7 ms·
How Not to Learn Cryptography (2014)
- anaphor 6y agoI can't figure out who wrote this article, and the site doesn't really make it clear if it's one person's blog or not. Anyone know? Edit: someone else answered already https://news.ycombinator.com/item?id=23386815 https://news.ycombinator.com/item?id=23386815
- zeroxfe 6y agoI've been working through the Cryptopals Crypto challenges (https://cryptopals.com https://cryptopals.com) over the last month-and-a-half (almost done with Set 6), and they've been extremely educational. Attacks that I thought were just "theoretical" turned out to be very practical (sometimes even quite simple.) I've always known that one shouldn't roll their own crypto because there's so many ways to shoot yourself -- but holy hell, executing some of these attacks really drive the point through. (Also, I've learned more number theory in the last few weeks than in my whole life!) If anyone's interested, I've been solving them in Go (which turned out to be surprisingly convenient for many reasons), and my solutions (so far) are here: https://github.com/0xfe/cryptopals https://github.com/0xfe/cryptopals.
- lucas-piske 6y agoThanks for sharing. I will definitely check this out.
- loup-vaillant 6y agoCryptopals strikes me as a very good way of scaring people from not only inventing, but also implementing their own crypto. It seems it's primary effect is to make people confident enough to repeat the "don't roll your own crypto" mantra to anyone who would listen. Some people however don't really have a choice. "Just Libsodium" doesn't work on anything smaller than a Raspberry-Pi, or pretty much any embedded system out there. There are alternatives out there (shameless plug: https://monocypher.org https://monocypher.org), but sometimes your only choice is to code and optimise it yourself. Sometimes, your only reasonable choice is to implement your own crypto. And I can tell from experience, a few weeks of full time learning is enough to not shoot yourself in the foot. The trick is to learn the right things (not everybody can spend a few weeks with Dan Boneh), but if you limit yourself to simple primitives like Chacha20 and Curve25519, it's not that hard. (Fun fact: I did not spend a few weeks with Dan Boneh, and I did shoot myself in the foot once.) Because let's be honest: you don't need to know all the attacks to protect yourself from them. What you need to know is the relevant classes of attacks, and how to void them. For instance, all timing attacks are stopped if your code runs in constant time (which in practice mostly means without secret-dependent branches and without secret-dependent indices).
- api 6y ago> Cryptopals strikes me as a very good way of scaring people from not only inventing, but also implementing their own crypto Paradox alert: the person who knows enough about crypto to fear implementing it is the person I want implementing the crypto I am using. So if the effect of such education is to discourage you, that means the crypto is left to the clueless to implement.
- zeroxfe 6y agoThanks, I agree with almost all of this. I didn't mean to imply that Cryptopals is how you become a cryptographer, just that it's a fantastic way to get down and dirty with cryptography, and learn a ton. These challenges are not easy, and you need some programming sophistication to get through them, since most of them require you to actually implement well-known primitives and algorithms (like Diffie-Hellman, RSA, DSA, PRNGs, etc.) And to do that correctly, you end up studying a _lot_ of side material. You do come out of the other end learning about various classes of attacks, but not necessarily how to avoid them -- that depends entirely upon your intellectual curiosity. :-)
- beefhash 6y ago> "Just Libsodium" doesn't work on anything smaller than a Raspberry-Pi, or pretty much any embedded system out there. There are alternatives out there And the same author provides a solution for those systems as well with libhydrogen. Though that doesn't look so super hot anymore given the recent advances on Gimli[1,2,3], but it'll likely still hold up in practice. > but sometimes your only choice is to code and optimise it yourself That is a critical shortcoming of the ecosystem. If you reach that point, you should be hiring a cryptographer/experienced implementer. Your follow-up question might be “Where do the cryptographers come from, then?” and the answer to that is: “PhD programs at universities, ideally”. Curiously, however, many (most?) cryptography libraries that are used in practice appear to be written by people with barely any academic background. We should be working to rectify that one way or another (send the implementers to university or pull more people from theory into implementation practice). > you don't need to know all the attacks to protect yourself from them. What you need to know is the relevant classes of attacks, and how to void them Some attacks, however, can be quite surprising or virtually impossible to mitigate without deep knowledge of the specific problem domain. Are we sure how to mitigate software implementations of EC scalar multiplication against differential power analysis yet? And that's before you get to protocol design, where there are new, mysterious ways to shoot yourself in the foot (use TLS, use TLS, use Noise). [1] https://eprint.iacr.org/2020/561.pdf https://eprint.iacr.org/2020/561.pdf [2] https://eprint.iacr.org/2020/591.pdf https://eprint.iacr.org/2020/591.pdf [3] https://eurocrypt.iacr.org/2020/rump/ec2020rump-paper23-slides-presentation.pdf https://eurocrypt.iacr.org/2020/rump/ec2020rump-paper23-slid...
- koeng 6y agoCould you give a couple examples of attacks that you thought was just theoretical but turned out to be very practical? Very curious about this topic.
- zeroxfe 6y agoSure: - The timing attacks were the most surprising to me -- particularly because how easy they were to exploit once you collected enough statistics. - Finding the seed / predicting upcoming random numbers from popular PRNGs by reconstructing internal state. (Interesting side note: I had to implement the Mersenne Twister from wikipedia, and my code literally looks like line noise: https://github.com/0xfe/cryptopals/blob/master/prng.go https://github.com/0xfe/cryptopals/blob/master/prng.go. Reversing the tempering code made me lose a lot of hair.) - Modifying encrypted data reliably on AES-CBC and AES-CTR by flipping bits! - If you use the same values for IV and key, you can recover the key with a little math. - Determining block/key sizes from ciphertext using statstical analysis worked surprisingly well. - Number-theoretic algorithms like DH, RSA, DSA, are sensitive to their parameters (like choice of primes, generators, etc.) - The padding oracle blew my mind: https://cryptopals.com/sets/3/challenges/17 https://cryptopals.com/sets/3/challenges/17
- shp0ngle 6y agoThey are, however, a little bit out of date in 2020, and the promised follow-ups never materialized for about 6 years now. Some things never changed from 2014 though, so it's a good start
- ghostpepper 6y agoCan you be more specific on what stuff is no longer relevant? I started the challenges and put them on hold but plan to return at some point.
- shp0ngle 6y agoIt’s not that specific thing is not relevant or even wrong, just that it misses new attacks
- colmmacc 6y agoI don't think you need even an undergraduate education in mathematics to get into cryptography; for many people it's the other way around. Cryptography can be a great motivator to learn the underlying math. Concepts that may have seemed too abstract to be useful suddenly become practical tools that help you build something that solves a real problem. I love my colleagues who have come from cryptography research programs; they are awesome! But the majority of my colleagues working on cryptography in practice come from software and security engineering backgrounds. You might think that is just a dividing line between folks who design and analyze cryptography, and those who implement it, but I don't think so. I've seen folks from both backgrounds be able to work on cryptography design and implementation.
- ralston3 6y agoCould you offer some tips/advice/resource for a SWE looking to get involved in applied cryptography? It seems like a very dense subject, with different areas being of different levels of importance depending on how deeply you’re involved (eg, researching vs writing application code)
- colmmacc 6y agoOne of my favorites is to build a DRBG; download one of the NIST DRBG specifications and try to implement it and have your implementation's output match the test vectors. You'll be building cryptography without having to design or build the underlying foundational layers. It's actually a lot harder to compose these things then it first seem. Then as you go, try to understand where every single limit in the DRBG specifications come from. Those will teach you a lot about how security factors are worked out. Plus it's hard; and it gets you into that phase of making big dark numbers match other big dark numbers. It's a very unforgiving form of programming.
- vsareto 6y agoIANAC but would the lattice stuff or the other post-quantum stuff require it? "Not having a solid math education" might be a condition with an expiration date if so.
- anvarik 6y agowell that page is not even on https
- barbegal 6y agoThis seems to boil down to: > If you can, just get a Ph.D. at a place with a good crypto group (remember that Ph.D.'s in computer science are effectively free) Which I'm not sure is great advice except for someone who wants a full time career in cryptography. And if you want a career in cryptography it's fairly obvious that the most well trodden root is via a PhD (which is definitely not free when you compare it to how much you could be earning in industry with a compsci or math degree)
- thevirtuoso1973 6y agoCan anyone elaborate on how CS Ph.D.'s are 'free'? Does this apply to UK universities? I'm aware of scholarships but I'm not from an under-represented background nor am I a genius. I suppose the student loan would cover the costs but I don't consider that free.
- tialaramex 6y agoI've dropped out of a PhD programme in the UK (many years ago) so perhaps I can help. It is usual for PhD students to have tuition and a small stipend for their living expenses paid for by government. The government knows perfectly well it needs some supply of researchers, the old ones eventually die so you need to train new ones and a PhD course is how you do that. A particular university Computer Science department might have say, six slots this year for PhD students. It needs not only the money (which you could if you're wealthy just pay for yourself) but also experienced staff willing to supervise these students which may be a more limiting factor. If it has eight capable applicants versus six slots then yes, you might get refused, but it's rare for there to be a huge imbalance between the number of applicants and available slots such that you'd need to be a "genius". If you have a good (say first or upper second honours) undergraduate degree in the same or closely related area, and you can find a PhD topic and a doctoral supervisor, in Computer Science they can probably make the money happen. You will not be wealthy (the stipend is small), but you should be too busy to notice and you're hanging out with other students who haven't got any money anyway.
- quickthrower2 6y agoLearning Cryptography in any way is never going to be free, when you could have spent that time building a SaaS or doing LeetCode exercises to land a Google job. In fact most people's life choices are very expensive through this lens.
- deleted 6y ago[deleted]
- non-entity 6y ago> (1) developing mathematical maturity; This has stopped me from learning so many things at this point it's not even funny.
- nine_k 6y agoSpeaking the language of reality a bit better pays off. Try to frame learning more useful bits of math like that.
- markus_zhang 6y agoMath maturity is probably unavoidable for some of the topics out there. But there are so many more in CS that don't require a ton of it.
- ruang 6y agoBest courses for mathematical maturity besides the standard CS ones? I'm thinking Algebra, or maybe Real Analysis.
- markus_zhang 6y agoYeah both are good. Basically anything that forces you to prove a lot of theorems that look trivial (but are not easy to prove) is good because they build up a system from small theorems. Back in school we use Rudin for Real Analysis and it's a good textbook. But I'd recommend taking a class if you are still in university because Math is a bit tricky for self study IMO. If you already graduated maybe follow some MOOC. I'd actually recommend Number theory if you want more fun or if you are interested in Cryptography which is related to CS. Elementary Number Theory throws you tons of questions that even a toddler can understand but you might hit bam head on walls for nights to prove them.
- ruang 6y agoThanks, I'm doing a Masters now and I was planning on taking Number Theory and Abstract Algebra next term. I took mathematical cryptography this term and it got me interested in more related math.
- xtajv 6y agotl;dr: To learn about some cryptography fundamentals: * Read Katz & Lindell's Introduction to Modern Cryptography * If you're missing math background, read Timothy Gowers' blog * Supplement: Take Jonathan Katz' and Dan Boneh's MOOCS (links in post) To get to the point where you can "design/analyze crypto protocols" (and maybe know what you're doing): * Read Oded Goldreich's Foundations of Cryptography (Volumes 1&2) * Try to have quasi-intelligent conversations with real cryptographers (advice for this in blog post) * Get a PhD somewhere with a good crypto program edit: formatting
- wegs 6y ago"Applied Cryptography" is the best-written book on this topic that I know of. Author is a brilliant communicator. Esp. the section on cryptographic protocols should be required reading for any computer scientist. It's not overly rigorous or mathematical, and has a lot of informality and humor, so it's a fairly light read. You don't need a lot of mathematical maturity to read it (and reading things like this helps develop mathematical maturity). Unfortunately, the 2nd edition adds "50% more words, 7 more chapters, and over 1600 new references." I thought the first edition was better in length. It was novel-length, and reads as well as a novel. Going from long-ish novel to short-ish trilogy makes this somewhat less readable. But c'est la vie.
- kragen 6y agoWho is this by? There doesn't seem to be an author listed at either the beginning or the end.
- lucas-piske 6y agoHi kragen. It was written by one of the Lab's directors. Here is a link to his page: http://cs.brown.edu/~seny http://cs.brown.edu/~seny
- kragen 6y agoThank you!