lvh

50 ms·

481.
by lvh 7y ago
The public key fingerprints that need checking are important because they get introduced in 3DH, which is an AKE. Like 'tptacek mentioned.
482.
by lvh 7y ago
No. Why would it?
483.
by lvh 7y ago
We did a blog post! You might like it. https://latacora.micro.blog/2018/04/03/cryptographic-right-a...
484.
by lvh 7y ago
Fortunately many of the problems associated with RSA are less worrisome when they're used in a PKI context, where realistically the BRs (or at least CA praxis), together with the limited set of highly audited clients (browsers, mostly)
485.
by lvh 7y ago
Firstly, NSA recommended specific NIST-brand ECC that didn't have many of the practical security advantages of what's being recommended here. Secondly, if you were really that worried about quantum computing, you'd use a quan
486.
by lvh 7y ago
There's a reason we're telling you to use libsodium box instead: even if pyrsa sets a reasonable exponent, for example, it's still a separate pure Python implementation (with fewer eyeballs and almost certainly more side chan
487.
by lvh 7y ago
Some keygen is busted, but openssl RSA (as well as ssh-keygen) are probably fine. Part of the problem there is "probably": turns out RSA keygen is a lot harder than ECC keygen. (Since ROCA broke a bunch of RSA keygen, our confiden
488.
by lvh 7y ago
"Shipping [your] product"? How do I, for example, make money off of libsodium? The point of the article is all the ways RSA blows up. libsodium addresses that style of problem. Saying there are other problems ("how do we agre
489.
by lvh 7y ago
"Finite-field" is the operative phrase in that sentence. I wouldn't tell you to use IES, as in the thing where you do g^xy mod p. I would tell you to use libsodium's box, which is a specific implementation of something s
490.
by lvh 7y ago
Total agreement re: groups of bigcos trying to sabotage TLS, but I think a lot of traffic was de facto using RSA because of default configurations, not because of a serious mandate. Otherwise, I don't think you'd see such a PFS up
491.
by lvh 7y ago
FWIW the cool API here that PyNaCl exposes (but not every libsodium impl) is automatically selecting the nonce for you.
492.
by lvh 7y ago
Depending on context the answer is "absolutely" or "absolutely not", so that's hard to answer. I definitely wouldn't tell you to use finite-field Diffie-Hellman in any context, or any derived cryptosystems (ElG
493.
by lvh 7y ago
There are good formal cryptography courses, though some of them focus on aspects that aren't relevant to what I'd call "cryptographic engineering". For example, differential cryptanalysis is very interesting, but basical
494.
by lvh 7y ago
It doesn't need to tell you anything new about prime number factorization because practical RSA cryptosystems get broken with far more boring bugs than prime number factorization. RSA padding bugs aren't really "coding errors
495.
by lvh 7y ago
The article also tells you to use libsodium, which makes safe cryptographic choices. (It's absolutely true that ECC can be as much of a footgun, e.g. non-random-k ECDSA is worse than RSA PKCSv15. But the real takeaway is to use somethi
496.
by lvh 7y ago
Yes, you need some foundational source of trust, but you were going to communicate that public key one way or another. If you don't trust that medium (let's say it's WebPKI TLS and an adversary gets a bad cert from Comodo som
497.
by lvh 7y ago
Disclaimer: I co-authored the Latacora one. I think "key size" is something maybe protocol designers need to be worried about, but it's still about two hops above how kobs-set-for-safety I like recommendations I make to be fo
498.
by lvh 7y ago
ECIES is part of a family of things that are all more or less just ElGamal with a symmetric primitive attached. libsodium implements one version of that with Curve25519 + secretbox (which in turn is XSalsa20.) It's really mostly just s
499.
by lvh 7y ago
According to the F5 telemetry report (and my own anecdotal evidence), non-PFS suites were a lot more popular than that, the majority as little as 5 years ago :-) [0]: https://www.f5.com/content/dam/f5/f5-labs&
500.
by lvh 7y ago
You would need an obscenely large key size to make RSA post-quantum secure. The speedup a quantum computer gives you isn't some linear factor. People have explored what that would look like: https://cr.yp.to/papers&#x2F
501.
by lvh 7y ago
Oh, hey, [2], that's me, glad you liked it. FWIW: while I clearly subscribe to the notion of cryptographic education, I also thing that we should give people high-level recipes. Why are they the right ones? Yep, you gotta trust me. I&#
502.
by lvh 7y ago
The textbook e=3 attack is Hastad's broadcast attack (on textbook RSA), which is much simpler than the e=3 signature verification problem. (So the article is right that _lots_ of things go wrong, 'tptacek's example is just mo
503.
by lvh 7y ago
We wrote a blog post for that: https://latacora.micro.blog/2018/04/03/cryptographic-right-a... To answer your specific comments: firstly, you don't need public key crypto. If both you and your sender can
504.
by lvh 7y ago
Concepts and abstractions, like the virtual DOM, matter. Just because you could in an abstract sense (of course you could! It’s a JS library) doesn’t mean anyone actually could. Thought experiment: why does your argument not apply to, say,
505.
by lvh 7y ago
Stored XSS requires some sort of backend, yes, but reflected and DOM-based XSS does not. Furthermore, all XSS is some variant of a contextual confusion where something that wasn’t intended to be interpreted as JS suddenly is. jQuery makes X
506.
by lvh 7y ago
ClojureScript compiles down to JavaScript, so yes, it is entirely possible to spell the same buggy jQuery site you would in regular JavaScript but with the parentheses on the outside and it will solve no problems for you. I don’t think it’s
507.
by lvh 7y ago
Your example of a sector where we can’t use conservative technology to make progress is space travel? ;-) But look, I see your point, but the “counterpoint” doesn’t actually disagree: the point is that a lot of incremental improvements in i
508.
by lvh 7y ago
In the double entry bookkeeping sense that GP is using it, yes, everything is a liability. They’re also necessarily equal, which I think is where the disconnect between the analogy in the post and the analogy here comes from.
509.
by lvh 7y ago
Sure! I’ve written large apps in it and am familiar with the technology. My point is that whatever the reason, frontend clearly has made strides. So, is it: 1. Frontend was less mature to begin with 2. Frontend has a unique, definitional st
510.
by lvh 7y ago
Can you elaborate? I don't quite understand. (I also think TypeScript is a great example of a category breaker here since it's a lot closer to a linter than a database. Sure, you have a new compiler stage so it's not quite fr

More ›