61–70 of 255 posts
The last paragraph of this review is in poor taste. The most cursory research into the author's "CryptoBox" shows that indeed this project is inspired by NaCL.
Earlier quoted context omitted.
I think the tone is what makes it tougher than it needs to be, not the factual content. Props to the author for just looking at the content and not at the way in which it was delivered. Props to Thomas for taking the time to review the book.
This condescending tone seems to be mandatory for karmic users of over 100K points :)
> The book actively recommends public key cryptography, because of concerns about key distribution. Again: bad strategy. Cryptographers use public key crypto only when absolutely required. Most settings for cryptography don't need it! Public key cryptography multiplies the number of things that can go wrong with your cryptosystem. Can I ask why? What is so dangerous with asymmetric crypto compared to symmetric crypto…
There's one, admittedly theoretical difference, at least: there is such a thing as perfectly (information theoretically) secure symmetric encryption scheme (regardless of the computational power of the adversary), but asymmetric crypto, by definition, relies on being computationally infeasible, not information theoretically impossible. Even though it's theoretical, the side effects of this fact surface from time to t…
It's great that one-time pad exists, but it's not really relevant in actual crypto code, right?
The only actual reason I can think of is that symmetric crypto is easier to write and understand - you just mangle and xor some text back and forth, while in asymmetric crypto, you need to understand fairly complex algebra. But again, that's not that important if you use existing primitives, right?
I happen to know the author of this. This was a really tough thing for him to read, but he's taking it as constructive criticism. I would add to the people commentating here on HN: tptacek's review is tough; you do not need to lay into the author of this book any more.
It's a tough thing for anyone to read: it's browserWidth wide and monospaced. Here's a readable version: https://gist.github.com/mikemaccana/10847077
I like that, because my browser window is resizable.
Earlier quoted context omitted.
It's a tough thing for anyone to read: it's browserWidth wide and monospaced. Here's a readable version: https://gist.github.com/mikemaccana/10847077
it's browserWidth wide I like that, because my browser window is resizable.
I happen to know the author of this. This was a really tough thing for him to read, but he's taking it as constructive criticism. I would add to the people commentating here on HN: tptacek's review is tough; you do not need to lay into the author of this book any more.
I think the tone is what makes it tougher than it needs to be, not the factual content. Props to the author for just looking at the content and not at the way in which it was delivered. Props to Thomas for taking the time to review the book.
> The book actively recommends public key cryptography, because of concerns about key distribution. Again: bad strategy. Cryptographers use public key crypto only when absolutely required. Most settings for cryptography don't need it! Public key cryptography multiplies the number of things that can go wrong with your cryptosystem. Can I ask why? What is so dangerous with asymmetric crypto compared to symmetric crypto…
Not as big an issue with ECC, but RSA also has much larger block sizes, increasing the size of small payloads.
It's been my experience that Asymmetric is used for kex (key exchange) or key agreement or signing, but encryption is done using a symmetric algorithm.
Brutal but also in some ways a gift to the author/publisher. Paired with the 1st edition, it cures the major defects. And, if the criticisms can be addressed, in both specifics and perspective, for a future edition, they'll have a hardened book... almost sure to earn another updated expert review ("is it fixed?") at that time.
Coursera's "Cryptography I" pays off again -- I know most of the words!
Earlier quoted context omitted.
An "inexperienced practitioner of cryptography" should not be writing a book about cryptography. It's great that such a person is learning, but you shouldn't be trying to pass on such information at that stage. (I don't know the author either)
Remember that being wrong about something feels exactly the same as being right about something, so (extending "being wrong" to "being ignorant") unless somebody tells them they won't know they still have stuff to learn.
Not if you extend being wrong to being ignorant, no. When you're right about something in the sense of not being ignorant, you understand all the discussions and news easily, you know exactly what everyone is talking about, including reading academic articles on the subject, etc. When you're wrong about something your wrongness butts up against the correct model again and a gain and you're often left confused or unable to understand the actions, discussions, arguments, and conclusions, of others. (As opposed to seeing specific places they are wrong.) You can feel this lack of understanding. It just doesn't feel the same way as properly understanding a subject at all.
I would argue that this review is saying that the author's understanding falls a little short of par for the course. The author would probably have had a chance to see this for themselves by getting a little more into the literature.