4 ms·

The lack of justifications makes this as useful as anybody else out there claiming "use X. Don't use Y". Eg: > Avoid: AES-CBC, AES-CTR by itself, block ciphers

The lack of justifications makes this as useful as anybody else out there claiming "use X. Don't use Y". Eg: > Avoid: AES-CBC, AES-CTR by itself, block ciphers with 64-bit blocks --- most especially Blowfish, which is inexplicably popular, OFB mode. Don't ever use RC4, which is comically broken. Why not 64-bit blocks? What's wrong with them? How do they affect us? Mind you, I'm not saying the statement is incorrect, but with no justification for it, I'm not convinced why I should avoid them.

tptacek 11y ago
I mean this sincerely and not as snark: if this is a question you have to ask, just use Nacl; don't design with ciphers yourself. Since there is a "right answer" to this question and a "wrong one", "convincing" doesn't seem like a good use of anyone's time. The right way to learn about cryptography is to start by learning how to break it. If that's something you're willing to sink time into, try this thing we set up: http://cryptopals.com http://cryptopals.com It's totally free and by the send of set 3, you'll have an appreciation for block sizes.
- some_furry 11y ago
  Hey Thomas, does anyone at Matasano still review submissions if someone wants to submit them for a particular programming language? I'm looking to establish myself as the luminary crypto nerd of the furry fandom :3
  - kibibu 11y ago
    The downvotes are likely because he's not at Matasano any more.
    - some_furry 11y ago
      I know he isn't. But I always thought that Crypto Pals was a Matasano project. He should know if someone took up the mantle in his absence.
      - jerematasno 11y ago
        We are still working on new sets, though obviously the rate of new sets is pretty low. The mailing list is basically unmonitored at this point, but everything we've got is on the site. (This is a vast improvement on the previous state, where we regularly failed to set out challenges to people who emailed us, due to overload.)
  - tptacek 11y ago
    I don't know why you got downvoted. Maybe it's the furry thing. Cryptopals is still ongoing (there's a set 8 in the works, all elliptic curve attacks). As for posting the solutions: we're doing that, too, in the abstract, but we're all busy and every time we bring it up a bunch of people say "noooo don't post solutions".
    - some_furry 11y ago
      Heh. Haters gonna hate. Okay, very glad to hear that there's still work being done on that end. I'll start sending solutions in then :3
- danielweber 11y ago
  For people on very small teams, "use X not Y" is great. For people on larger teams, or working next to teams of developers, "use X not Y" will lead to pushback of "why not?" and full answers will be needed.
  - lorenzhs 11y ago
    "Because that is what people who know more about this than all of us combined have come to that conclusion"? Sounds snark but I mean that's what it boils down to anyway.
    - wolf550e 11y ago
      You can cite meta-analysis, like in medicine. "The people who studied this concluded that using this method has a higher chance of bad side effects and lethal complications than using the suggested method".
njohnson41 11y ago
Cryptographic constructions using block ciphers generally rely on the block cipher never having the same input twice with the same key in order to satisfy security models. If you're feeding effectively random data into the block cipher (like if you're using CBC), then because of the birthday paradox, you get at most about 2^32 blocks (far fewer in practice at a good security level) per key if you have 64-bit blocks. This is low enough to be annoying for designers or problematic for suites that don't rekey correctly. However, because CTR (or GCM) mode uses sequential inputs to the cipher, I think that a 64-bit block size would not be a problem there. At that point, the reason not to use 64-bit block ciphers is because they're all older, weaker, and less-supported than AES-128.

tptacek 11y ago

I mean this sincerely and not as snark: if this is a question you have to ask, just use Nacl; don't design with ciphers yourself. Since there is a "right answer" to this question and a "wrong one", "convincing" doesn't seem like a good use of anyone's time. The right way to learn about cryptography is to start by learning how to break it. If that's something you're willing to sink time into, try this thing we set up: http://cryptopals.com http://cryptopals.com It's totally free and by the send of set 3, you'll have an appreciation for block sizes.

some_furry 11y ago
Hey Thomas, does anyone at Matasano still review submissions if someone wants to submit them for a particular programming language? I'm looking to establish myself as the luminary crypto nerd of the furry fandom :3
- kibibu 11y ago
  The downvotes are likely because he's not at Matasano any more.
  - some_furry 11y ago
    I know he isn't. But I always thought that Crypto Pals was a Matasano project. He should know if someone took up the mantle in his absence.
    - jerematasno 11y ago
      We are still working on new sets, though obviously the rate of new sets is pretty low. The mailing list is basically unmonitored at this point, but everything we've got is on the site. (This is a vast improvement on the previous state, where we regularly failed to set out challenges to people who emailed us, due to overload.)
- tptacek 11y ago
  I don't know why you got downvoted. Maybe it's the furry thing. Cryptopals is still ongoing (there's a set 8 in the works, all elliptic curve attacks). As for posting the solutions: we're doing that, too, in the abstract, but we're all busy and every time we bring it up a bunch of people say "noooo don't post solutions".
  - some_furry 11y ago
    Heh. Haters gonna hate. Okay, very glad to hear that there's still work being done on that end. I'll start sending solutions in then :3
danielweber 11y ago
For people on very small teams, "use X not Y" is great. For people on larger teams, or working next to teams of developers, "use X not Y" will lead to pushback of "why not?" and full answers will be needed.
- lorenzhs 11y ago
  "Because that is what people who know more about this than all of us combined have come to that conclusion"? Sounds snark but I mean that's what it boils down to anyway.
  - wolf550e 11y ago
    You can cite meta-analysis, like in medicine. "The people who studied this concluded that using this method has a higher chance of bad side effects and lethal complications than using the suggested method".

njohnson41 11y ago

Cryptographic constructions using block ciphers generally rely on the block cipher never having the same input twice with the same key in order to satisfy security models. If you're feeding effectively random data into the block cipher (like if you're using CBC), then because of the birthday paradox, you get at most about 2^32 blocks (far fewer in practice at a good security level) per key if you have 64-bit blocks. This is low enough to be annoying for designers or problematic for suites that don't rekey correctly. However, because CTR (or GCM) mode uses sequential inputs to the cipher, I think that a 64-bit block size would not be a problem there. At that point, the reason not to use 64-bit block ciphers is because they're all older, weaker, and less-supported than AES-128.