3 ms·

> The book actively recommends public key cryptography, because of concerns about key distribution. Again: bad strategy. Cryptographers use public key crypto on

by runn1ng 13y ago

> The book actively recommends public key cryptography, because of concerns about key distribution. Again: bad strategy. Cryptographers use public key crypto only when absolutely required. Most settings for cryptography don't need it! Public key cryptography multiplies the number of things that can go wrong with your cryptosystem. Can I ask why? What is so dangerous with asymmetric crypto compared to symmetric crypto?

mehrdada 13y ago
There's one, admittedly theoretical difference, at least: there is such a thing as perfectly (information theoretically) secure symmetric encryption scheme (regardless of the computational power of the adversary), but asymmetric crypto, by definition, relies on being computationally infeasible, not information theoretically impossible. Even though it's theoretical, the side effects of this fact surface from time to time as engineering issues in asymmetric crypto: all information that the attacker might need to break asymmetric crypto is more or less in the ciphertext, intuitively suggesting it's easier for asymmetric crypto to catastrophically go wrong.
- runn1ng 13y ago
  No, I still don't get it. How is information about the private key in the ciphertext? It's great that one-time pad exists, but it's not really relevant in actual crypto code, right? The only actual reason I can think of is that symmetric crypto is easier to write and understand - you just mangle and xor some text back and forth, while in asymmetric crypto, you need to understand fairly complex algebra. But again, that's not that important if you use existing primitives, right?
a8000 13y ago
One symmetric cryptography method are one-time pads. Essentially you generate a truly random key (for example by observing some decay process) that has the same length as the maximum length of a message you might want to send and distribute the key to the receiver in advance. You encrypt the message by modular vector addition and decrypt it by subtracting the key. If you use the key only once and it is random, there can't be any attack on this method.
jimktrains2 13y ago
Possibly speed? Symmetric crypto is fast, and is often hardware accelerated. Asymetric is slow and not accelerated. Not as big an issue with ECC, but RSA also has much larger block sizes, increasing the size of small payloads. It's been my experience that Asymmetric is used for kex (key exchange) or key agreement or signing, but encryption is done using a symmetric algorithm.
- yread 13y ago
  But you would be using asymmetric only for exchanging keys for symmetric encryption.
tptacek 13y ago
The biggest reason is that public-key crypto is "just a math problem" to an extent that isn't true of symmetric crypto. Diffie Hellman, for instance, is just an RNG and a couple modexps. There's no machinery of repeated substitutions and permutations and nonlinearities to hide your mistakes. Another big reason is that public-key algorithms are parameterized to an extent symmetric systems aren't. Two random numbers is all you need to safely encrypt something with AES. Diffie Hellman, the simplest of the public key algorithms, needs a prime, a generator, and random private keys with particular relationships to those parameters.

by runn1ng 13y ago

mehrdada 13y ago

There's one, admittedly theoretical difference, at least: there is such a thing as perfectly (information theoretically) secure symmetric encryption scheme (regardless of the computational power of the adversary), but asymmetric crypto, by definition, relies on being computationally infeasible, not information theoretically impossible. Even though it's theoretical, the side effects of this fact surface from time to time as engineering issues in asymmetric crypto: all information that the attacker might need to break asymmetric crypto is more or less in the ciphertext, intuitively suggesting it's easier for asymmetric crypto to catastrophically go wrong.

runn1ng 13y ago
No, I still don't get it. How is information about the private key in the ciphertext? It's great that one-time pad exists, but it's not really relevant in actual crypto code, right? The only actual reason I can think of is that symmetric crypto is easier to write and understand - you just mangle and xor some text back and forth, while in asymmetric crypto, you need to understand fairly complex algebra. But again, that's not that important if you use existing primitives, right?

a8000 13y ago

One symmetric cryptography method are one-time pads. Essentially you generate a truly random key (for example by observing some decay process) that has the same length as the maximum length of a message you might want to send and distribute the key to the receiver in advance. You encrypt the message by modular vector addition and decrypt it by subtracting the key. If you use the key only once and it is random, there can't be any attack on this method.

jimktrains2 13y ago

Possibly speed? Symmetric crypto is fast, and is often hardware accelerated. Asymetric is slow and not accelerated. Not as big an issue with ECC, but RSA also has much larger block sizes, increasing the size of small payloads. It's been my experience that Asymmetric is used for kex (key exchange) or key agreement or signing, but encryption is done using a symmetric algorithm.

yread 13y ago
But you would be using asymmetric only for exchanging keys for symmetric encryption.

tptacek 13y ago

The biggest reason is that public-key crypto is "just a math problem" to an extent that isn't true of symmetric crypto. Diffie Hellman, for instance, is just an RNG and a couple modexps. There's no machinery of repeated substitutions and permutations and nonlinearities to hide your mistakes. Another big reason is that public-key algorithms are parameterized to an extent symmetric systems aren't. Two random numbers is all you need to safely encrypt something with AES. Diffie Hellman, the simplest of the public key algorithms, needs a prime, a generator, and random private keys with particular relationships to those parameters.