5 ms·

Heart of his argument is this, with which I absolutely agree: "The moral is the need for cryptographic agility. It’s not enough to implement a single standard;

Heart of his argument is this, with which I absolutely agree: "The moral is the need for cryptographic agility. It’s not enough to implement a single standard; it’s vital that our systems be able to easily swap in new algorithms when required. We’ve learned the hard way how algorithms can get so entrenched in systems that it can take many years to update them: in the transition from DES to AES, and the transition from MD4 and MD5 to SHA, SHA-1, and then SHA-3." Although, personally, I am more supportive of the OpenVPN model (many standards to choose from, including older algos, maybe too much choice) compared to the Wireguard model (one set of well thought of defaults, no choice), one has to ask -- aren't they both wrong? Isn't the correct model high flexibility, while relentlessly deprecating and removing older standards, and, maybe, a clear nudge towards sensible default choices ("X recommends the following algos in 2022..."). Obviously crypto is super hard. But the 'problem of agility' seems like a software engineering problem not a hard crypto theoretical or implementation issue.

dangerface 4y ago
If the software supports multiple cryptographic primitives how do you stop a down grade attack when one of those primitives becomes obsolete? To do so securely would require cryptographic primitives that can not become weak and obsolete at which point why not just use that for everything? Its a chicken and egg problem.
- orev 4y ago
  Seems like that was already addressed: > while relentlessly deprecating and removing older standards Stuff that’s old and broken needs to be removed.
  - dangerface 4y ago
    So then what stops a down grade attack? The attack would no longer leak encrypted data sure but now it acts as a dos attack. In reality the user would use another method one that is probably easier to break than the latest best crypto. Without secure crypto we can't securely establish which primitives to use.
    - mustache_kimono 4y ago
      I guess I'm wondering what you're getting at. Are you saying a more inflexible/less agile model is a better model? Doesn't that have a similar problem? When say, for example, Wireguard's choices become obsolete doesn't that operate like a DOS as well? What's your point?
      - dangerface 4y ago
        > Are you saying a more inflexible/less agile model is a better model? No I am saying there is no secure answer. Both choices result in the same thing use one primitive when it becomes broken the protocol is broken, or negotiate a primitive and face downgrade attacks that make the protocol broken. There is no secure answer to stop mitm attack from the protocol level it has to come from cryptography at which point what happens when that cryptography is broken? The whole thing is a chicken and egg problem, there is no secure answer.
        orev 4y ago
        It has to be taken as a given that all encryption deployed today will get “weaker” over time, so that’s already accounted for. The solution is that you just have to live with some risk from older algorithms, and make sure the replacement schedule is reasonably fast. You only need the absolute highest levels of security for a very few things, and if those are so critical then cutting off access is probably the right choice if the best algorithms aren’t available. Presumably those situations are in well-controlled environments and everyone is aware and can manage that type of coordination.

dangerface 4y ago

If the software supports multiple cryptographic primitives how do you stop a down grade attack when one of those primitives becomes obsolete? To do so securely would require cryptographic primitives that can not become weak and obsolete at which point why not just use that for everything? Its a chicken and egg problem.

orev 4y ago
Seems like that was already addressed: > while relentlessly deprecating and removing older standards Stuff that’s old and broken needs to be removed.
- dangerface 4y ago
  So then what stops a down grade attack? The attack would no longer leak encrypted data sure but now it acts as a dos attack. In reality the user would use another method one that is probably easier to break than the latest best crypto. Without secure crypto we can't securely establish which primitives to use.
  - mustache_kimono 4y ago
    I guess I'm wondering what you're getting at. Are you saying a more inflexible/less agile model is a better model? Doesn't that have a similar problem? When say, for example, Wireguard's choices become obsolete doesn't that operate like a DOS as well? What's your point?
    - dangerface 4y ago
      > Are you saying a more inflexible/less agile model is a better model? No I am saying there is no secure answer. Both choices result in the same thing use one primitive when it becomes broken the protocol is broken, or negotiate a primitive and face downgrade attacks that make the protocol broken. There is no secure answer to stop mitm attack from the protocol level it has to come from cryptography at which point what happens when that cryptography is broken? The whole thing is a chicken and egg problem, there is no secure answer.
      - orev 4y ago
        It has to be taken as a given that all encryption deployed today will get “weaker” over time, so that’s already accounted for. The solution is that you just have to live with some risk from older algorithms, and make sure the replacement schedule is reasonably fast. You only need the absolute highest levels of security for a very few things, and if those are so critical then cutting off access is probably the right choice if the best algorithms aren’t available. Presumably those situations are in well-controlled environments and everyone is aware and can manage that type of coordination.