The Side Channel

7:38 PM

Would anyone happen to know where to study the current state of the art in information theoretically secure symmetric encryption algorithms?

blacklight

7:51 PM

@MickLH that depends on what you call "state of the art" and what implementation you mean

SEJPM

@MickLH AFAICT there is the OTP and the generalized OTP for groups and that's about it with interesting symmetric information theoretically secure crypto

the fact that |K|>|M| really makes other schemes pretty much useless as they all just add unneccessary complexity

MickLH

What caught my interest was Shamir's secret sharing system

blacklight

i wonder though, why is symmertic encryption less vurnerable to quatum computing then a-symmertic encryption.

MickLH

Especially the notion that instead of the decryption costing a "hard" problem to break, it's simply ambiguous which decryption is interesting

SEJPM

@MickLH as are all information theoretically secure systems

and SSS is pretty much optimal in the field of information-theoretically secure secret sharing (if you don't need advanced / fancy properties)

simple, fast and really secure

@blacklight because asymmetric crypto has more structure

MickLH

7:58 PM

It's becoming very difficult to abide the "don't roll your own crypto" rule

I had an idea a while back to use the intersection of two random lines as the key, which I found out is equivalent to Shamir's scheme

SEJPM

@MickLH well, if you only want to play around with stuff you can always roll your own

just don't use it for serious purposes

or sell it for serious purposes :/

MickLH

lol!

I might be in luck, as a game developer I have something which is by definition "playing"

It seems to be a good blend of not-too-serious, but still provides motivation for people to break it

blacklight

@MickLH your own crypto can be good (still please don't use it), but the chance that you actully create something secure is really small and its really hard to create, your better off using big open crypto standards, those passed rigerous tests from some of the best cryptographers and cryptanalists in the world.

SEJPM

@blacklight ... but mind yourself to not trust all (open) standards (e.g. OSGP)

blacklight

@SEJPM yes, yes, i am quite aware of that.

MickLH

8:03 PM

Soft question: Is RSA still "good enough" for a long term public key?

blacklight

@MickLH it depends

MickLH

I've heard nearly endless suggestion to migrate to ECC for the long haul

SEJPM

@MickLH how long term?

@MickLH NO

QC will break ECC

as it will with RSA

for the long-term you need post-quantum crypto

MickLH

That sounds very "ouch" to implement

blacklight

it depends on what keys sizes you use, like you should not use 1024bit but 4096 should still be save for quite some time.

SEJPM

8:05 PM

but for the next two-three decades 4096-bit RSA should be fine

@MickLH yeah, PQ crypto usually is more difficult to understand and implement

MickLH

I'm gearing up to release an online game, and I will need to outfit my users with public key crypto of some form, so I've been leaning towards a 4096-bit master key and smaller temporary keys

SEJPM

@MickLH how long does it have to be secure?

blacklight

plus you need to think who your adversery is, is it a high school hacker with 100 dollar, or a million dollar state level adversary(like the nsa or the ghcq for example)

MickLH

Well, I'd like to extend the lifetime as long as possible, because I'd hope to keep using the same user accounts in the next releases too

SEJPM

@blacklight usually it's just as easy to handle both in terms of crypto (not implementation!)

@MickLH so maybe three decades?

or rather one?

MickLH

8:07 PM

I'd think one would cut it, and three would be comfortable

Oh! While you guys are here providing such friendly peer review!

SEJPM

@MickLH yeah, 3072-bit or 4096-bit RSA should be fine

or if you have a library for it, 384-bit or 256-bit ECC would probably be faster and equally as secure

MickLH

I've been considering a scheme where a user has an extremely massive DH/ElGamal pair (ie >8192-bit), and then they can sign temporary RSA-1024 keys for short periods of time

SEJPM

@MickLH wot, this would be beyond 192-bit classical security

waaaaaaaayy too much

128 or somethinbg around 150 bits is fine

blacklight

i am still pretty new to crypto myself(i am studying it roughly for a year now) and i wanst even that good in math in highschool, but its such a fasinating subject that i can't stop reading about it, so its nice to be able to help others now (only im trying watch myself to keep me from talking about things i know nothing (or not enough) about.

MickLH

Would it extend the lifetime at all over 4096, or do you suppose that by the time we break through 4k we will also shoot right past 8k?

SEJPM

8:12 PM

@MickLH my (personal) guess would be, that the day we break 4096-bit RSA, we have successfully scaled qunatum computers

which is the day to run from classical asymmetric crypto fast

MickLH

Ok a little more, how about user interface?

blacklight

@SEJPM from what i know about rsa, doubling the key size doesnt double the security off it right?

MickLH

How can I make users stop fucking up?! I mean specifically, how can I force them to buy a "smartcard's worth of security" with daily effort if they wont buy one with money?

SEJPM

@blacklight you're correct. 4096-bit RSA is at 144-bit security and 8192 is at 200 bit maybe

blacklight

@MickLH well thats a hard thing, you can try as best you can to make a secure system, but human failure will ALWAYS be a weak spot

SEJPM

8:15 PM

@MickLH if you ship your game physically only, you could give them an usb-token, but this would be expensive

my token has CC EAL4 certification and cost me 80€ :/

@MickLH you should hide all the crypto stuff from the user

MickLH

Well it would sure justify those $100 game boxes lol

SEJPM

@MickLH are you going Win10 exclusive?

MickLH

I really appreciate the feedback

blacklight

@SEJPM do you actully know a way for secure 2FA via sms, since i recently read that it was very easy to intercept those messages

SEJPM

@blacklight TOTP is practically the best we can do for now

if you can't go full-crazy PKI

MickLH

8:18 PM

@SEJPM I am not, in fact I have almost the worst case for safe platform-based assumptions: The client is scheduled to have the source released, and users are allowed to compile for whatever obscure platform and connect

blacklight

so it basiclly depends or your budget

SEJPM

@blacklight things always depend on the budget

@MickLH well, then you can't use those fancy TPM 2.0s which are mandatory for Win certified HW starting in 2 months ;)

MickLH

yeah :/

SEJPM

@MickLH so if you can, go with a multi-platform library and hide all the crypto stuff as much as humanly possible from the user

MickLH

I had a really... fucked up idea that I prototyped: I wrote a shitty (but working) smartcard firmware for an arduino.

blacklight

8:21 PM

well that makes some sense i guess, i had to buy a new computer so i could run qubes os since my computer didnt had the hardware to fully utilize all of the security messures

SEJPM

@blacklight secure boot? RdRand? RdSeed? AES-NI? SGX?

blacklight

i think whatsapp and protonmail did a good job on hiding all their crypto lol

SEJPM

@MickLH it kinda works I guess, but shouldn't be claimed secure probably. writing good smartcard firmware is hard

MickLH

@SEJPM I wonder to what degree it must be hidden

@SEJPM Oh yeah lol there is not even the slightest consideration to side channel attacks

blacklight

i didnt have vt-d technogly, which it uses to better isolate the virtual machienes

SEJPM

8:23 PM

@blacklight ahh, I see now :)

@MickLH as much as possible. if the user doesn't know PK crypto is used, you did your job right

blacklight

btw, im writing a firefox userscript which also deactivates all weak crypto so it will force the server to use better(and give a warning when this is not possible) , and while i think i got most covered i hope on of you guys could give it a little look to see if i missed something: github.com/blacklight447/…

its on line 221 till 284

SEJPM

@blacklight the cipher suites look good, but it will probably weaken some connections because it will fall-back to RSA-AES-CBC-SHA if DHE but not ECDHE is offered

blacklight

@SEJPM but there are no real significant things i missed or errors made? (im still pretty new to crypto so i dont want to screw things up for other people with my newbism)

SEJPM

@blacklight it may actually break some sites with odd configurations (which don't have RSA-only but also don't have ECDHE-AES)

and it may break quite some sites because of that SHA-1 setting

blacklight

@SEJPM hmm strange, i havent have alot of trouble with it myself, but i have also left my contact details in the tutorial file so people can reach out to me and how people can easly deal with problems, but do you have any suggestions i what things i need to change? (i can put you in the credits if you want? )

SEJPM

8:37 PM

@blacklight ahh, I see now what that setting does!

it bans all SHA-1 certs issued before 2016

so chances are it's gonna be fine

blacklight

yeah im trying to make the acceptence of certificates kinda strict because i have read alot about hackers faking old issued certifictes

SEJPM

@blacklight that's about MD5 probably, SHA-1 isn't yet at that point

blacklight

@SEJPM well it was with the thought: its better to prevent a problem then to solve it hahah

SEJPM

@blacklight yeah it certainly has higher chances of being secure :) and the setting there seems like a good compromise between usability and security

blacklight

@SEJPM thanks, im trying to balance it as good as possible to make it useable for all kinds of people, im trying to make to code look structured aswell, you see im not a coder by any means, but as my first project, i think it turned out ok i guess haha

on of the tradeoffs is for example that firefox wont scan for malioucs sites anymore, since it uses googles data bases for shady url's but that is a major compromise in terms of privacy and whcih is also the reason why i turned it off.

MickLH

8:49 PM

@SEJPM Would it be a gross violation of the purpose of hiding the crypto, if under advanced settings there is an option to export your key to a PEM file?

SEJPM

@MickLH why should they be able to do that?

MickLH

They could import it on another machine to permanently authorize it

Basically as a "password file"

SEJPM

@MickLH so you store the keys in-plain on the machine?

MickLH

In some cases, yes. If the user leaves their master password blank

SEJPM

@MickLH allow them to "move their game state" and include the key with that? (while noting that this will allow the other machine to also log-in as you)

@MickLH master password sounds so grimm, maybe "log-in password"?

MickLH

8:52 PM

Well I have something I already called the "log-in password", it's the password for that smaller key I mentioned

SEJPM

@MickLH your UX is probably gonna be bad if you want the user to remember two different PWs

MickLH

Here's where I really want to screw everything up: I want the "master" password to be permanent, so I can encrypt the private key against it and share it on a public DB

So that if your master PW is compromised, you are completely and utterly fucked with no way to recover except creating a new account

blacklight

does anyone actully has a recommadation on books about abstract or linear algebra(or both) and on which of the two i should start?

SEJPM

@MickLH so as recovery method in case the user's machine breaks?

MickLH

@SEJPM Yes exactly

SEJPM

8:55 PM

@MickLH what about "backup-password" then?

blacklight

i never was really good in math but since i love crypto so much i am willing to study hard and learn algebra myself, so i would like a startpoint on where to start (or with which book to buy)

SEJPM

used only for the sole purpose of storing the backup key on the server

@blacklight you don't really need much linear algebra for crypto

the much you need is usually contained in the beginner's books

the HAC has a rather rough approach but will probably cover everything neccessary

Katz-Lindell's Introduction to modern cryptography is pretty much self-contained

blacklight

well one of my dreams is to become cryptographer, so i want to get a strong base on algebra and number thoery (even if it means i have to study for years)

SEJPM

as for lattice-based stuff, coding theoretic stuff, multivariate and isogeny stuff I can't really comment

MickLH

I am completely open to it, but I'll share my reasoning that has brought me to say that so far: I can split the account into normal use and administration tasks. I actually call the master pw the "Admin Password" in the UI, and call the temporary password just "Password". The small key is listed in the public directory including the private part encrypted against your regular password, this is what you use to log-in from a friend's house.

SEJPM

9:01 PM

@blacklight if you have access to free university quality education, you can invest half a year and make the linear algebra course there

they'll also point you to the lecture where you can learn about group theory / number theory

MickLH

When you change your password, you have to generate a new small key, and then access your big key to sign a message that authorizes your new small key and bans the old one.

SEJPM

and if you ask the professors nicely / search their web-presence cleverly, you'll probably find their book recommendations for these fields

blacklight

@SEJPM well the problem is that i dont have the neccesary qualafications to join a university in my country, so it depends on alot of self study, everything i know about crypto is also self learned at the moment

SEJPM

@blacklight so go and find out which books are used to build the relevant lectures and use those instead?

MickLH

As for the "Admin Password", you set it once (optionally) during account creation, and are warned that if you choose to use it then it's permanent, but if you omit it then your account is lost if your machine breaks or is compromised. I could refer to it as a backup password, but I'd like to convey that it also is required when changing account setting. Basically the small key is only used for player messages and for stopping a man-in-the-middle during the DH exchange with the game server

blacklight

9:04 PM

i an IT student in college but crypto just fascinates me , but because i cannot join a university, i will have to learn everything on my own

SEJPM

and if you're lucky, you can also find the relevant training material in the books / openly in the interwebs

blacklight

well right now im following the lectures of cristoff paar on youtube

i also buyed his book "understanding cryptography" which should arrive in a view days

SEJPM

@blacklight emsec.rub.de/chair/_staff/christof-paar ?

MickLH

Please, don't let me do anything horrible ;)

SEJPM

@MickLH AFAICT, what you're doing doesn't sound obviously flawed / reasonable

MickLH

9:06 PM

I appreciate the once-over!

blacklight

@SEJPM him indeed

SEJPM

@blacklight so you probably can't use the linear algebra course of the associated university...?

blacklight

youtube.com/channel/UC1usFRN4LCMcfIV7UjHNuQg and this is the lecture of him that i follow

SEJPM

@blacklight may I ask what languages do you speak?

blacklight

@SEJPM i speak dutch fluantly , my english is fairly good, and i speak a bit of german

SEJPM

9:11 PM

29

Q: Very good linear algebra book.

I plan to self-study linear algebra this summer. I am sorta already familiar with vectors, vector spaces and subspaces and I am really interested in everything about matrices (diagonalization, ...), linear maps and their matrix representation and eigenvectors and eigenvalues. I am looking for a b...

36

Q: What is a good book to study linear algebra?

I'm looking for a book to learn Algebra. The programme is the following. The units marked with a $\star$ are the ones I'm most interested in (in the sense I know nothing about) and those with a $\circ$ are those which I'm mildly comfortable with. The ones that aren't marked shouldn't be of import...

linear-algebra reference-request

google: "book recommendation linear algebra site:math.stackexchange.com" to find more of these

and replace linear algebra with your field of choice

then make a cross-check if your local trusted libray has it / you're willing to pay for it

(those books may be at 50€+)

blacklight

@SEJPM thanks, you helped out alot, you know as a student with a lack of money and high end education, finding ways to get good and affortable education can be hard sometimes, so thanks

SEJPM

@blacklight I'm here (read: SE) to help people (qualifiedly) :)

blacklight

@SEJPM so your basically some kind of moderator here?

SEJPM

@blacklight no, I'm not. sushi, codes and mike are our mods here and I didn't run during the last election due to my in-experienced-ness with SE back then (I was only three months here and was at about 1k rep)

But I'll definitely run for the next mod elections if my time allows me to be a good mod :)

(if you're interested in the last election: crypto.stackexchange.com/election)

blacklight

@SEJPM well thats pretty cool, id vote for you lol, just like i hope to become an actule cryptographer someday, although it might seem an impossible goal, (since im pretty terrible at math) i will still try but studying as hard as i can and do my best

MickLH

9:27 PM

Oh yet another noob question @SEJPM, if a message has an attached HMAC, does it still need a plain checksum?

I got the idea that an HMAC is abstracted as a signed checksum, and therefore could be used as for both data integrity, and source verification

SEJPM

@MickLH a CRC? no you don't need that but it could be useful as a first-level check if you expect many malformed packets (due to natural sources)

MickLH

Well I have a way to reject... let me see... 99.99999% of bad packets already

But these packets could possibly contain multiple messages (or less than one)

SEJPM

@MickLH well, in this case a plain HMAC will do (and may I question why you don't use proper authenticated encryption?)

MickLH

@SEJPM Just because I have formulated the system in terms of a stream cipher

I need to be able to receive and process partial data out-of-order

SEJPM

@MickLH use packets with GCM (one nonce = one packet)?

or directly DTLS?

MickLH

9:34 PM

Excuse me while I ask myself why I'm not using DTLS ;)

SEJPM

Datagram Transport Layer Security

In information technology, the Datagram Transport Layer Security (DTLS) communications protocol provides communications security for datagram protocols. DTLS allows datagram-based applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery. The DTLS protocol is based on the stream-oriented Transport Layer Security (TLS) protocol and is intended to provide similar security guarantees. The DTLS protocol datagram preserves the semantics of the underlying transport — the application does not suffer from the delays associated with stream protocols, but...

MickLH

@SEJPM Skimming RFC 6347 (for UDP) it's a good fit but I would need to outfit it with some DDoS protection

I use a simple Proof-Of-Work system: The server measures time spent on public key operations and when it goes over budget, the "work required" variable increases. The work required variable gives how many zero bits message's SHA256 sum must begin with

Any incoming message with a checksum that does not have enough initial zeros is rejected instantly

The clients are allowed to append crap bytes to the datagram to brute force the checksum bits

SEJPM

@MickLH proper DDoS protection while offering TLS is indeed difficult

MickLH

Sadly that might be the one thing I have to take most seriously. If someone can eavesdrop then it's not such a big deal, players are already used to the possibility of hackers "seeing through walls"

Even if someone can outright crack the key the user is connecting with, it's not such a big problem because they can generate a new key and reconnect immediately

Man... I've almost completely reinvented the wheel on DTLS.

It's comforting in a way though, maybe it won't be trivially broken in the first hour after all!

I seriously appreciate the time you've taken to consider and respond to all my queries, @SEJPM, I'd offer you a hug or a smoke or something... Ok one more and I swear I'll lay off for a few minutes ;)

SEJPM

10:01 PM

@MickLH ;)

MickLH

Does it ruin information theoretic security to provide a hash of the plaintext?

SEJPM

@MickLH yes, because it reduces the plaintext's uncertainity

MickLH

I have to also ask the complement question: Does providing an HMAC of the ciphertext guarantee message integrity provided I can guarantee that both parties know to use the same shared secret?

SEJPM

@MickLH yes. HMAC authenticates the origin of the sender which includes integrity protection because a message change is equivalent to a sender change

MickLH

Thank you! I'm sorry for the endless noob questions, I'm the kind of guy who reads the manual while deciding what to do, and then checks with the manual while doing it :P

SEJPM

10:09 PM

@MickLH it's ok, the fact that I'm answering means a) that I know some bits about the stuff and b) have spare time and c) am willing to help you :)

Transcript for