5 ms·
To be fair, I'm not in cryptography engineering and had to understand all those details for an implementation security review. But I completely agree on the blo
by RaitoBezarius 6y ago
To be fair, I'm not in cryptography engineering and had to understand all those details for an implementation security review.
But I completely agree on the block cipher modes thing, a lot of people don't realize what they are doing and just use whatever sounds good, even if it is ECB and it is not relevant in the context.
- pvg 6y agoCan you say something the circumstances that lead to a security review of something that implements its own AES and that implementation is reviewed by (self-described) nonspecialists?
- maqp 6y agoIt's always this: AES-CBC with 1) no authentication whatsoever, or 2) fixed IV, "but it's random, I threw the dices myself!!", or 3) fixed key, no forward secrecy of any kind
- cryptXTS 6y agocryptsetup -c serpent-xts-plain64 -s 512 -h sha512 -i 123456 luksFormat /dev/ice /path/to/8M/dev/urandom/keyfile (serpent wasn't chosen by NSA because it's the best, if you want inferior AES, then change serpent to AES.)
- SAI_Peregrinus 6y agoI disagree that serpent is superior to AES. The evidence that it's secure is much flimsier than that for AES. It's seen far less analysis, and suffers from many of the same implementation issues as AES (hard to make both constant time and fast without hardware support, and has no hardware support). I'd have agreed with you 10 years ago, but there have been a lot more (failed) attack attempts on AES in the intervening decade than there have been on Serpent, which increase my confidence in AES.
- dragontamer 6y agoWith modern CPU-cores hitting 2x AES-instructions per clocktick, CBC-mode is going obsolete. CBC-mode cannot perform 2-AES iterations in parallel. You need to use CTR-mode. CTR-mode however has been largely subsumed by GCM (Galois Counter Mode), and all of a sudden you need to learn Galois fields anyway (which AES is an excellent case-study in GF(2^8)). ------ AVX512 performs 4x AES-instructions per clock tick by the way, to fill up the entire 512-bit register. You're only reaching that parallelism with CTR mode or GCM mode.
- arcticbull 6y agoThe example image in the wikipedia section on ECB is pretty damning: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_codebook_(ECB) https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation...