6 ms·
Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice
- pfortuny 8y agolocalhost? wrong redirect?
- kardos 8y agoIt's a sci-hub link; does your network hijack DNS to block it?
- dweekly 8y agoI'm also receiving a locahost redirect over Verizon Wireless in the US when using Chrome for iOS. DNS resolves to 80.82.77.83 and .84. When I surf directly to that IP I am redirected to https://sci-hub.se https://sci-hub.se which seems to load correctly. That implies this is the correct server and not a MITM. When using CloudFlare's DNS VPN I get the same IPs, so this is not a VZW injected IP. It seems the Sci Hub site itself is doing the local host redirect...?
- dweekly 8y agoWorking link: http://sci-hub.se/downloads/17ae/10.1145@3292035.pdf http://sci-hub.se/downloads/17ae/10.1145@3292035.pdf
- tosh 8y agohttps://dl.acm.org/citation.cfm?doid=2810103.2813707 https://dl.acm.org/citation.cfm?doid=2810103.2813707
- kardos 8y agoIt's open access, should change to this link
- jeffreydpayne 8y agoThis is relevant to my interests. Thank God we're already using ECC for everything.
- dadrian 8y agohttps://weakdh.org/imperfect-forward-secrecy.pdf https://weakdh.org/imperfect-forward-secrecy.pdf
- dang 8y agoChanged from https://sci-hub.tw/10.1145/3292035 https://sci-hub.tw/10.1145/3292035. Thanks!
- dadrian 8y agoThere's an updated version of the paper that was published today, so here's an even better link: https://jhalderm.com/pub/papers/weakdh-cacm19.pdf https://jhalderm.com/pub/papers/weakdh-cacm19.pdf Source: I'm an author.
- dang 8y agoThanks! Changed from https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf.
- dweekly 8y agoWorking link http://sci-hub.se/downloads/17ae/10.1145@3292035.pdf http://sci-hub.se/downloads/17ae/10.1145@3292035.pdf
- gregschlom 8y agoI'm confused... Wasn't all that published in 2015 already? Edit: ah it says it right there on this article: The full version of this paper was published in Proceedings of the 22nd Conference on Computer and Communications Security (CCS), October 2015, ACM Mods, maybe add a "2015" to the title?
- antoineMoPa 8y agoSo that thing I learned last semester is useless?
- dgrove 8y agoUse the elliptic curve version instead https://security.stackexchange.com/questions/46802/what-is-the-difference-between-dhe-and-ecdh https://security.stackexchange.com/questions/46802/what-is-t... This is built into modern browsers so you can use that as the basis for HMAC if you can't trust TLS or have something like an open URL for a lambda function that in theory should only be hit by someone's webhook (ie. Slack)
- wolf550e 8y agoYou should have learned this paper last semester, as the paper is from 2015 and is relevant if you study DH. Anyway, for an application developer (as opposed to a crypto engineer), just use libsodium when you control both sides. If you need to interop with someone else, use TLS 1.3 if you can, or TLS 1.2 but only with ciphers that support PFS and AEAD, i.e. in practice x25519 and P-256 ECDHE with RSA signatures with AES GCM or ChaCha20Poly1305. Same primitives are available in SSH. If you can, don't use IPSec, use wireguard. Don't use pgp/openpgp/gpg email, use signal. You can use gpg to sign packages and encrypt backups, but the email integration and UX will kill you.
- jolmg 8y ago> Don't use pgp/openpgp/gpg email, use signal. You can use gpg to sign packages and encrypt backups, but the email integration and UX will kill you. Is there any problem with the crypto that gpg uses, or is it just a matter of the UX?
- marcosdumay 8y agoGpg can use a lot of different crypto primitives. Some do have problems, some are kinda broken but still good enough for use, some are too easy to make mistakes so gpg is probably bugged, and some are top of the line. Gpg email also leak some more metadata than signal does. But it leaks to different parties, so this is not clear-cut.
- deleted 8y ago[deleted]
- samirm 8y agoStrange that they recommend an elliptic-curve based implementation considering it's not quantum resistant.
- mtgx 8y agoUniversal Quantum computers were barely started to be announced at that time by IBM and Google.
- tuxxy 8y agoThere likely will not be a cryptanalytic capable quantum computer for over a few decades.
- Taniwha 8y agoI bet that's the NSA's (public) company line
- setr 8y agoActually wasn’t the latest gov standard pushing for quantum-resistant algos? I vaguely remember some controversy over it on HN, because the switched recommendation was sudden and came out of nowhere (with at least one suggestion that they must be nearing it, or someone else is). Dont follow this topic normally, which is why I’m so vague on this, and possibly wrong.
- tkhoven 8y agoIf you're talking about NIST, they've initiated the process to standardise post-quantum public key crypto: https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Post-Quantum-Cryptography-Standardization https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Pos... Round 1 submissions were received by November 2017: https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Round-1-Submissions https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Rou...
- samirm 8y ago
- lerno 8y agoWow, people using 512 bit keysizes in 2018?? Back in 2014 I got the recommendation to ditch 2048 in favor of 4096.