6 ms·

For the depressing truth on the crypto wars: https://news.ycombinator.com/item?id=7757978 https://news.ycombinator.com/item?id=7757978 (Crypto won't save you ei

For the depressing truth on the crypto wars: https://news.ycombinator.com/item?id=7757978 https://news.ycombinator.com/item?id=7757978 (Crypto won't save you either [PDF]) ...or to paraphrase Jeff Atwood: "I love crypto, it tells me what part of the system not to bother attacking"

egyptiankarim 11y ago
That's my favorite quote from Atwood! People are so prone to forget that while cryptographic algorithms are provably secure (under practical constraints) in a mathematically rigorous way, their implementations are subject to all of the shortcomings of any engineering practice. Makes quick work for an attacker trying to figure out where to start.
- eutectic 11y ago
  Even cryptography relies on unproven assumptions; we just consider them trustworthy enough to rely on.
- adenadel 11y ago
  It's my understanding that most (all?) public key cryptographic algorithms aren't provably secure, but are conjectured to be. They are reliant on some problem being hard to solve (factoring of large integers, discrete log, etc.). Something like a one time pad is provably secure, however.
  - egyptiankarim 11y ago
    True and fair. I overstated my point. More appropriate to say "provably secure (under practical constraints)", and that's a rather significant caveat.
  - swordswinger12 11y ago
    This is a common misconception. The algorithm itself is provably secure, in the sense that violating the stated security guarantees of the algorithm is equivalent to solving a problem that's considered to be computationally intractable. The only part that isn't 'provable' is the basic assumption that the problem is intractable in the first place.
    - ZoF 11y ago
      Didn't you just agree with him but substitute 'hard to solve' with 'computationally intractable'? Yes based on our understanding today these things are computationally expensive (e.g not feasible), but they could theoretically be easy to crack given a mathematical breakthrough. Am I misunderstanding? As the field of mathematics advances there's a chance that current crypto will be broken. Why is this a misconception to point out? Why is it not, on some level, conjecture to say these systems are secure?
      - adenadel 11y ago
        It looks like probably secure is defined in cryptography to mean breaking the algorithm is equivalent to solving the underlying intractable problem [0]. In my mind provably secure meant that the problem was actually intractable (which is not the convention). 0. https://en.wikipedia.org/wiki/Provable_security https://en.wikipedia.org/wiki/Provable_security
        swordswinger12 11y ago
        That is the conventional meaning of 'provably secure' in every text and research paper on modern cryptography.
      - DigitalJack 11y ago
        All proofs have axioms if you chase them all the way down. Given the axiom that the solving the math in the crypto is intractable, the crypto algorithm is proven secure. But only so long as the axiom holds. For example, quantum computing may break the axiom, and then the proof will be invalidated. It might be more correct to say assumption rather than axiom here.
      - thomasahle 11y ago
        What you are saying was true until this February when this paper came out https://eprint.iacr.org/2016/170 https://eprint.iacr.org/2016/170 It hadn't been implemented yet I'm any practical crypto system that I know of, buy it certainly seems like we are finally going to have actually, provably hard problems to build out security om.
  - duaneb 11y ago
    Given the breadth of ways to leak information about the private keys--side channel attacks, physical attacks, userspace (allocator, random number generator) this would be extremely difficult (impossible?) to prove.
    - stcredzero 11y ago
      It's a well known result that one time pads are provably secure. (Also, no PRNGs are involved.)
      - duaneb 11y ago
        The PRNG is certainly involved in the generation of the one-time pad. You could tell if they used the ascii text of hamlet.
        rthille 11y ago
        Could be actual random data is used, rather than a PRNG
        sneak 11y ago
        Using a PRNG to generate an OTP is called a stream cipher, and then it isn't an OTP. :) When using an OTP, you have to use non-pseudorandom values to avoid just being a stream cipher. If you're doing that, you can skip sharing the pad and just share the initial state of the PRNG. If you go to the trouble of sharing the pad, go to the trouble of using random data within it. :)
- dubdubbub 11y ago
  Cryptographic algorithms are generally not 'provably' secure, because most are based on an underlying assumption that some problems are hard, and this is not proven, just assumed. Also, there are mathematically verified implementations, and tools for verifying existing implementations that are about as 'provably' secure as the specifications of the algorithms.
- salgernon 11y ago
  I think you misunderstand him? If the crypto of a system is assumed to be correct, then that is the last place to look for a vulnerability. Better to look at what lies on either side without relying on the pipe being vulnerable.
  - update 11y ago
    "Don't bother trying to break encryption, break [whatever] implements the encryption instead" that's how i interpreted it
cb18 11y ago
There is obviously a place for cryptography in both personal and commercial communications. I'm always curious when one hears a politician moaning on about the 'dangers' of cryptography, if they understand how intricately intertwined cryptography is with the modern economy. And the fact that something is either cryptographically secure, or it isn't. There is no middle ground. If you intentionally break a cryptography system then you're going to disrupt trillions of dollars of commerce. But crypto is of course not a magic pill. There are political issues that need to be addressed as well. This was a theme touched on in Bruce Sterling's SXSW keynote this year.
- duaneb 11y ago
  Just the idea that crypto CAN be fought indicates a misunderstanding of the technology. You can't break a technology implemented decently on every consumer computer on the planet and with many open source implementations.
codemac 11y ago
The PDF you link attributes that quote to Drew Gross
- icebraining 11y ago
  Yeap, Jeff Atwood only cited it: https://twitter.com/codinghorror/status/467415214648881152 https://twitter.com/codinghorror/status/467415214648881152
  - endymi0n 11y ago
    oops - my bad, you're totally right... too late to edit though :(
Spooky23 11y ago
This is why I always eyeroll when people complain about GPG user interface weaknesses. The only way to really ensure the integrity of encrypted communications is by isolating and keeping the endpoints away from prying eyes. If your personal, business, political or criminal activity is such that you're concerned about third party interference with your clients, you have no business using iMessage -- which is protecting you from snooping network admins and carriers. The beauty of a complex but powerful tool like GPG is that you can completely isolate your online activity from secure activity. There's nothing preventing you from printing cipher text and using a scanner attached to an air gapped computer without any network connection. If your health and safety depend on secure communications to avoid extraordinary threats, don't use off the shelf tools that you don't understand. If you don't understand any tools, follow "the Godfather's" advice and avoid telecom-based communication.
deleted 11y ago
[deleted]

egyptiankarim 11y ago

That's my favorite quote from Atwood! People are so prone to forget that while cryptographic algorithms are provably secure (under practical constraints) in a mathematically rigorous way, their implementations are subject to all of the shortcomings of any engineering practice. Makes quick work for an attacker trying to figure out where to start.

eutectic 11y ago
Even cryptography relies on unproven assumptions; we just consider them trustworthy enough to rely on.
adenadel 11y ago
It's my understanding that most (all?) public key cryptographic algorithms aren't provably secure, but are conjectured to be. They are reliant on some problem being hard to solve (factoring of large integers, discrete log, etc.). Something like a one time pad is provably secure, however.
- egyptiankarim 11y ago
  True and fair. I overstated my point. More appropriate to say "provably secure (under practical constraints)", and that's a rather significant caveat.
- swordswinger12 11y ago
  This is a common misconception. The algorithm itself is provably secure, in the sense that violating the stated security guarantees of the algorithm is equivalent to solving a problem that's considered to be computationally intractable. The only part that isn't 'provable' is the basic assumption that the problem is intractable in the first place.
  - ZoF 11y ago
    Didn't you just agree with him but substitute 'hard to solve' with 'computationally intractable'? Yes based on our understanding today these things are computationally expensive (e.g not feasible), but they could theoretically be easy to crack given a mathematical breakthrough. Am I misunderstanding? As the field of mathematics advances there's a chance that current crypto will be broken. Why is this a misconception to point out? Why is it not, on some level, conjecture to say these systems are secure?
    - adenadel 11y ago
      It looks like probably secure is defined in cryptography to mean breaking the algorithm is equivalent to solving the underlying intractable problem [0]. In my mind provably secure meant that the problem was actually intractable (which is not the convention). 0. https://en.wikipedia.org/wiki/Provable_security https://en.wikipedia.org/wiki/Provable_security
      - swordswinger12 11y ago
        That is the conventional meaning of 'provably secure' in every text and research paper on modern cryptography.
    - DigitalJack 11y ago
      All proofs have axioms if you chase them all the way down. Given the axiom that the solving the math in the crypto is intractable, the crypto algorithm is proven secure. But only so long as the axiom holds. For example, quantum computing may break the axiom, and then the proof will be invalidated. It might be more correct to say assumption rather than axiom here.
    - thomasahle 11y ago
      What you are saying was true until this February when this paper came out https://eprint.iacr.org/2016/170 https://eprint.iacr.org/2016/170 It hadn't been implemented yet I'm any practical crypto system that I know of, buy it certainly seems like we are finally going to have actually, provably hard problems to build out security om.
- duaneb 11y ago
  Given the breadth of ways to leak information about the private keys--side channel attacks, physical attacks, userspace (allocator, random number generator) this would be extremely difficult (impossible?) to prove.
  - stcredzero 11y ago
    It's a well known result that one time pads are provably secure. (Also, no PRNGs are involved.)
    - duaneb 11y ago
      The PRNG is certainly involved in the generation of the one-time pad. You could tell if they used the ascii text of hamlet.
      - rthille 11y ago
        Could be actual random data is used, rather than a PRNG
      - sneak 11y ago
        Using a PRNG to generate an OTP is called a stream cipher, and then it isn't an OTP. :) When using an OTP, you have to use non-pseudorandom values to avoid just being a stream cipher. If you're doing that, you can skip sharing the pad and just share the initial state of the PRNG. If you go to the trouble of sharing the pad, go to the trouble of using random data within it. :)
dubdubbub 11y ago
Cryptographic algorithms are generally not 'provably' secure, because most are based on an underlying assumption that some problems are hard, and this is not proven, just assumed. Also, there are mathematically verified implementations, and tools for verifying existing implementations that are about as 'provably' secure as the specifications of the algorithms.
salgernon 11y ago
I think you misunderstand him? If the crypto of a system is assumed to be correct, then that is the last place to look for a vulnerability. Better to look at what lies on either side without relying on the pipe being vulnerable.
- update 11y ago
  "Don't bother trying to break encryption, break [whatever] implements the encryption instead" that's how i interpreted it

cb18 11y ago

There is obviously a place for cryptography in both personal and commercial communications. I'm always curious when one hears a politician moaning on about the 'dangers' of cryptography, if they understand how intricately intertwined cryptography is with the modern economy. And the fact that something is either cryptographically secure, or it isn't. There is no middle ground. If you intentionally break a cryptography system then you're going to disrupt trillions of dollars of commerce. But crypto is of course not a magic pill. There are political issues that need to be addressed as well. This was a theme touched on in Bruce Sterling's SXSW keynote this year.

duaneb 11y ago
Just the idea that crypto CAN be fought indicates a misunderstanding of the technology. You can't break a technology implemented decently on every consumer computer on the planet and with many open source implementations.

codemac 11y ago

The PDF you link attributes that quote to Drew Gross

icebraining 11y ago
Yeap, Jeff Atwood only cited it: https://twitter.com/codinghorror/status/467415214648881152 https://twitter.com/codinghorror/status/467415214648881152
- endymi0n 11y ago
  oops - my bad, you're totally right... too late to edit though :(

Spooky23 11y ago

This is why I always eyeroll when people complain about GPG user interface weaknesses. The only way to really ensure the integrity of encrypted communications is by isolating and keeping the endpoints away from prying eyes. If your personal, business, political or criminal activity is such that you're concerned about third party interference with your clients, you have no business using iMessage -- which is protecting you from snooping network admins and carriers. The beauty of a complex but powerful tool like GPG is that you can completely isolate your online activity from secure activity. There's nothing preventing you from printing cipher text and using a scanner attached to an air gapped computer without any network connection. If your health and safety depend on secure communications to avoid extraordinary threats, don't use off the shelf tools that you don't understand. If you don't understand any tools, follow "the Godfather's" advice and avoid telecom-based communication.

deleted 11y ago

[deleted]