3 ms·

No, crypto is actually hard. One difference from regular programming is that there really are no 'intermediate' errors. Experience shows that getting one small

No, crypto is actually hard. One difference from regular programming is that there really are no 'intermediate' errors. Experience shows that getting one small detail wrong is as bad as getting the whole thing wrong. I can't think of another programming domain where that holds.

tptacek 9y ago
Distributed databases. Medical imaging.
ivanhoe 9y ago
Ariane 5 rocket crashed in 1996 because of one wrong int conversion, costing Euro Space Agency something like $500 millions... how about that for "one small detail"? :)
- lisper 9y ago
  Mars Climate Orbiter too (http://www.cnn.com/TECH/space/9909/30/mars.metric.02/ http://www.cnn.com/TECH/space/9909/30/mars.metric.02/)
dahart 9y ago
I agree crypto is actually hard. But there are lots of domains where details matter and small errors have big consequences. Vehicles, medicine, and manufacturing are all places where errors have killed people. Obviously severity depends on the situation, but generally speaking I'd rather my encryption get broken than die. Software defects in the Therac-25 radiation therapy machine killed several people [1]. Software defects in Toyota's acceleration killed 37 people [2]. "We've demonstrated how as little as a single bit flip can cause the driver to lose control of the engine speed in real cars due to software malfunction that is not reliably detected by any fail-safe," Michael Barr, CTO and co-founder of Barr Group, told us in an exclusive interview. Barr served as an expert witness in this case." [3] Self-driving autopilot has got to be pretty hard. [4] [1] http://sunnyday.mit.edu/papers/therac.pdf http://sunnyday.mit.edu/papers/therac.pdf [2] https://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_recalls https://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle... [2] http://www.embedded.com/electronics-news/4423365/Toyota-Camry-L4-case--the-single-bit-flip-that-killed http://www.embedded.com/electronics-news/4423365/Toyota-Camr... [4] https://www.youtube.com/watch?v=-2ml6sjk_8c https://www.youtube.com/watch?v=-2ml6sjk_8c
- deleted 9y ago
  [deleted]
- idlewords 9y ago
  I agree too! The point I'm trying to make is that even in critical software, where people's lives are in the balance, there can be minor errors that don't bring down the entire edifice. Whereas in crypto code, there seems to be only one kind of error possible.
  - dahart 9y ago
    I see a few kinds of intermediate crypto errors possible. You can weaken the crypto without breaking it, you can leak metadata, you can screw up protocols without compromising the algorithm, etc.. But yes in some sense you're completely right, perhaps just because the aim of a crypto algorithm is so narrow? The number of things you can do right with a pair of encrypt/decrypt functions is so limited that the number of things you can do wrong is also pretty small. There's certainly a lot more than can go wrong with "drive a car" than with "encrypt this message".
    - tptacek 9y ago
      In the same sense that modern vulnerability research is in large part the study of leveraging the smallest possible memory corruption bug to obtain remote code execution, modern practical cryptanalysis is the study of leveraging the smallest possible unexpected behavior of any sort to full breaks in both confidentiality and integrity. By way of example: you could "weaken" an RNG so that where a construction expects a 256 bit nonce, you generate only 255 secure bits. If that construction is ECDSA, there's a good chance you've managed to disclose to attackers your signing private key. You could "weaken" a protocol so that attackers can replace an original plaintext with 16 uniform random bits. If the protocol is using CBC mode, you've allowed attackers to recover whole plaintexts. There aren't a lot of errors that get routinely made in crypto code that don't have devastating consequences.
      - infraruby 9y ago
munificent 9y ago
> I can't think of another programming domain where that holds. Static type systems.
mindcrime 9y ago
Experience shows that getting one small detail wrong is as bad as getting the whole thing wrong. Then it's highly likely that there isn't a single "completely" secure crypto implementation in existence...

tptacek 9y ago

Distributed databases. Medical imaging.

ivanhoe 9y ago

Ariane 5 rocket crashed in 1996 because of one wrong int conversion, costing Euro Space Agency something like $500 millions... how about that for "one small detail"? :)

lisper 9y ago
Mars Climate Orbiter too (http://www.cnn.com/TECH/space/9909/30/mars.metric.02/ http://www.cnn.com/TECH/space/9909/30/mars.metric.02/)

dahart 9y ago

I agree crypto is actually hard. But there are lots of domains where details matter and small errors have big consequences. Vehicles, medicine, and manufacturing are all places where errors have killed people. Obviously severity depends on the situation, but generally speaking I'd rather my encryption get broken than die. Software defects in the Therac-25 radiation therapy machine killed several people [1]. Software defects in Toyota's acceleration killed 37 people [2]. "We've demonstrated how as little as a single bit flip can cause the driver to lose control of the engine speed in real cars due to software malfunction that is not reliably detected by any fail-safe," Michael Barr, CTO and co-founder of Barr Group, told us in an exclusive interview. Barr served as an expert witness in this case." [3] Self-driving autopilot has got to be pretty hard. [4] [1] http://sunnyday.mit.edu/papers/therac.pdf http://sunnyday.mit.edu/papers/therac.pdf [2] https://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle_recalls https://en.wikipedia.org/wiki/2009%E2%80%9311_Toyota_vehicle... [2] http://www.embedded.com/electronics-news/4423365/Toyota-Camry-L4-case--the-single-bit-flip-that-killed http://www.embedded.com/electronics-news/4423365/Toyota-Camr... [4] https://www.youtube.com/watch?v=-2ml6sjk_8c https://www.youtube.com/watch?v=-2ml6sjk_8c

deleted 9y ago
[deleted]
idlewords 9y ago
I agree too! The point I'm trying to make is that even in critical software, where people's lives are in the balance, there can be minor errors that don't bring down the entire edifice. Whereas in crypto code, there seems to be only one kind of error possible.
- dahart 9y ago
  I see a few kinds of intermediate crypto errors possible. You can weaken the crypto without breaking it, you can leak metadata, you can screw up protocols without compromising the algorithm, etc.. But yes in some sense you're completely right, perhaps just because the aim of a crypto algorithm is so narrow? The number of things you can do right with a pair of encrypt/decrypt functions is so limited that the number of things you can do wrong is also pretty small. There's certainly a lot more than can go wrong with "drive a car" than with "encrypt this message".
  - tptacek 9y ago
    In the same sense that modern vulnerability research is in large part the study of leveraging the smallest possible memory corruption bug to obtain remote code execution, modern practical cryptanalysis is the study of leveraging the smallest possible unexpected behavior of any sort to full breaks in both confidentiality and integrity. By way of example: you could "weaken" an RNG so that where a construction expects a 256 bit nonce, you generate only 255 secure bits. If that construction is ECDSA, there's a good chance you've managed to disclose to attackers your signing private key. You could "weaken" a protocol so that attackers can replace an original plaintext with 16 uniform random bits. If the protocol is using CBC mode, you've allowed attackers to recover whole plaintexts. There aren't a lot of errors that get routinely made in crypto code that don't have devastating consequences.
    - infraruby 9y ago

munificent 9y ago

> I can't think of another programming domain where that holds. Static type systems.

mindcrime 9y ago

Experience shows that getting one small detail wrong is as bad as getting the whole thing wrong. Then it's highly likely that there isn't a single "completely" secure crypto implementation in existence...