6 ms·

You're proposing to add extra complexity for some hypothetical scenario that is unlikely to happen. That's a bad tradeoff.

by hannob 5y ago

elcomet 5y ago
unlikely ? all methods are broken eventualy when compute becomes faster
- hsbauauvhabzb 5y ago
  All current methods. Isn’t sha256 an order of magnitude more complex than sha1? It’s not like cryptographers can’t learn from their mistakes.
  - deleted 5y ago
    [deleted]
- hannob 5y ago
  Computers can only become faster within the limits of what humans are able to build and what physics allows. You're not gonna break SHA256 with faster computers.
  - seanw444 5y ago
    I swear there was a pertinent article link that goes through how it's physically impossible to construct a computing device fast enough to break SHA-256, even at the most fundamental scale.
- marcan_42 5y ago
  This is not true. Modern cryptography is not breakable via brute force any more, nor will it ever be. You can prove that the amount of energy required assuming a thermodynamically ideal computer is more than will ever be available in our galaxy, with classical computing. Breaks of symmetric crypto or hashes that are practical require an actual cryptographic weakness, whose existence is not a given. Then there's quantum computing, but that also doesn't break symmetric crypto outright, it just makes it weaker. I'm not sure if anyone has run the math, but we'd probably still be talking galaxy sized quantum computers to get anywhere.
  - elcomet 5y ago
    thanks, that's interesting, I didn't know this !
  - samstave 5y ago
    This is why they create laws to require you unlock your phone when crossing borders. I have been constantly surprised that there isnt a phone/company that specifically markets to "buy this temp phone to cross a border" -- Also, WRT Quantum computing, what are your thoughts on the talk by D-Wave CEO where he said "we can reach into different dimensions" -- and soon after, D-Wave went super silent? What is the state of quantum currently - did they discover something super secret?
    - antris 5y ago
      They? Who, where? Which law?
  - xoa 5y ago
    >Modern cryptography is not breakable via brute force any more Specifically, modern symmetric crypto (and hashing which is a related but different thing) is fine. It's public-key crypto that has always been the worry thanks to Shor's Algorithm, and all modern widely used crypto there is indeed vulnerable if an actual scalable general quantum computer could be constructed. There are a variety of post-quantum cryptographic algorithms under development including some ones that would be ugly slow but likely effective bandaids if required, but that's still a not totally unreasonable concern for certain threat profiles. But yes GP was totally wrong about "all methods are broken when compute becomes faster". >I'm not sure if anyone has run the math "The math" here is just Grover's Algorithm, that lowers the cost of generic brute forcing to O(sqrt(n)). So a 128-bit symmetric key could be cracked on average like 2^64 or a 256-bit key like 2^128. Obviously this is utterly trivially countered by doubling the exponent. Even 2^128 is still ridiculous, and going to a 512-bit key brings us right back to 2^256 which is impossible. 128-bit keys should indeed be phased out entirely (and that seems to be well on the way anyway), and perhaps 256-bit too at some point (even if it's only the very paranoid or very long termers, it's also not big stretch on modern hardware at all, so eh), but fundamentally yes symmetric crypto is fine.
alophawen 5y ago
There's nothing unlikely with such scenario. See MD5, SHA1 and so on. See current research on SHA256 https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_validation https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_valida... https://dusted.codes/sha-256-is-not-a-secure-password-hashing-algorithm https://dusted.codes/sha-256-is-not-a-secure-password-hashin... https://security.stackexchange.com/questions/34256/sha256-security-what-does-it-mean-that-attacks-have-broken-46-of-the-60-rounds https://security.stackexchange.com/questions/34256/sha256-se...
- hannob 5y ago
  The Wikipedia link is very reassuring regarding the security of SHA256. All attacks are very far away from going anywhere close to attacking full SHA256 and no major progress has been made lately. The password hashing remark is correct, but irrelevant. SHA256 is not a good password hash, because it's not made to be a password hash. Don't use it for passwords. The weaknesses that broke MD5/SHA1 were known since 1994. No similar weakness is known for SHA256.
  - alophawen 5y ago
    If you want to be reassured then sure. My take from reading that is in 2016 there was practical collision attacks demonstrated, which would be amplified with specialized hardware (compare to bitcoin mining). Btw cheers! I recall you from correspondence years ago regarding fuzz testing linux packages.
    - hannob 5y ago
      > My take from reading that is in 2016 there was practical collision attacks demonstrated No such thing happened. You're likely referring to this paper quoted in Wikipedia: https://eprint.iacr.org/2016/374.pdf https://eprint.iacr.org/2016/374.pdf This is 1. not about SHA256, but about the truncated sha2 algorithms and, more important, 2. it's an attack on reduced-round versions of these algorithms. That's a common thing in cryptoanalysis to do. You're basically saying "we have no way of attacking the full algorithm, so let's build a version which is much less secure and try to attack that". That's a valid thing to do for research purposes, but it needs to be interpreted correctly. "I can break this massively weaker version of the algorithm" is very different from "I have shown a practical attack on the real algorithm".

You're proposing to add extra complexity for some hypothetical scenario that is unlikely to happen. That's a bad tradeoff.

by hannob 5y ago

You're proposing to add extra complexity for some hypothetical scenario that is unlikely to happen. That's a bad tradeoff.

elcomet 5y ago

unlikely ? all methods are broken eventualy when compute becomes faster

hsbauauvhabzb 5y ago
All current methods. Isn’t sha256 an order of magnitude more complex than sha1? It’s not like cryptographers can’t learn from their mistakes.
- deleted 5y ago
  [deleted]
hannob 5y ago
Computers can only become faster within the limits of what humans are able to build and what physics allows. You're not gonna break SHA256 with faster computers.
- seanw444 5y ago
  I swear there was a pertinent article link that goes through how it's physically impossible to construct a computing device fast enough to break SHA-256, even at the most fundamental scale.
marcan_42 5y ago
This is not true. Modern cryptography is not breakable via brute force any more, nor will it ever be. You can prove that the amount of energy required assuming a thermodynamically ideal computer is more than will ever be available in our galaxy, with classical computing. Breaks of symmetric crypto or hashes that are practical require an actual cryptographic weakness, whose existence is not a given. Then there's quantum computing, but that also doesn't break symmetric crypto outright, it just makes it weaker. I'm not sure if anyone has run the math, but we'd probably still be talking galaxy sized quantum computers to get anywhere.
- elcomet 5y ago
  thanks, that's interesting, I didn't know this !
- samstave 5y ago
  This is why they create laws to require you unlock your phone when crossing borders. I have been constantly surprised that there isnt a phone/company that specifically markets to "buy this temp phone to cross a border" -- Also, WRT Quantum computing, what are your thoughts on the talk by D-Wave CEO where he said "we can reach into different dimensions" -- and soon after, D-Wave went super silent? What is the state of quantum currently - did they discover something super secret?
  - antris 5y ago
    They? Who, where? Which law?
- xoa 5y ago
  >Modern cryptography is not breakable via brute force any more Specifically, modern symmetric crypto (and hashing which is a related but different thing) is fine. It's public-key crypto that has always been the worry thanks to Shor's Algorithm, and all modern widely used crypto there is indeed vulnerable if an actual scalable general quantum computer could be constructed. There are a variety of post-quantum cryptographic algorithms under development including some ones that would be ugly slow but likely effective bandaids if required, but that's still a not totally unreasonable concern for certain threat profiles. But yes GP was totally wrong about "all methods are broken when compute becomes faster". >I'm not sure if anyone has run the math "The math" here is just Grover's Algorithm, that lowers the cost of generic brute forcing to O(sqrt(n)). So a 128-bit symmetric key could be cracked on average like 2^64 or a 256-bit key like 2^128. Obviously this is utterly trivially countered by doubling the exponent. Even 2^128 is still ridiculous, and going to a 512-bit key brings us right back to 2^256 which is impossible. 128-bit keys should indeed be phased out entirely (and that seems to be well on the way anyway), and perhaps 256-bit too at some point (even if it's only the very paranoid or very long termers, it's also not big stretch on modern hardware at all, so eh), but fundamentally yes symmetric crypto is fine.

alophawen 5y ago

There's nothing unlikely with such scenario. See MD5, SHA1 and so on. See current research on SHA256 https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_validation https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_valida... https://dusted.codes/sha-256-is-not-a-secure-password-hashing-algorithm https://dusted.codes/sha-256-is-not-a-secure-password-hashin... https://security.stackexchange.com/questions/34256/sha256-security-what-does-it-mean-that-attacks-have-broken-46-of-the-60-rounds https://security.stackexchange.com/questions/34256/sha256-se...

hannob 5y ago
The Wikipedia link is very reassuring regarding the security of SHA256. All attacks are very far away from going anywhere close to attacking full SHA256 and no major progress has been made lately. The password hashing remark is correct, but irrelevant. SHA256 is not a good password hash, because it's not made to be a password hash. Don't use it for passwords. The weaknesses that broke MD5/SHA1 were known since 1994. No similar weakness is known for SHA256.
- alophawen 5y ago
  If you want to be reassured then sure. My take from reading that is in 2016 there was practical collision attacks demonstrated, which would be amplified with specialized hardware (compare to bitcoin mining). Btw cheers! I recall you from correspondence years ago regarding fuzz testing linux packages.
  - hannob 5y ago
    > My take from reading that is in 2016 there was practical collision attacks demonstrated No such thing happened. You're likely referring to this paper quoted in Wikipedia: https://eprint.iacr.org/2016/374.pdf https://eprint.iacr.org/2016/374.pdf This is 1. not about SHA256, but about the truncated sha2 algorithms and, more important, 2. it's an attack on reduced-round versions of these algorithms. That's a common thing in cryptoanalysis to do. You're basically saying "we have no way of attacking the full algorithm, so let's build a version which is much less secure and try to attack that". That's a valid thing to do for research purposes, but it needs to be interpreted correctly. "I can break this massively weaker version of the algorithm" is very different from "I have shown a practical attack on the real algorithm".