Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptographic Right Answers: Post Quantum Edition

latacora.com

Post reply on HN
Print view View original

21–30 of 61 posts

Re: Cryptographic Right Answers: Post Quantum Edition

#21

Post by stratom »

BoppreH wrote: post #6

Excellent post, I've always recommended people to this series. I'm curious what's the general opinion on the production-readiness of these solutions. Open Quantum Safe, for example, discourages it's use in production, and recompiling nginx to use PQC-BoringSSL feels risky since I'm not intimately familiar with both projects ("did I miss a --enable-security flag?"). > the PQ keys are 4 orders of magnitude larger For M…

The field is too young that we can be absolutely sure. That's why most suggest to use hybrid cryptography for now.

Re: Cryptographic Right Answers: Post Quantum Edition

#22

Post by slooonz »

michaelt wrote: post #8

I've always found it a bit disquieting how many times people feel the need to update these "cryptographic right answers" blog posts. This is what, a fourth or fifth version since 2009? Meanwhile everything from ubuntu's apt-get to my connection to HN is secured with 2048-bit RSA - an algorithm invented in 1977 and in widespread use since at least 1995. Am I getting crypto advice that will keep my data safe for 30+ ye…

> Meanwhile everything from ubuntu's apt-get to my connection to HN is secured with 2048-bit RSA - an algorithm invented in 1977 and in widespread use since at least 1995.

That’s a bit misleading, considering RSA is only used for certificate verification. Key exchange and symmetric encryption is handled by somewhat more recent algorithms (ECDH / AES-GCM).

Re: Cryptographic Right Answers: Post Quantum Edition

#23

Post by upofadown »

>Avoid: HMAC-MD5, HMAC-SHA1 and such. The underlying hash function has to be safe.

Interestingly enough, there is a proof out there that more or less states the opposite for HMAC-MD5 and HMAC-SHA1:

* https://eprint.iacr.org/2006/043.pdf

The issue here is that MD5 and SHA1 are broken for collisions. But no one could figure out an actual attack for HMACs based on them. The linked paper is an attempt to explain that.

Re: Cryptographic Right Answers: Post Quantum Edition

#25

Post by red_admiral »

ccppurcell wrote: post #17

As I understand it, the only reason pqc is of "practical" concern is the issue of "store now, decrypt later". Is it possible to defend against this attack in a classical way? Some sort of time limit on decryption? Or an argument that it's impossible?

The NSA has a copy of your ciphertexts on their disks today. What could stop them from trying to decrypt it in 5 years' time? It's not like they will be held back by any Terms & Conditions.

The only way you can do any "not after X time" decryption even for honest-ish users is if the decryption involves getting extra key material from some server that erases it or shuts down at some point. But even that doesn't help if someone can break the crypto.

Re: Cryptographic Right Answers: Post Quantum Edition

#26

Post by wepple »

michaelt wrote: post #8

I've always found it a bit disquieting how many times people feel the need to update these "cryptographic right answers" blog posts. This is what, a fourth or fifth version since 2009? Meanwhile everything from ubuntu's apt-get to my connection to HN is secured with 2048-bit RSA - an algorithm invented in 1977 and in widespread use since at least 1995. Am I getting crypto advice that will keep my data safe for 30+ ye…

Perhaps the meta-message here is that you absolutely have to design for cryptographic agility.

You may not need to jump to the next best thing every 3 years, but as certain constructs are proven weak, you’ll need to start migrating systems and data off of them to modern equivalents.

Re: Cryptographic Right Answers: Post Quantum Edition

#27

Post by lumb63 »

michaelt wrote: post #8

I've always found it a bit disquieting how many times people feel the need to update these "cryptographic right answers" blog posts. This is what, a fourth or fifth version since 2009? Meanwhile everything from ubuntu's apt-get to my connection to HN is secured with 2048-bit RSA - an algorithm invented in 1977 and in widespread use since at least 1995. Am I getting crypto advice that will keep my data safe for 30+ ye…

The “right answer” also depends on attack vector. If you are trying to protect against nation-state-level tampering or data leaks for two full generations, the enemy moves much quicker, and so you will need to advance much more quickly, to outpace what you think they might do to outpace you in the future.

If you are only trying to prevent your ISP from seeing your traffic, which they are not trying particularly hard to do, then that level of protection would be overkill.

Re: Cryptographic Right Answers: Post Quantum Edition

#28

Post by rgovostes »

“Classical cryptography” used to refer to historical ciphers, Vigenère and the like, tapering off after the World War 2-era cipher machines and definitely not used to describe asymmetric algorithms. There should be a different term for pre- (non-?) quantum cryptography from the modern era. We already suffered the redefinition of “crypto”.

Re: Cryptographic Right Answers: Post Quantum Edition

#29

Post by BoppreH »

stratom wrote: post #21
BoppreH wrote: post #6

Excellent post, I've always recommended people to this series. I'm curious what's the general opinion on the production-readiness of these solutions. Open Quantum Safe, for example, discourages it's use in production, and recompiling nginx to use PQC-BoringSSL feels risky since I'm not intimately familiar with both projects ("did I miss a --enable-security flag?"). > the PQ keys are 4 orders of magnitude larger For M…

The field is too young that we can be absolutely sure. That's why most suggest to use hybrid cryptography for now.

True, and hybrid cryptography is definitely the way to go.

But there's more to it than just resistance to cryptanalysis: crashes, memory leaks, disabled security features (e.g., ASLR), irregular performance, supply chain attacks...

PQC requires extra code, and every added instruction carries some risk.

Re: Cryptographic Right Answers: Post Quantum Edition

#30

Post by woodruffw »

upofadown wrote: post #23

>Avoid: HMAC-MD5, HMAC-SHA1 and such. The underlying hash function has to be safe. Interestingly enough, there is a proof out there that more or less states the opposite for HMAC-MD5 and HMAC-SHA1: * https://eprint.iacr.org/2006/043.pdf The issue here is that MD5 and SHA1 are broken for collisions. But no one could figure out an actual attack for HMACs based on them. The linked paper is an attempt to explain that.

I think the phrasing in this post could be better, but the basic observation is sound: if the last use of a weak hash function in your codebase is in HMACs, then it’s better to upgrade to a stronger underlying hash function and apply a blanket ban to the weak ones. Similarly, in a greenfield codebase, there’s no reason to pick an HMAC construction based on a weaker hash when collision-resistant ones are universally available.
Post reply on HN