zlacker

[parent] [thread] 14 comments
1. memset+(OP)[view] [source] 2020-04-27 00:33:30
Crypto and practical security. I get tired of the circular “don’t roll your own crypto unless you’re qualified”. How does one become qualified? I don’t feel like I know how to evaluate many of the arguments people make for or against technologies people argue about on HN, such as Signal or different password managers. I feel like “security through obscurity” is a bad thing, and “layers of security” are a good thing, but isn’t all security obscuring something, and how does one evaluate whether a layer is adequate? “Just use bcrypt” - okay, help me understand!
replies(13): >>azerni+q1 >>Eridru+D1 >>kccqzy+56 >>GolDDr+98 >>dreamc+Zh >>bencha+oj >>bawolf+Lj >>himinl+EN >>zorked+kV >>Davidb+e01 >>marcos+uC1 >>vlasev+ht2 >>Can_No+a39
2. azerni+q1[view] [source] 2020-04-27 00:48:31
>>memset+(OP)
If you have a good CS background, I highly recommend the lecture notes for the security class I took in undergrad: https://inst.eecs.berkeley.edu/~cs161/sp10/

That's from 10 years ago, so you might be able to find video of a more recent version; try to find a year when Wagner taught, he's great.

3. Eridru+D1[view] [source] 2020-04-27 00:50:14
>>memset+(OP)
The reason people say not to roll your own crypto is that there is no secret answer to making things secure, we just have smart and creative people bash their heads against a crypto protocol/implement for a long time and hope we found all the problems.

So unless you have a good reason to do something else, and the budget to pay experienced people to bash their heads against it, you should stick to an implementation that has had this effort expended on it.

If you want an intro about common problems in custom cryptosystems, go look at cryptopals or something, but don't get too cocky that you know everything.

replies(1): >>regula+rO
4. kccqzy+56[view] [source] 2020-04-27 01:40:40
>>memset+(OP)
I recommend Serious Cryptography by Jean-Philippe Aumasson. After reading it, you will gain enough understanding to compose cryptographic primitives and build your own secure system based on well-known best practices, as long as you don't deviate too much from the golden paths. Although with that, you still won't know how to design or implement these primitives yourself. It's like having a nice toolkit of screwdrivers, hammers, spanners etc to build your thing, but you can't build those tools themselves.
5. GolDDr+98[view] [source] 2020-04-27 02:03:58
>>memset+(OP)
Also, what makes me irritated about this blurt is that there are many "layers" of what people could reasonably call "crypto". There are the cryptographic primitives. There are higher-level crypto algorithms and functions that use those primitives. There are even higher-level cryptographic protocols, file formats etc. Then there's actually the application, applying crypto to a real-world problem.

Even in each of those, there are two "levels" of implementation: specifying an exact algorithm that implements a solution to problem x, and actually producing the code that implements the algorithm.

At some level, there is no ready-made solution to every problem. Even if the foundations are implemented by "somebody else", the line's blurry. At which level of (lack of) expertise and which level of "lowness" of the implementation should I start to worry?

6. dreamc+Zh[view] [source] 2020-04-27 04:15:20
>>memset+(OP)
> How does one become qualified?

By attacking crypto--a lot. And submitting your crypto to be attacked by others--a lot. It's the only way to develop the requisite level of humility to design good crypto.

7. bencha+oj[view] [source] 2020-04-27 04:39:49
>>memset+(OP)
You should study cryptanalysis. This is why rolling your own crypto is dangerous. Not just because the result is going to be insecure, but also because it isn’t particularly educational, but it feels like it is. It is easy to convince yourself you know more than you do if you spend a lot of time playing with bad crypto systems.

Edit: I should add that even if you are an expert in cryptanalysis, you still shouldn’t just roll your own crypto. It’s the analysis of the entire community, not the credentials of the author, that makes modern cryptography so strong.

8. bawolf+Lj[view] [source] 2020-04-27 04:44:55
>>memset+(OP)
From what i understand, the original context of "security through obscurity=bad" is that its really hard to keep secrets, and its hard to design secure systems, so peer review is really helpful. Thus if the security of your system relies on it being secret, you are probably in a bad place because its hard to keep something so big secret, its hard to redesign the system if it leaks, you probably had less people look at it in order to keep it secret. This is in contrast to just having a password or key secret. You can easily change a password if it gets leaked. You can keep a small password secret much easier than the design of the whole system, etc.

More generally, security is like any other field. You have to evaluate arguments based on the logic and evidence given. The main difference is that with crypto, it is much easier to shoot yourself in the foot and have catastrophic failure, since you have to be perfect and the attackers just have to be right once to totally own you. Thus the industry has standardized on a few solutions that have been checked really really well.

More generally, if you are interested, i would say read the actual papers. The papers on bcrypt, argon2 etc explain what problems they are trying to solve, usually by contrasting with previous solutions that have failed in some fashion. That doesn't mean reading the paper will explain everything or make you an expert or qualify you to roll your own crypto. Nor should you believe just because a paper author says something is a good idea that it actually is. It will however explain why slow hash function like bcrypt/argon2/scrypt were created and are better choices than the previous solutions in the domain like md5.

9. himinl+EN[view] [source] 2020-04-27 11:28:11
>>memset+(OP)
> I get tired of the circular “don’t roll your own crypto unless you’re qualified”.

It's true, but you need to realize that you're qualified enough only when you understand that you shouldn't roll out your own crypto.

In my opinion, the only person who has credibly demonstrated being able to roll his own crypto is djb (http://cr.yp.to/)

> but isn’t all security obscuring something,

Keeping a secret isn't "obscuring" something, it's hiding it entirely. Security through obscurity is bad because it relies on attackers being dumb. The smartest person in the world cannot be expected to guess a well chosen and kept secret.

◧◩
10. regula+rO[view] [source] [discussion] 2020-04-27 11:36:36
>>Eridru+D1
It's also easy to dramatically underestimate the order of magnitude of effort involved in "the budget to pay experienced people to bash their heads against it".
11. zorked+kV[view] [source] 2020-04-27 12:47:34
>>memset+(OP)
The proper way of interpreting the sentence about "don't roll your own crypto" is that it actually means "don't roll out your own crypto until it has been peer reviewed by many experts". At which point it kind of stops being "your own", in a way.
12. Davidb+e01[view] [source] 2020-04-27 13:24:54
>>memset+(OP)
Spring had made "Understanding Cryptography" available for free https://link.springer.com/book/10.1007/978-3-642-04101-3
13. marcos+uC1[view] [source] 2020-04-27 17:32:57
>>memset+(OP)
> I get tired of the circular “don’t roll your own crypto unless you’re qualified”. How does one become qualified?

Oh, by all means, roll your own crypto, break it, and roll it again. Just do not use it.

Also, break other people's crypto and study theory.

By the way, the advice is not "unless you are qualified". Nobody is qualified to just roll their own. Good crypto is a community project and can not happen without reviewers.

14. vlasev+ht2[view] [source] 2020-04-27 23:06:54
>>memset+(OP)
I don't see it mentioned, but I thought I'd chime in. Even if your crypto algorithm is perfect and works infinitely fast, there's still the problem of implementation. And that's usually not perfect and often leads to practical gaps that can be exploited. During WWII, the German Enigma machines were broken in part due to design errors (like letters wouldn't be encoded to themselves) and user error (like sending messages that start/end the same way). Even if crypto is some day perfect in a sense, it may still be used in imperfect ways that allow one to break it or circumvent it entirely.
15. Can_No+a39[view] [source] 2020-04-30 01:21:23
>>memset+(OP)
> I get tired of the circular “don’t roll your own crypto unless you’re qualified”

It's not circular, it's a simple flowchart.

Are you writing an app or are you trying to invent more advanced crypto?

"writing an app" -> dont roll your own crypto

"invent more advanced crypto" -> go learn and research crypto history, math, etc..

[go to top]