5 ms·
> Erratum: Apparently, I don't know what I'm doing either. I committed a number of approximations, misdirections, and even errors in there. Some of them where p
by rahrahrah 10y ago
> Erratum: Apparently, I don't know what I'm doing either. I committed a number of approximations, misdirections, and even errors in there. Some of them where pointed out by /u/sacundim on Reddit. If you thought you could trust me, read that comment. It's sobering.
LOL brilliant. That was fast.
- neaden 10y agoI'm glad he put that up at the top instead of trying to hide it. The moral of the story appears to be indeed: Don't roll your own crypto.
- inetsee 10y agoI think rolling your own crypto, as a learning exercise, can be very helpful when choosing which trusted crypto solutions to use for a particular use case.
- lvh 10y agoBreaking crypto is certainly an excellent way to learn many kinds of crypto. The problem is that writing your own typically isn't enough by itself -- a lot of horribly broken crypto looks fine after casual inspection. You probably won't find bugs like CBC padding oracles or Bleichenbacher attacks all by yourself. You can, however, absolutely _implement_ them yourself. I recommend cryptopals, together with my own free book, Crypto 101 if you prefer a little prose versus trying to figure it out yourself.
- loup-vaillant 10y agoI draw a different conclusion: don't roll crypto on your own. https://www.reddit.com/r/programming/comments/5iv1ti/rolling_your_own_crypto/dbg58iy/ https://www.reddit.com/r/programming/comments/5iv1ti/rolling... I have updated my article since, and also made clear you can still screw up even if you had help.
- oconnore 10y agoA lot of those criticisms are sort of unfair. For example, pointing out length extension attacks in a fabricated MAC construction not found in the article, especially when the OP explicitly recommends blake2b, which is not vulnerable to length extension (and also disclaims "How that magical MAC is built is beyond the scope of this paragraph."). Another example: criticizing that he mentions appending a MAC (you should choose an AEAD!)... when later he recommends using an AEAD.
- dom0 10y agoAEAD normally only means actual AEAD constructions (think AES-GCM/OCB, Chacha20-Poly1305 - not combinations of primitives providing authentication (=EtM, eg. first encrypt with AES-CTR then MAC with some HMAC). But yeah, some of the criticism reads kinda nit-picky / "I'm going to find false things in here". But on the other hand he provides good hints how the article could be improved.
- oconnore 10y agoThe article recommends Chacha20 Poly1305, not some combination of primitives.
- dom0 10y agoWhat do you mean by this then? > Another example: criticizing that he mentions appending a MAC (you should choose an AEAD!)... when later he recommends using an AEAD.
- oconnore 10y agoThere is a section called "integrity: not optional", where he uses MACs (which I would consider to be conceptually simpler to understand than AEADs) to explain how integrity can be implemented. Later, in a section called "Level 2: choosing crypto", he recommends using ChaCha20 Poly1305. Anyway, this isn't really my crusade, I just think that if you read the informal blog post as an informal blog post, it's fine.
- Bartweiss 10y agoIf nothing else, this was a hell of a lesson in just how hard rolling your own crypto really is.
- grkvlt 10y ago> Erratum: [...] Some of them where pointed out [...] And Muphry's Law[0] strikes again! [0] https://en.wikipedia.org/wiki/Muphry's_law https://en.wikipedia.org/wiki/Muphry's_law