Exploiting common crypto flaws (Google Tech Talk)

rdist.root.org

36 points·jremmy··6 comments

Why implementing your own crypto isn't such a good idea. How saving 10 bytes cost the IETF 28 bytes more and compromised the XMLDsig security.

Open articleView on HN

Evidence why this kind of talk is needed, ironically on the same day: http://news.ycombinator.com/item?id=748430

Hey Nate, I watched your google talk yesterday from work. I've always been fascinated by cryptography as it seems to be one of the more complicated branches of computer science. I was trying to find this info online, but to no avail: what sort of education does one need to have a solid foundation in this field? And if you don't mind, what's your educational background :D

Cheers and thanks for the educational video!

I know you just have too much content for the time you're given in these talks (I doubt anybody in the audience really got the padding oracle thing, for instance), but I'm still surprised at how few questions you got at the end.

Maybe Hacker News will generate better questions.

Hi Thomas. Yeah, it was hard to get a read on the crowd. When I asked how many knew what RSA was, nearly everyone raised their hands. When I asked how many used PGP, it was about 4 people out of 100(?) attendees. I would have expected the inverse.

A few people got the CBC padding oracle attack, especially after I explained it in more detail at the end. Kudos to the QA guy who really got it, despite claiming he didn't have much crypto background.

I was surprised by that too. I usually take that as a sign that either everybody understands or nobody understands. Hopefully the former.

There was like one guy asking questions at the end of his Yahoo talk, too, and that guy was just saying "don't use Google's library, use Yahoo's!".

Reply on news.ycombinator.com