6 ms·

I'm surprised they'd make such a rookie mistake when there are hundreds of good encryption methods online to crib from, just a Google search away.

lukeh 13y ago
Agreed. It can be fun and/or sometimes necessary to roll your own, but, at least get it reviewed by someone who knows what they're doing - anyone on the IETF Kitten working group, for example (for a SASL mechanism).
- lukeh 13y ago
  Or, use RFC 4121. It's not just for Kerberos: GSS EAP (Moonshot), BrowserID (Persona), and SAML EC all use it for message integrity and privacy. And those specifications were all written by smart people (save for myself, at least) who could have rolled their own if they wanted to.
  - tptacek 13y ago
    For the love of almighty and merciful God please do not use GSSAPI. MAC-then-encrypt? CRC checksums? All-zeroes IV? CBCMAC? This stuff died in the '90s for a reason.
    - lukeh 13y ago
      GSS-API says nothing about any of the things you mention, it's an abstract standard (like SASL) that can be profiled for many different authentication and message integrity/confidentiality systems. The DES-based Kerberos GSS-API mechanism you're thinking of should be dying out by now. Granted, RFC 3962 does MAC-then-encrypt. This is being addressed in draft-ietf-kitten-aes-cbc-hmac-sha2.
      - tptacek 13y ago
        Those are all things I took out of 3962. But furthermore, I'm now even more confused by your recommendation. If it's a metastandard (which has always been the rap on stuff like SASL), how does it help them design good crypto? I can't see any reason in the world to adopt GSSAPI. I strongly recommend that nobody else do so.
        lukeh 13y ago
        I wasn't recommending GSS-API per se, just the message protection services from 3961/4121. It was just a suggestion. Feel free to roll your own!
tptacek 13y ago
Here's a fun thought experiment: find the first "good" encryption method you could crib from off of a simple Google search, and provide the Google search that found it.
- cperciva 13y ago
  "Encrypting data: Use AES in CTR (Counter) mode, and append an HMAC." Google search: "cryptography answers" :-)
  - JeremyBanks 13y ago
    Does it have advice for selecting an IV?
    - cperciva 13y ago
      CTR mode doesn't have IVs. It has a counter: Start at zero and count upwards.
      - X-Istence 13y ago
        Depending on if the key may be reused having a non-zero nonce may be a good idea too... --- And I just realised who I am replying too, off course you know this.
        cperciva 13y ago
        I was being a bit facetious in discriminating between "IV" and "nonce"... they're almost two sides of the same coin.
      - StavrosK 13y ago
        And don't overflow.
        cperciva 13y ago
dobbsbob 13y ago
Or spend the money to hire somebody who knows what they are doing. Whatsapp has 300 million monthly users and charges $0.99 per year I'm sure they can afford somebody.
- ucha 13y ago
  They don't have a subscription model on the iPhone and the first year is free on the other devices. Then you puncture the 30% the app store gets and you're left with a mid-low 8-digits revenue.
  - ddeck 13y ago
    They got $8 million in funding a couple of years back. One would hope that would be sufficient.
- Al-Khwarizmi 13y ago
  We are talking about a company that makes a crappy product with obvious and blatant limitations (such as not being able to use the same account in different devices, or with different SIMs, or on an iPad, let alone on a PC... and if you have a bad connection messages can arrive out of order - is it so hard to use timestamps? Why are messaging apps getting wrong things that IRC was doing fine back in the 80's?) To be honest, I'm not surprised.
  - thirdsun 13y ago
    Yes, everything they do feels rather sloppy - of course that doesn't stop any of my "normal" friends from almost requiring it for any kind of messaging. A necessary evil in my opinion.
willvarfar 13y ago
Surely the proper answer is: use TLS! Then they just have to google to get the latest TLS best practice cipher suite settings etc. People shouldn't be using crpyto libraries directly; they should just be using TLS to talk client-server, and then its just a configuration problem, not a code problem. And think how much time they'd have saved too :)
- e12e 13y ago
  I've heard that openssl enc -none is blazingly fast!

lukeh 13y ago

Agreed. It can be fun and/or sometimes necessary to roll your own, but, at least get it reviewed by someone who knows what they're doing - anyone on the IETF Kitten working group, for example (for a SASL mechanism).

lukeh 13y ago
Or, use RFC 4121. It's not just for Kerberos: GSS EAP (Moonshot), BrowserID (Persona), and SAML EC all use it for message integrity and privacy. And those specifications were all written by smart people (save for myself, at least) who could have rolled their own if they wanted to.
- tptacek 13y ago
  For the love of almighty and merciful God please do not use GSSAPI. MAC-then-encrypt? CRC checksums? All-zeroes IV? CBCMAC? This stuff died in the '90s for a reason.
  - lukeh 13y ago
    GSS-API says nothing about any of the things you mention, it's an abstract standard (like SASL) that can be profiled for many different authentication and message integrity/confidentiality systems. The DES-based Kerberos GSS-API mechanism you're thinking of should be dying out by now. Granted, RFC 3962 does MAC-then-encrypt. This is being addressed in draft-ietf-kitten-aes-cbc-hmac-sha2.
    - tptacek 13y ago
      Those are all things I took out of 3962. But furthermore, I'm now even more confused by your recommendation. If it's a metastandard (which has always been the rap on stuff like SASL), how does it help them design good crypto? I can't see any reason in the world to adopt GSSAPI. I strongly recommend that nobody else do so.
      - lukeh 13y ago
        I wasn't recommending GSS-API per se, just the message protection services from 3961/4121. It was just a suggestion. Feel free to roll your own!

tptacek 13y ago

Here's a fun thought experiment: find the first "good" encryption method you could crib from off of a simple Google search, and provide the Google search that found it.

cperciva 13y ago
"Encrypting data: Use AES in CTR (Counter) mode, and append an HMAC." Google search: "cryptography answers" :-)
- JeremyBanks 13y ago
  Does it have advice for selecting an IV?
  - cperciva 13y ago
    CTR mode doesn't have IVs. It has a counter: Start at zero and count upwards.
    - X-Istence 13y ago
      Depending on if the key may be reused having a non-zero nonce may be a good idea too... --- And I just realised who I am replying too, off course you know this.
      - cperciva 13y ago
        I was being a bit facetious in discriminating between "IV" and "nonce"... they're almost two sides of the same coin.
    - StavrosK 13y ago
      And don't overflow.
      - cperciva 13y ago

dobbsbob 13y ago

Or spend the money to hire somebody who knows what they are doing. Whatsapp has 300 million monthly users and charges $0.99 per year I'm sure they can afford somebody.

ucha 13y ago
They don't have a subscription model on the iPhone and the first year is free on the other devices. Then you puncture the 30% the app store gets and you're left with a mid-low 8-digits revenue.
- ddeck 13y ago
  They got $8 million in funding a couple of years back. One would hope that would be sufficient.
Al-Khwarizmi 13y ago
We are talking about a company that makes a crappy product with obvious and blatant limitations (such as not being able to use the same account in different devices, or with different SIMs, or on an iPad, let alone on a PC... and if you have a bad connection messages can arrive out of order - is it so hard to use timestamps? Why are messaging apps getting wrong things that IRC was doing fine back in the 80's?) To be honest, I'm not surprised.
- thirdsun 13y ago
  Yes, everything they do feels rather sloppy - of course that doesn't stop any of my "normal" friends from almost requiring it for any kind of messaging. A necessary evil in my opinion.

willvarfar 13y ago

Surely the proper answer is: use TLS! Then they just have to google to get the latest TLS best practice cipher suite settings etc. People shouldn't be using crpyto libraries directly; they should just be using TLS to talk client-server, and then its just a configuration problem, not a code problem. And think how much time they'd have saved too :)

e12e 13y ago
I've heard that openssl enc -none is blazingly fast!