3 ms·

Bernstein is touting "boring crypto" as what users want. Boring crypto is crypto that just works, so that users don't have to keep updating their libraries and

Bernstein is touting "boring crypto" as what users want. Boring crypto is crypto that just works, so that users don't have to keep updating their libraries and protocols. The implementation is provably correct, and the only two ways to transform cyphertext into plaintext are (a) having the key, and (b) brute force. But this isn't some C library; cryptography is intrinsically adversarial. And attackers outnumber defenders; you can make more money by breaking a cypher than by inventing one. Cracking libboring would be a major prize. And I imagine libboring is never going to happen. There will always be new, unexpected attack channels. For example, I'd never have guessed (in advance) that instruction timing would be a viable way to attack a cypher.

chpatrick 3y ago
libboring exists, it's called nacl.
- denton-scratch 3y ago
  As far as I'm aware, NaCl isn't like "The End Of History" for cryptographic excitement; isn't it more like a safety razor, that makes it more difficult than usual for users to do stupid things? The primitives it offers don't include stupid primitives, and you can't stich the primitives together in stupid ways. But the primitives it offers are the same primitives offered by other kits; those are not immune to 'excitement' issues.
  - Sesse__ 3y ago
    It offers higher-level primitives than e.g. OpenSSL. Instead of the primitives “ChaCha20”, “Poly1305” and “Ed25519 signature”, you get “authenticated encryption” (implemented using ChaCha20, Poly1305 and Ed25519). You do not have to know or understand how to combine the three securely, nor how to combine everything down into a single parseable stream for the other end.
    - tptacek 3y ago
      "Safety razor" sounds like the right analogy to me.
- nly 3y ago
  Libsodium you mean. Has safe cutting edge crypto, and nothing else.
  - chpatrick 3y ago
    Based on NaCL by DJB, who wrote the OP.
    - nly 3y ago
      Right, but pointing people to NaCl which is a proof of concept and not actively maintained (last version 2011) isn't helpful at this point.
arccy 3y ago
but BoringCrypto does exist as a library: BoringSSL https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS.md https://boringssl.googlesource.com/boringssl/+/master/crypto...
- 0l 3y ago
  This is not true - BoringSSL is Google's OpenSSL fork, and has nothing to do with BoringCrypto.
  - d-z-m 3y ago
    "BoringCrypto" is a FIPS validated core library in BoringSSL[0]. "Boring Crypto" as an ethos/concept that djb is invoking in these slides is indeed not related to this. [0]: https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4407 https://csrc.nist.gov/projects/cryptographic-module-validati...

chpatrick 3y ago

libboring exists, it's called nacl.

denton-scratch 3y ago
As far as I'm aware, NaCl isn't like "The End Of History" for cryptographic excitement; isn't it more like a safety razor, that makes it more difficult than usual for users to do stupid things? The primitives it offers don't include stupid primitives, and you can't stich the primitives together in stupid ways. But the primitives it offers are the same primitives offered by other kits; those are not immune to 'excitement' issues.
- Sesse__ 3y ago
  It offers higher-level primitives than e.g. OpenSSL. Instead of the primitives “ChaCha20”, “Poly1305” and “Ed25519 signature”, you get “authenticated encryption” (implemented using ChaCha20, Poly1305 and Ed25519). You do not have to know or understand how to combine the three securely, nor how to combine everything down into a single parseable stream for the other end.
  - tptacek 3y ago
    "Safety razor" sounds like the right analogy to me.
nly 3y ago
Libsodium you mean. Has safe cutting edge crypto, and nothing else.
- chpatrick 3y ago
  Based on NaCL by DJB, who wrote the OP.
  - nly 3y ago
    Right, but pointing people to NaCl which is a proof of concept and not actively maintained (last version 2011) isn't helpful at this point.

arccy 3y ago

but BoringCrypto does exist as a library: BoringSSL https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS.md https://boringssl.googlesource.com/boringssl/+/master/crypto...

0l 3y ago
This is not true - BoringSSL is Google's OpenSSL fork, and has nothing to do with BoringCrypto.
- d-z-m 3y ago
  "BoringCrypto" is a FIPS validated core library in BoringSSL[0]. "Boring Crypto" as an ethos/concept that djb is invoking in these slides is indeed not related to this. [0]: https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4407 https://csrc.nist.gov/projects/cryptographic-module-validati...