4 ms·

The Cryptographic Doom Principle

120 points by Rexxar 12y ago

diafygi 12y ago
What does OpenPGP do? If you have the MAC in plaintext, wouldn't anyone be able to determine who encrypted the message?
- maxerickson 12y ago
  It calls it a modification detection code, but it does "Authenticate Then Encrypt": https://tools.ietf.org/html/rfc4880#section-5.13 https://tools.ietf.org/html/rfc4880#section-5.13 It also does digital signatures (but those are different than a MAC, they verify the identity of the sender). The MAC takes a shared secret as input, so it should only reveal anything to parties that possess that secret.
krazydad 12y ago
For the other clueless readers: MAC: http://en.wikipedia.org/wiki/Message_authentication_code http://en.wikipedia.org/wiki/Message_authentication_code [Please spell out your acronyms the first time, nerds]
- brownbat 12y ago
  To be fair, the first use was a link to the wikipedia article, the style just doesn't give you any indication of that. If I recall, underlining links led to heated debates in some circles, but it's really, really nice to have some visual signal to set off links for readers. If it wasn't obvious why already, this is a great case.
  - akjsdfh 12y ago
    > To be fair, the first use was a link to the wikipedia article, the style just doesn't give you any indication of that. Huh? it's a different color.
    - brownbat 12y ago
      Huh, yeah, they are two different shades of gray. Completely missed that, so I'm still for more contrast in links. I guess if I'm forced to rate Moxie Marlinspike on presentation, maybe he gets docked a point. It all feels a bit like rating chef Jonathan Benno on shoelace cleanliness though.
    - slang800 12y ago
      At first glance, I just thought the slightly different shade was for emphasis, rather than indicating a link.
  - jimmaswell 12y ago
    Who in their right mind would debate against underlined hyperlinks? Either underlined or blue, and bolded. Keep it at that accepted standard. Such senseless bikeshedding. If your design breaks user expectations then it's almost certainly bad design.
revelation 12y ago
Or don't bother with this and generate random tokens, which should cover about 99 percent of cases where a clueless developer would run into the problems here. Leave the cryptography to those that actually know they need cryptography.
- jbaudanza 12y ago
  What do you do with the random tokens after you've generated them? The author's proposed solution of "Encrypt then authenticate" seems pretty reasonable.
- ambrop7 12y ago
  You sound like a web developer who thinks that 99% of cryptographic problems have to do with a web application discriminating between sessions. (I'm just guessing about the context of your comment since you didn't provide any.)
- dsacco 12y ago
  Generating random tokens is cryptography. It just happens to be done more by non-cryptographers, which doesn't necessarily mean they're better at it (hint: they aren't). You can perform cryptanalysis on random tokens and if the RNG (or PRNG) isn't seeded properly, you get a replay attack. This is not to mention: aside from attacks, you have further crypto to do aside from the generation: how do you verify the token? If you roll your own RNG/PRNG and token generation, it is probably just as broken as the block cipher you tried to roll yourself as well. Using standard libraries and well-audited tools brings ciphertext authentication into the same realm of usability for developers that token generation is in.
yuhong 12y ago
I wonder if AtE with MD5 with secret prefix as MAC can be exploited, as in say SSLv2.
KerrickStaley 12y ago
This is from 2011. Still a really good (and short) read :) The URL from this submission ends with /?, so HN wasn't able to dedupe it from the earlier submission: https://news.ycombinator.com/item?id=6153834 https://news.ycombinator.com/item?id=6153834
sarciszewski 12y ago
I've always enjoyed Moxie's blog posts. This one is probably my favorite. AEAD, EtM, or bust.
perryHacking 12y ago
It does make sense in a way. With how our systems have become very vulnerable to security breaches, threats and attacks, we have to double or tripple efforts to secure these systems.

120 points by Rexxar 12y ago

diafygi 12y ago

What does OpenPGP do? If you have the MAC in plaintext, wouldn't anyone be able to determine who encrypted the message?

maxerickson 12y ago
It calls it a modification detection code, but it does "Authenticate Then Encrypt": https://tools.ietf.org/html/rfc4880#section-5.13 https://tools.ietf.org/html/rfc4880#section-5.13 It also does digital signatures (but those are different than a MAC, they verify the identity of the sender). The MAC takes a shared secret as input, so it should only reveal anything to parties that possess that secret.

krazydad 12y ago

For the other clueless readers: MAC: http://en.wikipedia.org/wiki/Message_authentication_code http://en.wikipedia.org/wiki/Message_authentication_code [Please spell out your acronyms the first time, nerds]

brownbat 12y ago
To be fair, the first use was a link to the wikipedia article, the style just doesn't give you any indication of that. If I recall, underlining links led to heated debates in some circles, but it's really, really nice to have some visual signal to set off links for readers. If it wasn't obvious why already, this is a great case.
- akjsdfh 12y ago
  > To be fair, the first use was a link to the wikipedia article, the style just doesn't give you any indication of that. Huh? it's a different color.
  - brownbat 12y ago
    Huh, yeah, they are two different shades of gray. Completely missed that, so I'm still for more contrast in links. I guess if I'm forced to rate Moxie Marlinspike on presentation, maybe he gets docked a point. It all feels a bit like rating chef Jonathan Benno on shoelace cleanliness though.
  - slang800 12y ago
    At first glance, I just thought the slightly different shade was for emphasis, rather than indicating a link.
- jimmaswell 12y ago
  Who in their right mind would debate against underlined hyperlinks? Either underlined or blue, and bolded. Keep it at that accepted standard. Such senseless bikeshedding. If your design breaks user expectations then it's almost certainly bad design.

revelation 12y ago

Or don't bother with this and generate random tokens, which should cover about 99 percent of cases where a clueless developer would run into the problems here. Leave the cryptography to those that actually know they need cryptography.

jbaudanza 12y ago
What do you do with the random tokens after you've generated them? The author's proposed solution of "Encrypt then authenticate" seems pretty reasonable.
ambrop7 12y ago
You sound like a web developer who thinks that 99% of cryptographic problems have to do with a web application discriminating between sessions. (I'm just guessing about the context of your comment since you didn't provide any.)
dsacco 12y ago
Generating random tokens is cryptography. It just happens to be done more by non-cryptographers, which doesn't necessarily mean they're better at it (hint: they aren't). You can perform cryptanalysis on random tokens and if the RNG (or PRNG) isn't seeded properly, you get a replay attack. This is not to mention: aside from attacks, you have further crypto to do aside from the generation: how do you verify the token? If you roll your own RNG/PRNG and token generation, it is probably just as broken as the block cipher you tried to roll yourself as well. Using standard libraries and well-audited tools brings ciphertext authentication into the same realm of usability for developers that token generation is in.

yuhong 12y ago

I wonder if AtE with MD5 with secret prefix as MAC can be exploited, as in say SSLv2.

KerrickStaley 12y ago

This is from 2011. Still a really good (and short) read :) The URL from this submission ends with /?, so HN wasn't able to dedupe it from the earlier submission: https://news.ycombinator.com/item?id=6153834 https://news.ycombinator.com/item?id=6153834

sarciszewski 12y ago

I've always enjoyed Moxie's blog posts. This one is probably my favorite. AEAD, EtM, or bust.

perryHacking 12y ago

It does make sense in a way. With how our systems have become very vulnerable to security breaches, threats and attacks, we have to double or tripple efforts to secure these systems.