4 ms·
After differential cryptanalysis we are mostly out of ideas.
by wbl 7y ago
After differential cryptanalysis we are mostly out of ideas.
- tptacek 7y agoHow true is this (I have no idea)? And to the extent it is, how valid would it be to draw a comparison to the security of software, saying something like "after out-of-bounds writes, we're mostly out of ideas on how to get RCE out of C programs"? There are a lot of extensions to basic differential cryptanalysis.
- pvg 7y agoSeems like a tough comparison to make given the security of a cryptosystem is a lot better defined than that of a program, even in a constrained case like 'RCE in a C program'.
- tptacek 7y agoIt might be, I don't know. In practice (that is, in carrying out cryptographic attacks on real systems), nobody ever cryptanalyzes ciphers, so I've hardly studied block cipher cryptanalysis at all; someone much smarter than me gave me a purely linear block cipher once and I didn't spot it (plus side: now I can break purely linear ciphers! make a bunch of them! put them in JWT!), so this stuff is generally over my pay grade, though I have cryptopals exercises for basic linear and differential cryptanalysis tee'd up. But I'm just noticing how many named cryptanalytic techniques, like Boomerang, Impossible Differential, even I guess to an extent Slide, are really extensions of Matsui and Biham and Shamir. And that's true of C/C++ software too: most attacks seen in the wild are derivatives of just a couple basic techniques ("out of bound write" is obviously putting my thumb on the scale, but "buffer overrun", "integer mishandling", and "use after free" cover a pretty good fraction of all attacks on memory safety). Which is all to say: "we've had no good ideas since differential" might not be as meaningful as it sounds? Or maybe it is. Sometimes the best way to get good information into a message board thread is to add bad information, and, in theoretical cryptography, I contribute that ably!
- pvg 7y agoI don't really know either, I'm just pedentipointing out that the security of one of these things is an actual number, measurable in bits and this fact makes Aumasson's argument possible to begin with. The 'security' of any program even in relatively constrained cases is woolier. Is a C program that can't write to executable memory at all but can allow the interpretation and execution of some language it happens to interpret vulnerable to RCE, etc. So if there is a parallel of some sort, it seems to me it could only be a narrative one.
- wolf550e 7y agoAnalysis of security of arbitrary programs is in its infancy, we can't quantify anything yet. I think the best we have is halvarflake's provable unexploitability [1] and that is very weak. 1 - https://ieeexplore.ieee.org/document/8226852 https://ieeexplore.ieee.org/document/8226852
- EthanHeilman 7y agoIn fairness there isn't that many people that work on cryptanalysis, at least in the public sphere.
- tptacek 7y agoI think there are actually rather a lot of them.
- EthanHeilman 7y agoWhen I look at the number of papers published, the number of courses offered, professors, or companies, it doesn't seem like the cryptanalysis field is particularly big.
- mlyle 7y agoBut keep in mind that other parties knew about differential cryptanalysis 15 years+ before publication.