3 ms·

Then you my friend are free to roll your own crypto

bob1029 5y ago
Just so we are clear, rolling my own crypto doesnt necessarily involve reinventing SHA256 and AES from scratch. It just means using these primitives directly rather than farming out and allowing others to select the underlying methods for you. I use Microsoft's cryptographic implementations, but I don't let them pick the method for me. I don't think this is unreasonable if you have some experience in the space.
- marcus_holmes 5y ago
  It's that old saw of "anyone can create a security system that they can't break". How do you know that your combination of methods is secure? There may well be hidden (or at least non-obvious) complications with using certain methods and/or implementations together that make them easier to break. If you're not aware of that, but someone else is, then the first you'll know about it is years later when a security leak is traced back to your "secure" system. And the only other way of knowing about this sort of stuff is to spend a lot of time staying current with the research. Or you can let someone else do all that hard work, and run the extremely small risk that their work has been silently compromised by the NSA (or other state actor of your choice).
  - a1369209993 5y ago
    > How do you know that your combination of methods is secure? Because if you give me some hashes, some messages, and a black box that signs arbitrary things for a arbitrary public key (with my combination of methods), I can turn around and give you back either a preimage of one of the hashes or a second preimage of one of messages. Provable security is nice. Still working on how to extend such a scheme to key agreement rather than just signing, admittedly.
- marcan_42 5y ago
  Putting together primitives in a way that doesn't have subtle flaws is not trivial. Many a standard have been vulnerable due to this. You think you can do better? We do have simple, well engineered, and sometimes even probably secure constructions. Look at libsodium if you want a decent example of what a modern library looks like. And stay away from anything that mentions the words NIST, FIPS, or any other government acronym. You aren't going to find modern, well-engineered, simple crypto in anything catering to that market. It's always hideously overcomplicated and rife with chances for bugs.
  - dylan604 5y ago
    >and sometimes even probably secure constructions Probably doesn't make me feel secure. Did you mean properly?
    - marcan_42 5y ago
      Sorry, that was a typo, I meant provably. As in constructions that have been proven to be secure assuming the underlying primitives are secure.
      - dylan604 5y ago
        I like provably better than properly. Now I feel warm and fuzzy.
troyvit 5y ago
Not that I sanction all of the parent's post, but for instance Telegram did exactly that, and they still receive grief for rolling their own crypto. So per the parent you can either use back-doored state-sponsored encryption or roll your own which nobody trusts. Which is better? Is there another alternative?
- marcan_42 5y ago
  State sponsorship doesn't matter, what matters is that it's secure. Everyone knew Dual-EC DRBG was likely backdoored, it stank to hell and back. There are dozens of other CSPRNGs, including other "state sponsored" ones, that pretty clearly aren't. There is also a whole world of crypto developed by people not associated with any state, including the modern ec25519/ChaCha based combinations (which are partly a response to the idea that the widely used NSA proposed ECC parameters may also be backdoored). There are trustable people doing things right with easy to use libraries you can just drop in today, with documented rationale for the designs and without any "magic numbers" (which are a telltale of the backdoored and suspected-backdoored NSA algorithms).

Just so we are clear, rolling my own crypto doesnt necessarily involve reinventing SHA256 and AES from scratch. It just means using these primitives directly rather than farming out and allowing others to select the underlying methods for you. I use Microsoft's cryptographic implementations, but I don't let them pick the method for me. I don't think this is unreasonable if you have some experience in the space.

marcus_holmes 5y ago
It's that old saw of "anyone can create a security system that they can't break". How do you know that your combination of methods is secure? There may well be hidden (or at least non-obvious) complications with using certain methods and/or implementations together that make them easier to break. If you're not aware of that, but someone else is, then the first you'll know about it is years later when a security leak is traced back to your "secure" system. And the only other way of knowing about this sort of stuff is to spend a lot of time staying current with the research. Or you can let someone else do all that hard work, and run the extremely small risk that their work has been silently compromised by the NSA (or other state actor of your choice).
- a1369209993 5y ago
  > How do you know that your combination of methods is secure? Because if you give me some hashes, some messages, and a black box that signs arbitrary things for a arbitrary public key (with my combination of methods), I can turn around and give you back either a preimage of one of the hashes or a second preimage of one of messages. Provable security is nice. Still working on how to extend such a scheme to key agreement rather than just signing, admittedly.
marcan_42 5y ago
Putting together primitives in a way that doesn't have subtle flaws is not trivial. Many a standard have been vulnerable due to this. You think you can do better? We do have simple, well engineered, and sometimes even probably secure constructions. Look at libsodium if you want a decent example of what a modern library looks like. And stay away from anything that mentions the words NIST, FIPS, or any other government acronym. You aren't going to find modern, well-engineered, simple crypto in anything catering to that market. It's always hideously overcomplicated and rife with chances for bugs.
- dylan604 5y ago
  >and sometimes even probably secure constructions Probably doesn't make me feel secure. Did you mean properly?
  - marcan_42 5y ago
    Sorry, that was a typo, I meant provably. As in constructions that have been proven to be secure assuming the underlying primitives are secure.
    - dylan604 5y ago
      I like provably better than properly. Now I feel warm and fuzzy.

troyvit 5y ago

Not that I sanction all of the parent's post, but for instance Telegram did exactly that, and they still receive grief for rolling their own crypto. So per the parent you can either use back-doored state-sponsored encryption or roll your own which nobody trusts. Which is better? Is there another alternative?

marcan_42 5y ago
State sponsorship doesn't matter, what matters is that it's secure. Everyone knew Dual-EC DRBG was likely backdoored, it stank to hell and back. There are dozens of other CSPRNGs, including other "state sponsored" ones, that pretty clearly aren't. There is also a whole world of crypto developed by people not associated with any state, including the modern ec25519/ChaCha based combinations (which are partly a response to the idea that the widely used NSA proposed ECC parameters may also be backdoored). There are trustable people doing things right with easy to use libraries you can just drop in today, with documented rationale for the designs and without any "magic numbers" (which are a telltale of the backdoored and suspected-backdoored NSA algorithms).