3 ms·

Although it doesn't use them by default (preferring pyca/cryptography if available), reticulum contains pure-python hand-rolled crypto primitives. I'm not reall

Although it doesn't use them by default (preferring pyca/cryptography if available), reticulum contains pure-python hand-rolled crypto primitives. I'm not really sure why. These implementations are not secure against side-channels, for example, here's their AES implementation indexing an array with a secret index: https://github.com/markqvist/Reticulum/blob/6ded42edd7ae203e5a565cb70138c2d7b4b58b5b/RNS/Cryptography/aes/aes.py#L66 https://github.com/markqvist/Reticulum/blob/6ded42edd7ae203e... Their ed25519 implementation doesn't even attempt to be constant-time: https://github.com/markqvist/Reticulum/blob/6ded42edd7ae203e5a565cb70138c2d7b4b58b5b/RNS/Cryptography/pure25519/basic.py#L123-L132 https://github.com/markqvist/Reticulum/blob/6ded42edd7ae203e... Their X25519 implementation tries to be constant time by using... time.sleep() https://github.com/markqvist/Reticulum/blob/6ded42edd7ae203e5a565cb70138c2d7b4b58b5b/RNS/Cryptography/X25519.py#L164 https://github.com/markqvist/Reticulum/blob/6ded42edd7ae203e... There are also pure-python implementations of sha256 and sha512, which I haven't looked at closely, but they're already available as part of hashlib (part of the standard library, and already used as a dependency), so they serve no practical purpose. Ditto for hmac.

charleslmunger 2y ago
https://github.com/markqvist/Reticulum/tree/6ded42edd7ae203e5a565cb70138c2d7b4b58b5b?tab=readme-ov-file#cryptographic-primitives https://github.com/markqvist/Reticulum/tree/6ded42edd7ae203e... I am struggling to understand who the overlap between people who can accurately assess the risk of each of these implementations and correctly find them ok (graduate level cryptography?) and people who cannot get pyca or openssl to compile is. For offline operation maybe a case could be made that timing side channels aren't an issue in practice, but this is explicitly network software.
woah 2y ago
If you're going to rewrite every networking protocol, why stop there? Might as well rewrite the crypto protocols too.
Retr0id 2y ago
I was taking a closer look at the EdDSA to see if I could get a practical exploit going, and it looks like it might be safe, for now. Per https://minerva.crocs.fi.muni.cz/ https://minerva.crocs.fi.muni.cz/, > The EdDSA scalar multiplication code in libgcrypt was leaking, however due to the way it was used, it was likely not exploitable. It did not reduce the scalar which was a SHA512 digest by the curve order, but used the digest directly, thus the leakage did not represent the bit-length of the reduced scalar. (Extended discussion: https://blog.cr.yp.to/20191024-eddsa.html https://blog.cr.yp.to/20191024-eddsa.html) Reticulum's implementation is similar in that it doesn't reduce the scalar.

charleslmunger 2y ago

https://github.com/markqvist/Reticulum/tree/6ded42edd7ae203e5a565cb70138c2d7b4b58b5b?tab=readme-ov-file#cryptographic-primitives https://github.com/markqvist/Reticulum/tree/6ded42edd7ae203e... I am struggling to understand who the overlap between people who can accurately assess the risk of each of these implementations and correctly find them ok (graduate level cryptography?) and people who cannot get pyca or openssl to compile is. For offline operation maybe a case could be made that timing side channels aren't an issue in practice, but this is explicitly network software.

woah 2y ago

If you're going to rewrite every networking protocol, why stop there? Might as well rewrite the crypto protocols too.

Retr0id 2y ago

I was taking a closer look at the EdDSA to see if I could get a practical exploit going, and it looks like it might be safe, for now. Per https://minerva.crocs.fi.muni.cz/ https://minerva.crocs.fi.muni.cz/, > The EdDSA scalar multiplication code in libgcrypt was leaking, however due to the way it was used, it was likely not exploitable. It did not reduce the scalar which was a SHA512 digest by the curve order, but used the digest directly, thus the leakage did not represent the bit-length of the reduced scalar. (Extended discussion: https://blog.cr.yp.to/20191024-eddsa.html https://blog.cr.yp.to/20191024-eddsa.html) Reticulum's implementation is similar in that it doesn't reduce the scalar.