The Side Channel

12:38 AM

On the note of blatant falsehoods being taught: I see signatures being explained as "encrypt with the private key to sign and decrypt with the public key to verify" very frequently. Even in places that I would have expected them to know better.

forest

12:53 AM

@EllaRose I feel ya. Big thread on Sec.SE where everyone was saying that.

28

A: What does "signing" a file really mean?

Unfortunately, the answers here which claim that signing is equivalent to encryption of the message digest are not entirely correct. Signing does not involve encrypting a digest of the message. While it is correct that a cryptographic operation is applied on a digest of the message created by a c...

Maeher

@EllaRose There are a number of textbook teaching that. It's quite sad really.

forest

My answer to the question.

Thankfully I bitched long enough to get the accepted answer improved... a little.

-1 This is completely incorrect. Signing a hash is not the same as encrypting a hash. — forest Nov 27 at 0:28

Like look at this shit. This should not be a controversial comment!

@EllaRose I think people get confused because both signing and encryption (for RSA at least) involve modular exponentiation, i.e. a^b mod c.

But they forget that where the exponent comes from matters.

And they forget that padding is important.

PSS vs OAEP etc

Maeher

@forest The issue already starts with teaching that RSA by itself is an encryption scheme. It's not. It's merely a trapdoor-permutation.

2

forest

^^^

Exactly.

It's no more an encryption scheme than a lone PRP is a symmetric block cipher.

Maeher

@forest Tell that to the person who thought it was a good idea to call a PRP a "block cipher" and a PRG a "stream cipher".

forest

1:01 AM

Who said that? O_o

Maeher

Well that's what they are

forest

But they aren't on their own.

Maeher

block cipher is just a name people in practice use for a PRP

forest

But on its own it would be woefully insecure (ECB mode, etc).

Maeher

of course

which is why the "Advanced Encryption Standard" is horribly named.

forest

1:03 AM

Well to be fair, that's bureaucracy.

Maeher

Yes but I know for a fact that NIST has enough people who should have known better when choosing the name... at least they do now, AES standardization was a few years before my time.

forest

They wanted a name similar to DES, which was even older.

Maeher

but whatever, it's late and I need to stop ranting and go to bed

forest

I honestly think the name is fine, since it was standardized for encryption, even if it's naturally just a single block cipher on its own. It's useful to call it AES because it's a standard when e.g. government agencies need to choose a cipher.

Easier to say "Well this block cipher is permitted to protect info up to top secret".

Ella Rose

1:39 AM

The abbreviation for "Advanced Block Cipher Standard" (ABCS) sounds like it would be pronounced "Abscess", which would not be very appealing!

Alternatively, that could be read like "ABC's" (e.g. the alphabet), which doesn't sound like anything advanced and technical

@forest I did see that Q/A when it was happening, and just rage-quit instead of joining the fray

The "encrypt with the private key" mantra completely ignores that many public-key scheme do not offer any way to encrypt anything with either the public or private key

3

e.g. most discrete log based signatures

the "encrypt with the private key" thing only happens to be tangentially close to the truth in the case of RSA, and there are way, way more public-key cryptosystems than just RSA

forest

^

Future Security

2:06 AM

Beat you by 5 seconds @forest

Oh. I forgot what the actual question was. I thought it was asking about block cipher modes but the actual question is a huge mess.

Wait. I think that is the question he asked. By "OTP would be its key" I think he means that every bit of key material is statistically independent and each bit of key material is used to encrypt only one block.

@forest @Maeher I'm still a little angry that they didn't rename the PHC winner to "PBKDF3".

It would take a lot less work to convince people to upgrade.

That initialism and generic-ness makes it sound more official. I don't like that a lot of people think PBKDF2 is better than bcrypt, argon, scrypt.

forest

2:24 AM

@FutureSecurity Yeah the question is a mess. I took the liberty to answer for any cipher and not limit it to block cipher modes, since I have a feeling OP doesn't know that modes are not used to do this.

I took "OTP" to mean keystream in the context.

Since if you don't know that an OTP requires information theoretic randomness, you could easily conclude that a keystream is just one big pad.

Future Security

I think that's really common. People believe they've discovered something big before they even learn what a stream cipher is. Things like "deterministically generated OTP". Even worse when they say "Mersenne Twister generated pad".

forest

heh

forest

2:45 AM

RC2

In cryptography, RC2 (also known as ARC2) is a symmetric-key block cipher designed by Ron Rivest in 1987. "RC" stands for "Ron's Code" or "Rivest Cipher"; other ciphers designed by Rivest include RC4, RC5, and RC6. The development of RC2 was sponsored by Lotus, who were seeking a custom cipher that, after evaluation by the NSA, could be exported as part of their Lotus Notes software. The NSA suggested a couple of changes, which Rivest incorporated. After further negotiations, the cipher was approved for export in 1989. Along with RC4, RC2 with a 40-bit key size was treated favourably under US...

> Its 18 rounds are arranged as a source-heavy unbalanced Feistel network

What is a "source-heavy" unbalanced Feistel network?

I know what an unbalanced Feistel network is.

forest

3:11 AM

> One round of a s-on-t, or s:t, UFN is:

X_{i+1} = (F(msb_s(X_i),k_i) ⊕ lsb_t(X_i)) || msb_s(X_i).

The msb_s(X_i) is called the source block. The lsb_t(X_i) is called the target block. UFNs where s > t are called source heavy, and UFNs where s < t are called target heavy.

Found that in schneier.com/academic/paperfiles/paper-unbalanced-feistel.pdf

Future Security

5:10 AM

Never heard the term "source heavy" before. I'm guessing that it refers to the ratio between the number of bits on each side. A 1:1 ratio would be balanced. The source and destination both have the same 'weight'.

Oh. Didn't read the math. That's exactly it.

Future Security

5:31 AM

Does a target heavy cipher even make sense? Like 127 source bits and 1 target bit seems way better than 1 source bit and 127 target bits.

Maeher

10:05 AM

@EllaRose But the (misleading) descriptive names are terrible anyway. At some point they may want to standardize a new PRP, what's it going to be Even More Advanced Encryption Standard?

forest

EES: Epic Encryption Standard

Maeher

For hashes they at least chose a generic name and numbered them. But putting "secure" in the name is also stupid as the fate of SHA-1 shows.

forest

Well it was intended to be secure.

Maeher

It's very unfortunate when the "Secure Hash Algorithm" is insecure.

forest

I've always taken the naming of the SHS to differentiate it from, say, Fletcher128.

Transcript for