3 ms·

Why personify crypto? Let the math alone be the driver in this domain. What is solid and true will eventually trickle up.

• treve 10y ago
  Security issues often come from engineering and culture, not math.
• geofft 10y ago
  > Let the math alone be the driver in this domain. What is solid and true will eventually trickle up. Unless you have some way of proving that one-way functions exist, which would imply as a consequence P ≠ NP, this is literally untrue (unless by "eventually" you mean "one day centuries hence, maybe we'll prove P ≠ NP"). There is not a single piece of crypto that can be proven correct today; all crypto that we use is safe because mathematicians have so far been unable to find a practical way to break. This requires mathematicians to be actively trying to break the crypto, so personalities matter because you can't get a worldwide community of experts to study every random person's algorithm. This also requires mathematicians to have a sense of which ways a particular algorithm might be fragile, even if they can't break it quite yet, which requires some non-mathematically-provable trust in the cryptanalyst's good sense. And, of course, if you believe that a certain cryptographer might be inserting back doors or prone to approving crypto that has back doors (see for instance Dual_EC_DRBG), you might distrust other output from that same cryptographer even if you can't prove anything yet.
  • lederhosen 10y ago
    Not only is One-time pad proven secure, it is also obvious without any knowledge of math.
    • geofft 10y ago
      It is not secure: it doesn't provide authentication (integrity protection) and it isn't nonce-reuse-resistant.
      • loup-vaillant 10y ago
        Integrity can be provided with a Wegman-Carter scheme, which come with a security reduction. The combination one-time pad + poly1305 for instance is provably secure. It's just impractical, and you have to rely on your chacha20 random number generator from /dev/urandom anyway. Also good luck finding a nonce-reuse resistant algorithm.
        • geofft 10y ago
          Does the correctness of Poly1305 not depend on P ≠ NP? I guess this boils down to whether the correctness of AES depends on P ≠ NP, which it might not since it's symmetric? The failure modes of reusing a nonce are never good, but some are far worse than others. The one-time pad's failure mode is particularly disastrous; it leaks the XOR of two plaintexts. There are a good number of algorithms that only leak whether the same message was repeated.
          • loup-vaillant 10y ago
            > Does the correctness of Poly1305 not depend on P ≠ NP? Not that I know of. As far as I know the security reductions are unconditional. Even worse than revealing the XOR of 2 plaintexts is the key recovery enabled by GCM (source: other comments in this thread). And if you're that scared of nonce reuse, just Nevertheless, it doesn't matter. Avoiding nonce reuse is easy. And if you're really scared, just use a random nonce from a big enough space (192 bits, like XChacha20, are good). That way if you have access to a random source, you can turn any encryption algorithm into a nonce-less algorithm.