11 ms·

The Joy of Cryptography

431 points by signa11 5y ago

azalemeth 5y ago
Beautiful typography and beautiful text -- it's very easy to read (and wonderful LaTeX'd output). I very much appreciate this -- thanks for sharing.
pangolinplayer 5y ago
America First
elijahvoigt 5y ago
Mike was my cryptography professor and an advisor on an independent cryptography course I took a an undergraduate at OSU. We used an early copy of this book and it was wonderful. This is a great, free, resource for anybody interested in crypto maths.
1cvmask 5y ago
This is the coolest way I have seen someone write their email and avoid email harvesting bots: For inquiries related to this book, use x@joyofcryptography.com, where x is the author's first name. - Nearly everyone with a high school education can “crack” that puzzle and figure out his email and yet most bots will fail.
- stevenjgarner 5y ago
  RFC 5321 requires compliant domains to have both a "postmaster" and an "abuse" email address (e.g. postmaster@joyofcryptography.com). This technique will not stop a flood of spam emails to x@joyofcryptography.com, which will end up in the postmaster inbox.
  - quesera 5y ago
    Not sure what you mean. Mail to the literal 'x@joyofcryptography.com' address would just be dropped. There's no expectation that mail to a nonexistent address would be placed in the postmaster mailbox.
- slig 5y ago
  I prefer cmlja2FzdGxleQ== at example.com, for instance, if the target audience is tech literate.
  - MobiusHorizons 5y ago
    lol, nice one.
- a-dub 5y ago
  i'd guess that bots these days harvest domain names and then human names associated with them and then spam tools try common schemes for constructing email addresses. don't know for sure though. i always thought the hotness would be to encrypt the address in source text and render/decrypt it client side in javascript, but i suppose scrapers these days use full blown headless browsers complete with javascript runtimes.
- clint 5y ago
  Its a very old technique from the 90s actually!
max_ 5y ago
This is exactly the kind of book on cryptography I need. The book uses math & pseudocode to describe algorithms instead of using popular languages like Python or C/C++. This makes it language agnostic. Code can be very opinionated in my opinion.
- davidmurdoch 5y ago
  I don't know mathematic notation well at all, but can easily reason about most code.
  - eru 5y ago
    They are different notations for different purposes. With some overlap. In some sense, programming languages are a mathematical notation, too.
- randombits0 5y ago
  I got that same impression from “Applied Cryptography” (Schneier). But Bruce isn’t exactly giving it away! :)
  - deleted 5y ago
    [deleted]
le-mark 5y ago
> All the sensible textbook titles were already taken. Actual joy not guaranteed. Like a lot of people (I imagine) I made it through a CS bachelors program not really ‘getting’ the discrete math combinatorics part. Crypto is an area where those concepts really really matter. It’s great to see this resource available!
- hackcasual 5y ago
  I learned so much math when I looked into RLWE based lattice crypto. Some times it just takes a distinct use case to have something click
- k__ 5y ago
  Somehow discrete math was the only math I understood in CS. Calculus, on the other hand, completely eluded me.
  - copperx 5y ago
    How did you graduate with a CS degree?
    - eru 5y ago
      Depends on which country you are in. Not sure eg in Germany you have to do that much calculus for a CS degree. (Though, what do you mean by calculus? I assume you mean integration and differentiation and real numbers and stuff? Or something else?)
    - kccqzy 5y ago
      In my school, to get the CS degree you only need as much calculus as needed to get to the second Physics course, which covers electromagnetism. You don't need a deep understanding of calculus. A lot of applications of calculus in the course can be handled by rote memorization. I took extra calculus classes from the math department. Those are way harder than what you need for introductory physics.
    - MeinBlutIstBlau 5y ago
Moodles 5y ago
Looks like an excellent book. Would the author prefer the solutions to the exercises not be public? Or would it be welcome for someone to publish them? If the latter, I would quite happily work on it.
slig 5y ago
Related question: when using Block Cipher Mode, how does Alice and Bob exchange the IV?
- mcpherrinm 5y ago
  It depends on the protocol and mode, but it’s usually transmitted in the clear along with the encrypted message.
  - slig 5y ago
    Thanks! I thought it had to be somehow not transmitted in the clear.
    - marcan_42 5y ago
      It can also be implied by some other system parameter. As long as the same IV is never reused for the same key, it's safe. For example, if you're encrypting data blobs in some kind of CDN and you never mutate old blobs, your IV can be the blob ID. That said, depending on the construction you use, nonrandom IVs can be a problem (they can leak that there's a relationship between different plaintexts if they line up with a difference in the first block), so you're better off at least making it a random function of the key and said blob/etc ID.
    - bccdee 5y ago
      The IV isn't secret, but in CBC mode it does need to be securely random, otherwise you open yourself up to a class of attacks based on IV prediction. In other modes (CTR, for instance) you can use any nonce you like, so long as you're not reusing it.
- not-elite 5y ago
  Signal message keys seem to include an IV. [1] Message keys are generated by passing a chain key through a key derivation function. [2] So you can also expand a shared secret established through Diffie-Hellman. Someone please correct me if I'm wrong. [1] https://github.com/signalapp/libsignal-protocol-java/blob/master/java/src/main/java/org/whispersystems/libsignal/ratchet/MessageKeys.java https://github.com/signalapp/libsignal-protocol-java/blob/ma... [2] https://signal.org/docs/specifications/doubleratchet/Set0_1.png https://signal.org/docs/specifications/doubleratchet/Set0_1....
Terry_Roll 5y ago
I've often thought the use of prime numbers to be the weakness in cryptography. Whilst theory is different in practice due to machine limitations, there are only so many prime numbers a machine can present in a limited timespan restricting the range of primes available to use. With this in mind, and then knowing what a webserver will typically use by simply browsing the website with different encryption algo's disabled in the browser if its not possible to work out the underlying webserver software and version from a variety of methods like a simple 404 message, decoding the URL or using DPI, further limits the encryption algorithms to spend time reversing when using the replay attack method making it somewhat more targeted. Its still a sort of brute force but a more targeted brute force. So should I see primes as a weakness in cryptography?
- bdamm 5y ago
  No. First of all, primes are only used to arrive at a session key, and once you have a session key you're in the land of symmetric algorithms, which provide security by permutations rather than vectoring into prime spaces. The content of a web page does not matter at all in terms of the security being provided. A 404 is just as secure as a valid home page, in terms of cryptography. (Not in terms of application security, but that's a whole different thing.) Second, the supply of prime numbers is countable but also infinite, and the relation between a number space and the number of primes within it is well established within the workable sizes. We have upper and lower bounds on the number of primes within certain ranges. This is partly why we end up with certain key sizes as being secure and other key sizes as being insufficient. Secure key sizes (in asymmetric algorithms) partly are secure because there are so many primes that can be fodder for key generation.
  - schoen 5y ago
    Well said. A fun way to improve one's intuition for the huge space of primes in the regions that are used in cryptography is to run something like openssl prime -generate -bits 1024 (This would give you one of two secret parameters for a 2048-bit RSA modulus.) Here is an example output: 171512683213144641422165911053946068613736141364433791764418217818329805042681574174826781297743340609766353737741548521280185783254625590756752560896455821248403501924867464886010664489035275551178636464876794754383911750620888923620343965444339734253757757361106691647372710935609902417522529107877592063581 Not very easy to guess just because the space in question is limited to "1024-bit primes"! And indeed, that's part of why we use primes that are this big when we still use RSA. They're big enough that the number of possibilities makes them not easy to guess (even given the extra hint of "the secret number you're looking for is one of the factors of this 2048-bit semiprime"). Exponentials are always hard for human intuition. We start with some kind of pattern and it feels like there just aren't that many numbers that would satisfy it. But when you get out to large numbers (even numbers as large as the one above), there just are that many numbers that would satisfy the pattern!
jounus 5y ago
I read this book as an introduction to cryptography. Very well written. More understandable and easier to follow than any other texts I've read on cryptography.
ianpurton 5y ago
Is this using a LateX template of some sort? Or more specifically how could I create a book with formatting that looks as nice as this.
BossingAround 5y ago
This looks excellent. I tried to go through the Introduction to Cryptography by Christof Paar [1] and that material was not really suitable for me, personally. I found it too dense, and written in not very interesting manner. Thank you for posting this book, I'll give it a go! Crypto is one of those things I have on my shameful "how-come-you-don't-know-it-yet" to-learn list :). [1] https://www.youtube.com/channel/UC1usFRN4LCMcfIV7UjHNuQg https://www.youtube.com/channel/UC1usFRN4LCMcfIV7UjHNuQg
- cleemens 5y ago
  Really? The book might not be suitable to read it from cover to cover in bed, but still approachable. The videos are also really nice and easy going (I took the lecture at his uni, nice foundation). Compared to this book you seem right, the glimps I had was easily digestable and still concise.
tuxie_ 5y ago
Is it available in a format other than PDF? Like HTML or MOBI for example? PDF is very inconvenient to read on small screens like phones or kindle. Thanks!
- ZoomZoomZoom 5y ago
  In case you haven't tried, I suggest using koreader. It has a good combination of a reliable crop and a usable reflow feature. Not ideal, but it's much better than constant zooming and moving the view around. https://koreader.rocks/ https://koreader.rocks/
cugniere 5y ago
For those looking for a more exercise-oriented approach to cryptography, the Cryptopals challenge (https://cryptopals.com/ https://cryptopals.com/) is an excellent way to discover cryptography step by step with 64 exercises with an increasing difficulty level
- pretext 5y ago
  Thank you! Looks like crypto version of Project Euler and Rosalind.
oleganza 5y ago
Myself going from "web designer" to a "zero-knowledge proof cryptographer" (I'm a coauthor of Dalek Bulletproofs implementation, the cleanest API, documentation and fastest ZKP system ever) I'm sad to see crypto textbooks spending most of the time on symmetric ciphers, going through the same nonsense like ECB and then touching asymmetric only with RSA and annoying GCD stuff when everyone moved onto elliptic curves already. I'd like to see material around modern stuff (Keccak and ECC) with only a cursory discussion of pitfalls of the past standards in contrast with the current stuff. And more time on asymmetric, discrete log and fiat-shamir protocols that are so much fun and require really a 7th grade algebra to grasp. I've also made a couple of videos on ECC basics with that approach: https://www.youtube.com/channel/UCk0r9S76wngNPJb_GlhJYdw https://www.youtube.com/channel/UCk0r9S76wngNPJb_GlhJYdw EDIT: what i mean, is focus first on how to use primitives and what they promise, rather than how they actually work. Once you feel like you can play with these legos, it's more fun to dig deeper and see why ECDLP is hard and how ciphers are made. But please don't start from within - it's an annoying boring mess that distracts from the true beauty: the cool things you can build with these tools.
- ogogmad 5y ago
  > what i mean, is focus first on how to use primitives and what they promise These sorts of "provable security" textbooks (like the one in the article) try and do that. They emphasise less the exact inner workings of algorithms, and more on what they supposedly achieve. Various kinds of security proofs are possible. This school of thought in cryptography does also allow you to argue fairly convincingly that some concrete ciphers are secure. So it can talk about both the inner workings of ciphers as well as what security properties they achieve. The "provable security" approach seems to be in line with your suggestion. In fact, it was the framework under which Zero Knowledge Proofs were developed. Not every cryptographer knows about that though, so I'm not sure if you were aware...
ZoomZoomZoom 5y ago
Again I complain on the irritating habit of non-descriptive naming of files. book.pdf Really? I'm saving the file for a later review and this name will guarantee I either completely lose the file or will spend more time than necessary to locate it. The other option is to rename the file on saving, which is some work which needs to be performed by each user, instead of being done just once on the source. I think this is just impolite. Here's a proper name you can copy-paste: Mike_Rosulek_-_The_Joy_Of_Cryptography_(draft_2021-01-03).pdf PS: The short-link-for-verbal-sharing problem is solved via a symbolic link.
- mavelikara 5y ago
  Also, avoid resume.pdf for similar reasons.
- ASalazarMX 5y ago
  Your observation is very valid, that's one of my pet peeves too, but renaming the file before saving it is also very easy. Your observation, while helpful, feels excessively negative.
  - ZoomZoomZoom 5y ago
    The only negative adjectives I used were "irritating" and "impolite". The first one is strictly my feelings, and if you don't share them, I can only congratulate you on your self-restrain. The second one is just my opinion, I could explain why I think so, but I don't think it's that big of a deal to waste time on further discussions. Just please, keep file naming in mind if you can. No one will come to any harm if you won't, though, so I guess it's not that important. On the second thought, one part of my job is preparing products for the final consumption, so this attention to minutiae is probably a professional deformation.
    - pkage 5y ago
      Using negative adjectives is not the only way to be negative.

431 points by signa11 5y ago

Beautiful typography and beautiful text -- it's very easy to read (and wonderful LaTeX'd output). I very much appreciate this -- thanks for sharing.

pangolinplayer 5y ago

America First

elijahvoigt 5y ago

Mike was my cryptography professor and an advisor on an independent cryptography course I took a an undergraduate at OSU. We used an early copy of this book and it was wonderful. This is a great, free, resource for anybody interested in crypto maths.

1cvmask 5y ago

This is the coolest way I have seen someone write their email and avoid email harvesting bots: For inquiries related to this book, use x@joyofcryptography.com, where x is the author's first name. - Nearly everyone with a high school education can “crack” that puzzle and figure out his email and yet most bots will fail.

stevenjgarner 5y ago
RFC 5321 requires compliant domains to have both a "postmaster" and an "abuse" email address (e.g. postmaster@joyofcryptography.com). This technique will not stop a flood of spam emails to x@joyofcryptography.com, which will end up in the postmaster inbox.
- quesera 5y ago
  Not sure what you mean. Mail to the literal 'x@joyofcryptography.com' address would just be dropped. There's no expectation that mail to a nonexistent address would be placed in the postmaster mailbox.
slig 5y ago
I prefer cmlja2FzdGxleQ== at example.com, for instance, if the target audience is tech literate.
- MobiusHorizons 5y ago
  lol, nice one.
a-dub 5y ago
i'd guess that bots these days harvest domain names and then human names associated with them and then spam tools try common schemes for constructing email addresses. don't know for sure though. i always thought the hotness would be to encrypt the address in source text and render/decrypt it client side in javascript, but i suppose scrapers these days use full blown headless browsers complete with javascript runtimes.
clint 5y ago
Its a very old technique from the 90s actually!

max_ 5y ago

This is exactly the kind of book on cryptography I need. The book uses math & pseudocode to describe algorithms instead of using popular languages like Python or C/C++. This makes it language agnostic. Code can be very opinionated in my opinion.

davidmurdoch 5y ago
I don't know mathematic notation well at all, but can easily reason about most code.
- eru 5y ago
  They are different notations for different purposes. With some overlap. In some sense, programming languages are a mathematical notation, too.
randombits0 5y ago
I got that same impression from “Applied Cryptography” (Schneier). But Bruce isn’t exactly giving it away! :)
- deleted 5y ago
  [deleted]

le-mark 5y ago

> All the sensible textbook titles were already taken. Actual joy not guaranteed. Like a lot of people (I imagine) I made it through a CS bachelors program not really ‘getting’ the discrete math combinatorics part. Crypto is an area where those concepts really really matter. It’s great to see this resource available!

hackcasual 5y ago
I learned so much math when I looked into RLWE based lattice crypto. Some times it just takes a distinct use case to have something click
k__ 5y ago
Somehow discrete math was the only math I understood in CS. Calculus, on the other hand, completely eluded me.
- copperx 5y ago
  How did you graduate with a CS degree?
  - eru 5y ago
    Depends on which country you are in. Not sure eg in Germany you have to do that much calculus for a CS degree. (Though, what do you mean by calculus? I assume you mean integration and differentiation and real numbers and stuff? Or something else?)
  - kccqzy 5y ago
    In my school, to get the CS degree you only need as much calculus as needed to get to the second Physics course, which covers electromagnetism. You don't need a deep understanding of calculus. A lot of applications of calculus in the course can be handled by rote memorization. I took extra calculus classes from the math department. Those are way harder than what you need for introductory physics.
  - MeinBlutIstBlau 5y ago

Moodles 5y ago

Looks like an excellent book. Would the author prefer the solutions to the exercises not be public? Or would it be welcome for someone to publish them? If the latter, I would quite happily work on it.

slig 5y ago

Related question: when using Block Cipher Mode, how does Alice and Bob exchange the IV?

mcpherrinm 5y ago
It depends on the protocol and mode, but it’s usually transmitted in the clear along with the encrypted message.
- slig 5y ago
  Thanks! I thought it had to be somehow not transmitted in the clear.
  - marcan_42 5y ago
    It can also be implied by some other system parameter. As long as the same IV is never reused for the same key, it's safe. For example, if you're encrypting data blobs in some kind of CDN and you never mutate old blobs, your IV can be the blob ID. That said, depending on the construction you use, nonrandom IVs can be a problem (they can leak that there's a relationship between different plaintexts if they line up with a difference in the first block), so you're better off at least making it a random function of the key and said blob/etc ID.
  - bccdee 5y ago
    The IV isn't secret, but in CBC mode it does need to be securely random, otherwise you open yourself up to a class of attacks based on IV prediction. In other modes (CTR, for instance) you can use any nonce you like, so long as you're not reusing it.
not-elite 5y ago
Signal message keys seem to include an IV. [1] Message keys are generated by passing a chain key through a key derivation function. [2] So you can also expand a shared secret established through Diffie-Hellman. Someone please correct me if I'm wrong. [1] https://github.com/signalapp/libsignal-protocol-java/blob/master/java/src/main/java/org/whispersystems/libsignal/ratchet/MessageKeys.java https://github.com/signalapp/libsignal-protocol-java/blob/ma... [2] https://signal.org/docs/specifications/doubleratchet/Set0_1.png https://signal.org/docs/specifications/doubleratchet/Set0_1....

Terry_Roll 5y ago

I've often thought the use of prime numbers to be the weakness in cryptography. Whilst theory is different in practice due to machine limitations, there are only so many prime numbers a machine can present in a limited timespan restricting the range of primes available to use. With this in mind, and then knowing what a webserver will typically use by simply browsing the website with different encryption algo's disabled in the browser if its not possible to work out the underlying webserver software and version from a variety of methods like a simple 404 message, decoding the URL or using DPI, further limits the encryption algorithms to spend time reversing when using the replay attack method making it somewhat more targeted. Its still a sort of brute force but a more targeted brute force. So should I see primes as a weakness in cryptography?

bdamm 5y ago
No. First of all, primes are only used to arrive at a session key, and once you have a session key you're in the land of symmetric algorithms, which provide security by permutations rather than vectoring into prime spaces. The content of a web page does not matter at all in terms of the security being provided. A 404 is just as secure as a valid home page, in terms of cryptography. (Not in terms of application security, but that's a whole different thing.) Second, the supply of prime numbers is countable but also infinite, and the relation between a number space and the number of primes within it is well established within the workable sizes. We have upper and lower bounds on the number of primes within certain ranges. This is partly why we end up with certain key sizes as being secure and other key sizes as being insufficient. Secure key sizes (in asymmetric algorithms) partly are secure because there are so many primes that can be fodder for key generation.
- schoen 5y ago
  Well said. A fun way to improve one's intuition for the huge space of primes in the regions that are used in cryptography is to run something like openssl prime -generate -bits 1024 (This would give you one of two secret parameters for a 2048-bit RSA modulus.) Here is an example output: 171512683213144641422165911053946068613736141364433791764418217818329805042681574174826781297743340609766353737741548521280185783254625590756752560896455821248403501924867464886010664489035275551178636464876794754383911750620888923620343965444339734253757757361106691647372710935609902417522529107877592063581 Not very easy to guess just because the space in question is limited to "1024-bit primes"! And indeed, that's part of why we use primes that are this big when we still use RSA. They're big enough that the number of possibilities makes them not easy to guess (even given the extra hint of "the secret number you're looking for is one of the factors of this 2048-bit semiprime"). Exponentials are always hard for human intuition. We start with some kind of pattern and it feels like there just aren't that many numbers that would satisfy it. But when you get out to large numbers (even numbers as large as the one above), there just are that many numbers that would satisfy the pattern!

jounus 5y ago

I read this book as an introduction to cryptography. Very well written. More understandable and easier to follow than any other texts I've read on cryptography.

ianpurton 5y ago

Is this using a LateX template of some sort? Or more specifically how could I create a book with formatting that looks as nice as this.

BossingAround 5y ago

This looks excellent. I tried to go through the Introduction to Cryptography by Christof Paar [1] and that material was not really suitable for me, personally. I found it too dense, and written in not very interesting manner. Thank you for posting this book, I'll give it a go! Crypto is one of those things I have on my shameful "how-come-you-don't-know-it-yet" to-learn list :). [1] https://www.youtube.com/channel/UC1usFRN4LCMcfIV7UjHNuQg https://www.youtube.com/channel/UC1usFRN4LCMcfIV7UjHNuQg

cleemens 5y ago
Really? The book might not be suitable to read it from cover to cover in bed, but still approachable. The videos are also really nice and easy going (I took the lecture at his uni, nice foundation). Compared to this book you seem right, the glimps I had was easily digestable and still concise.

tuxie_ 5y ago

Is it available in a format other than PDF? Like HTML or MOBI for example? PDF is very inconvenient to read on small screens like phones or kindle. Thanks!

ZoomZoomZoom 5y ago
In case you haven't tried, I suggest using koreader. It has a good combination of a reliable crop and a usable reflow feature. Not ideal, but it's much better than constant zooming and moving the view around. https://koreader.rocks/ https://koreader.rocks/

cugniere 5y ago

For those looking for a more exercise-oriented approach to cryptography, the Cryptopals challenge (https://cryptopals.com/ https://cryptopals.com/) is an excellent way to discover cryptography step by step with 64 exercises with an increasing difficulty level

pretext 5y ago
Thank you! Looks like crypto version of Project Euler and Rosalind.

oleganza 5y ago

Myself going from "web designer" to a "zero-knowledge proof cryptographer" (I'm a coauthor of Dalek Bulletproofs implementation, the cleanest API, documentation and fastest ZKP system ever) I'm sad to see crypto textbooks spending most of the time on symmetric ciphers, going through the same nonsense like ECB and then touching asymmetric only with RSA and annoying GCD stuff when everyone moved onto elliptic curves already. I'd like to see material around modern stuff (Keccak and ECC) with only a cursory discussion of pitfalls of the past standards in contrast with the current stuff. And more time on asymmetric, discrete log and fiat-shamir protocols that are so much fun and require really a 7th grade algebra to grasp. I've also made a couple of videos on ECC basics with that approach: https://www.youtube.com/channel/UCk0r9S76wngNPJb_GlhJYdw https://www.youtube.com/channel/UCk0r9S76wngNPJb_GlhJYdw EDIT: what i mean, is focus first on how to use primitives and what they promise, rather than how they actually work. Once you feel like you can play with these legos, it's more fun to dig deeper and see why ECDLP is hard and how ciphers are made. But please don't start from within - it's an annoying boring mess that distracts from the true beauty: the cool things you can build with these tools.

ogogmad 5y ago
> what i mean, is focus first on how to use primitives and what they promise These sorts of "provable security" textbooks (like the one in the article) try and do that. They emphasise less the exact inner workings of algorithms, and more on what they supposedly achieve. Various kinds of security proofs are possible. This school of thought in cryptography does also allow you to argue fairly convincingly that some concrete ciphers are secure. So it can talk about both the inner workings of ciphers as well as what security properties they achieve. The "provable security" approach seems to be in line with your suggestion. In fact, it was the framework under which Zero Knowledge Proofs were developed. Not every cryptographer knows about that though, so I'm not sure if you were aware...

ZoomZoomZoom 5y ago

Again I complain on the irritating habit of non-descriptive naming of files. book.pdf Really? I'm saving the file for a later review and this name will guarantee I either completely lose the file or will spend more time than necessary to locate it. The other option is to rename the file on saving, which is some work which needs to be performed by each user, instead of being done just once on the source. I think this is just impolite. Here's a proper name you can copy-paste: Mike_Rosulek_-_The_Joy_Of_Cryptography_(draft_2021-01-03).pdf PS: The short-link-for-verbal-sharing problem is solved via a symbolic link.

mavelikara 5y ago
Also, avoid resume.pdf for similar reasons.
ASalazarMX 5y ago
Your observation is very valid, that's one of my pet peeves too, but renaming the file before saving it is also very easy. Your observation, while helpful, feels excessively negative.
- ZoomZoomZoom 5y ago
  The only negative adjectives I used were "irritating" and "impolite". The first one is strictly my feelings, and if you don't share them, I can only congratulate you on your self-restrain. The second one is just my opinion, I could explain why I think so, but I don't think it's that big of a deal to waste time on further discussions. Just please, keep file naming in mind if you can. No one will come to any harm if you won't, though, so I guess it's not that important. On the second thought, one part of my job is preparing products for the final consumption, so this attention to minutiae is probably a professional deformation.
  - pkage 5y ago
    Using negative adjectives is not the only way to be negative.