Chat event #3 - book discussion featuring Poncho, Rory Alsop and Ninefingers

Ninefingers

Feb 28, 2012 19:36

Hi guys if you're here, I'm running slightly late, feel free to start.

I will catch up shortly :)

Ninefingers

Feb 28, 2012 19:51

Right, I'm here

My apologise, please feel free to blame the trains in the UK :(

So, who've we got :)

?

poncho

Well, you have little ol' me

Rory Alsop

an' me

dunno how much use I am though but thought I'd say hi:-)

Ninefingers

@poncho It might just be us :( Ok, In a sec, I'll start as I have a book I've been reading and either of @poncho or @rory can fire away if they've got a book to talk about. If nobody joins us, we'll just do a free for all ask about what crypto books you've read

Rory Alsop

Heh - I think I've only read 2 proper Crypto books ever. The Handbook of Applied Cryptography and Practical Cryptography

Ninefingers

@RoryAlsop Well in a bit feel free to stick some thoughts down here in chat :)

Rory Alsop

Feb 28, 2012 19:57

And both outstripped my maths before the end :-(

poncho

I've read considerably more, but nothing that recently

Ninefingers

Ok, well we'll see how we do :)

Rory Alsop

(both of those were some years ago.....)

Ninefingers

Right, I've been reading this little number:

amazon.co.uk/Elliptic-Cryptography-Mathematical-Society-Lecture/…

So - this covers just about everything you could want to know on ECC, including implementation. It starts off with a very brief introduction to fields of small characteristic and arthmetic on elliptic curves, then plunges straight into Efficient Implementation - i.e. point compression. From there, you start reading about the MOV attack, Schoofs algorithm etc.

I am personally about 3/4 of the way through.

poncho

Hmmm, I don't believe I've seen that one. On EC references, I've got the Frey et al (Handbook of Elliptic and Hyperelliptic Curve Cryptography), and Washington (Elliptic Curves/Number Theory and Cryptography)

Ninefingers

Feb 28, 2012 20:01

Now, it's very thorough, but it's very mathematical. The introductory sections are very very brief overviews of the arithmetic of elliptic curves, so if you're not familiar with that (like me) you either need another book, or the patience to google.

poncho

So, what do you think of the Blake? The ones I've read have been more about the mathematics behind Elliptic Curves, and less (hardly much at all) about the cryptography

Ninefingers

@poncho This is very mathematically-inclined. There are some algorithms presented, but only in very pure form. There are, in this book, a few notes on efficiency

which my programmer brain is able to interpret, but it isn't a "how to implement" book by any means.

I am definitely enjoying it and thinking it's a good read, but if you want an intro reference I might find something else, likewise for a "how to implement".

poncho

Actually, I don't care that much about "how to implement". What I'm interested in is answers to security related questions; "what do you need to avoid"

As for an intro text, I believe I already have a basic understanding

Ninefingers

@poncho It's pretty light in that area through. Just had a thumb through to check and it focuses a lot on the maths/algorithms. It reminds me of reading about "theoretical" RSA in a number theory textbook as opposed to reading PKCS#1. Obviously, it covers the MOV attack so it does have some things to avoid when searching for good curves.

So that's my book :) Any questions I can try to answer, or we can talk about some others?

poncho

Sounds like it's not that much of a step up over what I already have (I don't believe they cover MOV, or searching for a good curve, so if I ever need to do that, I might get it; I don't anticipate needing that, though...)

Hmmmm, how much does it go into IBE?

Ninefingers

Feb 28, 2012 20:13

@poncho So what do you make of the handbook of elliptic curve... book? I looked at that when wondering what to buy; in th eend I got this one from the library.

@poncho Not at all.

Oh no wait a sec

poncho

Well, it rather depends on what you're looking for. If you're looking for something that talks about the mathematics behind elliptic curves, it goes through that rather extensively. If we're talking about the cryptography, well, it does, but (IMHO) in rather less depth

Ninefingers

Ok so on IBE, it covers weil pairings and related mathematics but makes no specific mention of IBE

@poncho Ah ok, interesting - I assume the number theory one is similar then?

poncho

For example, ECDSA is essentially one of the two most commonly used EC crypto primitives (the other one is ECDH); the ECDSA algorithm is discussed on one page (without any discussion of, say, what happens if the signer doesn't choose r uniformly (or even, as far as I can see, that using r for two different signatures is a bad idea)

Yes, the Washington is even worse (to the point I almost suspect that the publisher put in the "and Cryptography" mostly to make it sell more)

Ninefingers

@poncho Oh dear :( Ok, one to avoid then!

poncho

Ok, maybe it's not that bad... but, there's no reason to search it out either.

Ninefingers

Feb 28, 2012 20:23

Fair enough - so, @poncho, any other books you want to bring up?

poncho

Hmmmm, I didn't have anything in particular in mind; as I mentioned, I haven't been reading many crypto books (not counting things I needed to look up references in)

Ninefingers

Ok, well I've read another one. This one was a while ago, and I felt was pretty light on detail really. It dealt with basic DH and RSA, but again, missing the critical crypto elements (like RSA padding). It covers EC, but in no way near as much depth as the green book above:

amazon.co.uk/…

It is an undergraduate text, so I suppose as an intro reference it is fine (fairly easy to read etc), I just felt like when I'd done I'd already covered what I knew.

Whilst we're here too, I have also looked at this:

amazon.co.uk/Modern-Cryptanalysis-Techniques-Advanced-Breaking/…

I struggled to find any books covering cryptanalysis at all - this one does and is my next to-read. I am yet to sit down with it, but it looks quite comprehensive, so I'm looking forward to it.

Has anyone read it?

poncho

Sorry, I haven't.

It does look interesting, though...

And, yes, books covering cryptanalysis are quite hard to find

Ninefingers

I found one other, actually, I don't have a link to hand, but it had next to nothing in it.

Not even a mention from the amazon preview of differential or linear cryptanalysis (which the above has) or pollard's rho (which I have yet to study). When I sit down with it (and for next time) I'll be able to talk all about it; but this one looked much more promising than the other.

poncho

I just glanced through the table of contents on the Swenson; it sounds like it covers the basics (up to LC/DC); that's good, but it doesn't go much beyond that.

Ninefingers

Feb 28, 2012 20:34

I think this one might need to go with it:

amazon.co.uk/…

It also has worked examples in C, which is more up my street (it's not the one I was referring to).

(Which I can't find).

Right, @RoryAlsop, from an intro perspective do you want to cover HOAC etc ?

Rory Alsop

@Ninefingers you have already scared me!

Practical Crypto is probably well below anything you guys would ever read

poncho

Hmmm, well, the Joux is a lot pricier, and it doesn't appear to cover LC/DC; it does appear to cover correlation attacks (useful against LFSR-based stream ciphers), as well as Coppersmith's attack against partially revealed RSA keys. Those attacks would appear to be less generic; my advice (if you had to pick one) would be to go with the Swenson

Rory Alsop

and the HOAC is relatively functional but relies on the reader having a reasonable grasp of the maths already

poncho

Actually, "Practical Crypto" is exactly that; it doesn't worry about the theoretical aspects of crypto (that we like to talk about, because they're neat and tidy), but "how do you do crypto that's actually secure in the real world".

There's quite of bit of "social" aspects to cryptography that we tend to ignore, but are practically imortent

Ninefingers

amazon.co.uk/Practical-Cryptography-Niels-Ferguson/dp/…

That one? (I'm just pasting in Amazon links, by the way - it does the big box thing, no special magic). I've not read that - but it sounds like it covers a more security-practicalities focused view on crypto?

So as it's quiet I'll mention two others that come up a bit:

amazon.co.uk/Applied-Cryptography-Protocols-Algorithms-Source/…

Rory Alsop

Feb 28, 2012 20:43

@Ninefingers yes it was that one - had to go and get it out to look at the cover

Ninefingers

So on Applied crypto - these days I think it's fair to say it's showing its age, but when I read it (not so long ago, actually) it covers implementing in C many different algorithms in a very thorough way.

The other intro reference that gets mentioned is this:

amazon.co.uk/…

Which is available here: cacr.uwaterloo.ca/hac

poncho

AC is (IMHO) the book that both helped the most in crypto, and caused the most damage. It helped the most because it attacted so many people to learn more about cryptography. It did the most damage because so many people just read it, and figured they knew enough...

Ninefingers

@poncho That sounds pretty accurate - it's fair to say having participated here my eyes have been opened, so it's a good introductory reference but definitely not a complete, all inclusive guide.

On HOAC - I think again that's a very thorough introductory reference - again slightly dated, but still useful.

poncho

I am personally not that thrilled with HOAC as an intro text; it seemed to me more geared to give description of algorithms, with not enough detail about what the algorithms are meant to do. I think it's rather more important to stress the "why" and less the "what".

Ninefingers

@poncho I've always sort of used it as a "I need to know how to do X - look up such a chapter" - I feel it's more that kind of book. I'd honestly say the whys I've picked up more as I've come here and from reading online previous to crypto.se starting than from any of the intro books.

Is there an intro book that covers the why, do we know?

poncho

Feb 28, 2012 21:01

Hmmm, I'm not sure; I don't read that many intro books (unless I'm deliberately reseaching somthing I didn't know before, such as EC).

Ninefingers

@poncho mmm ok.

Right, anyone anything else they want to add? Any questions anyone wants to ask, whilst I'm here?

Right, well I think we'll call that an end :) Thanks for coming along @Rory, @poncho, I'll organise another one in the next week or so for a month's time (ish) :) Feel free to check meta where they get posted and comment if the date/time is problematic.

Rory Alsop

cheers @Ninefingers - was good to see what gets talked about on this, sorry it's not my area of expertise though

Ninefingers

Also, if anyone wants a chat event on a specific topic, feel free. It doesn't have to be me who organises it - anyone can :)

Chat event #3 - book discussion featuring Poncho, Rory Alsop and Ninefingers

The Side Channel

Participants