4 ms·
Yeah - utterly agree. The point raised in the article is valid - but the correct thing to do isn't to persuade the auditor they are wrong, it's to push FIPS to
by richardwhiuk 6y ago
Yeah - utterly agree. The point raised in the article is valid - but the correct thing to do isn't to persuade the auditor they are wrong, it's to push FIPS to include bcrypt instead of SHA2 (although as below, this isn't the right answer either - it should use PBKDF2 or similar).
- renewiltord 6y agoNo, the right answer is to push no one on anything, comply with the FIPS standard and suck up the marginally increased probability of a breach. They made the right decision throughout.
- Nullabillity 6y agoYou could also consider it a M&M test for both FIPS and the auditor. If they get something this simple wrong, what other issues lay hidden?
- tptacek 6y agoFIPS is never going to include bcrypt. Not including things like bcrypt is literally part of the point of FIPS.
- wool_gather 6y agoWhich aspects of bcrypt are you referring to by "things like bcrypt"?
- tptacek 6y agoModern, superior alternatives to standard algorithms and constructions. Canonical example: Curve25519. WireGuard, for instance, will never be FIPS compatible.
- loup-vaillant 6y agoHow then, can refusing superior alternative be anyone's point? Are you merely calling them overly conservative to the point of incompetence (I'd be tempted to), or is there another aspect to it?
- yencabulator 6y agoOne angle to consider here is that FIPS is informed by whatever NSA knows about cryptography, so not all the evaluation criteria is public. You and I may think djb's inventions are superior, but for example NSA might have an active research project into elliptic curves, and refused to endorse Curve25519 until those results came in.
- NovemberWhiskey 6y agoDon't the drafts for NIST FIPS 186-5 and SP 800-186 both include Curve25519-based algorithms?
- SAI_Peregrinus 6y agoThey do. This person doesn't know what they're talking about. The point of FIPS is to provide a set of approved algorithms (and other standards) that are considered to be secure due to thorough analysis. Curve25519 has become widely implemented, and hasn't been broken, and has some advantages over the other NIST-approved curves, so NIST will likely approve it. Password hashing has been rapidly changing over the last few years. PBKDF2 isn't memory-hard, but can be instantiated with only a FIPS-approved cryptographic hash. Bcrypt is OK, Scrypt has different tradeoffs, Argon2 has different tradeoffs (and even more tweakability with multiple variants), Pufferfish2 is cache-hard instead of just memory hard (so potentially better than any of the only-memory-hard systems), etc. NIST probably don't see any reason to update the standard for a marginal improvement when they can wait for the cryptographic research in the area to stabilize. There's also a lot of research into ways to avoid having to send passwords to servers in the first place with strong asymmetric password-authenticated key exchange (sAPAKE) algorithms. So NIST might end up standardizing a password-based key derivation function separately from a PAKE system. Personally I think standards should be updated a bit more frequently than they are, but I can understand NIST's conservative stance here.
- tptacek 6y agoWow, I'm wildly wrong about Curve25519 and FIPS. I should probably not write HN comments in bed immediately after waking up. Thanks for the correction. (Ironically, we had an HN thread almost exactly 1 year ago about the same thing; I'd just refer to my comments there, I guess.) https://news.ycombinator.com/item?id=21744469 https://news.ycombinator.com/item?id=21744469
- tptacek 6y agoIncidentally I've noticed the voting bouncing around in this comment but you all should be hammering it, it is a supremely dumb comment (WireGuard will never be FIPS compatible, but Curve25519 is obviously not why).
- deleted 6y ago[deleted]
- JamesBarney 6y agoWhy is this by the way? I've googled it and most of the responses I've found were "NIST doesn't talk about bcrypt and probably won't because it's related to blowfish and not SHA". And the other being "Blowfish is equivalent to SHA so if anything is approved blowfish would be approved, not BCrypt which is similar to PBKDF2, which is approved because it uses SHA". Is it just bureaucratic inertia?
- tptacek 6y agoThe point of FIPS is to deliberately narrow down the range of acceptable primitives, to simplify the evaluation of systems sold to the government. (FIPS is very bad).
- daneel_w 6y agoCan you elaborate on why this is a point of the FIPS? It sounds as if it's specific and by intention.