Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptographic Right Answers: Post Quantum Edition

latacora.com

Post reply on HN
Print view View original

51–60 of 61 posts

Re: Cryptographic Right Answers: Post Quantum Edition

#51

Post by dogsledsleddog »

red_admiral wrote: post #25
ccppurcell wrote: post #17

As I understand it, the only reason pqc is of "practical" concern is the issue of "store now, decrypt later". Is it possible to defend against this attack in a classical way? Some sort of time limit on decryption? Or an argument that it's impossible?

The NSA has a copy of your ciphertexts on their disks today. What could stop them from trying to decrypt it in 5 years' time? It's not like they will be held back by any Terms & Conditions. The only way you can do any "not after X time" decryption even for honest-ish users is if the decryption involves getting extra key material from some server that erases it or shuts down at some point. But even that doesn't help i…

I don't think that is true, current PFS algorithms are probably all just an inconvenience PQ, but I think they suggest strategies where one has to have a key at the time of a negotiation or even be part of a decision in a negotiation to ever have the session key as long as the parties discard it.

Re: Cryptographic Right Answers: Post Quantum Edition

#52

Post by mwcampbell »

tptacek wrote: post #43
michaelt wrote: post #8

I've always found it a bit disquieting how many times people feel the need to update these "cryptographic right answers" blog posts. This is what, a fourth or fifth version since 2009? Meanwhile everything from ubuntu's apt-get to my connection to HN is secured with 2048-bit RSA - an algorithm invented in 1977 and in widespread use since at least 1995. Am I getting crypto advice that will keep my data safe for 30+ ye…

Yes. It's past time for this concept to be put to rest. It started out as a joke and has taken on a life of its own; moreoever, it has looped back over onto itself, to the point where it's advocating a sort of DIY SOTA vibe that is going to get people hurt --- the opposite of what the joke was going for originally.

I suspect that cperciva, who wrote the first "cryptographic right answers" post in 2009 and doesn't seem to have intended it as a joke, would disagree.

Re: Cryptographic Right Answers: Post Quantum Edition

#53

Post by tptacek »

mwcampbell wrote: post #52
tptacek wrote: post #43

Earlier quoted context omitted.

Yes. It's past time for this concept to be put to rest. It started out as a joke and has taken on a life of its own; moreoever, it has looped back over onto itself, to the point where it's advocating a sort of DIY SOTA vibe that is going to get people hurt --- the opposite of what the joke was going for originally.

I suspect that cperciva, who wrote the first "cryptographic right answers" post in 2009 and doesn't seem to have intended it as a joke, would disagree.

Yes, and I wrote the next two. The joke was about Colin's post --- "these 'right answers' are neither common best practices nor what cryptographic hipsters are advocating". The joke has always been "these should be titled Colin's Right Answers or Thomas' Right Answers [eek]" or whatever.

Nobody has deliberately included bad advice. That's not what I'm saying.

Re: Cryptographic Right Answers: Post Quantum Edition

#54

Post by notresidenter »

ccppurcell wrote: post #17

As I understand it, the only reason pqc is of "practical" concern is the issue of "store now, decrypt later". Is it possible to defend against this attack in a classical way? Some sort of time limit on decryption? Or an argument that it's impossible?

Quantum cryptography, not post-quantum cryptography, would allow schemes in which the store now, decrypt later attack is impossible.

Re: Cryptographic Right Answers: Post Quantum Edition

#55

Post by bigiain »

kaliszad wrote: post #3

Thank you for the update. This is really useful. It would be really great, if you could commit to an update a few years down the road at the latest. E.g. "I will release an update no later than August 15th 2027". 3 years in the fast-changing world shouldn't be such a burden and it would help to settle many discussions somewhat reasonably with appeal to authority :-D No seriously, having something that can be consider…

There are a string of these posts going back to 2009. Not "updated every 3 years", but it looks to me like we get an update when important advice has changed at least. I may have missed some, but from my bookmarks I have:

2009: https://www.daemonology.net/blog/2009-06-11-cryptographic-ri...

2015: https://gist.github.com/tqbf/be58d2d39690c3b366ad

2018: https://www.latacora.com/blog/2018/04/03/cryptographic-right...

2024: https://www.latacora.com/blog/2024/07/29/crypto-right-answer...

So not every 3 years, but if you read through you'll notice a _lot_ of each update pretty much says "use the same advice as last time."

It's not clear who wrote the most recent Latacora post, but it's Thomas Ptacek's company, and the original 2009 post was by Colin Percival. If you've been around here for a while you'll probably recognise those names, they's #1 and #60 here: https://news.ycombinator.com/leaders At least in my head, both have serious credibility over many years in this subject space.

The 2018 Latacora post says:

"This content has been developed and updated by different people over a decade. We’ve kept what Colin Percival originally said in 2009, Thomas Ptacek said in 2015, and what we’re saying in 2018 for comparison. If you’re designing something today, just use the 2018 Latacora recommendation."

Re: Cryptographic Right Answers: Post Quantum Edition

#56

Post by lifthrasiir »

tatersolid wrote: post #41
wepple wrote: post #26

Earlier quoted context omitted.

Perhaps the meta-message here is that you absolutely have to design for cryptographic agility. You may not need to jump to the next best thing every 3 years, but as certain constructs are proven weak, you’ll need to start migrating systems and data off of them to modern equivalents.

> you absolutely have to design for cryptographic agility Yes, but for heaven’s sake don’t design something with “cipher suite negotiation” which has been an endless source of vulnerability over the years in SSL/TLS, IPsec, PGP… Instead one should advance the version of the entire protocol or file format when you need to upgrade the cryptography. Then you deprecate old versions as quickly as possible. WireGuard and a…

In the other words, you only need cryptographic evolvability, not agility.

Re: Cryptographic Right Answers: Post Quantum Edition

#57

Post by tptacek »

bigiain wrote: post #55
kaliszad wrote: post #3

Thank you for the update. This is really useful. It would be really great, if you could commit to an update a few years down the road at the latest. E.g. "I will release an update no later than August 15th 2027". 3 years in the fast-changing world shouldn't be such a burden and it would help to settle many discussions somewhat reasonably with appeal to authority :-D No seriously, having something that can be consider…

There are a string of these posts going back to 2009. Not "updated every 3 years", but it looks to me like we get an update when important advice has changed at least. I may have missed some, but from my bookmarks I have: 2009: https://www.daemonology.net/blog/2009-06-11-cryptographic-ri... 2015: https://gist.github.com/tqbf/be58d2d39690c3b366ad 2018: https://www.latacora.com/blog/2018/04/03/cryptographic-right... 20…

I started Latacora with Erin and Jeremy in 2016, and wrote the last "Right Answers" post with their name on it, but Erin and I haven't worked there since 2020.

Re: Cryptographic Right Answers: Post Quantum Edition

#58

Post by bigiain »

tptacek wrote: post #57
bigiain wrote: post #55

Earlier quoted context omitted.

There are a string of these posts going back to 2009. Not "updated every 3 years", but it looks to me like we get an update when important advice has changed at least. I may have missed some, but from my bookmarks I have: 2009: https://www.daemonology.net/blog/2009-06-11-cryptographic-ri... 2015: https://gist.github.com/tqbf/be58d2d39690c3b366ad 2018: https://www.latacora.com/blog/2018/04/03/cryptographic-right... 20…

I started Latacora with Erin and Jeremy in 2016, and wrote the last "Right Answers" post with their name on it, but Erin and I haven't worked there since 2020.

Oh, OK. Apologies for the misinformation.

(I was somewhat surprised to see this post without you credited as author...)

Re: Cryptographic Right Answers: Post Quantum Edition

#59

Post by polungf »

tptacek wrote: post #57
bigiain wrote: post #55

Earlier quoted context omitted.

There are a string of these posts going back to 2009. Not "updated every 3 years", but it looks to me like we get an update when important advice has changed at least. I may have missed some, but from my bookmarks I have: 2009: https://www.daemonology.net/blog/2009-06-11-cryptographic-ri... 2015: https://gist.github.com/tqbf/be58d2d39690c3b366ad 2018: https://www.latacora.com/blog/2018/04/03/cryptographic-right... 20…

I started Latacora with Erin and Jeremy in 2016, and wrote the last "Right Answers" post with their name on it, but Erin and I haven't worked there since 2020.

Why did you and Erin stop working there in 2020?

Re: Cryptographic Right Answers: Post Quantum Edition

#60

Post by tptacek »

polungf wrote: post #59
tptacek wrote: post #57

Earlier quoted context omitted.

I started Latacora with Erin and Jeremy in 2016, and wrote the last "Right Answers" post with their name on it, but Erin and I haven't worked there since 2020.

Why did you and Erin stop working there in 2020?

I became a principal at Fly.io and Erin moved from consulting to in-house red team work. Both of us had been consulting for over 10 years.
Post reply on HN