3 ms·

1. There's a difference between kicking the tyres and looking under the bonnet of a car, and taking the schematics and building your own. It's easier to show so

by nly 8y ago

1. There's a difference between kicking the tyres and looking under the bonnet of a car, and taking the schematics and building your own. It's easier to show something is crap than convince people that it is good when you're outright hiding things. If the things you aren't hiding (well) are crap, then god only knows how terrible the things you are really hiding are. 2. Making claims based on the calibre of the companies and individuals involved doesn't work. People don't trust DJBs algorithms simply because of his personal track record. He also publishes whitepapers about their design, and demonstrates their advantages over the state of the art. That's hard science, not "it must be good because DJB is a rock star". The fact that people can then take his designs and implement them themselves, in the open, is also important.

tptacek 8y ago
I don't know many people who actually work in cryptography who believe that verification is cheaper and easier than building systems. People absolutely do, for the most part, trust DJB because of his track record. Find 10 people who have adopted Poly1305 and ask them what Poly1305 does better than GCM. That's not to say their decision is uninformed; rather, they've delegated a very specialized part of the decision that very few people are actually qualified to make out to an expert they trust, and trust for good reason. In practical cryptography, the opposite approach --- people who trust nothing until they verify it from first principles --- is extremely problematic. That's how you end up with oddball libraries that only look like they can do a secure scalar multiplication or reliably add two numbers together. As Bruce Schneier is fond of pointing out, everyone can design a system they themselves can't break.
- CiPHPerCoder 8y ago
  > Find 10 people who have adopted Poly1305 and ask them what Poly1305 does better than GCM. Two things, one of which cannot be credited to Poly1305 directly. 1. Poly1305 is easier to implement without introducing side-channels (modulo integer multiplication on some CPUs; in which case, I defer to Thomas Pornin on how to avoid them). 2. The Chapoly constructions that use Poly1305 do so in a way that leaking the one-time Poly1305 key doesn't buy you much. (This is the one that cannot be attributed to Poly1305 directly.) Others may have better or different answers. I implemented it in PHP [1], so anyone reading this thread should keep that in mind. :) [1] https://github.com/paragonie/sodium_compat/blob/f3b2d775a50d6f316b311554f4954a1668439551/src/Core/Poly1305/State.php https://github.com/paragonie/sodium_compat/blob/f3b2d775a50d...

by nly 8y ago

tptacek 8y ago

I don't know many people who actually work in cryptography who believe that verification is cheaper and easier than building systems. People absolutely do, for the most part, trust DJB because of his track record. Find 10 people who have adopted Poly1305 and ask them what Poly1305 does better than GCM. That's not to say their decision is uninformed; rather, they've delegated a very specialized part of the decision that very few people are actually qualified to make out to an expert they trust, and trust for good reason. In practical cryptography, the opposite approach --- people who trust nothing until they verify it from first principles --- is extremely problematic. That's how you end up with oddball libraries that only look like they can do a secure scalar multiplication or reliably add two numbers together. As Bruce Schneier is fond of pointing out, everyone can design a system they themselves can't break.

CiPHPerCoder 8y ago
> Find 10 people who have adopted Poly1305 and ask them what Poly1305 does better than GCM. Two things, one of which cannot be credited to Poly1305 directly. 1. Poly1305 is easier to implement without introducing side-channels (modulo integer multiplication on some CPUs; in which case, I defer to Thomas Pornin on how to avoid them). 2. The Chapoly constructions that use Poly1305 do so in a way that leaking the one-time Poly1305 key doesn't buy you much. (This is the one that cannot be attributed to Poly1305 directly.) Others may have better or different answers. I implemented it in PHP [1], so anyone reading this thread should keep that in mind. :) [1] https://github.com/paragonie/sodium_compat/blob/f3b2d775a50d6f316b311554f4954a1668439551/src/Core/Poly1305/State.php https://github.com/paragonie/sodium_compat/blob/f3b2d775a50d...