Comment by JoachimSchipper | Hacker News Reader

Comment by JoachimSchipper | Hacker News Reader

JoachimSchipper

This is old cryptography. This book should not be quite as bad for its readers as Schneier's Applied Cryptography (which includes many ciphers which were known to be broken at the time, with little hint of that fact in the text), but it's still old-fashioned.

E.g.

- Chapter 7 "block ciphers" doesn't even mention CTR mode, but does mention CFB and OFB. Modern cryptosystems all use CTR mode, and no new system I'm aware of uses CFB or OFB.

- Chapter 8 "Public-Key Encryption" doesn't even mention elliptic-curve cryptography, despite almost all new cryptosystems being based on that in some form or another. This chapter also doesn't appear to mention RSA padding, which is crucial to a secure RSA implementation.

- Chapter 9 "Hash Functions and Data Integrity" doesn't mention anything newer than SHA-1. But SHA-1 is thoroughly deprecated, and will be broken in the next few years.

Just buy a new book instead; I hear good things about Cryptography Engineering, and I liked "An Introduction to Modern Cryptography" (more mathematical, less engineering-focused).

Also, section 9.6.5 advocates MAC-then-encrypt over encrypt-then-MAC - presumably the flaws in this approach have only become apparent since the book was published.

An interesting historical document though.

> presumably the flaws in this approach have only become apparent since the book was published

A nice concise discussion of Encrypt-then-MAC vs MAC-then-Encrypt can be found here:

http://crypto.stackexchange.com/questions/202/should-we-mac-...

What about the updated Cryptography engineering book by Schneier et al? Do you have any experience with it?

No experience, but I wrote "I hear good things about Cryptography Engineering".

That said, at least one colleague was much happier with Security Engineering (also available for free online, and the non-crypto parts age well). Security Engineering doesn't teach you hard crypto (much), but does teach threat modelling and presents various solutions.

http://sockpuppet.org/blog/2013/07/22/applied-practical-cryp...

Aside from Stack Exchange, are there any other good cryptography Q&A forums:

http://crypto.stackexchange.com/questions?sort=votes

http://security.stackexchange.com/tags

I think you mean: Cryptography Engineering : Design Principles and Practical Applications by Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno

The book is introduction to the engineering problems and details when implementing cryptography. It introduces primitives, like symmetric ciphers, hash functions etc. and then shows how to write actual protocols using them. It covers many practical details and implementation concerns. I think it's good read. Just bear in mind that it's not comprehensive or authoritative. Some advice can be controversial. For example, they lean on authentication before encryption that others consider bad practice.

Another free and more up-to-date option is http://www.crypto101.io/ , but significant parts of the book are still in progress.

> But SHA-1 is thoroughly deprecated, and will be broken in the next few years.

Why is this a problem? sha1 is not broken by design, it's only broken by current and future computing power.

No, SHA-1's design is broken. The attacks still need a lot of computing power, but much less than they would if SHA-1 was secure.

That's not true. SHA-1 is a 160-bit hash, which means that you'd expect it to take on average 2^80 hash computations to find a collision. The best attacks against full SHA-1 require more like 2^57 to 2^61 computations, and there are attacks against parts of SHA-1 that require quite a bit less than that (which indicates that the design is risky).

https://en.wikipedia.org/wiki/SHA-1#Cryptanalysis_and_valida...

The difference between 2^60 and 2^80 is huge. If 2^80 operations take, say, a thousand years, it would take only about 8 hours to do 2^60 operations.

(Also, there's the additional twist that SHA-1 isn't even the fastest known algorithm. If you switch to BLAKE2, you can get faster hashing, and the output is 256-bit, so the brute-force strength is 2^128, which more than makes up for each individual operation being a little faster. https://blake2.net/)

Reply on news.ycombinator.com