Hacker News Reader

Comment by NikolaeVarius | Hacker News Reader

I really don't think this counts as rolling your own crypto. They just used a weak implementation of existing methods.

No more rolling your own crypto than if I were to use DES.

I agree - all security is assembled from lower level primitives and can be insecure despite using good building blocks. AES (even AES-128) is a fine choice, ECB mode is even okay in some contexts, but using that a stream cipher is not appropriate.

Definitely. Some other places (I think Telegram iirc) do actually create their own encryption algorithms without using existing ones. That’s what I thought rolling your own crypto scheme was. If the problem with Zoom is that they chose a poor mode for the algorithm, why doesn’t the headline say that? Creating your own encryption algorithm is way worse.

If rolling your own encryption scheme is just choosing what algorithm you use — every system does that. So it’s not headline worthy. :/ I get that zoom needs to make better choices, but the rhetoric around it has been pretty poor and unhelpful.

Search for images encrypted with aes-CBC. This is pretty much the definition of rolling your own crypto.

It's "rolling your own crypto", not "rolling your own encryption algorithm". That includes using "secure" low-level primitives incorrectly to build an insecure higher-level protocol. In this case, using ECB mode has been known for years (decades?) to be a bad move regardless of the underlying encryption algorithm.

As the classic article says, if you type the letters A-E-S, you're doing it wrong.

Yeah, in fact, that is USUALLY the way people screw up and roll their own crypto.

Well, except for the part of the article where it is made clear that they don't implement any sort of encryption at all.

Zoom is an interface for secretly sending a message to the Chinese government, and then hoping that they secretly relay that message to the person on the other end of your call.

Reply on news.ycombinator.com