I downloaded this about a year ago and loved it. Incredibly informative. Is this an updated version?
Crypto 101 – Introductory course on cryptography
101–110 of 148 posts
Re: Crypto 101 – Introductory course on cryptography
#102For idiots like myself, I found this video, Public key cryptography - Diffie-Hellman Key Exchange (full version), to be completely enlightening using mixed colors to explain the most basic features of a cryptography algorithm.[0]
Re: Crypto 101 – Introductory course on cryptography
#103This is great! Kudos to the author and thanks Rackspace for sponsoring this as well.
It's really encouraging to see this increased democratization of crypto not necessarily in the engineering of it per se but rather the awareness and understanding of it.
Re: Crypto 101 – Introductory course on cryptography
#104This is currently on edx. Its more advanced that the courses mentioned here. I do not know what edx will do after the course ends, but if you want it you can get it while it ss still available. https://www.edx.org/course/quantum-cryptography-caltechx-del... Quantum Cryptography by Thomas Vidick (Caltech) and Stephanie Wehner (Delft University)
So-called Quantum Cryptography is largely snake oil. The most important things you need to know about it is that: * In order to do QC you need an authenticated channel first. QC proponents hardly mention that or try to obscure it, but it basically means you can't have QC unless you already have some other secure cryptography. * QC has severe practical limits. It needs a point to point connection capable of sending ph…
Of the first point I shall plead Wittgenstein and not speak, but as regards the second: In what way are photons, the medium of wireless telecommunication, not physical particles? In what way are, indirect connections not decomposable into multiple direct connections (broadcast vs. point-to-point is a more robust difference, I agree)?
Re: Crypto 101 – Introductory course on cryptography
#105This is about to eat my weekend, I think! :) Quite seriously, this is exactly what the tech world needs - personally, I know that in terms of understanding of crypto I'm streets ahead of the average Joe, but orders of magnitude behind people who actually know the field. I'm certain I'm far from alone in that set, but the way the world's going means that we with the generalised technical know-how have a moral impetus…
I'm not sure if it still applies, but there is a saying: "There are maybe 5 people in the world that may call themselves cryptographers"
And they're called Alice, Bob, Chris, Dave and Eve.
Re: Crypto 101 – Introductory course on cryptography
#106When I was taking Aikido, there was a day when the sensei was going through all of our techniques and showed how the uke (initiator of the attack, receiver of the technique) could turn things around on the tori . (receiver of the attack, initiator of the technique) It seemed like there were a half dozen ways each that a technique could go seriously wrong, and that many of them didn't require much skill, only determin…
There should be. In industry, we call those things CTFs, and there are both attacker and defender CTFs. My experience has been that they are extremely effective learning tools.
extremely effective learning tools
As far as they go, maybe; but I worry that people don't appreciate the limitations. Making sure that someone can't code up an exploit against your system in half an hour is absolutely essential, but it's not the only thing that matters -- a serious cryptographer is also going to be concerned about "two years of coding and ten million dollars of computing power" attacks, which can be safely disregarded in CTFs.
Re: Crypto 101 – Introductory course on cryptography
#107The old Cryptopals challenges (http://cryptopals.com/) seem to cover the same material in a pedagogically very different way - they don't feed you the information as this book does, but give you a practical task which can be easily done with e.g. reading the specification of an algorithm from wikipedia, but figuring out the implementation of the attack yourself gives a much better understanding than simply reading about it.
Although this book claims a "Learn by doing" approach, I didn't find any specific assignments or data samples to facilitate that.
Re: Crypto 101 – Introductory course on cryptography
#108Earlier quoted context omitted.
Something tells me a conspirator wouldn't be required anyways. Your security is either sound or broken, i.e. probably broken unless you use proven implementations of proven cryptosystems with proven configurations. E.g. even if RSA is (currenly) safe, as well as its primitives and common configuration... rolling your own implementation will probably be subject to timing attacks.
Something tells me a conspirator wouldn't be required anyways. The conspirator is there to teach about Defense in Depth. Systems that rely on just 1 "impenetrable" membrane tend to be brittle. Their failure is catastrophically sudden and complete, like glass breaking. Glass is way harder than steel, but steel structures are much more robust, because steel's ductility allows for partial failures and continued resistan…
Defense in depth mostly does not work (against willful targeted attacks).
Software is not the real world where things bend. If a barrier is sane, it will stand, nobody will break it. But no matter how many non-sane barriers you add, you can not turn them into a sane one. The only thing you will achieve is to increase your system complexity and get more bugs as a result.
Re: Crypto 101 – Introductory course on cryptography
#109Earlier quoted context omitted.
> I really have no way of verifying if I'm learning the correct DHE, and I know that it's easy to get wrong. Perhaps I can do some testing in code, but I may test it incorrectly too, and those small errors can be exploited. Well this is step 0 in cryptography engineering: You don't implement primitives. Use reviewed components providing primitives and implement your protocol on top of that. Step -1 is to not design y…
There's a difficult rabbithole here - eventually you have to draw a line and decide to trust someone . Otherwise it's just layer after layer of paranoia until you implode in a puff of Philip Dick :)
It's not really a rabbithole in most cases - unless you have exceptional expertise (and you'd know), you should trust someone else right away, not eventually, because you should trust yourself even less.
Even if you have good reason to believe that all available third party systems are vulnerable to one or another intelligence agency, using that would still be more secure than doing everything yourself, which you can't do properly (noone can do that without extensive review from a large community, so you definitely can't as well), and thus making a system that's vulnerable to everyone.
Re: Crypto 101 – Introductory course on cryptography
#110Earlier quoted context omitted.
So-called Quantum Cryptography is largely snake oil. The most important things you need to know about it is that: * In order to do QC you need an authenticated channel first. QC proponents hardly mention that or try to obscure it, but it basically means you can't have QC unless you already have some other secure cryptography. * QC has severe practical limits. It needs a point to point connection capable of sending ph…
Of the first point I shall plead Wittgenstein and not speak, but as regards the second: In what way are photons, the medium of wireless telecommunication, not physical particles? In what way are, indirect connections not decomposable into multiple direct connections (broadcast vs. point-to-point is a more robust difference, I agree)?
For QC to work, the receiver must receive the exact same photons the transmitter created. Those photons can not be tampered with, what means they can not be relayed, or reflected by most surfaces.