6 ms·

listing what ciphers and hash functions you're using for a project has got to be on the top 10 list of signs that you don't understand security.

pius 19y ago
All due respect, but thinking that a system's security relies on people not knowing what ciphers and hash functions the system uses is on the top 3 list of signs that you're clueless about security. It'd be difficult to have made a more ironic post than slamming someone for "not understanding security" with a "security through obscurity" argument. ;) See http://en.wikipedia.org/wiki/Kerckhoffs%27_principle http://en.wikipedia.org/wiki/Kerckhoffs%27_principle for why.
- hhm 19y ago
  Maybe what sigstoat wanted to say is that telling so much detail about that could be a sign that he doesn't know much about it. You don't talk about loops all the day when talking about programming, as they are the fundamentals any decent programmer understands and can imagine by himself (and when there is ambiguity, any programmer can check some extra documentation or even the code later to know about the details). I don't know much about security so I could be wrong, but that's what I think he could have meant.
  - pius 19y ago
    Perhaps; I couldn't speculate. To your point, though, a security protocol implementation document that makes use of secure hashes, encryption schemes, and the like isn't typically considered credible unless it states precisely what building blocks it uses. For instance, it's not enough to say you're going to use "random numbers." You need to say how you're going to seed and generate your pseudo-random numbers. The details matter. Had the document spent time explaining what CBC means or how AES is implemented, that would have been the security equivalent of talking too much about loops or Quicksort.
    - hhm 19y ago
      Very interesting reply; you are right of course.
    - tptacek 19y ago
      If Zed Shaw was interested in having people review his weird chat protocols, he'd probably: * Document them without the "mixture of humor, ranting, code, and specification language." The "specification language", presuming it's not in something Zed invented (like Stackish franken-sexps), would do nicely. * Use well-understood, well-tested primitives, and where he deviates (ECC might be mainstream, but CCM and Needham-Schroeder public key exchange aren't), explain why. * Describe things in terms of the cryptosystem and the goals, instead of using the least intelligible, most intimidating acronyms he can come up with (seriously, "ISO/IEC 11770-3 Mechanism 6"?). You're exactly wrong, of course. Zed's using CCM, and an evaluator would want to know what properties his system expects to achieve from doing so. Talking about CBC (or CBC-MACs) would make him look more savvy. Instead, we get "I’ve decided to send it back as Er(Nr) but I’m not sure of the security of this."
      - pius 19y ago
        I should be clear; I haven't read Zed's documentation and neither approve nor disapprove what he wrote. My reactions are strictly to the notion that a protocol creator shouldn't mention specifics in a security document -- that's flat out wrong. Until the snarky bit at the end there, I agreed with you 100%.
        tptacek 19y ago
        Why are you commenting on things you haven't even read? No, wait, I said that wrong. Stop fucking commenting on things you haven't even fucking read.
        pius 19y ago
        Ah, the Internet, where people act tough when they're safe behind their computer screens. You're really cool, getting so riled up about encryption schemes and commenting habits that you're typing swear words at me on a forum. <shaking my head> I'll say in advance, don't blame me for the downmods -- I didn't contribute a single one.
- tptacek 19y ago
  All due respect, but the "security through obscurity" argument went out the window when Shaw published his source. His propaganda is fair game, and sigstoat is right.
  - pius 19y ago
    Have you even read the thread?
tptacek 19y ago
As a practitioner, I'm going to chime in and agree completely. Shaw has created a merit badge sash of crypto exotica: Needham-Shroeder key exchange (oh, sorry, "ISO IEC 48798783 without the Helsinki vulnerability"), a bizarro block cipher mode, a custom PRNG, and no explanation whatsoever of the motivation behind his choices. Of course, this is all just libtomcrypt under the hood, which probably explains the showy idiosyncrasy. You'd be able to take something like this more seriously if Zed "So Fucking Awesome" Shaw had ever contributed any findings against TLS, or even SSH. But that would be Hard, Harder than "fighting the cargo cults" --- people much more demonstrably competant than Shaw have already shaken the bugs out of TLS. Generally, I find Shaw's arguments and reasoning about security unconvincing. For instance, there's a place in that article where he argues that "binary protocols have fewer buffer overflows" --- he might as well just write "I don't pay attention to vulnerability research". He seems to believe that Ragel, an obscure regex-modeled lexer, is a talisman against vulnerabilities. His "Hate" protocol assumes that attackers originate from single sources, not from armadas of compromised machines. Sigstoat isn't the first person to comment on this "top 10 list of signs of bad security" --- this is a point Schneier makes, often.
- thurston 19y ago
  Just a note on ragel: it can be used to create lexers, but that is not its distinguishing characteristic. It is a parser generator for regular languages.
  - tptacek 19y ago
    Because this is a more interesting conversation than the grandparent comment --- what's the difference between a lexer generator and a parser generator for regular languages? What can I do with Ragel that I can't do with a (probably clumsy) application of Flex? I don't mean to snipe at Ragel, just Shaw's use of it as an amulet against vulnerabilities.
    - thurston 19y ago
      You can define a full grammar for a language and embed actions in arbitrary places. It is compiled to a very fast DFA. Think of it as a yacc for regular languages. Zed's advocacy for Ragel is really about using parser generators to implement internet-facing parsers.

pius 19y ago

All due respect, but thinking that a system's security relies on people not knowing what ciphers and hash functions the system uses is on the top 3 list of signs that you're clueless about security. It'd be difficult to have made a more ironic post than slamming someone for "not understanding security" with a "security through obscurity" argument. ;) See http://en.wikipedia.org/wiki/Kerckhoffs%27_principle http://en.wikipedia.org/wiki/Kerckhoffs%27_principle for why.

hhm 19y ago
Maybe what sigstoat wanted to say is that telling so much detail about that could be a sign that he doesn't know much about it. You don't talk about loops all the day when talking about programming, as they are the fundamentals any decent programmer understands and can imagine by himself (and when there is ambiguity, any programmer can check some extra documentation or even the code later to know about the details). I don't know much about security so I could be wrong, but that's what I think he could have meant.
- pius 19y ago
  Perhaps; I couldn't speculate. To your point, though, a security protocol implementation document that makes use of secure hashes, encryption schemes, and the like isn't typically considered credible unless it states precisely what building blocks it uses. For instance, it's not enough to say you're going to use "random numbers." You need to say how you're going to seed and generate your pseudo-random numbers. The details matter. Had the document spent time explaining what CBC means or how AES is implemented, that would have been the security equivalent of talking too much about loops or Quicksort.
  - hhm 19y ago
    Very interesting reply; you are right of course.
  - tptacek 19y ago
    If Zed Shaw was interested in having people review his weird chat protocols, he'd probably: * Document them without the "mixture of humor, ranting, code, and specification language." The "specification language", presuming it's not in something Zed invented (like Stackish franken-sexps), would do nicely. * Use well-understood, well-tested primitives, and where he deviates (ECC might be mainstream, but CCM and Needham-Schroeder public key exchange aren't), explain why. * Describe things in terms of the cryptosystem and the goals, instead of using the least intelligible, most intimidating acronyms he can come up with (seriously, "ISO/IEC 11770-3 Mechanism 6"?). You're exactly wrong, of course. Zed's using CCM, and an evaluator would want to know what properties his system expects to achieve from doing so. Talking about CBC (or CBC-MACs) would make him look more savvy. Instead, we get "I’ve decided to send it back as Er(Nr) but I’m not sure of the security of this."
    - pius 19y ago
      I should be clear; I haven't read Zed's documentation and neither approve nor disapprove what he wrote. My reactions are strictly to the notion that a protocol creator shouldn't mention specifics in a security document -- that's flat out wrong. Until the snarky bit at the end there, I agreed with you 100%.
      - tptacek 19y ago
        Why are you commenting on things you haven't even read? No, wait, I said that wrong. Stop fucking commenting on things you haven't even fucking read.
        pius 19y ago
        Ah, the Internet, where people act tough when they're safe behind their computer screens. You're really cool, getting so riled up about encryption schemes and commenting habits that you're typing swear words at me on a forum. <shaking my head> I'll say in advance, don't blame me for the downmods -- I didn't contribute a single one.
tptacek 19y ago
All due respect, but the "security through obscurity" argument went out the window when Shaw published his source. His propaganda is fair game, and sigstoat is right.
- pius 19y ago
  Have you even read the thread?

tptacek 19y ago

As a practitioner, I'm going to chime in and agree completely. Shaw has created a merit badge sash of crypto exotica: Needham-Shroeder key exchange (oh, sorry, "ISO IEC 48798783 without the Helsinki vulnerability"), a bizarro block cipher mode, a custom PRNG, and no explanation whatsoever of the motivation behind his choices. Of course, this is all just libtomcrypt under the hood, which probably explains the showy idiosyncrasy. You'd be able to take something like this more seriously if Zed "So Fucking Awesome" Shaw had ever contributed any findings against TLS, or even SSH. But that would be Hard, Harder than "fighting the cargo cults" --- people much more demonstrably competant than Shaw have already shaken the bugs out of TLS. Generally, I find Shaw's arguments and reasoning about security unconvincing. For instance, there's a place in that article where he argues that "binary protocols have fewer buffer overflows" --- he might as well just write "I don't pay attention to vulnerability research". He seems to believe that Ragel, an obscure regex-modeled lexer, is a talisman against vulnerabilities. His "Hate" protocol assumes that attackers originate from single sources, not from armadas of compromised machines. Sigstoat isn't the first person to comment on this "top 10 list of signs of bad security" --- this is a point Schneier makes, often.

thurston 19y ago
Just a note on ragel: it can be used to create lexers, but that is not its distinguishing characteristic. It is a parser generator for regular languages.
- tptacek 19y ago
  Because this is a more interesting conversation than the grandparent comment --- what's the difference between a lexer generator and a parser generator for regular languages? What can I do with Ragel that I can't do with a (probably clumsy) application of Flex? I don't mean to snipe at Ragel, just Shaw's use of it as an amulet against vulnerabilities.
  - thurston 19y ago
    You can define a full grammar for a language and embed actions in arbitrary places. It is compiled to a very fast DFA. Think of it as a yacc for regular languages. Zed's advocacy for Ragel is really about using parser generators to implement internet-facing parsers.