Comment by sdevlin | Hacker News Reader

Comment by sdevlin | Hacker News Reader

Parent Full thread

> With this (and your computer) you can secure a message with a password in a way that's unbreakable. I can't break it, your government can't break it, other people's governments can't break it. Secure.

Argh. No.

> Should you use it? No. There's many important missing features that are present in proper symmetric encryption tools, such as proper key derivation, protection against modification, IVs, and fewer bugs.

This (buried) warning makes these things sound like bells and whistles. The truth is they're essential to security.

Here are some good reasons not to use this for anything:

1. It conflates passwords with keys. Users will not choose high-entropy passwords when left to their own devices.

2. It doesn't take an IV. This means a given password will always generate the same key stream, which means password reuse will lead to plaintext recovery by simple statistical methods. There are no warnings about this.

3. It's not authenticated. An attacker can modify messages in flight with unexpected consequences that very often include plaintext recovery.

4. RC4 is irreparably broken. Dropping 1024 bytes from the key stream might help in the author's intended use-case (assuming users adhere to it), but this is not an effective mitigation in general. The best attacks on RC4 rely on periodic biases that persist over the entire key stream.

Right, but the goal isn't to make a strong or useful encryption tool. The goal is to show that cryptography is, at it's core, rather simple. It's simple enough that we can cram "real" symmetric encryption into the size of a tweet.

It's like building an electric motor out of some scrap wire and some fridge magnets - the motor isn't really useful for anything, but it teaches the basic idea in a way that anybody can appreciate. A useful motor would have bearings, a commutator, multiple windings, an iron core, etc., but adding all that stuff just obscures the basics. Criticizing a school-kid's motor for being weak and inefficient is completely missing the point.

This program isn't supposed to be useful. It's supposed to prove a point.

If that is true, the author should avoid words like "secure" and "unbreakable".

Is RC4 secure? For this use-case, yes.

That was the point where I went to go write an HN comment, before seeing that Sean had already written it.

Is RC4 secure? No.

I initially thought the article was satire.

> but the goal isn't to make a strong or useful encryption tool

> > With this (and your computer) you can secure a message with a password in a way that's unbreakable. I can't break it, your government can't break it, other people's governments can't break it. Secure.

Some governments execute their citizens. If a crypto tool is neither strong nor useful it probably shouldn't be described as such.

You consider a qualification four paragraphs into an article “buried”? Christ. I know attentions spans are short these days, but that's pretty pathetic.

You're acting like the author proposed this as a serious encryption tool, but no sane person could read this article and reach that conclusion. You're only feigning to believe it in order in order to have an excuse to show off your supposedly superior knowledge of encryption.

If you have one of the three:

1. a one-way hash function; 2. a block cipher; or 3. a secure random number generator;

then you have the other two.

So replace "RC4" with Keccak and the argument stands. Keccak doesn't fit in a tweet but it prints onto a single page, which is easy enough to distribute: https://github.com/gvanas/KeccakCodePackage/blob/master/Stan...

You are talking about "users" a lot, I doubt the author actually tried to suggest that this was used in some kind of "product" rather that if a encryption can be spread via tweet it makes no difference how you try to ban it's usage, the bad actors ARE going to be able to encrypt their messages, you are just banning honest citizens usage.

Potential bannable use-case for this "bad crypto" is some criminal organization messaging each other and if they are smart enough to use this they can also come up with good password which makes the banning again completely irrelevant and the kicker is that criminals aren't going to use this "bad crypto" they are going to use something even stronger

Without an IV, it's laughably easy to reconstruct the plaintext from multiple messages with the same key. Probably as few as a handful.

That being said, I agree with the other people -- this isn't a "real" thing. It's just something to show how ill-conceived a plan to "ban encryption" is.

Reply on news.ycombinator.com