6 ms·

If we're using the word "boring" as a euphemism for "well engineered, less likely to cause a fire", Salsa20 is slightly less boring than ChaCha20, but far more

If we're using the word "boring" as a euphemism for "well engineered, less likely to cause a fire", Salsa20 is slightly less boring than ChaCha20, but far more boring than RC4. https://github.com/CodesInChaos/SalsaBias https://github.com/CodesInChaos/SalsaBias :) I hope we see TLS 1.3 some time soon. > Virtually all of Bernstein's problems, going all the way back through his career, stem from the way standards bodies mangle cryptography. The more I read about his career, the clearer this becomes. It almost makes me wish we could abolish standards committees.

chetanahuja 11y ago
> I hope we see TLS 1.3 some time soon If you follow that ietf mailing list link, you'll find that TLS1.3 is having some "interesting" arguments right now.
bostik 11y ago
> It almost makes me wish we could abolish standards committees. I have for some time let myself believe that standards committees are a politically correct way to ensure incompatibility. My boss/supervisor from an earlier life was a regular in IETF IPSec working group. (This would have been in 2004-2005.) He commented, on several occasions, that the reason IPSec was such a travesty of a spec was because the working group was infested(!) by employees from all the big players. Each of whom made absolutely sure that their bastardised version of IPSec was allowed (and therefore declared compatible) by the spec, no matter now insane, inane or outright nonsensical it was. I still remember with horror the kinds of contortions we had to make our code do to support L2TP IPSec with native clients on multiple OS's. (Think: kernel patches that would cause maintainers to claw their eyes out.) He also quipped that IKEv2 was supposed to fix most of the problems encountered with IKEv1, but thanks to the special interests involved, he didn't expect it to come out any time soon, and even then he had no idea how badly it would be watered down when it did. The RFC for IKEv2 eventually came out in 2010.[0] I haven't had much of a look, to be honest. Apart from Cisco and Juniper, is anyone even really using IPSec for real these days? 0: https://tools.ietf.org/html/rfc5996 https://tools.ietf.org/html/rfc5996
- pjc50 11y ago
  We know from the elliptic curve debacle that standards committees provide an opportunity for active sabotage. IPSec is a useless nightmare as you say.
- tptacek 11y ago
  The IPSEC working group also boasts the hilarious threads where William Simpson and Perry Metzger ran Phil Rogaway --- Phil Rogaway! --- off the list for trying, early and without success, to fix some of the more basic crypto mistakes they were plowing ahead with. A decade later, Eric Hughes (I think? One of the early cypherpunks) made news by suggesting that NSA had deliberately sabotaged IPSEC, implanting crypto vulnerabilities derived (IIRC) from IV handling mistakes. If you go back and look at the threads, it's pretty clear that wasn't NSA: the personalities involved aren't hard to track down. It was just garden variety bikeshedding. The problem definitely isn't that standards groups attract noisy morons. William Simpson is very well regarded as a systems person. The problem is that it puts specialists in one field, specialists from others, and generalists in a room together, and puts them all on the same tier, and says "let the most persuasive person win".
  - bostik 11y ago
    > working group also boasts the hilarious threads where William Simpson and Perry Metzger ran Phil Rogaway --- Phil Rogaway! --- off the list for trying, early and without success, to fix some of the more basic crypto mistakes I did not know that, thank you for pointing it out. On the other hand, I think I even read through the other material: > A decade later, Eric Hughes (I think? One of the early cypherpunks) made news [...] I got the link from somewhere, possibly on SILC, and remember the ensuing discussion. There was a lot of bickering, and one of the comments has remained with me. Can't remember the exact words, but the context was "if this was NSA, they sure knew how to appear juvenile."
- beagle3 11y ago
  (unrelated to crypto, but) that's how we got XMPP. Back in '99, there was an IETF working group tasked with creating a chat protocol, with members from all the players at the time (AOL, Microsoft, IBM, Netscape, and a few more). I wasn't part of the wg, but I did follow it closely, and it was clear that some big players only cared about making their own product (as close as possible to) the standard (e.g. Microsoft), and the biggest player (AOL) was just actively sabotaging the process in order to prolong their advantage. Eventually, the group disbanded, and the mostly-working protocol at the time (Jabber -> XMPP) was adopted. It was a horrible ultra verbose under specified mess (and in some cases still is). But it was there, it was working, and it was open.
wglb 11y ago
With respect to wish we could abolish standards committees, he is also out to abolish the security industry. An idea not without its underpinning merits.
- sarciszewski 11y ago
  > abolish the security industry Good. Then I can focus on building valuable stuff without having to worry about security.
  - wglb 11y ago
    I suspect that you know this is the opposite of what he meant.

chetanahuja 11y ago

> I hope we see TLS 1.3 some time soon If you follow that ietf mailing list link, you'll find that TLS1.3 is having some "interesting" arguments right now.

bostik 11y ago

> It almost makes me wish we could abolish standards committees. I have for some time let myself believe that standards committees are a politically correct way to ensure incompatibility. My boss/supervisor from an earlier life was a regular in IETF IPSec working group. (This would have been in 2004-2005.) He commented, on several occasions, that the reason IPSec was such a travesty of a spec was because the working group was infested(!) by employees from all the big players. Each of whom made absolutely sure that their bastardised version of IPSec was allowed (and therefore declared compatible) by the spec, no matter now insane, inane or outright nonsensical it was. I still remember with horror the kinds of contortions we had to make our code do to support L2TP IPSec with native clients on multiple OS's. (Think: kernel patches that would cause maintainers to claw their eyes out.) He also quipped that IKEv2 was supposed to fix most of the problems encountered with IKEv1, but thanks to the special interests involved, he didn't expect it to come out any time soon, and even then he had no idea how badly it would be watered down when it did. The RFC for IKEv2 eventually came out in 2010.[0] I haven't had much of a look, to be honest. Apart from Cisco and Juniper, is anyone even really using IPSec for real these days? 0: https://tools.ietf.org/html/rfc5996 https://tools.ietf.org/html/rfc5996

pjc50 11y ago
We know from the elliptic curve debacle that standards committees provide an opportunity for active sabotage. IPSec is a useless nightmare as you say.
tptacek 11y ago
The IPSEC working group also boasts the hilarious threads where William Simpson and Perry Metzger ran Phil Rogaway --- Phil Rogaway! --- off the list for trying, early and without success, to fix some of the more basic crypto mistakes they were plowing ahead with. A decade later, Eric Hughes (I think? One of the early cypherpunks) made news by suggesting that NSA had deliberately sabotaged IPSEC, implanting crypto vulnerabilities derived (IIRC) from IV handling mistakes. If you go back and look at the threads, it's pretty clear that wasn't NSA: the personalities involved aren't hard to track down. It was just garden variety bikeshedding. The problem definitely isn't that standards groups attract noisy morons. William Simpson is very well regarded as a systems person. The problem is that it puts specialists in one field, specialists from others, and generalists in a room together, and puts them all on the same tier, and says "let the most persuasive person win".
- bostik 11y ago
  > working group also boasts the hilarious threads where William Simpson and Perry Metzger ran Phil Rogaway --- Phil Rogaway! --- off the list for trying, early and without success, to fix some of the more basic crypto mistakes I did not know that, thank you for pointing it out. On the other hand, I think I even read through the other material: > A decade later, Eric Hughes (I think? One of the early cypherpunks) made news [...] I got the link from somewhere, possibly on SILC, and remember the ensuing discussion. There was a lot of bickering, and one of the comments has remained with me. Can't remember the exact words, but the context was "if this was NSA, they sure knew how to appear juvenile."
beagle3 11y ago
(unrelated to crypto, but) that's how we got XMPP. Back in '99, there was an IETF working group tasked with creating a chat protocol, with members from all the players at the time (AOL, Microsoft, IBM, Netscape, and a few more). I wasn't part of the wg, but I did follow it closely, and it was clear that some big players only cared about making their own product (as close as possible to) the standard (e.g. Microsoft), and the biggest player (AOL) was just actively sabotaging the process in order to prolong their advantage. Eventually, the group disbanded, and the mostly-working protocol at the time (Jabber -> XMPP) was adopted. It was a horrible ultra verbose under specified mess (and in some cases still is). But it was there, it was working, and it was open.

wglb 11y ago

With respect to wish we could abolish standards committees, he is also out to abolish the security industry. An idea not without its underpinning merits.

sarciszewski 11y ago
> abolish the security industry Good. Then I can focus on building valuable stuff without having to worry about security.
- wglb 11y ago
  I suspect that you know this is the opposite of what he meant.