TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Cryptographic Right Answers

187 pointsby sweisalmost 10 years ago

27 comments

alextgordonalmost 10 years ago
&gt; If you can get away with it: use SHA-512&#x2F;256, which truncates its output and sidesteps length extension attacks.<p>Note that &quot;SHA-512&#x2F;256&quot; is a separate algorithm, not to be confused with &quot;SHA-512 or SHA-256&quot; which are two other less secure algorithms.
评论 #9596381 未加载
评论 #9594340 未加载
JoshTriplettalmost 10 years ago
&gt; Password handling (Was: scrypt or PBKDF2): In order of preference, use scrypt, bcrypt, and then if nothing else is available PBKDF2.<p>What&#x27;s the reason to prefer scrypt over bcrypt? And, what&#x27;s the reason to prefer both over PBKDF2? (Asking because I see quite a few bits of software that use PBKDF2.)<p>&gt; Asymmetric signatures (Was: Use RSASSA-PSS with SHA256 then MGF1+SHA256 yabble babble): Use Nacl, Ed25519, or RFC6979.<p>Could you make a recommendation for or against using GPG, since that&#x27;s by far the most common approach for asymmetric signatures? (Obviously such a recommendation would need to point at specific key&#x2F;algorithm choices to use or avoid.)<p>&gt; Client-server application security (Was: ship RSA keys and do custom RSA protocol) Use TLS.<p>Using which of the many TLS implementations?
评论 #9594253 未加载
评论 #9594259 未加载
评论 #9595041 未加载
评论 #9594230 未加载
zokieralmost 10 years ago
Considering the recommendations for NaCL, what is the current status of it? There is NaCL proper and its webpage has link to a 2011 version. Then there is TweetNaCL which seems more recent with a 2014 release. And finally there is libsodium which is not from DJB. What is the recommended version to use? I&#x27;d guess TweetNaCL because it is most recent, but idk.<p>On a slightly related note, I just noticed that there is also µNaCL for embedded use that seems really cool.
评论 #9594622 未加载
评论 #9594685 未加载
评论 #9594623 未加载
some_furryalmost 10 years ago
&gt; If your threat model is criminals, prefer DH-1024 to sketchy curve libraries. If your threat model is governments, prefer sketchy curve libraries to DH-1024. But come on, find a way to one of the previous recommendations.<p>I got a serious chuckle out of this. :)
Xorlevalmost 10 years ago
Pardon my ignorance, but is the NaCl referred to in the gist this NaCl? <a href="http:&#x2F;&#x2F;nacl.cr.yp.to&#x2F;" rel="nofollow">http:&#x2F;&#x2F;nacl.cr.yp.to&#x2F;</a> Or does it refer to libsodium here? <a href="https:&#x2F;&#x2F;github.com&#x2F;jedisct1&#x2F;libsodium" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;jedisct1&#x2F;libsodium</a><p>I realize that the library is probably available via my package manager, but it&#x27;d be nice if the install page (<a href="http:&#x2F;&#x2F;nacl.cr.yp.to&#x2F;install.html" rel="nofollow">http:&#x2F;&#x2F;nacl.cr.yp.to&#x2F;install.html</a>) linked to an archive over HTTPS and had some signatures to compare hosted elsewhere.
评论 #9595119 未加载
chaitanyaalmost 10 years ago
AES-GCM allows the caller to supply additional authenticated data (AAD) -- data that is only authenticated but not encrypted. However NaCl&#x27;s authenticated encryption mode doesn&#x27;t seem to provide anything like this: <a href="http:&#x2F;&#x2F;nacl.cr.yp.to&#x2F;secretbox.html" rel="nofollow">http:&#x2F;&#x2F;nacl.cr.yp.to&#x2F;secretbox.html</a><p>So when I have AAD, what should I do when using NaCl? Add it as part of the message to crypto_secretbox(), or should I authenticate this data separately?
评论 #9594066 未加载
评论 #9594068 未加载
hobarreraalmost 10 years ago
The lack of justifications makes this as useful as anybody else out there claiming &quot;use X. Don&#x27;t use Y&quot;.<p>Eg: &gt; Avoid: AES-CBC, AES-CTR by itself, block ciphers with 64-bit blocks --- most especially Blowfish, which is inexplicably popular, OFB mode. Don&#x27;t ever use RC4, which is comically broken.<p>Why not 64-bit blocks? What&#x27;s wrong with them? How do they affect us?<p>Mind you, I&#x27;m not saying the statement is incorrect, but with no justification for it, I&#x27;m not convinced why I should avoid them.
评论 #9594628 未加载
评论 #9594454 未加载
cpercivaalmost 10 years ago
Since this is heading towards the top of HN, I figure it&#x27;s worth responding to the specifics here:<p><i>AES-GCM</i><p>As tptacek says, this has pitfalls on some platforms. I also dislike exposing AES cores to malicious data, which is my primary reason for preferring a hash-based MAC construction.<p><i>Avoid: key sizes under 128 bits.</i><p>My recommendation for 256-bit symmetric keys isn&#x27;t because I think AES-128 can be broken mathematically; rather, it&#x27;s because AES implementations have a history of leaking some of their key bits via side channels. This is less of an issue now than it was five years ago (implementors have found and closed some side channels, and hardware AES implementations theoretically shouldn&#x27;t have any) but given the history of leaking key bits I&#x27;d prefer to have a few to spare.<p><i>Avoid: userspace random number generators</i><p>Thomas and I have argued about this at length; suffice to say that, as someone who has seen interesting misbehaviours from kernel RNGs I&#x27;d prefer to use them for seeding and then generate further bits from a uesrspace RNG. (Thomas&#x27;s counterargument, which has some validity, is that he has seen interesting misbehaviours from userspace RNGs. This largely comes down to a question of whether you think the person writing your userland crypto code is more or less prone to making mistakes than the average kernel developer.)<p><i>avoid RSA</i><p>Thomas is correct to imply that a random RSA implementation is more likely to be broken than an average elliptic curve implementation. This is true for the same reason as a random program written in python is more likely to have bugs than a random program written in Brainfuck: Inexperienced developers usually don&#x27;t even try hard problems. On the other hand, <i>for any particular developer</i>, an RSA implementation they write is more likely to be correct than an elliptic curve implementation they write.<p>I also continue to be wary of mathematical breakthroughs concerning elliptic curves. Depending on the amount of new research we see in the next few years I might be comfortable recommending ECC some time between 2020 and 2025.<p><i>use NaCl</i><p>This is not entirely a bad idea. The question of &quot;implement yourself or use existing libraries&quot; comes down to the availability of libraries and whether the authors of the library are more or less prone to making errors than you; &quot;random developer vs. NaCl developers&quot; is straightforward and doesn&#x27;t have the same answer as &quot;random developer vs. OpenSSL developers&quot;.<p><i>you discover that you made a mistake and your protocol had virtually no security. That happened to Colin</i><p>Just to clarify this, the (very embarrassing) bug Thomas is referring to was in the at-rest crypto, not the encrypted client-server transport layer.<p><i>Online backups (Was: Use Tarsnap): Remains Tarsnap. What can I say? This recommendation stood the test of time.</i><p>I have to agree with Thomas on this one. ;-)
评论 #9594191 未加载
netheril96almost 10 years ago
One problems I have with most cryptographic libraries, like OpenSSL and NaCl as recommended here, is their extensive use of globally mutable variables. I can&#x27;t understand how that seems a good idea in 2015.
lmmalmost 10 years ago
&gt; Avoid: offbeat TLS libraries like PolarSSL, GnuTLS, and MatrixSSL.<p>I&#x27;m interested to hear the rationale behind this. Those seem like reasonable options considering OpenSSL&#x27;s (and their) security history.
评论 #9594144 未加载
评论 #9594605 未加载
评论 #9594218 未加载
emastealmost 10 years ago
For reference, Colin&#x27;s 2009 &quot;Cryptographic Right Answers&quot; blog post is here: <a href="http:&#x2F;&#x2F;www.daemonology.net&#x2F;blog&#x2F;2009-06-11-cryptographic-right-answers.html" rel="nofollow">http:&#x2F;&#x2F;www.daemonology.net&#x2F;blog&#x2F;2009-06-11-cryptographic-rig...</a>
nine_kalmost 10 years ago
&gt; <i>Avoid: constructions with huge keys, cipher &quot;cascades&quot;</i><p>Can anyone please explain what&#x27;s wrong with e.g. 4096 bit keys (instead of 1024 bit) and piling 2-3 different or same encryption passes? Performance implications are obvious; what are security implications?
评论 #9594163 未加载
评论 #9595011 未加载
bradleyjgalmost 10 years ago
&gt; There is a class of crypto implementation bugs that arises from how you feed data to your MAC, so, if you&#x27;re designing a new system from scratch, Google &quot;crypto canonicalization bugs&quot;.<p>I get a whole bunch of links about javax.xml.crypto.dsig throwing exceptions, which wasn&#x27;t terribly illuminating.<p>I think the reference is to the bugs discussed on page 21 here: <a href="http:&#x2F;&#x2F;www.contextis.com&#x2F;documents&#x2F;33&#x2F;Exploiting_XML_Digital_Signature_Implementations-HITBKL20131.pdf" rel="nofollow">http:&#x2F;&#x2F;www.contextis.com&#x2F;documents&#x2F;33&#x2F;Exploiting_XML_Digital...</a> but I&#x27;m not sure.
评论 #9594293 未加载
评论 #9594236 未加载
aftbitalmost 10 years ago
What if I need to send up encrypted logs from a number of clients? I tried to use nacl for this, but in its opinionated style, it holds that I have to have a sender private key to authenticate my logs, and it won&#x27;t decrypt unless I provide the corresponding public key on the other end.<p>I don&#x27;t want authentication here - there&#x27;s no way for me to manage these keys; I just want to prevent someone from reading my logs off the disk...
评论 #9596316 未加载
评论 #9596175 未加载
hellbanneralmost 10 years ago
&quot;Asymmetric encryption (Was: Use RSAES-OAEP with SHA256 and MGF1+SHA256 bzzrt pop ffssssssst exponent 65537): Use Nacl.<p>You care about this if: you need to encrypt the same kind of message to many different people, some of them strangers, and they need to be able to accept the message asynchronously, like it was store-and-forward email, and then decrypt it offline. It&#x27;s a pretty narrow use case.&quot;<p>Is this like bitmessage?
arielbyalmost 10 years ago
Also:<p>For each key you use, pick 1 format of messages for it to authenticate. Document that format. Version-control that documentation along with the code that uses it. If the format changes in a non-back-compat way, pick a new key (so try to use a backwards-compatible format). Ensure the documented messages make sense (try not to have a &quot;fire this person&quot; message without knowing who is that person) - timestamps and&#x2F;or nonces can really help here.<p>If you can&#x27;t pick just 1 format, you can say have the first 16 bytes of the message be a UUID, and document each UUID-format (with the same documentation rules as if you are not using a UUID).<p>Seriously, that and &quot;don&#x27;t mix secret and unauthenticated things&quot; together covers 90% of all vulnerabilities.
alokedesaialmost 10 years ago
Can anyone elaborate why we shouldn&#x27;t use BouncyCastle?
评论 #9594543 未加载
ilurkalmost 10 years ago
Didn&#x27;t notice at first that it was from Thomas Ptacek.<p>But still feels odd OP is sharing it since it was a secret link.
评论 #9594050 未加载
aftbitalmost 10 years ago
Is there anything wrong with using haveged after the system has been up long enough to generate a seed the traditional way?<p>I occasionally use it to make &#x2F;dev&#x2F;random unblock for applications that think they need to use &#x2F;dev&#x2F;random to generate keys (cough gpg cough).
cafalmost 10 years ago
<i>Avoid: ... SRP, J-PAKE, ...</i><p>Are there any recommended schemes for password-authenticated key exchange?
评论 #9594731 未加载
ingenteralmost 10 years ago
Hypothetically, if any weakness is found in Curve25519, what happens to NaCl users?
评论 #9596335 未加载
nickpsecurityalmost 10 years ago
This article does plenty right but gets a few things wrong. Overlooks a few others. I&#x27;m going to hit on a few of these in order I see them.<p>&quot;Avoid cipher cascades.&quot; I&#x27;ve pushed and successfully used cascades in highly assured work for years. Cryptographers talk down about it but &quot;meet in the middle&quot; is best attack they can cite. So, they&#x27;re full of it &amp; anyone who cascaded might have avoided many algorithm&#x2F;mode breaks. My polymorphic cipher works as follows: three strong algorithms applied out of almost 10 potentials; algorithms are randomly selected with exception that each pass is a new algorithm; separate keys; separate, initial, counter values; process driven by a large, shared secret. Breaking it without the secret requires breaking all three and no cryptographer has proven otherwise despite massive speculation.<p>I&#x27;ll briefly mention scrypt because it&#x27;s <i>ironically</i> great advice. I asked cryptographers for over a decade to deliver a slow-by-design hash function that couldn&#x27;t be sped up. They, for years on end, criticized me (see Schneier&#x27;s blog comments) saying it was foolish and we just need to iterate a fast one. I expected problems and hackers delivered them. I had to homebrew a cryptosystem that input a regular HMAC scheme into another scheme: (a) generated a large, random array in memory, (b) did impossible to speed up operations on random parts of it, (c) iterated that excessively, and (d) finished with a proper HMAC. Array size always higher than GPU or FPGA onboard memory in case opponents used them. Eventually in a discussion, a Schneier commenter told me about scrypt and I finally got to ditch the inefficient homebrew. A true outlier in the crypto field.<p>Avoid RSA: bad advice for commercial if NSA is opponent. All his risks are true. NaCl is great and my default recommendation. Yet, he doesn&#x27;t mention that NSA has another reason for pushing ECC: they own 26 patents on it that they license conditionally on the implementation details along with ability to restrict export. We know what NSA&#x27;s goal for crypto is and therefore I avoid ECC commercially like the plague. I just used RSA implementations and constructions pre-made by experts with review by experts. Esp GPG, as NSA haven&#x27;t even broken it. They use it internally, actually.<p>For asymmetric signatures, see above. All points apply. I&#x27;ll just add that, for post-quantum, there&#x27;s been tremendous process in Merkle signatures with things such as unlimited signatures. Their security just depends on a hash function, there&#x27;s no known quantum attacks on them, and they&#x27;re doing pretty good against classical attacks, too. So, I&#x27;m following and doing private R&amp;D on standardizing Merkle signatures plus hardware to accelerate it on either end.<p>He says use OpenSSL and avoid MatrixSSL, PolarSSL, etc. He said some vague stuff about their quality. Problem: anyone following the git comments of OpenBSD team that tore through OpenSSL knows that IT WAS S<i></i>*. It was about the worst quality code they&#x27;ve run into with so much complexity and potential to be exploited that the NSA would be proud of it. I&#x27;d be surprised if Matrix, Polar, etc are worse and less structured than that. If OpenSSL is really the best, then we&#x27;re in a bad situation and need to fund a clean-slate design by experts like Galois and Altran-Praxis.<p>Although I&#x27;m focused on problematic points, his last piece of advice deserves special mention: use TLS. These protocols have proven difficult to implement properly. TLS and their ilk have had many problems along with massive effort to smash them. Against that backdrop, it&#x27;s actually done pretty well and using it like he suggests is best option for COTS security. Medium to high assurance systems can always use variants custom-designed for that level. Most don&#x27;t need that, though.
评论 #9596740 未加载
saganusalmost 10 years ago
Wow...so hard to keep up with best practices.
评论 #9596354 未加载
snvzzalmost 10 years ago
Recommends openssl, ignores libressl exists at all.
telloralmost 10 years ago
useful, but..<p>- What about the correct password length ?
chris_wotalmost 10 years ago
It cracks me up that on Office 365, Microsoft has a Lync auto discover protocol that uses https but the certificates have name mismatches.<p>Then again, it cracks me up that Microsoft have https at all, given the protocol checks https and http when it goes to lyncdiscover.domainname
quotemstralmost 10 years ago
&gt; Random IDs (Was: Use 256-bit random numbers): Remains: use 256-bit random numbers.<p>256-bit random identifiers are overkill. 122 random bits (as in a GUID) should still be more than sufficient. Size is important for IDs because people whine about the storage overhead. A 256-bit identifier requirement may unfortunately convince some people that it&#x27;s better to use much smaller, non-random identifiers, and that&#x27;d be a shame.
评论 #9595294 未加载