5 ms·

> The assumption is that a block cipher is secure to differential cryptanalysis. That assumption was not taken for granted back in the 90's. It was only with y

> The assumption is that a block cipher is secure to differential cryptanalysis. That assumption was not taken for granted back in the 90's. It was only with years of cryptanalysis of AES (which had had resistance to known plaintext an explicit design goal) that designers felt comfortable with things like CTR mode. In practice, we've learned that the block ciphers are by far the strongest part of the system, and it's the block cipher modes that provide the weakness for attackers. IMHO this is the type of poisoned knowledge that the US spies should be blamed for.

diminish 13y ago
..isn't a good place to be paranoid the core of AES, namely substitution-permutation network hocus-pocus. (Joan Daemen' and Vincent Rijmen's). A backdoor transformation would suffice to make all other paranoia superfluous.
- marshray 13y ago
  I'm not saying its impossible, but decades of public cryptanalysis have failed to produce a significant dent in the security of 3DES or AES. On the other hand, we've seen a total discrediting of LFSR-based schemes and a steady flow of issues resulting from the block modes (padding and timing oracles). We should be paranoid, but mostly that we might be not worrying about the right things.
  - diminish 13y ago
    You are right that padding/timing attacks on block modes and weaknesses in PRGs form the bulk of contemporary cryptanalysis. Nonetheless, if there is one single backdoor transform with a unique key on AES substitution-permutation network which would make further attacks possible, it would be nearly impossible to devise a adversary/challenge to reveal it using current cryptanalysis techniques. The standardization history for AES, and the organizations involved does not give much hope neither.
    - marshray 13y ago
      There are a couple of reasons I have some hope for the security of AES: 1. There's this proof that a trapdoored symmetric cipher is equivalent to a public key system (there's a link in the metzdowd thread somewhere). No one seems to have figured out how to build a public key system with anything close to the efficiency of AES. 2. The specification of AES itself isn't that large. It's not minimal, but neither does it seem to have large arbitrary-looking constants. https://en.wikipedia.org/wiki/Kolmogorov_complexity https://en.wikipedia.org/wiki/Kolmogorov_complexity https://en.wikipedia.org/wiki/Nothing_up_my_sleeve_number https://en.wikipedia.org/wiki/Nothing_up_my_sleeve_number The NIST Dual-EC DRBG fails on both counts: 1. it is based on an obvious public key system, and 2. it recommends the use of large arbitrary constants that could easily be a trapdoor. Now is it possible that NSA occasionally intentionally fails to backdoor a NIST standard in order to help us underestimate how often they succeed? Can we ever develop a coherent threat model with the possibility of this kind of adversary?
  - tptacek 13y ago
    I think if you're going to be a paranoid, Marsh, you might as well be an equal-opportunity paranoid and not exempt the algorithms you happen to like (or need, professionally). I think you're obligated to provide a real rationale for why we shouldn't all switch to Camellia.
    - marshray 13y ago
      How about RC4 -> GOST -> AES -> Camellia, all with unrelated keys?
wbl 13y ago
Now I am genuinely curious: at what point did the standard game definitions of security become widespread/presented? Because given those it is obvious that CTR is secure given a PRP, which any block cipher should be to be semantically secure when encrypting a single block.
- marshray 13y ago
  My impression is that it was NSA/NIST's AES specification process that made it "officially OK" to stop worrying about known plaintext. But really we need to ask some the folks older than I am. It would be a good question for the randombit or metzdowd crypography lists. Also, I'll tweet at Bellovin. Edit: https://twitter.com/marshray/status/376600321637638144 https://twitter.com/marshray/status/376600321637638144

diminish 13y ago

..isn't a good place to be paranoid the core of AES, namely substitution-permutation network hocus-pocus. (Joan Daemen' and Vincent Rijmen's). A backdoor transformation would suffice to make all other paranoia superfluous.

marshray 13y ago
I'm not saying its impossible, but decades of public cryptanalysis have failed to produce a significant dent in the security of 3DES or AES. On the other hand, we've seen a total discrediting of LFSR-based schemes and a steady flow of issues resulting from the block modes (padding and timing oracles). We should be paranoid, but mostly that we might be not worrying about the right things.
- diminish 13y ago
  You are right that padding/timing attacks on block modes and weaknesses in PRGs form the bulk of contemporary cryptanalysis. Nonetheless, if there is one single backdoor transform with a unique key on AES substitution-permutation network which would make further attacks possible, it would be nearly impossible to devise a adversary/challenge to reveal it using current cryptanalysis techniques. The standardization history for AES, and the organizations involved does not give much hope neither.
  - marshray 13y ago
    There are a couple of reasons I have some hope for the security of AES: 1. There's this proof that a trapdoored symmetric cipher is equivalent to a public key system (there's a link in the metzdowd thread somewhere). No one seems to have figured out how to build a public key system with anything close to the efficiency of AES. 2. The specification of AES itself isn't that large. It's not minimal, but neither does it seem to have large arbitrary-looking constants. https://en.wikipedia.org/wiki/Kolmogorov_complexity https://en.wikipedia.org/wiki/Kolmogorov_complexity https://en.wikipedia.org/wiki/Nothing_up_my_sleeve_number https://en.wikipedia.org/wiki/Nothing_up_my_sleeve_number The NIST Dual-EC DRBG fails on both counts: 1. it is based on an obvious public key system, and 2. it recommends the use of large arbitrary constants that could easily be a trapdoor. Now is it possible that NSA occasionally intentionally fails to backdoor a NIST standard in order to help us underestimate how often they succeed? Can we ever develop a coherent threat model with the possibility of this kind of adversary?
- tptacek 13y ago
  I think if you're going to be a paranoid, Marsh, you might as well be an equal-opportunity paranoid and not exempt the algorithms you happen to like (or need, professionally). I think you're obligated to provide a real rationale for why we shouldn't all switch to Camellia.
  - marshray 13y ago
    How about RC4 -> GOST -> AES -> Camellia, all with unrelated keys?

wbl 13y ago

Now I am genuinely curious: at what point did the standard game definitions of security become widespread/presented? Because given those it is obvious that CTR is secure given a PRP, which any block cipher should be to be semantically secure when encrypting a single block.

marshray 13y ago
My impression is that it was NSA/NIST's AES specification process that made it "officially OK" to stop worrying about known plaintext. But really we need to ask some the folks older than I am. It would be a good question for the randombit or metzdowd crypography lists. Also, I'll tweet at Bellovin. Edit: https://twitter.com/marshray/status/376600321637638144 https://twitter.com/marshray/status/376600321637638144