There weren't any "Don'ts" about compression.
Is that solely an SSL/TLS concern, or is it generally applicable to cryptosystems?
Everything you need to know about cryptography in 1 hour (2010) [pdf]
31–40 of 104 posts
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#32The reason this is being (re)posted now is that I gave this talk at a Polyglot Vancouver meetup last night. Freed from the constraint of a conference schedule I actually took about 90 minutes to go through this talk this time (followed by another 30 minutes of questions).
[deleted]
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#33Earlier quoted context omitted.
As someone who is completely new to cryptography and knows very little, where would you recommend I start? I've recently been reading about bitwise operations to become familiar with how to (somewhat) interpret what a cryptograhic algorithm is doing in a program, since bitwise operations seems to be popular in almost all crypto algorithms.
I would highly recommend reading Cryptography Engineering [0] cover to cover. It's amazingly readable, covers the basics, the theory necessary to understand how things works and includes ample practical advice and observations on the industry. The first thing I did after the Snowden leaks was read through the entire thing and after doing so I really wished I had done this years earlier. There's very few books that I…
I don't. This book recommends, say, MAC-then-Encrypt and tries to justify it in 2010 by perpetuating FUD about provable crypto (proofs are only valid if your primitives are ideal, therefore you should worry about--one set of--risks that you can't measure, so trust us instead of proofs). There's no excuse for doing that.
In general, the authors seem to subscribe to "crypto is black magic" school of thought, which doesn't make for good pedagogy.
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#34Earlier quoted context omitted.
The comments say that there's an Ogg download but I can't find it. Any pointers?
Someone posted the bliptv link above: http://blip.tv/fosslc/everything-you-need-to-know-about-cryp... $ youtube-dl http://blip.tv/blahblah $ ffmpeg -i file.flv file.ogv
youtube-dl also has a --recode-video option that takes ogg or webm.
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#35Earlier quoted context omitted.
The comments say that there's an Ogg download but I can't find it. Any pointers?
Someone posted the bliptv link above: http://blip.tv/fosslc/everything-you-need-to-know-about-cryp... $ youtube-dl http://blip.tv/blahblah $ ffmpeg -i file.flv file.ogv
Thank you, for introducing me to youtube-dl.
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#36Here's a provocative gem: > The purpose of cryptography is to force the US government to torture you.
As in the $5 wrench xkcd: http://xkcd.com/538/
or Rubber-hose Cryptanalysis
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#37I used Poly1305, but exactly in the way Daniel J. Bernsetein used it in his NaCl library. I also used his ECC signature scheme, also in exactly the same way. :)
As far as I can tell the gotcha with Poly1305 is that you absolutely cannot reuse the same key ever. His construction involves using your keyed cipher to create 32 random bytes by encrypting 32 zero bytes before encrypting the actual message. These random bytes are then used as the one-time-use Poly1305 key. In NaCl he does this with either Salsa20 or AES-CTR, both of which are stream ciphers. (CTR converts a block cipher into a stream cipher.)
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#38> PROBABLY AVOID: Elliptic Curve signature schemes. Including Ed25519?
This PDF is a tiny bit old, so I wonder what they'd say today. I guess it depends on how conservative you want to be. RSA has been through a ton of cryptanalysis and peer review and has stood the test of time. Ed25519 is newer. It's highly regarded but hasn't been analyzed as much or used as heavily so you're taking a bit more of a risk.
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#39Earlier quoted context omitted.
I do now: http://daemonology.net/papers/crypto1hr-small.pdf
Many thanks. I wish Beamer made a bigger point of recommending distribution in handout mode or more accurately dissuading distribution in presentation mode.
I always do that now. The only reason I didn't this time is that the slides were from 2010, before I updated my Makefile to automatically build both versions.
Re: Everything you need to know about cryptography in 1 hour (2010) [pdf]
#40Here's a provocative gem: > The purpose of cryptography is to force the US government to torture you.
[deleted]