5 ms·

Sigh. If you're configuring "Curve Preferences" you're doing it wrong. Crypto either works out of the box or find another tool.

by smegel 10y ago

tptacek 10y ago
First, the person writing this article (Filippo Valsorda) has expertise. Second, the point isn't to select crypto that "works", but rather to select crypto that is efficiently supported by Golang.
- smegel 10y ago
  > However, you should still set PreferServerCipherSuites to ensure safer and faster cipher suites are preferred, and CurvePreferences to avoid unoptimized curves Sounds more like he's giving advice to others on the finer points of elliptic curve cryptography. Programmers should not need to know this stuff.
  - awj 10y ago
    ...no, it's literally saying "here are the settings you need to make sure you only use efficiently implemented algorithms"
    - smegel 10y ago
      Because making safe, efficient settings the hard-to-tamper-with default would be waaay too sensible?
      - awj 10y ago
        More sensible than trying to have a conversation by stating your points as condescending "questions". In case you actually care to discuss it, there's definitely a trade-off between variety of cipher support (which some people want) and efficiency of cipher support (which some people absolutely need). Prioritizing one over the other is not a clear or simple decision.
  - f2f 10y ago
    instead, programmers are given a fips-compliant "black box" drop-in openssl replacement which they're not expected to question, right? :)
    - smegel 10y ago
      If by "question" you mean an average web scripter with a community college degree in "IT" deciding what elliptic curve to use in conjunction with what cipher suite and protocol...then maybe the answer is yes?
      - tptacek 10y ago
        Are you at all familiar with Go's TLS and crypto libraries? Because, by design, unsafe and exotic curve choices aren't in the standard library. Here's the entire set of curves exposed in 1.7 to Go's TLS: type CurveID uint16 const ( CurveP256 CurveID = 23 CurveP384 CurveID = 24 CurveP521 CurveID = 25 )
        smegel 10y ago
        STOP SAYING CURVE! I JUST WANT TO WRITE A WEB APP!
        tptacek 10y ago
        (a) No. (b) You can use asterisks to set off emphasized text. The guidelines ask you not to use all-caps. (c) You can ignore all these recommendations and write a Go web app by doing what most people do, and put nginx in front of your app server.
        smegel 10y ago
        I wasn't emphasising, I was quoting a hypothetical developer yelling in frustration because he just wants to write a safe web app and people keep talking about curves. All-caps is the correct markup style for yelling.
  - edmccard 10y ago
    >> and CurvePreferences to avoid unoptimized curves The key word being unoptimized. In the article, the code snippet has a comment "Only use curves which have assembly implementations" and he mentions that "a client using CurveP384 would cause up to a second of CPU to be consumed on our machines." (presumably because it does not have an assembly implementation) > Programmers should not need to know this stuff. It can sometimes be a sign of a leaky abstraction, but programmers might need to know the performance characteristics of the code they write.
    - smegel 10y ago
      > Only use curves There you go again. Programmers should not be "using curves". It's idiotic to think the average programmer can make that kind of decision. And it's so very typical of the arrogant fools who develop certain software to expect or assume developers would or should know this stuff, and if they don't they shouldn't be writing software or such.
      - sctb 10y ago
        Please stop breaking the guidelines. They ask us not to call names like this because it's not conducive to having the types of civil discussions that this site is for. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
        4ad 10y ago
        > Please stop breaking the guidelines. How about you stop breaking the guidelines? The parent didn't break any guideline.

Sigh. If you're configuring "Curve Preferences" you're doing it wrong. Crypto either works out of the box or find another tool.

by smegel 10y ago

Sigh. If you're configuring "Curve Preferences" you're doing it wrong. Crypto either works out of the box or find another tool.

tptacek 10y ago

First, the person writing this article (Filippo Valsorda) has expertise. Second, the point isn't to select crypto that "works", but rather to select crypto that is efficiently supported by Golang.

smegel 10y ago
> However, you should still set PreferServerCipherSuites to ensure safer and faster cipher suites are preferred, and CurvePreferences to avoid unoptimized curves Sounds more like he's giving advice to others on the finer points of elliptic curve cryptography. Programmers should not need to know this stuff.
- awj 10y ago
  ...no, it's literally saying "here are the settings you need to make sure you only use efficiently implemented algorithms"
  - smegel 10y ago
    Because making safe, efficient settings the hard-to-tamper-with default would be waaay too sensible?
    - awj 10y ago
      More sensible than trying to have a conversation by stating your points as condescending "questions". In case you actually care to discuss it, there's definitely a trade-off between variety of cipher support (which some people want) and efficiency of cipher support (which some people absolutely need). Prioritizing one over the other is not a clear or simple decision.
- f2f 10y ago
  instead, programmers are given a fips-compliant "black box" drop-in openssl replacement which they're not expected to question, right? :)
  - smegel 10y ago
    If by "question" you mean an average web scripter with a community college degree in "IT" deciding what elliptic curve to use in conjunction with what cipher suite and protocol...then maybe the answer is yes?
    - tptacek 10y ago
      Are you at all familiar with Go's TLS and crypto libraries? Because, by design, unsafe and exotic curve choices aren't in the standard library. Here's the entire set of curves exposed in 1.7 to Go's TLS: type CurveID uint16 const ( CurveP256 CurveID = 23 CurveP384 CurveID = 24 CurveP521 CurveID = 25 )
      - smegel 10y ago
        STOP SAYING CURVE! I JUST WANT TO WRITE A WEB APP!
        tptacek 10y ago
        (a) No. (b) You can use asterisks to set off emphasized text. The guidelines ask you not to use all-caps. (c) You can ignore all these recommendations and write a Go web app by doing what most people do, and put nginx in front of your app server.
        smegel 10y ago
        I wasn't emphasising, I was quoting a hypothetical developer yelling in frustration because he just wants to write a safe web app and people keep talking about curves. All-caps is the correct markup style for yelling.
- edmccard 10y ago
  >> and CurvePreferences to avoid unoptimized curves The key word being unoptimized. In the article, the code snippet has a comment "Only use curves which have assembly implementations" and he mentions that "a client using CurveP384 would cause up to a second of CPU to be consumed on our machines." (presumably because it does not have an assembly implementation) > Programmers should not need to know this stuff. It can sometimes be a sign of a leaky abstraction, but programmers might need to know the performance characteristics of the code they write.
  - smegel 10y ago
    > Only use curves There you go again. Programmers should not be "using curves". It's idiotic to think the average programmer can make that kind of decision. And it's so very typical of the arrogant fools who develop certain software to expect or assume developers would or should know this stuff, and if they don't they shouldn't be writing software or such.
    - sctb 10y ago
      Please stop breaking the guidelines. They ask us not to call names like this because it's not conducive to having the types of civil discussions that this site is for. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
      - 4ad 10y ago
        > Please stop breaking the guidelines. How about you stop breaking the guidelines? The parent didn't break any guideline.