Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptographic Right Answers

latacora.singles

Post reply on HN
Print view View original

141–150 of 243 posts

Re: Cryptographic Right Answers

#141

Post by tptacek »

geofft wrote: post #140
norrius wrote: post #53

Earlier quoted context omitted.

Indeed. What on Earth is “bzzrt pop ffssssssst”? Am I missing something? Google does not help at all.

Percival 2009 is http://www.daemonology.net/blog/2009-06-11-cryptographic-rig... - the actual summary recommendation is "Use RSAES-OAEP with SHA256 as the hash function, MGF1+SHA256 as the mask generation function, and a public exponent of 65537. Make sure that you follow the decryption algorithm to the letter in order to avoid side channel attacks." I assume the misquote is making fun of how long that description is…

That, and the fact that nobody who uses RSA appears to follow that recommendation --- by far the most common RSA construction is (broken) P1v15 padding.

Re: Cryptographic Right Answers

#142

Post by tptacek »

bsder wrote: post #121
lvh wrote: post #104

Earlier quoted context omitted.

I think STROBE is quite a bit smaller than TweetNaCl once deployed, in gates or bytes, both ROM and RAM. More generally, there are lots of off-list recommendations that are still fine. The list doesn’t have AESCBCHMAC anymore but I’m unlikely to tell you Fernet is busted. We could do an elaborate embedded post but the answers diverge a lot more because constraints are tighter. If you’re doing embedded you need a secu…

The real question is which of these have actually been vetted . I trust NaCl and, specifically, DJB-associated implementations thereunto. Lots of people have looked at it. I trust DJB and his cohorts to think about and mitigate footguns as much as practical. STROBE is right about a year old. Maybe it's awesome, but it almost certainly hasn't been vetted sufficiently. I seem to recall that most PAKE's relied on one of…

Why do you trust Bernstein more than you trust Mike Hamburg?

Re: Cryptographic Right Answers

#143

Post by cperciva »

pbsd wrote: post #139
cperciva wrote: post #132

Earlier quoted context omitted.

I think this is our largest point of divergence. While I'm on the topic: Password handling: I skip bcrypt because the only reason to not use scrypt is if you need a US Government endorsed scheme. But yeah, it's (slightly) better than PBKDF2. Cryptographic primitives: I think "use NaCl" is cheating a bit as far as answers go; that may be reasonable advice to implementors but it's not a protocol specification. So I'm r…

To be pedantic, Keccak does have a 5 to 5 bit S-box. But like 3-Way, NOEKEON, Serpent, etc, it's disguised---bitsliced---as a short sequence of boolean operations.

If you want to be really pedantic, every boolean operation is just a 2->1 bit S-box...

Re: Cryptographic Right Answers

#144

Post by garmaine »

tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

What about the disadvantageous aspect of djb’s curves, like that they have a non-unit cofactors? That’s a huge foot-gun that has already maimed a few people.

Also, deterministic signing nonces have NOTHING to do the DSA/ECDSA vs alternative signatures scheme. The library you recommend just uses its own deterministic signer internally, just as any ECDSA implementation can and should (e.g. bitcoin’s does).

Re: Cryptographic Right Answers

#145

Post by web007 »

tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

Is it problematic that we're moving to a djb crypto monoculture, with 25519 and ChaCha and Poly1305 and even NaCl all as recommendations? Or is he the hero we need to fight bad or weakened crypto?

I've loved the CryptoPals series, even just reading the challenges for the more advanced parts while I poke at the easier stuff. Please keep them up, and hopefully I'll get all the way through "Shackling the Masses with Drastic Rap Tactics" someday!

Re: Cryptographic Right Answers

#146

Post by 29jm »

garmaine wrote: post #144
tptacek wrote: post #2

Fight me. I mean, happy to answer any questions. By the way: if you're interested in this, you might also be interested in the set of 9 (count them: 9) new cryptopals challenges we sold off to raise money for rural congressional races on Twitter: https://twitter.com/search?f=tweets&q=set%208%20from%3Atqbf&... This is Cryptopals Set 8, before this weekend available only on request and after swearing a solemn oath not…

What about the disadvantageous aspect of djb’s curves, like that they have a non-unit cofactors? That’s a huge foot-gun that has already maimed a few people. Also, deterministic signing nonces have NOTHING to do the DSA/ECDSA vs alternative signatures scheme. The library you recommend just uses its own deterministic signer internally, just as any ECDSA implementation can and should (e.g. bitcoin’s does).

Could you expand on what's dangerous in using a curve with a non-unit cofactor? I haven't heard of this as an attack vector before.

Re: Cryptographic Right Answers

#147

Post by rsync »

jlgaddis wrote: post #114
piracykills wrote: post #95

Curious - why is argon2 still second to scrypt on this list? I'd also question the backup solution, I think Restic is a better option due to its flexibility, I can do cheap backups to B2 and fairly reputable people seem to be approving of its cryptography: https://blog.filippo.io/restic-cryptography/ If anyone sees a reason why Tarsnap would be better (other than Percival's brand), I'd be quite interested.

Thanks for the pointer to restic. I like and use tarsnap (and have for years) but the lack of choice of backends is a downside. I've been waiting for something I can use to backup my workstation and laptops to a server at home as well as a server I have at $work (ISP). I've tried out all the usual applications but have yet to find something I'm happy with. restic looks like it may fit the bill perfectly.

"I've been waiting for something I can use to backup my workstation and laptops to a server at home as well as a server I have at $work (ISP)."

borg[1] has been referred to as "the holy grail of backups"[2] and is supported at rsync.net.[3]

The end result is encrypted, zero knowledge remote backups on a ZFS filesystem that you can SSH to.

I think everyone here knows all about rsync.net, but here are some examples:[4]

  ssh user@rsync.net sha256 some/file
  pg_dump -U postgres db | ssh user@rsync.net "dd of=db_dump"
  ssh user@rsync.net du -Ahd2 some/directory
[1] https://borgbackup.readthedocs.io/en/stable/

[2] https://www.stavros.io/posts/holy-grail-backups/

[3] http://rsync.net/products/attic.html

[4] http://www.rsync.net/resources/howto/remote_commands.html

Re: Cryptographic Right Answers

#148

Post by brohee »

bsder wrote: post #131
brohee wrote: post #69

A bit tired with "Just use HMAC". HMAC makes you pull a hash dependency, which is not much if you do software, but can be a waste of silicon if all you want is a MAC. If you already spent real estate on AES, then CMAC becomes a lot more attractive... This is the reasons it's at the core of SCP03, the smartcard world is very sensitive to transistor count...

> This is the reasons it's at the core of SCP03, the smartcard world is very sensitive to transistor count... The reason it's at the core of SCP03 is because SCP03 is ancient (2006?) and once things get affixed intro a "standard" things now move at a glacial pace. And, nowadays, fixed logic transistor count is almost irrelevant. RAM transistor count, however, is expensive and getting moreso.

SCP03 is from 2009 actually. But its authors were likely very aware of HMAC, yet chose CMAC.

Re: Cryptographic Right Answers

#149

Post by brohee »

lvh wrote: post #72
brohee wrote: post #69

A bit tired with "Just use HMAC". HMAC makes you pull a hash dependency, which is not much if you do software, but can be a waste of silicon if all you want is a MAC. If you already spent real estate on AES, then CMAC becomes a lot more attractive... This is the reasons it's at the core of SCP03, the smartcard world is very sensitive to transistor count...

The audience for this document is software engineers. It woudl be impossible to write a document that serves every audience. Unless you're also suggesting that you should AES-CMAC a password reset token? And if we're going to go there, why not PMAC? Or OMAC?

OMAC1 and CMAC are the same thing actually.

Re: Cryptographic Right Answers

#150

Post by loup-vaillant »

posterboy wrote: post #135
loup-vaillant wrote: post #81

Earlier quoted context omitted.

Take Monocypher or TweetNaCL, and rip off any primitive you don't need. This may be enough. Even when you take the whole thing, Monocypher only needs 30kb of x86-64 machine code when compiled with -Os. If you only keep authenticated encryption and x25519, which are enough for many uses, I think you should be able to halve that down to 15kb or less. If speed doesn't matter, TweetNaCl is even smaller. If those aren't e…

avr has aes extensions, surely arm cortex-m has similar. are those any good, are they used by the libs you mention?

If they have hardware AES support, forget everything I said. Monocypher and TweetNacl are portable C, they don't use extensions of any kind.
Post reply on HN