll see they're taking your approach targeting developers, not cryptographers.
They'll provide you one blessed algorithm for every primitive with secure alternatives if your use-case demands them. XChaCha20-Poly1305 for encryption, EdDSA for signatures, X25519 for key exchange, BLAKE2b for a hash, Argon2i for a KDF.
Re: Cryptography 101 with Alfred Menezes
#7What I would like, but haven’t found yet, is a cheat sheet on what up to date encryption method or algorithm one should use for whatever need. A kind of requirement -> algorithm dictionary. Like, I need to authenticate that a client is a known identity. What algo? How to use it? What to avoid? I need to sign a message or document. How? I need to verify said message. How? I need to store passwords. How? I know some cr…
Google’s Tink crypto library had a slightly technical page to help with that: https://developers.google.com/tink/choose-primitive
Re: Cryptography 101 with Alfred Menezes
#8What I would like, but haven’t found yet, is a cheat sheet on what up to date encryption method or algorithm one should use for whatever need. A kind of requirement -> algorithm dictionary. Like, I need to authenticate that a client is a known identity. What algo? How to use it? What to avoid? I need to sign a message or document. How? I need to verify said message. How? I need to store passwords. How? I know some cr…
It's not new, and some people would disagree on some minor elements -- but a good place to start was regularly this blog from approximately Matasano/NCC Group members, called Cryptographic Right Answers [1]. It's very clear, gives straight forward answers in clear fashion -- and with multiple opinions often aligning.
It was updated a few times, I wonder if the equivalent exists for PQ?
Edit/Update: Found the PQ one @ [2], definitely check it out!
Maybe I'm mis-remembering, but perhaps the most controversial element was the regular recommendation of AES-GCM. It certainly has excellent security properties, but also a certain brittleness re: nonces.
[1] https://www.latacora.com/blog/2018/04/03/cryptographic-right... [2] https://www.latacora.com/blog/2024/07/29/crypto-right-answer...
Re: Cryptography 101 with Alfred Menezes
#9What I would like, but haven’t found yet, is a cheat sheet on what up to date encryption method or algorithm one should use for whatever need. A kind of requirement -> algorithm dictionary. Like, I need to authenticate that a client is a known identity. What algo? How to use it? What to avoid? I need to sign a message or document. How? I need to verify said message. How? I need to store passwords. How? I know some cr…
It's not new, and some people would disagree on some minor elements -- but a good place to start was regularly this blog from approximately Matasano/NCC Group members, called Cryptographic Right Answers [1]. It's very clear, gives straight forward answers in clear fashion -- and with multiple opinions often aligning. It was updated a few times, I wonder if the equivalent exists for PQ? Edit/Update: Found the PQ one @…
> Random IDs
> Latacora, 2018: Use 256-bit random numbers.
> Latacora, 2024: You should get 100 lava lamps, point a camera to them and use the frames as seed for a PRNG.
Man, is my boss gonna be surprised what's getting requisition ordered this morning.
Re: Cryptography 101 with Alfred Menezes
#10What I would like, but haven’t found yet, is a cheat sheet on what up to date encryption method or algorithm one should use for whatever need. A kind of requirement -> algorithm dictionary. Like, I need to authenticate that a client is a known identity. What algo? How to use it? What to avoid? I need to sign a message or document. How? I need to verify said message. How? I need to store passwords. How? I know some cr…
It's not new, and some people would disagree on some minor elements -- but a good place to start was regularly this blog from approximately Matasano/NCC Group members, called Cryptographic Right Answers [1]. It's very clear, gives straight forward answers in clear fashion -- and with multiple opinions often aligning. It was updated a few times, I wonder if the equivalent exists for PQ? Edit/Update: Found the PQ one @…
I think this is a primary reason why there is no real "cheatsheet" for this stuff. The application of a given algo (and even what types of inputs you provide) are heavily dependent on the detailed specifics of your use case and how you apply them