Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rolling your own crypto: Everything you need to build AES from scratch

github.com

Post reply on HN
Print view View original

51–60 of 92 posts

Re: Rolling your own crypto: Everything you need to build AES from scratch

#51

Post by kriro »

tialaramex wrote: post #37
stingraycharles wrote: post #14

Earlier quoted context omitted.

It’s absolutely worth it to roll your own crypto if you want to learn from it. I feel like there is almost a stigma against articles like these because we’ve all been conditioned so much to avoid even thinking about it lol. I did some deep dive into AES and RSA at some point in a distant past, it was a learning experience that to this day allows me to make much better decisions when choosing algorithms.

> It’s absolutely worth it to roll your own crypto if you want to learn from it. It's essentially a waste of your time. Because of Schneier's Law: "Any person can invent a security system so clever that she or he can't think of how to break it". The thing that you might learn from, if you put the work in, would be breaking other people's stuff. Ideally you would find something that's actually in use and vulnerable en…

"""It's essentially a waste of your time."""

Strongly disagree. I'm pretty sure rolling your own crypto will strengthen your understanding of crypto (and potential flaws) a lot. Obviously don't use it in production but by all means, do it for the sake of learning. How can this be a waste of time? That's like saying "never implement a search/sort algorithm, just use libraries"...yeah sure use libraries but also implement the stuff to learn.

Re: Rolling your own crypto: Everything you need to build AES from scratch

#52

Post by badsectoracula »

charlieyu1 wrote: post #26
badsectoracula wrote: post #19

Earlier quoted context omitted.

I always found this "mantra" shortsighted and damaging on the long run - if nobody does their own crypto then who does their crypto? You are incentivizing people against learning this by that and a very significant part of learning something is actually using it in practice.

Because there are always someone who think they learnt enough and do their own implementation, putting the data of them and others at risk. Writing secure implementation of crypto algorithms is hard and there are millions of ways that you can screw up.

A lot of things are hard and yet people do them and implement them all the time, that it might be hard is not a reason for people to not implement things - if anything by implementing them is how they'll learn (especially for those, as mentioned elsewhere in this thread, who learn better by doing).

You can screw up all sorts of things - which may (depending on the situation, application, etc) also end up with data at risk (assuming that there is even such a requirement in the first place). That also doesn't mean people shouldn't implement crypto, otherwise they shouldn't implement anything that touches any data at all - after all someone might use the most secure library in the world and accidentally forget to check for user authentication (or whatever else that has nothing to do with crypto itself but still check for privileged data access) in a specific way and let the data leak out.

And honestly i'm personally vehemently against this elitism-preserving "this is for us enlightened few to dabble with, not you plebeian hands" attitude towards crypto that some people have as if it is some forbidden knowledge that only a few high priests can have.

Re: Rolling your own crypto: Everything you need to build AES from scratch

#53

Post by munchbunny »

watwut wrote: post #22
traceroute66 wrote: post #18

Earlier quoted context omitted.

> It’s absolutely worth it to roll your own crypto if you want to learn from it No. If you want to "learn from it", the first thing you should do is buy a copy of Bruce Schneier's Applied Cryptography . Just reading (and fully understanding !) that book will alone put you in a position where you already know more about cryptography than 90% of other people. If after that you still want to play around with rolling you…

Just no. This idea that people are not allowed to learn by doing things and must read huge books first is absurd. The guidelines for learning you gave here are impractical for majority of people who are interested. It is actually good when people are trying to learn about security. Just about worst thing these absurd rules achieve is that effectively only rule breakers are allowed in.

I also disagree with the “read books instead” stuff. As long as you’re not using your homegrown crypto in production, and more generally as long as you’re not doing stupid things like reusing single-use tokens, why would I care how you choose to spend your learning time? Though if I’m catching these mistakes in pull requests, I might suggest a formal curriculum for the sake of actual software safety.

I see the same problems in internet debates about which programming language to learn first or how to learn programming in general, and a lot of it just doesn’t take into account that learning is a long journey and staying on the path is often more important than taking the fastest or cleanest path. If trying to roll your own stuff is more engaging, great!

Re: Rolling your own crypto: Everything you need to build AES from scratch

#54

Post by fstokesman »

nullc wrote: post #2

It's much more interesting to implement AES without the table lookups-- as doing so requires constructing a boolean circuit that computes the same result as the tables, more useful too since the table lookups result in security killing side channels. :) The author might be surprised at how often someone's random "learn 2 crypto" ends up in use in production. Kudos for the warnings, though I doubt that actually accomp…

If someone copy-pastes this code in spite of the warnings, I consider them to be very much in own-risk territory. Sucks if they end up getting burned, but I don't consider myself responsible.

Re: Rolling your own crypto: Everything you need to build AES from scratch

#55

Post by fstokesman »

rob74 wrote: post #4

Refreshing to see "crypto" meaning cryptography, not cryptocurrencies... And also good that they mention right from the start that you shouldn't use your (or their) self-made cryptography in production (although they could have emphasized it a bit more).

I put the warnings in the title and the first few paragraphs, but also implicitly at the end, where the reader checks the comments to see a great deal of reiterations of the message

Re: Rolling your own crypto: Everything you need to build AES from scratch

#56

Post by vbezhenar »

charlieyu1 wrote: post #26
badsectoracula wrote: post #19

Earlier quoted context omitted.

I always found this "mantra" shortsighted and damaging on the long run - if nobody does their own crypto then who does their crypto? You are incentivizing people against learning this by that and a very significant part of learning something is actually using it in practice.

Because there are always someone who think they learnt enough and do their own implementation, putting the data of them and others at risk. Writing secure implementation of crypto algorithms is hard and there are millions of ways that you can screw up.

Don’t selfhost. You inevitably will misconfigure your servers and lose your customer data. Bow to amazon overlords and don’t even think otherwise.

Don’t drive. You inevitably will kill some pedestrian. Use Uber and let professionals do it.

I don’t think that’s a healthy attitude. And exposing data because of misconfigured firewall (ahem, DOCKER-USER, ahem) is like 1000x more probable than someone hacking your cryptoschemes.

There must be freedom in software engineering. Even at cost of some grave mistakes.

Re: Rolling your own crypto: Everything you need to build AES from scratch

#57

Post by fstokesman »

implements wrote: post #45

Can other people’s crypto binaries ever be fully trusted? - and there’s the other issue of ‘software rot’ making those binaries and associated data potentially unusable in the future. Home risk is mainly theft of hardware by burglars looking for cash resale rather than cryptanalyst hackers - so for purely personal use, and to guarantee future readability, perhaps rolling your own AES from source isn’t so misguided if…

If you code to a standard, this is less of a problem. If you implement AES in a way that produces a different output to someone elses implementation, then you by definition haven't implemented AES.

From a binary trust perspective, this is maybe a good way of ensuring that you're running the code you really think you are - but really you just kick the can down the road. You didn't build the hardware, and thus you don't know it's doing with your data once the instructions start executing. Is it storing them off to a side-buffer? Is the CPU detecting AES-like behaviour and triggering some surreptitious path? Who knows. This is where projects like precursor (https://player.vimeo.com/video/677854277?h=8ad58eece9) are really interesting. To be really, super sure that your code is running as expected, you have to build the world from the ground up.

Re: Rolling your own crypto: Everything you need to build AES from scratch

#58

Post by fstokesman »

zgs wrote: post #34
MarekKnapek wrote: post #25

Implementing AES from scratch is easy and fun, just read the spec and implement it 1:1, until ... you encounter GCM mode and its Galois Field "weird" math. Very. Not. Fun.

Most cryptographic operations are easy to implement. The best part is when you make a mistake, you'll most likely get random nonsense out the end. Floating point code is much more difficult, often you'll get an answer that's almost correct or worse one that's correct most places...

Heard about a great floating point implementation bug just today. When nintendo released Super Mario 64 for the Wii virtual console, they essentially just made their own emulator that plays a single ROM. The emulator is pretty accurate, though they made a mistake when implementing floating point operation rounding: All operations end up rounding upwards to the next floating point number (as opposed to alternating, depending on the result). A consequence of this was that some of the moving platforms in the game that had a periodic up/down pattern would slowly (over the course of literal days) creep upwards. Ended up being exploited in a speedrun category where the player attempts to press the A button as little as possible.

Re: Rolling your own crypto: Everything you need to build AES from scratch

#59

Post by ziddoap »

stingraycharles wrote: post #38
Beldin wrote: post #32

Earlier quoted context omitted.

> don’t tell me my way is wrong just because it’s crypto. The way where people think they learn cryptography by making their own implementation is, indeed, wrong. Cryptography is about ensuring specific requirements in the face of active adversaries. Self-implemented crypto misses many well-known caveats, causing them to be easily breakable. As such, it is not reasonable to consider them as something that aims learn…

But you're approaching it from the wrong perspective: the idea isn't to use the crypto you implement yourself, the idea is to gain a better understanding of how the "magic" works. Of course my hand-rolled RSA/AES crypto is breakable, I know that because that's the default assumption. It's akin to saying, "you're not allowed to build your own smoke detector because it will be unsafe!". Of course I know that, I want to…

>I found issues in several libraries, specifically around entropy, and even one library with modulo bias

This is exactly what the other people in this thread mean when they say "learn by breaking other crypto", assuming you didn't write those libraries.

Re: Rolling your own crypto: Everything you need to build AES from scratch

#60

Post by Retr0id »

MarekKnapek wrote: post #25

Implementing AES from scratch is easy and fun, just read the spec and implement it 1:1, until ... you encounter GCM mode and its Galois Field "weird" math. Very. Not. Fun.

I also made a 1:1 implementation of the spec. The finite field math did cause a bit of head-scratching, but in the end I mostly made sense of things:

https://github.com/DavidBuchanan314/aes-playground/blob/mast...

(I left comments quoting the spec as much as possible, so it should be possible to map it back onto the spec, for anyone interested)

Post reply on HN