Learn cryptographic engineering by example

Learn cryptographic engineering by example(github.com)

210 points by praxis23 7 years ago | 16 comments

tptacek 7 years ago |

This is more of a quick tour of the basic API for libsodium than a workshop for learning cryptographic engineering. Many of the exercises have no cryptographic component at all; the remainder basically exercise the most basic libsodium sign/verify/secretbox functionality. None of the exercises explain the rationale behind any of the libsodium constructions, and (because libsodium) nonce-based authenticated encryption is used without explaining any of the details of what a nonce is and what the requirements are for generating and handling them. Finally, the service model for the crypto involved doesn't make a whole lot of sense; most of the exercises build a "tamper proof log" from a simple chained hash function, and ultimately encrypts that log using a key exposed to the server anyways.

Respectfully, I don't think this is how you should learn cryptography (certainly: you shouldn't call this kind of work "cryptographic engineering").

I'm talking my own book here a little (but just a little, since it's not like I make a dime from this) when I say that the better way to learn and understand cryptography is stuff like the Matasano Cryptopals challenges:

   https://cryptopals.com/

These exercises will try to teach you crypto engineering by breaking cryptography, and without wasting much time structuring a trivial JSON interface. You'll understand what a nonce is by the end of set 3 because you'll have written exploits for otherwise sane cryptosystems that mishandle nonces. By the end of set 8 you'll have implemented invalid curve attacks and built and broken short-tag GCM AEAD encryption and, hopefully, be a little nauseous any time someone asks you to use crypto again --- which is the way it should be.

Even after you've undergone our cryptogaphic Ludovico Process, you still won't be a "cryptographic engineer". I've been testing and building exploits for random cryptosystems for over a decade and I'm nowhere close. The simple, blunt reality of it is that if you're going to build anything close to new with cryptography, you really do have to understand the math, and anyone who claims you can get to "securing a banking interface" without a detour through abstract algebra is, I think, doing you a disservice.

Another good resource for this stuff is LVH's Crypto 101: https://www.crypto101.io/

arkadiyt 7 years ago | |

For anyone interested in Cryptopals Set 8 (still not published on the cryptopals.com website), I've compiled them here:

https://gist.github.com/arkadiyt/5b33bed653ce1dc26e1df9c249d...

loup-vaillant 7 years ago | |

> the better way to learn and understand cryptography is stuff like the Matasano Cryptopals challenges

Compared to OP's tutorial, this is certainly a better way. I very much doubt this is the best way however, unless of course you actually want to do cryptanalysis.

Breaking stuff for real takes time. Learning that stuff can be broken is much quicker. I don't need to forge messages to be afraid of ciphertext malleability. Once I understand how XOR works, of course I'll run away screaming into the night at the sight of unauthenticated encryption. That said, I reckon doing the challenges is very good for street cred.

Also, some things just have to be taught. Forward secrecy for instance, is either like "I don't have the key, can't break anything", or "duh, you leaked your long term key, of course I can read everything". Exploiting breaches can help someone plug the leaks, but they won't teach them to secure their users' messages after law enforcement went for their long term keys.

And dammit, I don't aspire to be a crypto engineer. I just want to build a secure system. That said:

> if you're going to build anything close to new with cryptography, you really do have to understand the math

Oh yes. That alone warrants my upvote.

tedunangst 7 years ago | | |

Breaking stuff is still a good way to viscerally understand that tiny mistakes are fatal. Crypto that looks good turns out to be useless. The best way to really internalize that lesson is to see the crypto die. (I don't think it's strictly necessary to work through every example; looking at the problem, then reading the solution is probably good too, but one should spend some time looking at the problem, enough to say "yeah, this looks good" before watching it burn.)

tptacek 7 years ago | | |

It's interesting to hear that. Out of curiosity: have you implemented an invalid curve attack, or an attack against a GCM nonce repeat? Did you feel like that was instructive?

jonbtow 7 years ago | |

Really enjoyed going through the cryptopals sets. Thanks for gifting this to the community!

alistproducer2 7 years ago |

I would like more description in the main readme. Tell me a little about what kind of skills and knowledge will be gained by going through the exercises.

apo 7 years ago |

As I write, this article is above another on the front page titled "A security vulnerability in Git that can lead to arbitrary code execution "

Makes me wonder if the "example" is getting pwned by a Git repo and the lesson I'll learn is to keep my system updated.

That said, browsing the repo online, it looks like a pretty useful tutorial.

IloveHN84 7 years ago |

It would be good to have also examples of crypto over SOAP, a protocol which is vastly ignored in the wild (REST is preferred for its simplicity) but massively used in enterprise applications.

cweagans 7 years ago | |

In my experience, SOAP is dying off pretty much everywhere. It's ignored for the same reason that we don't put steam engines in cars: it's unwieldy, slow, and wasteful.