10 ms·

Could you expand a bit on your comments about Poly1305 ("too difficult to implement" - but Bernstein has a library, right?) and Blowfish ("DON'T use")?

cperciva 17y ago
Yes, Bernstein has written code for Poly1305; but bus factors are bad. If you decide to use Poly1305, at some point you're going to want to use it on a new CPU or in a different language, and you'll find that DJB's code won't work for you. You should avoid blowfish because it has a 64-bit block size.
- JoachimSchipper 17y ago
  Okay, I can see that. Most of Bernstein's crypto work falls in that category, probably. Forgive my ignorance, but why is having a short block size especially bad? You don't want to subject 64 bits to a birthday attack, but something like CTR mode should work, right? (I still wouldn't recommend Blowfish - AES is used more widely and works perfectly well - I'd just like to understand your reasoning).
  - cperciva 17y ago
    With a 128-bit block, you can send 2^64 messages of up to 2^64 blocks each; that's not going to cause problems. With a 64-bit block, you're limited to 2^32 messages of up to 2^32 blocks before you overflow.
- agl 17y ago
  Poly1305 is a fundamentally different class of authenticator than HMAC-SHA256: the addition of an nonce into the function makes it unsuitable for some environments. But given Intel's new instructions, GCM is looking like a more attractive polynomial MAC these days.
  - tptacek 17y ago
    Why would you take GCM over OCB (apart from patents)? Or, for that matter, OMAC/EAX?
- lisper 17y ago
  What does "bus factors are bad" mean? And as long as I'm asking questions, what about bcrypt for password hashing?
  - cperciva 17y ago
    "Bus factors" refers to how many people need to get hit by busses before there's nobody left who can work on something. In particular, a bus factor of 1 is a very bad thing to have.
    - JoachimSchipper 17y ago
      Although it's mitigated somewhat by the fact that Bernstein is passionate and has been a reliable maintainer in the past. "Bus factor" is typically an euphemism for "someone is going to pay this employee more than we do".
      - euccastro 17y ago
        I'd call that a cacophonism, though, unless you truly prefer that they get hit by a bus.
  - JoachimSchipper 17y ago
    AFAIK, bcrypt for password hashing is fine (although Percival has his own scheme that he believes to be better - I can't comment either way).
    - cperciva 17y ago
      Last time I asked him, one of the authors of bcrypt considered scrypt to be better, too. :-)
      - lisper 17y ago
        That's a pretty good endorsement :-) I'm a little confused though. S-crypt seems to be a symmetric encryption algorithm and to store passwords you need a one-way hash. I'm obviously missing something. What is it?

cperciva 17y ago

Yes, Bernstein has written code for Poly1305; but bus factors are bad. If you decide to use Poly1305, at some point you're going to want to use it on a new CPU or in a different language, and you'll find that DJB's code won't work for you. You should avoid blowfish because it has a 64-bit block size.

JoachimSchipper 17y ago
Okay, I can see that. Most of Bernstein's crypto work falls in that category, probably. Forgive my ignorance, but why is having a short block size especially bad? You don't want to subject 64 bits to a birthday attack, but something like CTR mode should work, right? (I still wouldn't recommend Blowfish - AES is used more widely and works perfectly well - I'd just like to understand your reasoning).
- cperciva 17y ago
  With a 128-bit block, you can send 2^64 messages of up to 2^64 blocks each; that's not going to cause problems. With a 64-bit block, you're limited to 2^32 messages of up to 2^32 blocks before you overflow.
agl 17y ago
Poly1305 is a fundamentally different class of authenticator than HMAC-SHA256: the addition of an nonce into the function makes it unsuitable for some environments. But given Intel's new instructions, GCM is looking like a more attractive polynomial MAC these days.
- tptacek 17y ago
  Why would you take GCM over OCB (apart from patents)? Or, for that matter, OMAC/EAX?
lisper 17y ago
What does "bus factors are bad" mean? And as long as I'm asking questions, what about bcrypt for password hashing?
- cperciva 17y ago
  "Bus factors" refers to how many people need to get hit by busses before there's nobody left who can work on something. In particular, a bus factor of 1 is a very bad thing to have.
  - JoachimSchipper 17y ago
    Although it's mitigated somewhat by the fact that Bernstein is passionate and has been a reliable maintainer in the past. "Bus factor" is typically an euphemism for "someone is going to pay this employee more than we do".
    - euccastro 17y ago
      I'd call that a cacophonism, though, unless you truly prefer that they get hit by a bus.
- JoachimSchipper 17y ago
  AFAIK, bcrypt for password hashing is fine (although Percival has his own scheme that he believes to be better - I can't comment either way).
  - cperciva 17y ago
    Last time I asked him, one of the authors of bcrypt considered scrypt to be better, too. :-)
    - lisper 17y ago
      That's a pretty good endorsement :-) I'm a little confused though. S-crypt seems to be a symmetric encryption algorithm and to store passwords you need a one-way hash. I'm obviously missing something. What is it?