Live data from Hacker News

Digital signatures and how to avoid them

neilmadden.blog

61–70 of 85 posts

Re: Digital signatures and how to avoid them

#61

Slightly off topic: In school I only took one cryptography class (it was bundled with networking, at that), and to this day I still think it contained some of the most amazing concepts I've ever learned. Public-key cryptography being on the short list along with cryptographic hash functions. Maybe it's my particular bias, or maybe cryptography has just attracted some of the most creative genius' of the 20th century.

What I find the most mind-blowing is that you can do a diffie-hellman-merkle key exchange in a room full of people, everyone can hear you, but the two participants are the only ones in possession of the encryption key after exchanging three messages (once to establish the parameters, once to convey one computed number in each direction). The math is simple enough to do by heart, at least as a demonstration (of course, it's not possible to compute numbers in your head that are so large a computer, doing billions of calculations per second, cannot simply iterate over all possible values and thus break it; but the principle works)

Didn't get this in school unfortunately. They made us implement DES S-boxes iirc and Caesar cipher breaking... all very relevant and foundational knowledge for non-mathematicians who will never design a secure cipher

Re: Digital signatures and how to avoid them

#62
post #56
post #15

Earlier quoted context omitted.

> It's also super simple: It's almost literally just concatenating the secret and the message you want to authenticate together, and take an ordinary hash (like SHA256) of that, the rest of it is just to deal with padding. It's not quite as simple as that. The output of the first hash is hashed a second time (to prevent length extension attacks).

Thanks, forgot to mention that. Needless to say, I always consult real cryptographers when working on stuff like that.

Do you ever need to implement an HMAC from scratch? I'd look for an off-the-shelf solution before trying to find a cryptographer.

Re: Digital signatures and how to avoid them

#63
post #18
post #14

Earlier quoted context omitted.

More generally, a MAC. You don't necessarily need one based on a hash. (Unrelated) see also the more recent https://www.latacora.com/blog/2018/04/03/cryptographic-right...

I'd also throw in that HMAC is overrated . It's a workaround for bad hash algorithms that are vulnerable to length-extension attacks. If you're using a "good" hash algorithm, then MAC-ing is simple: hash over your key and message. It's pretty weird that SHA-256 has been king for so long, when SHA-512/256 (which, as I've noticed people don't understand, means SHA-512 truncated to 256 bits) was there from the beginning…

You're pointing out that SOTA hashes like SHA3 and Blake2 aren't length-extendable, which is true, but KMAC is more than simply keyed SHA3; it's also domain-separated.

Re: Digital signatures and how to avoid them

#64
post #18

Earlier quoted context omitted.

I'd also throw in that HMAC is overrated . It's a workaround for bad hash algorithms that are vulnerable to length-extension attacks. If you're using a "good" hash algorithm, then MAC-ing is simple: hash over your key and message. It's pretty weird that SHA-256 has been king for so long, when SHA-512/256 (which, as I've noticed people don't understand, means SHA-512 truncated to 256 bits) was there from the beginning…

> It's pretty weird that SHA-256 has been king for so long, when SHA-512/256 (which, as I've noticed people don't understand, means SHA-512 truncated to 256 bits) was there from the beginning and is immune from this attack. A bit of a tangent, but I didn't know this, so thanks for pointing this out. It's insane to me that there's two SHA hash algorithms that result in a 256 bit string, named nearly identically, but t…

Keyed SHA-512/256 would be a design smell. Just use HMAC.

Re: Digital signatures and how to avoid them

#65
post #16

Earlier quoted context omitted.

Ah yes of course in 2018 it's still HMAC.

They published a followup to that article two months ago, and the correct answer in 2024 is still HMAC. https://www.latacora.com/blog/2024/07/29/crypto-right-answer...

Who's "they"? This "right answers" thing is a meme (I ruefully share responsibility for it) that needs to die; Colin Percival has nothing to do with anything but the first one.

Re: Digital signatures and how to avoid them

#66
post #65

Earlier quoted context omitted.

They published a followup to that article two months ago, and the correct answer in 2024 is still HMAC. https://www.latacora.com/blog/2024/07/29/crypto-right-answer...

Who's "they"? This "right answers" thing is a meme (I ruefully share responsibility for it) that needs to die; Colin Percival has nothing to do with anything but the first one.

I linked to the older Latacora one upthread and this comment is linking to the newer Latacora one. So I think it's reasonable to read "they" as "Latacora" here.

Re: Digital signatures and how to avoid them

#67
post #66
post #65

Earlier quoted context omitted.

Who's "they"? This "right answers" thing is a meme (I ruefully share responsibility for it) that needs to die; Colin Percival has nothing to do with anything but the first one.

I linked to the older Latacora one upthread and this comment is linking to the newer Latacora one. So I think it's reasonable to read "they" as "Latacora" here.

Yes, I wrote the older Latacora one, which was based on thing I wrote under my own name before I founded Latacora; I'm pretty sure I'm on solid ground saying Colin Percival had nothing to do with anything I wrote, since I wrote the first one as a rebuttal to Colin. (Did I misread you? Maybe we just agree.)

Re: Digital signatures and how to avoid them

#68
post #11

> As well as authenticating a message, they also provide third-party verifiability and (part of) non-repudiation. I think digital signatures and third party verification are an incredibly useful feature. The ability to prove you received some data from some third party lets you prove things about yourself, and enables better data privacy long-term, especially when you have selective disclosure when combined with zero…

I have been trying to think of ways we could leverage digital signatures to prove that something isn't AI-generated, and it's really a fascinating topic to think about. It's hard to avoid making the leap from "this isn't AI generated" to "this exact person made this." Then there's the issue of ensuring that a person doesn't make ChatGPT write something, then copy and paste it somewhere else and sign it.

If anything, the hardest part of making an anti-AI proof system is ensuring people don't lie and abuse it.

Re: Digital signatures and how to avoid them

#69
post #11

> As well as authenticating a message, they also provide third-party verifiability and (part of) non-repudiation. I think digital signatures and third party verification are an incredibly useful feature. The ability to prove you received some data from some third party lets you prove things about yourself, and enables better data privacy long-term, especially when you have selective disclosure when combined with zero…

I have been trying to think of ways we could leverage digital signatures to prove that something isn't AI-generated, and it's really a fascinating topic to think about. It's hard to avoid making the leap from "this isn't AI generated" to "this exact person made this." Then there's the issue of ensuring that a person doesn't make ChatGPT write something, then copy and paste it somewhere else and sign it. If anything,…

https://youtube.com/watch?v=1FuNLDVJJ_c

This talk from Real World Cryptography 2024 is probably a good place to start.

Re: Digital signatures and how to avoid them

#70
post #67
post #66

Earlier quoted context omitted.

I linked to the older Latacora one upthread and this comment is linking to the newer Latacora one. So I think it's reasonable to read "they" as "Latacora" here.

Yes, I wrote the older Latacora one, which was based on thing I wrote under my own name before I founded Latacora; I'm pretty sure I'm on solid ground saying Colin Percival had nothing to do with anything I wrote, since I wrote the first one as a rebuttal to Colin. (Did I misread you? Maybe we just agree.)

I think we agree. I was only responding to the "Who's 'they'?" bit.
Post reply on HN