5 ms·

Actually a great comment. This is what I wish all those "awesome lists" were: lists written by people actually in the field who've actually read all the books t

Actually a great comment. This is what I wish all those "awesome lists" were: lists written by people actually in the field who've actually read all the books they're recommending. Unlike the current state, which is lists compiled by people completely new to the field looking for easy github stars putting up every book they can find with a Google search.

dsacco 9y ago
Funny you mention that, because I'm currently working on a GitHub repo as a research aid for myself. It's a compendium of all major cryptographic primitives and constructions (protocols) and the current state of the art in cryptanalysis against them, sorted by type (i.e. symmetric:block cipher:AES). On the one hand it's rather straightforward because much of the state of the art in crypto research is in eprint or open access. On the other hand there isn't really a sane "landscape document" that elucidates all of this information in one place because it's so scattered and hard to organize. Specifically: imagine a straightforward document with a handy table of contents that e.g. explains what a given cryptographic primitive is at a high level and what the current state of the art in attacking it is, like so: https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_validation https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_valida... I don't know how useful this would be to someone not working on cryptography research because it's heavily descriptive and academic (unlike, say, Cryptographic Right Answers, which is a good prescriptive document for developers).
- schoen 9y ago
  Maybe kind of akin to http://valerieaurora.org/hash.html http://valerieaurora.org/hash.html but for constructions, and with more citations?
  - dsacco 9y ago
    Cool, yeah that's a good resource. But it's a bit opinionated and focuses on general purpose hashing functions without coverage of symmetric and asymmetric encryption, digital signatures or password hashing functions. It also doesn't include some obvious contenders, like BLAKE2 (presumably because Keccak won the SHA-3 contest, but that's not a great reason). Other than that, a git repository format also has the handy benefit of pull requests in case one maintainer misses some new avant-garde attack. While we're at it, a similar resource for benchmarking instead of cryptanalysis exists here: https://bench.cr.yp.to/ https://bench.cr.yp.to/. This is maintained by Daniel Bernstein, who is probably the single most qualified person to lead that sort of work.
    - schoen 9y ago
      It's really nice to have access to these kinds of summaries to understand these landscapes. So, thanks for that reference and thanks for working on another one.
- ahazred8ta 9y ago
  Thomas H. Ptacek (Ptáček) wrote a 2015 update to 'Cryptographic Right Answers'. https://gist.github.com/tqbf/be58d2d39690c3b366ad#ptacek-CryptoRtAns https://gist.github.com/tqbf/be58d2d39690c3b366ad#ptacek-Cry...

dsacco 9y ago

Funny you mention that, because I'm currently working on a GitHub repo as a research aid for myself. It's a compendium of all major cryptographic primitives and constructions (protocols) and the current state of the art in cryptanalysis against them, sorted by type (i.e. symmetric:block cipher:AES). On the one hand it's rather straightforward because much of the state of the art in crypto research is in eprint or open access. On the other hand there isn't really a sane "landscape document" that elucidates all of this information in one place because it's so scattered and hard to organize. Specifically: imagine a straightforward document with a handy table of contents that e.g. explains what a given cryptographic primitive is at a high level and what the current state of the art in attacking it is, like so: https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_validation https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_valida... I don't know how useful this would be to someone not working on cryptography research because it's heavily descriptive and academic (unlike, say, Cryptographic Right Answers, which is a good prescriptive document for developers).

schoen 9y ago
Maybe kind of akin to http://valerieaurora.org/hash.html http://valerieaurora.org/hash.html but for constructions, and with more citations?
- dsacco 9y ago
  Cool, yeah that's a good resource. But it's a bit opinionated and focuses on general purpose hashing functions without coverage of symmetric and asymmetric encryption, digital signatures or password hashing functions. It also doesn't include some obvious contenders, like BLAKE2 (presumably because Keccak won the SHA-3 contest, but that's not a great reason). Other than that, a git repository format also has the handy benefit of pull requests in case one maintainer misses some new avant-garde attack. While we're at it, a similar resource for benchmarking instead of cryptanalysis exists here: https://bench.cr.yp.to/ https://bench.cr.yp.to/. This is maintained by Daniel Bernstein, who is probably the single most qualified person to lead that sort of work.
  - schoen 9y ago
    It's really nice to have access to these kinds of summaries to understand these landscapes. So, thanks for that reference and thanks for working on another one.
ahazred8ta 9y ago
Thomas H. Ptacek (Ptáček) wrote a 2015 update to 'Cryptographic Right Answers'. https://gist.github.com/tqbf/be58d2d39690c3b366ad#ptacek-CryptoRtAns https://gist.github.com/tqbf/be58d2d39690c3b366ad#ptacek-Cry...