6 ms·
On the Impending Crypto Monoculture (2016)
- xiphias2 3y agoBoring is a sign of maturing: the focus should shift from algorithmic innovations to testing / validation / proof that the implementation is correct, which requires a mostly monoculture.
- cl3misch 3y agoThat's what I was thinking. If we want transparent crypto (i.e. not security by obscurity) and the implementation is highly vetted, its "monopoly" is actually desirable. Of course we might not even be aware of even better methods of doing crypto. But such advancements come from researchers anyway, and in that are not hindered by this monopoly.
- deleted 3y ago[deleted]
- petesergeant 3y agoNobody ever got fired for using djb-ware
- xena 3y agoExcept for those in FIPS land
- deleted 3y ago[deleted]
- spacecadet 3y agoYou dont have many options in FIPS land.
- colmmacc 3y agoDJB's ed25519 has made it into NIST and FIPS now. ChaCha20 too, but only in the context of TLS.
- wbl 3y agoThe story is more complicated. EdDSA was removed from the OpenSSL certificate and ChaCha20 was never there.
- thayne 3y ago> ChaCha20 too, but only in the context of TLS It isn't. And that's a problem, because that means an implementation can't be both FIPS compliant and compliant with the TLS 1.3 RFC.
- fmajid 3y agoThat's because nobody was hacked for using djb-ware, unlike ISC BIND or Sendmail.
- forgetfreeman 3y agoWas anyone ever not hacked for using Sendmail? I lost count of the number of times the project included remote-code-execution-as-a-service in a point release.
- sneak 3y agoWhy does nobody talk about Internet Mail 2000?
- giantrobot 3y agoThe idea got renamed to ActivityPub at some point?
- sneak 3y agoThen why is my media directory on my Mastodon instance 2TB despite my not having logged in to it in a couple months? I think you have confused AP's operation.
- mschuster91 3y agoThat's the one thing keeping me from operating my own Mastodon instance. All it takes for me to be in serious trouble is some troll tooting CSAM while mentioning my account... that causes my Mastodon instance to automatically download it, and so the troll can then report me to the authorities for hosting CSAM. Or Nazi content (which is banned in Germany for good reasons). Or piracy. The list of how one can shoot themselves in the groin by simply running a Mastodon server is pretty much endless, and it's not made easier by the fact that German prosecutors are so tone-deaf regarding anything Internet that it took years to get them to stop raid TOR exit-node operators. How people are running Mastodon servers out of Germany, or how there are people running Mastodon-as-a-service shops is frankly mind-blowing IMHO.
- giantrobot 3y agoYour Mastodon instance is caching stuff locally. If you post something to your instance it lives there until another instance requests it. Then it lives on both instances. If your instance deleted the toot/content and I try to access it after the deletion I won't be able to get ahold of it. Same concept as IM2000. Note I'm not sour on the idea of IM2000. I genuinely think its ideas were used by ActivityPub.
- Nursie 3y agoThat was a very interesting read. It's also somewhat of its time - there has definitely been a turn towards systems which are less full of footguns in the intervening years. TLS 1.3 for example, which heavily pared down the available ciphersuites. We're still using AES all over the place though!
- deleted 3y ago[deleted]
- jiggawatts 3y agoThe article is from 2016, but notably OCB mode is no longer patented since 2021.
- brohee 3y agoMy understanding is that one patent is still covering it for a few months : https://patents.google.com/patent/US7949129B2/ https://patents.google.com/patent/US7949129B2/
- upofadown 3y agoPhillip Rogaway explicitly abandoned the OCB patents in 2021: * https://mailarchive.ietf.org/arch/msg/cfrg/qLTveWOdTJcLn4HP3ev-vrj05Vg/ https://mailarchive.ietf.org/arch/msg/cfrg/qLTveWOdTJcLn4HP3... The linked patent reflects the unpaid upkeep fee and shows a status of expired as a result.
- arrowsmith 3y agoIt's refreshing to see an article about "crypto" on the HN front page that's about cryptography, not cryptocurrency.
- fmajid 3y agoIt's sad that my first reaction was "Monoculture? We need a crypto(currency) Zeroculture", and I had actually read the article when it first came out.
- pfdietz 3y agoMy reaction was monocultures are easier to wipe out, so this was a good thing (reading "crypto" as cryptocurrency).
- deleted 3y ago[deleted]
- pavlov 3y agoI wonder if there’s any cryptocurrency article from 2016 that would be worth reading today. Cryptocurrency content ages like milk. Some of the original papers are worth reading of course, but by 2016 the influencers and hype shills had thoroughly taken over. That was the era when Buterin was calling Ethereum “a global supercomputer” with a straight face.
- arrowsmith 3y agoThis article from 2017 remains timeless: https://hackernoon.com/ten-years-in-nobody-has-come-up-with-a-use-case-for-blockchain-ee98c180100 https://hackernoon.com/ten-years-in-nobody-has-come-up-with-...
- px43 3y agoI was thinking that one of the PoS papers might fit, but the Tendermint paper was 2014, and the Casper FFG paper was 2017. Do you think Groth16 counts? So named because it was written by Groth in 2016. Groth16 introduces the first really practical zero knowledge proving scheme. I'm pretty sure it's used by zcash as well as Filecoin, and projects like Tornado cash. It opened the floodgates on verifiable computation techniques that are used for everything from scaling to privacy. Every year there's a ton of braindead noise, obviously, but every year there are also fundamental breakthroughs that change how we compute. Actually, specifically because of Groth16, the "world computer" concept is becoming more and more possible every day. When you have verifiable computing, you shift the paradigm from every node on the network having to verify every state transition to any given state transition only needing to be verified by one machine somewhere in the world, once (which can be done in parallel with the proving of every other state transition). This means something like a blockchain network is now only limited in scale by how much compute you can throw at it, and as the algorithms get faster, and the compute gets better, we're seeing multiple orders of magnitude throughput increases every year. Things have been getting pretty wild in the cryptocurrency space for the past couple years, and the future looks insane. edit: For people interested in diving into WTF "verifiable computing" is, this is a really awesome project that does some cool stuff with it that I'm not affiliated with in any way : https://github.com/risc0/risc0 https://github.com/risc0/risc0
- RcouF1uZ4gsC 3y agoIt seems currently open source has a DJB monoculture. Meanwhile, recent NIST has a Joan Daemen monoculture (AES and SHA-3). Early 1990s there was a Ron Rivest monoculture (RSA, MD5, RC4).
- tux3 3y agoAES and SHA-3 sharing one contributor isn't exactly the same situation. NIST does a lot more than just John Daemen's algorithms. And you can't have an entire crypto toolbox with just AES and SHA-3. If you use NIST, you use the output of a committee, after it goes through another committee. If you use sodium, then DJB is all there is. Dan is the committee. Even your hash (blake2) is secretly ChaCha20 inside.
- yjftsjthsd-h 3y ago> It seems currently open source has a DJB monoculture. I mean, if you're going to have monoculture, that seems like the one to go with...
- deleted 3y ago[deleted]
- lagniappe 3y agoSometimes I stop and take a moment to appreciate DJB and his contributions both mathematically and ideologically. We're really fortunate to have him holding it down on the chalkboard and in the court room.
- deleted 3y ago[deleted]
- nmadden 3y agoLike much of Peter Gutmann’s writing this is a mixture of good points and things that are downright incorrect or at least misleading. For example, he criticises GCM for losing confidentiality when a nonce is reused. True, but ChaPoly has exactly the same issue. And although CBC+HMAC is somewhat better in that regard, it doesn’t “drop back to ECB mode”, and it still loses CPA security. HMAC is far more robust than any polynomial MAC, but the persistent idea that there is any meaningful difference in robustness between any of the traditional cipher modes under nonce/IV misuse is nonsense. If you need misuse resistance then use a mode that actually provides it, like SIV.
- tptacek 3y agoI mean, he hasn't nailed the reason ChaPoly is favored over GCM, and it's not a good paragraph, but he's not wrong that GCM is ill-loved by cryptography engineers, despite its ubiquity. Really though, it's just missing an important bit of the history, which is that there was a decent stretch of years where it was basically impossible to implement GCM securely on architectures that didn't have something like the CLMUL instruction. I don't agree with you at all about the equivalent of IV misuse under CBC+HMAC and nonce reuse under ChaPoly. It's a bug either way, and bugs in cryptosystems are bad, but it's much less bad in CBC+HMAC. That is in fact a good reason to use it.
- nmadden 3y agoBut it’s less bad because of HMAC, not because of CBC. Hand waving arguments that CBC is meaningfully better than CTR mode under IV reuse are silly. There are cases where a nonce reuse in CTR mode reveals very little (eg key wrapping) and cases where the same in CBC mode reveals everything. The worst case for both is equally bad.
- tptacek 3y agoI still disagree with you even given this refinement. A repeated CBC IV is a second-order vulnerability that still requires you to set up the conditions for an ECB-style attack on the system, which isn't always possible. A repeated CTR nonce immediately sacrifices confidentiality.
- edgarvaldes 3y agoThere was a time, not long ago, when HN was filled to Crypto threads. Now you can see one every other week. What happened? The same people who was invested in crypto is now all on AI? Or is just the media?
- jjav 3y agoCrypto = Cryptography, which is the topic of the email in the submission.
- Animats 3y agoDemonstrably, the most secure cryptosystems today are the one that secures Bitcoin. If that could be cracked, or even work-reduced, someone would be a multi-billionaire, and the transfers would be noticed. Since that hasn't happened, we can have some confidence in those cryptosystems.
- pvg 3y agoWhy would that be the case specifically for bitcoin? Lots of cryptography secures things far more valuable than bitcoin and breaks in bitcoin would reduce its value to zero unlike many of the other things protected by cryptography.
- tptacek 3y agoI assume that the argument is that a break in secp256k1 has an especially straightforward monetization, where breaking the cryptography in TLS, while much more destabilizing to the Internet and the things running on it, wouldn't immediately net you a bunch of cash, but rather would just enable further attacks that might get you that.
- Animats 3y ago> I assume that the argument is that a break in secp256k1 has an especially straightforward monetization Exactly. Considering the sheer effort put into Bitcoin, including volume manufacture of custom ICs, if this was possible, someone would have done it by now. It wouldn't even be illegal.
- tptacek 3y agoWhat I think your analysis misses is that the security of a cryptosystem isn't an absolute thing. All sorts of cryptosystems exist that haven't been broken, and may never be broken, but would likely get someone else broken if emulated in a different setting. So the reason cryptography engineers probably wouldn't use ECDSA in a modern signing system, if they had a choice, is that ECDSA includes a bunch of footguns that better signing systems avoid.
- dang 3y agoRelated: On the Impending Crypto Monoculture (2016) - https://news.ycombinator.com/item?id=13383006 https://news.ycombinator.com/item?id=13383006 - Jan 2017 (69 comments) On the Impending Crypto Monoculture - https://news.ycombinator.com/item?id=11355742 https://news.ycombinator.com/item?id=11355742 - March 2016 (124 comments)