Live data from Hacker News

Crypto 101 – Introductory course on cryptography

crypto101.io

41–50 of 148 posts

Re: Crypto 101 – Introductory course on cryptography

#41
post #20

Earlier quoted context omitted.

There's a difficult rabbithole here - eventually you have to draw a line and decide to trust someone . Otherwise it's just layer after layer of paranoia until you implode in a puff of Philip Dick :)

Of course; my point is (and I assume that's also the point of other people who assert similar stances on the topic) that the average programmer or software engineer should leave these things to recognized cryptographers. This also highlights a peculiarity with cryptography, in that it is very hard to understand for laymen (assuming laymen are ppl with some CS or math education), so most arguments in discussions of la…

> Of course; my point is (and I assume that's also the point of other people who assert similar stances on the topic) that the average programmer or software engineer should leave these things to recognized cryptographers.

If "crypto is for cryptographers" is your stance I think you're doing yourself a disservice. Understanding crypto, as in learning the foundations of it, is important for everyone. Having a good grasp of cryptography helps with making decisions in your code base w.r.t to how you use cryptography primitives and tends to help you in identifying places where it's gone wrong.

I agree that it's easy to get these things wrong but I don't think that's a very good reason not to try to write or read up on the subject. And yes, it's possible that what you get taught might have holes too. But it's easier to fix these holes, for example by having discussions around the topic with others and validating what you're being taught, than acquiring the knowledge to begin with.

Now the author in question (lvh) is also known for their contributions to caesium (Clojure implementation of libsodium/NaCl) and Python Cryptographic Authority's cryptography library. They've got some solid chops in the area but make of it what you will.

That said, rolling your own crypto should be left to cryptographers with extensive peer reviewing and so on.

Re: Crypto 101 – Introductory course on cryptography

#42
post #40
post #20

Earlier quoted context omitted.

Of course; my point is (and I assume that's also the point of other people who assert similar stances on the topic) that the average programmer or software engineer should leave these things to recognized cryptographers. This also highlights a peculiarity with cryptography, in that it is very hard to understand for laymen (assuming laymen are ppl with some CS or math education), so most arguments in discussions of la…

Look at DES or MD5. Were they not designed by cryptographers? Or how about the whole Dual_EC_RBG backdoor fiasco? Yes, there was criticism right from the start, but it was adopted and used widely as far as I know. Heck, Dual_EC_RBG was only ousted in 2013: "The ANSI X9F1 Tool Standards and Guidelines Group which discussed the backdoor also included three employees from the prominent security company RSA Security.[6]…

Nitpick: DUAL_EC was adopted despite cryptographer's complaints; I don't think there any cryptographers vociferously supporting it.

I do agree that learning crypto is a good thing, because it gives you an idea of what your primitives should do, and when it is appropriate to use them. People should always refrain from using their own home-grown crypto, however.

Re: Crypto 101 – Introductory course on cryptography

#43
post #20

Earlier quoted context omitted.

There's a difficult rabbithole here - eventually you have to draw a line and decide to trust someone . Otherwise it's just layer after layer of paranoia until you implode in a puff of Philip Dick :)

Of course; my point is (and I assume that's also the point of other people who assert similar stances on the topic) that the average programmer or software engineer should leave these things to recognized cryptographers. This also highlights a peculiarity with cryptography, in that it is very hard to understand for laymen (assuming laymen are ppl with some CS or math education), so most arguments in discussions of la…

To clarify: I didn't mean that people shouldn't learn or read about the topic, or try designing their own block or stream ciphers, hashes, KDFs and of course protocols (which are great fun!), not at all. Both my original comment and this one are directed at production use of cryptography.

Re: Crypto 101 – Introductory course on cryptography

#44

Quick question, I had apparently Pinboarded this in March 2014. I see the PDF is still pre-release. Has anything changed with this, or is it kinda just coming up again because of recent political climate. I'm fine either way, just curious if this has changed drastically from what I had looked at previously.

Paragraph "Development" (page 14 in the current version) answers your question:

"The entire Crypto 101 project is publicly developed on GitHub under the crypto101 organization, including this book: https://github.com/crypto101/book "

[...]

"The copy of this book that you are reading right now is based on the git commit with hash 3f89ec3 , also known as 0.4.0-22-g3f89ec3"

Then, looking at the commits, yes the book changed a lot since 2014: https://github.com/crypto101/book/commits/master

Re: Crypto 101 – Introductory course on cryptography

#46

Quick question, I had apparently Pinboarded this in March 2014. I see the PDF is still pre-release. Has anything changed with this, or is it kinda just coming up again because of recent political climate. I'm fine either way, just curious if this has changed drastically from what I had looked at previously.

Paragraph "Development" (page 14 in the current version) answers your question: "The entire Crypto 101 project is publicly developed on GitHub under the crypto101 organization, including this book: https://github.com/crypto101/book " [...] "The copy of this book that you are reading right now is based on the git commit with hash 3f89ec3 , also known as 0.4.0-22-g3f89ec3" Then, looking at the commits, yes the book cha…

[deleted]

Re: Crypto 101 – Introductory course on cryptography

#47
post #4

This is currently on edx. Its more advanced that the courses mentioned here. I do not know what edx will do after the course ends, but if you want it you can get it while it ss still available. https://www.edx.org/course/quantum-cryptography-caltechx-del... Quantum Cryptography by Thomas Vidick (Caltech) and Stephanie Wehner (Delft University)

So-called Quantum Cryptography is largely snake oil. The most important things you need to know about it is that:

* In order to do QC you need an authenticated channel first. QC proponents hardly mention that or try to obscure it, but it basically means you can't have QC unless you already have some other secure cryptography.

* QC has severe practical limits. It needs a point to point connection capable of sending physical particles. That means: No Wifi, no mobile Internet and no connections over large distances. Given that these people recently started talking about a "Quantum Internet" makes this simply ridiculous.

Re: Crypto 101 – Introductory course on cryptography

#48

When I was taking Aikido, there was a day when the sensei was going through all of our techniques and showed how the uke (initiator of the attack, receiver of the technique) could turn things around on the tori . (receiver of the attack, initiator of the technique) It seemed like there were a half dozen ways each that a technique could go seriously wrong, and that many of them didn't require much skill, only determin…

Not exactly what you describe but related: people build intentionally-vulnerable applications for the sake of teaching security by example.

In the sub-domain of web security, django.nV is such a "purposefully vulnerable Django application" that comes as companion to a websec tutorial: https://github.com/nVisium/django.nV

No disclaimer, I have no affiliation with the project, I just enjoy their work.

Re: Crypto 101 – Introductory course on cryptography

#49

Earlier quoted context omitted.

People who can break it won't spend the time breaking your homegrown crypto, so you won't get proof it's broken. But it's still broken. If lots of money or lives of political dissidents are at stake, it will be broken. To have really capable people work on breaking your crypto for free, you have to be an insider. You become an insider by breaking other people's crypto. You can publish a break in an insider's crypto e…

Ciphers aren't the place where security most often fails. The failures have to do with implementation. More commonly, they have to do with implementation of protocols and systems using the protocols.

I agree, but I replied to someone who talked about ciphers.
Post reply on HN