7 ms·

We need to stop saying don’t roll your own crypto and start teaching it with good examples and good explanations. The only people who will listen to “don’t rol

by api 4y ago

We need to stop saying don’t roll your own crypto and start teaching it with good examples and good explanations. The only people who will listen to “don’t roll your own crypto” are people who maybe should be learning crypto since they can approach it with the needed level of humility. The people who should not be writing crypto are precisely the ones who will ignore this advice. It’s also sort of elitist sounding and that puts people off and further reduces the odds that they will listen. Everyone knows that someone “rolls their own” crypto or none of it would exist. How does one get into this mysterious club? As near as I can tell you… roll your own crypto… and manage not to fuck it up. So the way you get to become someone who gives this sage advice is by disobeying it. (Of course there are degrees and Ph.Ds and publications but that’s the realm of real cryptographers of the sort that design ciphers. I’m talking about programmers using crypto.)

CiPHPerCoder 4y ago
> We need to stop saying don’t roll your own and start teaching it with good examples and good explanations. I 100% agree with this statement, in isolation. But in context, I have to wonder if something in the post sounded like I was telling people not to roll their own? Because that wasn't the take-away. Either way, https://gotchas.salusa.dev/GettingStarted.html https://gotchas.salusa.dev/GettingStarted.html > So the way you get to become someone who gives this sage advice is by disobeying it. Lawyers have a similar thing, from what I've been told. "Don't go to law school", "Don't become a lawyer", etc. are what many lawyer parents have told their children (some of whom went on to become lawyers themselves).
- melony 4y ago
  Crypto really isn't the sort of thing you should be doing by yourself, especially implementing crypto algorithms. To correctly implement a crypto algorithm from scratch without existing primitives, you need 1) A basic foundation in discrete mathematics, the type from a CS program and not a web dev bootcamp 2) Strong knowledge of computer architecture 3) Security knowledge of common exploits and vulnerabilities. It is like authoring compilers, most engineers have some knowledge of what's needed. But the few who are lucky enough to get paid to do it full time professionally are not very common. One thing I am thankful for with the hype about cryptocurrencies is that people with understanding of cryptography at the algorithmic are now much more common since the markets are aligned to reward technologies like symbolic execution and probably correct algorithms.
  - yccs27 4y ago
    Man that typo in the last few words cracked me up. "Probably correct algorithm" sounds like "I didn't test the code but it'll probably work fine. Let's deploy it to production!"
    - melony 4y ago
      *provably ;) *algorithmic level I should have proof read it
  - mlyle 4y ago
    As someone who has "rolled his own crypto" for various reasons, I was just wondering why you're saying this: > 2) Strong knowledge of computer architecture Is it so we can do performant things? Avoid side-channel attacks? Computer architecture isn't focal in my thinking when I'm working on cryptography. Very rarely it becomes important (I could leak information because of ... or boy, that is branch heavy and isn't going to be fast ...)
    - GTP 4y ago
      It's both, and your example in parentesys actually provides a good example, as brances can both slow you down and provide a side channel (but in crypto I think that in the particular case of branches only the second occurs). If you're looking for an example that is more rooted into computer architecture, you can look at how implementing AES with lookup tables can provide a cache timing side channel.
      - mlyle 4y ago
        Well, then I'd say the knowledge fits more in "3". It's not general purpose architectural knowledge, but rather the wealth of things we've learned from people thinking about side channels.
        GTP 4y ago
        I think it's hard to pick one between 2 and 3, as after knowing about a possible side channel from 3, you need 2 to prevent it on the specific architecture you'll run your code on.
- pixl97 4y ago
  Lawyers at least are going to a school to be professionally trained... If you're going to roll your own crypto maybe make sure you're professionally trained.
  - Zenst 4y ago
    Would it not be better to have some accredited auditing sevice that can verify and certify crypto code? After all, the whole infosec feild moves fast and what was 100% professinal at the time of being trained with the then known aspects does not mean that they would hold true today. Heck I'm certified to recogise drugs and bombs, yet I'd not have any idea upon many modern drugs or explosives, so in some eye's I qualify as a professional and in my eye's I'm far from it and garantee many who have no such acreditation would be far better than I.
  - api 4y ago
    Okay, then we need to tell people where to get this professional training. What should one do before one rolls their own crypto? But nobody does that. Nobody says "don't roll your own crypto until you learn these things and pass these tests." They just say don't, and the people saying don't are often the ones who are. So it's ignored, and with no good guidance people write crappy crypto.
    - CiPHPerCoder 4y ago
      > Okay, then we need to tell people where to get this professional training. I posted a link to a Getting Started guide in my comment above. Once you've exhausted those resources, your best bet is to join a cryptography team at a tech company to round off your education with some real-world experience. For example, https://www.amazon.jobs/en/search?business_category[]=amazon-web-services&base_query=crypto%20tools https://www.amazon.jobs/en/search?business_category[]=amazon...
dontbenebby 4y ago
> We need to stop saying don’t roll your own crypto and start teaching it with good examples and good explanations. Or teaching it by silently noting and exploiting the flaw, rather than put out a public blog post. Once people know you are elite, all such things do is draw attention to yourself. We live in terrible times, it's not a good idea to engage in cyber dick waving that only serves to draw attention to oneself.
- haswell 4y ago
  I’m trying to understand this comment. Are you suggesting that writing explanatory blog posts about technical topics is dangerous because someone will eventually come after you for being elite?
  - dontbenebby 4y ago
    >Are you suggesting that writing explanatory blog posts about technical topics is dangerous because someone will eventually come after you for being elite? Yes, based on my personal experience and that of others. But I wouldn't call myself elite... I just know a little bit ;-) I am saying giving them any sort of heads up is not good praxis, since the police have so thoroughly abused the access they already have. See: https://www.vice.com/en/article/k7bqew/us-marshal-securus-phone-location-tracked https://www.vice.com/en/article/k7bqew/us-marshal-securus-ph...
    - samhw 4y ago
      Well, this is bad news for the existence of infosec professionals...
flatiron 4y ago
From the article their roll was aes cbc which in itself is perfectly fine…but they did hmac it
carapace 4y ago
People shouldn't "roll their own" cryptography any more than they should "roll their own" padlocks or door locks. > The people who should not be writing crypto are precisely the ones who will ignore this advice. Why would they pay attention to "good examples and good explanations" if they disregard the simplest and most basic advice? > It’s also sort of elitist sounding and that puts people off and further reduces the odds that they will listen. Modern cryptography is intrinsically elite. It requires math and computer knowledge far beyond the ken of mere mortals, eh? > Everyone knows that someone “rolls their own” crypto or none of it would exist. How does one get into this mysterious club? As near as I can tell you… roll your own crypto… and manage not to fuck it up. So the way you get to become someone who gives this sage advice is by disobeying it. That sounds like, "Medical students dissect corpses to learn anatomy, so non-doctors should be allowed to perform their own surgery."
- api 4y ago
  If you ask a surgeon how to become one, they'll tell you to go to pre-med and then medical school and then become a resident and so on. There's a path to get there. They won't say "don't become a surgeon, go away." If you ask a crypto developer how to become one, they tell you to go away. "Don't roll your own crypto." Not "here's where you go to learn how to do crypto correctly, and here's a test you can take to determine if you're ready to do it." There's no generally accepted path to learn or to test your knowledge. There's just this informal guild of people we think know what they're doing. So no, it's nothing like medicine except in the most superficial sense of them both being hard things.
  - carapace 4y ago
    Keeping with the metaphor, the solution to the situation is to start a medical school, not to encourage people to attempt surgery without any training, eh?
    - api 4y ago
      I agree. My criticism is that the majority of the cryptography community just turns up their nose and does neither. They just say "go away," and people are obviously not listening to that and are instead attempting amateur surgery. The solution is to provide better learning materials. BTW some people often say "just use libraries." The problem is that even the best designed cryptographic libraries are easy to misuse if you don't at least understand the basics of what those building blocks are doing. Imagine using a networking library without knowing what a TCP connection is or how it behaves. You don't need to understand the deep internals of TCP but you need to at least know the semantics and what the protocol does.
xwdv 4y ago
IMO people shouldn’t roll their own anything. Use simple off the shelf solutions and services that are proven and ready to go, and leave the rolling to professionals doing true research and development.
- pavel_lishin 4y ago
  I'll go one step further; people shouldn't write software!
  - xwdv 4y ago
    People shouldn’t, only trained software engineers.
  - blooalien 4y ago
    > "I'll go one step further; people shouldn't write software!" That's right. Let "SkyNet" and "The Architect" handle all that! I for one welcome our new AI overlords.
- SoftTalker 4y ago
  You're really not wrong. There are so many ways a novice can screw up writing public-facing software. Even so-called experienced professional software "engineers" and billion-dollar tech companies do it regularly.
jeroenhd 4y ago
To use crypto right requires knowledge of crypto systems. You're not going to know how to use crypto schemes correctly without knowing about common flaws and a range of side channel attacks. The crypto code itself is usually relatively easy to use (OpenSSL may have a clunky interface, but there are tons of examples out there). The problem here, and I'd argue actually in most cases, isn't that the libraries don't exist or are hard to use. The problem is that the people using said libraries don't know what they're doing. There are great books out there that will tell you everything you need to know to understand and write safe crypto code. It's not some kind of closely guarded secret kept by an exclusive elite, it just requires reading. Pirate the books if you want to stop information hoarding among the rich, it's trivially easy to do with libgen. You can roll your own crypto if you're capable of doing so, and have someone as competent as you check your work. In this case, this tweet has listed the flaws that the custom crypto implementation has: https://mobile.twitter.com/gsuberland/status/1538117635971371009 https://mobile.twitter.com/gsuberland/status/153811763597137... Some of these flaws aren't that bad (== vs === shouldn't matter too much in this case, though it's a sign of bad PHP code when the types are supposed to be well known). Others are either bad code practice (allowing a variable to be uninitialized) or well-known cryptographic mistakes that you'll learn to catch after reading a book or two (timing attack, shared keys). I won't pretend I would've spotted all of those at a glance, but I can admit that my crypto course has been too long ago for me to write or review such code. I've got a basic grasp of electrical cirtuits but that doesn't mean I should be allowed to design highly secure electronic security circuits. I will miss important problems and dangerous flaws because I lack in-depth knowledge and experience. It's not because there's not an easy 1-2-3 guide on how to design safe circuits or because a cabal of academic elites are keeping this knowledge to themselves and pretending to do so just shifts the blame for my lack of effort to others. Feel free to do your own crypto. Tons of companies do. You'd better put in the work to make sure you're doing it right, though! If you're working on some kind of new cryptographic structure and an academic writes up a theoretical attack in a paper somewhere, you're doing it right, assuming that you extend your scheme to solve the problems discovered. If you make textbook mistakes in important code, you're clearly doing it wrong. If you're interested in learning cryptography so you can try to roll your own, I recommend starting with books like these: - Cryptography Made Simple by Nigel Smart - Applied Cryptography by Bruce Schneier - Cryptography Engineering: design principles and practical applications by Neil Ferguson, Bruce Schneier, and Tadayoshi Kohno These books require some prerequisite mathematical knowledge (like all crypto does) which you can probably pick up on Khan Academy. They go in depth into how common cryptography works, why these schemes are secure and how they can be broken (in theory and in practice). Some of them are getting old, though, so you may need to find some newer material if you're doing stuff like modern elliptic curve or post-quantum cryptography.

by api 4y ago

CiPHPerCoder 4y ago

> We need to stop saying don’t roll your own and start teaching it with good examples and good explanations. I 100% agree with this statement, in isolation. But in context, I have to wonder if something in the post sounded like I was telling people not to roll their own? Because that wasn't the take-away. Either way, https://gotchas.salusa.dev/GettingStarted.html https://gotchas.salusa.dev/GettingStarted.html > So the way you get to become someone who gives this sage advice is by disobeying it. Lawyers have a similar thing, from what I've been told. "Don't go to law school", "Don't become a lawyer", etc. are what many lawyer parents have told their children (some of whom went on to become lawyers themselves).

melony 4y ago
Crypto really isn't the sort of thing you should be doing by yourself, especially implementing crypto algorithms. To correctly implement a crypto algorithm from scratch without existing primitives, you need 1) A basic foundation in discrete mathematics, the type from a CS program and not a web dev bootcamp 2) Strong knowledge of computer architecture 3) Security knowledge of common exploits and vulnerabilities. It is like authoring compilers, most engineers have some knowledge of what's needed. But the few who are lucky enough to get paid to do it full time professionally are not very common. One thing I am thankful for with the hype about cryptocurrencies is that people with understanding of cryptography at the algorithmic are now much more common since the markets are aligned to reward technologies like symbolic execution and probably correct algorithms.
- yccs27 4y ago
  Man that typo in the last few words cracked me up. "Probably correct algorithm" sounds like "I didn't test the code but it'll probably work fine. Let's deploy it to production!"
  - melony 4y ago
    *provably ;) *algorithmic level I should have proof read it
- mlyle 4y ago
  As someone who has "rolled his own crypto" for various reasons, I was just wondering why you're saying this: > 2) Strong knowledge of computer architecture Is it so we can do performant things? Avoid side-channel attacks? Computer architecture isn't focal in my thinking when I'm working on cryptography. Very rarely it becomes important (I could leak information because of ... or boy, that is branch heavy and isn't going to be fast ...)
  - GTP 4y ago
    It's both, and your example in parentesys actually provides a good example, as brances can both slow you down and provide a side channel (but in crypto I think that in the particular case of branches only the second occurs). If you're looking for an example that is more rooted into computer architecture, you can look at how implementing AES with lookup tables can provide a cache timing side channel.
    - mlyle 4y ago
      Well, then I'd say the knowledge fits more in "3". It's not general purpose architectural knowledge, but rather the wealth of things we've learned from people thinking about side channels.
      - GTP 4y ago
        I think it's hard to pick one between 2 and 3, as after knowing about a possible side channel from 3, you need 2 to prevent it on the specific architecture you'll run your code on.
pixl97 4y ago
Lawyers at least are going to a school to be professionally trained... If you're going to roll your own crypto maybe make sure you're professionally trained.
- Zenst 4y ago
  Would it not be better to have some accredited auditing sevice that can verify and certify crypto code? After all, the whole infosec feild moves fast and what was 100% professinal at the time of being trained with the then known aspects does not mean that they would hold true today. Heck I'm certified to recogise drugs and bombs, yet I'd not have any idea upon many modern drugs or explosives, so in some eye's I qualify as a professional and in my eye's I'm far from it and garantee many who have no such acreditation would be far better than I.
- api 4y ago
  Okay, then we need to tell people where to get this professional training. What should one do before one rolls their own crypto? But nobody does that. Nobody says "don't roll your own crypto until you learn these things and pass these tests." They just say don't, and the people saying don't are often the ones who are. So it's ignored, and with no good guidance people write crappy crypto.
  - CiPHPerCoder 4y ago
    > Okay, then we need to tell people where to get this professional training. I posted a link to a Getting Started guide in my comment above. Once you've exhausted those resources, your best bet is to join a cryptography team at a tech company to round off your education with some real-world experience. For example, https://www.amazon.jobs/en/search?business_category[]=amazon-web-services&base_query=crypto%20tools https://www.amazon.jobs/en/search?business_category[]=amazon...

dontbenebby 4y ago

> We need to stop saying don’t roll your own crypto and start teaching it with good examples and good explanations. Or teaching it by silently noting and exploiting the flaw, rather than put out a public blog post. Once people know you are elite, all such things do is draw attention to yourself. We live in terrible times, it's not a good idea to engage in cyber dick waving that only serves to draw attention to oneself.

haswell 4y ago
I’m trying to understand this comment. Are you suggesting that writing explanatory blog posts about technical topics is dangerous because someone will eventually come after you for being elite?
- dontbenebby 4y ago
  >Are you suggesting that writing explanatory blog posts about technical topics is dangerous because someone will eventually come after you for being elite? Yes, based on my personal experience and that of others. But I wouldn't call myself elite... I just know a little bit ;-) I am saying giving them any sort of heads up is not good praxis, since the police have so thoroughly abused the access they already have. See: https://www.vice.com/en/article/k7bqew/us-marshal-securus-phone-location-tracked https://www.vice.com/en/article/k7bqew/us-marshal-securus-ph...
  - samhw 4y ago
    Well, this is bad news for the existence of infosec professionals...

flatiron 4y ago

From the article their roll was aes cbc which in itself is perfectly fine…but they did hmac it

carapace 4y ago

People shouldn't "roll their own" cryptography any more than they should "roll their own" padlocks or door locks. > The people who should not be writing crypto are precisely the ones who will ignore this advice. Why would they pay attention to "good examples and good explanations" if they disregard the simplest and most basic advice? > It’s also sort of elitist sounding and that puts people off and further reduces the odds that they will listen. Modern cryptography is intrinsically elite. It requires math and computer knowledge far beyond the ken of mere mortals, eh? > Everyone knows that someone “rolls their own” crypto or none of it would exist. How does one get into this mysterious club? As near as I can tell you… roll your own crypto… and manage not to fuck it up. So the way you get to become someone who gives this sage advice is by disobeying it. That sounds like, "Medical students dissect corpses to learn anatomy, so non-doctors should be allowed to perform their own surgery."

api 4y ago
If you ask a surgeon how to become one, they'll tell you to go to pre-med and then medical school and then become a resident and so on. There's a path to get there. They won't say "don't become a surgeon, go away." If you ask a crypto developer how to become one, they tell you to go away. "Don't roll your own crypto." Not "here's where you go to learn how to do crypto correctly, and here's a test you can take to determine if you're ready to do it." There's no generally accepted path to learn or to test your knowledge. There's just this informal guild of people we think know what they're doing. So no, it's nothing like medicine except in the most superficial sense of them both being hard things.
- carapace 4y ago
  Keeping with the metaphor, the solution to the situation is to start a medical school, not to encourage people to attempt surgery without any training, eh?
  - api 4y ago
    I agree. My criticism is that the majority of the cryptography community just turns up their nose and does neither. They just say "go away," and people are obviously not listening to that and are instead attempting amateur surgery. The solution is to provide better learning materials. BTW some people often say "just use libraries." The problem is that even the best designed cryptographic libraries are easy to misuse if you don't at least understand the basics of what those building blocks are doing. Imagine using a networking library without knowing what a TCP connection is or how it behaves. You don't need to understand the deep internals of TCP but you need to at least know the semantics and what the protocol does.

xwdv 4y ago

IMO people shouldn’t roll their own anything. Use simple off the shelf solutions and services that are proven and ready to go, and leave the rolling to professionals doing true research and development.

pavel_lishin 4y ago
I'll go one step further; people shouldn't write software!
- xwdv 4y ago
  People shouldn’t, only trained software engineers.
- blooalien 4y ago
  > "I'll go one step further; people shouldn't write software!" That's right. Let "SkyNet" and "The Architect" handle all that! I for one welcome our new AI overlords.
SoftTalker 4y ago
You're really not wrong. There are so many ways a novice can screw up writing public-facing software. Even so-called experienced professional software "engineers" and billion-dollar tech companies do it regularly.

jeroenhd 4y ago

To use crypto right requires knowledge of crypto systems. You're not going to know how to use crypto schemes correctly without knowing about common flaws and a range of side channel attacks. The crypto code itself is usually relatively easy to use (OpenSSL may have a clunky interface, but there are tons of examples out there). The problem here, and I'd argue actually in most cases, isn't that the libraries don't exist or are hard to use. The problem is that the people using said libraries don't know what they're doing. There are great books out there that will tell you everything you need to know to understand and write safe crypto code. It's not some kind of closely guarded secret kept by an exclusive elite, it just requires reading. Pirate the books if you want to stop information hoarding among the rich, it's trivially easy to do with libgen. You can roll your own crypto if you're capable of doing so, and have someone as competent as you check your work. In this case, this tweet has listed the flaws that the custom crypto implementation has: https://mobile.twitter.com/gsuberland/status/1538117635971371009 https://mobile.twitter.com/gsuberland/status/153811763597137... Some of these flaws aren't that bad (== vs === shouldn't matter too much in this case, though it's a sign of bad PHP code when the types are supposed to be well known). Others are either bad code practice (allowing a variable to be uninitialized) or well-known cryptographic mistakes that you'll learn to catch after reading a book or two (timing attack, shared keys). I won't pretend I would've spotted all of those at a glance, but I can admit that my crypto course has been too long ago for me to write or review such code. I've got a basic grasp of electrical cirtuits but that doesn't mean I should be allowed to design highly secure electronic security circuits. I will miss important problems and dangerous flaws because I lack in-depth knowledge and experience. It's not because there's not an easy 1-2-3 guide on how to design safe circuits or because a cabal of academic elites are keeping this knowledge to themselves and pretending to do so just shifts the blame for my lack of effort to others. Feel free to do your own crypto. Tons of companies do. You'd better put in the work to make sure you're doing it right, though! If you're working on some kind of new cryptographic structure and an academic writes up a theoretical attack in a paper somewhere, you're doing it right, assuming that you extend your scheme to solve the problems discovered. If you make textbook mistakes in important code, you're clearly doing it wrong. If you're interested in learning cryptography so you can try to roll your own, I recommend starting with books like these: - Cryptography Made Simple by Nigel Smart - Applied Cryptography by Bruce Schneier - Cryptography Engineering: design principles and practical applications by Neil Ferguson, Bruce Schneier, and Tadayoshi Kohno These books require some prerequisite mathematical knowledge (like all crypto does) which you can probably pick up on Khan Academy. They go in depth into how common cryptography works, why these schemes are secure and how they can be broken (in theory and in practice). Some of them are getting old, though, so you may need to find some newer material if you're doing stuff like modern elliptic curve or post-quantum cryptography.