3 ms·

I agree too! The point I'm trying to make is that even in critical software, where people's lives are in the balance, there can be minor errors that don't brin

I agree too! The point I'm trying to make is that even in critical software, where people's lives are in the balance, there can be minor errors that don't bring down the entire edifice. Whereas in crypto code, there seems to be only one kind of error possible.

dahart 9y ago
I see a few kinds of intermediate crypto errors possible. You can weaken the crypto without breaking it, you can leak metadata, you can screw up protocols without compromising the algorithm, etc.. But yes in some sense you're completely right, perhaps just because the aim of a crypto algorithm is so narrow? The number of things you can do right with a pair of encrypt/decrypt functions is so limited that the number of things you can do wrong is also pretty small. There's certainly a lot more than can go wrong with "drive a car" than with "encrypt this message".
- tptacek 9y ago
  In the same sense that modern vulnerability research is in large part the study of leveraging the smallest possible memory corruption bug to obtain remote code execution, modern practical cryptanalysis is the study of leveraging the smallest possible unexpected behavior of any sort to full breaks in both confidentiality and integrity. By way of example: you could "weaken" an RNG so that where a construction expects a 256 bit nonce, you generate only 255 secure bits. If that construction is ECDSA, there's a good chance you've managed to disclose to attackers your signing private key. You could "weaken" a protocol so that attackers can replace an original plaintext with 16 uniform random bits. If the protocol is using CBC mode, you've allowed attackers to recover whole plaintexts. There aren't a lot of errors that get routinely made in crypto code that don't have devastating consequences.
  - infraruby 9y ago
    > You could "weaken" a protocol so that attackers can replace an original plaintext with 16 uniform random bits. If the protocol is using CBC mode, you've allowed attackers to recover whole plaintexts. Do you have a link explaining this?
    - tptacek 9y ago
      I'm describing the CBC padding oracle attack. I'm surprised this is the thing you want the link for, and not "1 biased bit destroys the security of a 256 bit nonce where the other 255 bits come from secure random".
      - infraruby 9y ago
        > I'm describing the CBC padding oracle attack. Ah! Wouldn't that be "attackers can replace an original ciphertext with two chosen blocks"? > I'm surprised this is the thing you want the link for, and not "1 biased bit destroys the security of a 256 bit nonce where the other 255 bits come from secure random". IIRC the link for that is in your hiring post!

dahart 9y ago

I see a few kinds of intermediate crypto errors possible. You can weaken the crypto without breaking it, you can leak metadata, you can screw up protocols without compromising the algorithm, etc.. But yes in some sense you're completely right, perhaps just because the aim of a crypto algorithm is so narrow? The number of things you can do right with a pair of encrypt/decrypt functions is so limited that the number of things you can do wrong is also pretty small. There's certainly a lot more than can go wrong with "drive a car" than with "encrypt this message".

tptacek 9y ago
In the same sense that modern vulnerability research is in large part the study of leveraging the smallest possible memory corruption bug to obtain remote code execution, modern practical cryptanalysis is the study of leveraging the smallest possible unexpected behavior of any sort to full breaks in both confidentiality and integrity. By way of example: you could "weaken" an RNG so that where a construction expects a 256 bit nonce, you generate only 255 secure bits. If that construction is ECDSA, there's a good chance you've managed to disclose to attackers your signing private key. You could "weaken" a protocol so that attackers can replace an original plaintext with 16 uniform random bits. If the protocol is using CBC mode, you've allowed attackers to recover whole plaintexts. There aren't a lot of errors that get routinely made in crypto code that don't have devastating consequences.
- infraruby 9y ago
  > You could "weaken" a protocol so that attackers can replace an original plaintext with 16 uniform random bits. If the protocol is using CBC mode, you've allowed attackers to recover whole plaintexts. Do you have a link explaining this?
  - tptacek 9y ago
    I'm describing the CBC padding oracle attack. I'm surprised this is the thing you want the link for, and not "1 biased bit destroys the security of a 256 bit nonce where the other 255 bits come from secure random".
    - infraruby 9y ago
      > I'm describing the CBC padding oracle attack. Ah! Wouldn't that be "attackers can replace an original ciphertext with two chosen blocks"? > I'm surprised this is the thing you want the link for, and not "1 biased bit destroys the security of a 256 bit nonce where the other 255 bits come from secure random". IIRC the link for that is in your hiring post!