Hacker News Reader

Comment by cperciva | Hacker News Reader

The reason this is being (re)posted now is that I gave this talk at a Polyglot Vancouver meetup last night. Freed from the constraint of a conference schedule I actually took about 90 minutes to go through this talk this time (followed by another 30 minutes of questions).

View on HN

As someone who is completely new to cryptography and knows very little, where would you recommend I start? I've recently been reading about bitwise operations to become familiar with how to (somewhat) interpret what a cryptograhic algorithm is doing in a program, since bitwise operations seems to be popular in almost all crypto algorithms.

I would highly recommend reading Cryptography Engineering [0] cover to cover. It's amazingly readable, covers the basics, the theory necessary to understand how things works and includes ample practical advice and observations on the industry.

The first thing I did after the Snowden leaks was read through the entire thing and after doing so I really wished I had done this years earlier. There's very few books that I think should be required reading across the board for software engineers, but this is one that I do think everyone writing code should read every page of.

[0] http://www.amazon.com/Cryptography-Engineering-Principles-Pr...

I don't. This book recommends, say, MAC-then-Encrypt and tries to justify it in 2010 by perpetuating FUD about provable crypto (proofs are only valid if your primitives are ideal, therefore you should worry about--one set of--risks that you can't measure, so trust us instead of proofs). There's no excuse for doing that.

In general, the authors seem to subscribe to "crypto is black magic" school of thought, which doesn't make for good pedagogy.

Dan Boneh's free "Crypto 1" on coursera. A new session will be starting on the 30th of June. I've taken it myself and this is hands down one of the best MOOCs (and class overall) I've ever taken.

I agree, "Crypto 1" was excellent! On Coursera's website, in the upcoming section, it says that "Crypto 2" starts in 3 months. I hope that's true!

It hasn't been the last, oh... four times or so?

It was indeed an excellent course and for any would-be participants I recommend buffing up on discrete mathematics and number theory already if they're not your strong suit.

I found the course pretty hard as programmer with a strong interest in crypto, but no formal CS/maths background. The coding pieces were fairly straightforward, but the maths hurt.

The Crypto 101 ebook [1] has been discussed a bit on HN [2]. It was submitted by tptacek, who had positive things to say about it.

It is in my "summer reading" pile.

[1] https://www.crypto101.io/

[2] https://news.ycombinator.com/item?id=7430946

The free cryptography courses at Coursera. I have seen the videos uploaded somewhere, maybe you can find them.

Hey, I found a small typo in the presentation. On page 80, in "good" code sample, you can see:

    x |= MAC_computed[i] − MAC_computed[i];

It probably should be something like:

    x |= MAC_computed[i] − MAC_received[i];

Or better yet

    x |= MAC_computed[i] ^ MAC_received[i];

If they're not careful and the numeric type being subtracted is wider than CPU registers, depending on architecture, the compiler-generated carry code to implement wider-than-register subtraction may introduce timing attacks. Wider-than-register xor is much much less likely to have such issues.

I don't suppose there's a video of this available? Longer + decent Q&A sounds appealing.

There was a video camera. I assume it will be posted somewhere; I didn't ask.

Do you have a copy of the presentation in beamer's "handout" mode? I think that is what it is called. It is the mode that condenses the 140+ pages into 20-30 by collapsing all the reveals.

I do now: http://daemonology.net/papers/crypto1hr-small.pdf

Is there a website that has information like this listed so that it can be updated over time? And perhaps where items could be discussed?

For example, is the suggested key size still the same as 2010?

Thank you.

Many thanks. I wish Beamer made a bigger point of recommending distribution in handout mode or more accurately dissuading distribution in presentation mode.

I always do that now. The only reason I didn't this time is that the slides were from 2010, before I updated my Makefile to automatically build both versions.

> that the slides were from 2010

Considering this, what do you think has changed in the past 5 years? Eg the slides mention SHA3 as a future option, now it is finalized and afaik usable.

There is also one interesting thing about SHA3 which I learned recently, namely that it can apparently be easily used as MAC too:

> Unlike SHA-1 and SHA-2, Keccak does not have the length-extension weakness, hence does not need the HMAC nested construction. Instead, MAC computation can be performed by simply prepending the message with the key

from http://keccak.noekeon.org/

In this light, do you think it would be reasonable to add exception for "DON’T: Try to use a hash function as a symmetric signature." rule?

Another thing is that ECC seems to be on the rise (or is it just my perception?). Do you think a revised slide set would include something more about elliptic curves?

what do you think has changed in the past 5 years? Eg the slides mention SHA3 as a future option, now it is finalized and afaik usable.

Not much has changed. I still think SHA3 is worth considering 5-10 years into the future; five years ago I was concerned about the implications of MD5 and SHA1 breaks on SHA2, but the lack of recent progress makes me happier with staying on SHA2 while SHA3 gets more analysis.

do you think it would be reasonable to add exception for "DON’T: Try to use a hash function as a symmetric signature." rule?

I mentioned this in the talk; even with SHA3 you need to be careful, since a simple "append and hash" would result in MAC("key", "data") == MAC("keyd", "ata"), which breaks the MAC assumptions. Yes, you can use SHA3 as a MAC, but make sure you know what you're doing.

ECC seems to be on the rise (or is it just my perception?). Do you think a revised slide set would include something more about elliptic curves?

ECC is getting more popular; not necessarily for the right reasons, though. (The big drivers seem to be "bitcoin uses this" and "the most common way of using this provides forward perfect secrecy".) That said, as mathematicians continue to attack ECC systems, I am gradually becoming more comfortable; the 2025 version of this talk might recommend using them, but for now I don't think it makes sense to change my recommendation (except for situations like bitcoin which specifically need ECC's advantages).

Reply on news.ycombinator.com