The Crypto Gardening Guide and Planting Tips

ncostigan writes "Peter Gutmann of cryptlib fame has written a very readable paper on real-world constraints for cryptographers, and points out problems that their designs will run into when attempts are made to deploy them. Also included is a motivational list of extremely uncool problems that implementors have been building ad-hoc solutions for since no formal ones exist."

Comments

Also available on...

[vpreHoose]

Cryptome

ow

[syle]

This article makes my brain hurt.

Yes but...

[MosesJones]

-----BEGIN PGP MESSAGE-----
Version: PGP 7.0.4

qANQR1DBwU4DyuYN9AlBSc8QB/4gR8MbVCSKYkdpb2j3EFap lQ cej4XiaXrUEASE
t81BHPhHLZbHV7+EmRS8rrCwyjITGQ9fwd 3sQEimvMQJEZp0cf 0yPYT1K1YltAQO
r7SeQa3S24JC1WB4cEgZpcKtxw18LSPoL8 nRapZT3/1A44nfB4 8sCUgCLIRAAKHm
oQrI/H87V2fq7RLuAWbXUVbnQ9R7sIPp+f odXj/0gdDagcO9JJ f3bRijv/ewTy2L
GLBa4YNADCh2lbXzCUxzbmJA/Ij5bIGuql yp+Oo0Qm20V4LyoL pN3GQ9OHuwLBff
3Ngbwzu5n+uh8Fw2VO2ReGSbekWJhiMWJy loI1g++jLqt+A/B/ wJ/NS/NetTdoXL
wZaxn19e3h2RHEvkwO8BVVDHkKVWdYT/79 8tAlF8kQFMUrn3xD UODo9m1Tse8i5O
VL+PjUx8fo1X6w9dYsT1/nVGkWqv1W+MMp xHmgkC0NUVSPGyxR wmjexaC6rgyroh
LZxEsAvsQdBmS1ugA0hbUZyuKxRZ4ej8dX H0bOs5Qu69yYwnqP AfuS9lY3fPQ0qR
B+e/Idqd7WKiN/SLrHRNHo76p/0NIiClkc YW1NvKdtqz+vDREr S7Puoghj2/oFNx
J3FW68e49jJHn01VvWAw3fLmWN97WQYLWf sSrh96KwCLiYNdin HPcxwhmnUPeu1W
r1cK33rqyTued/PJyfvKwGd2WyInyCZdzp 1N+95GlUAkJ5ZR2h m350lRoNwdEFPg
OX1a8Rxru+pwG3gqrhRrEMcLGQ==
=c9i 6
-----END PGP MESSAGE-----

Makes sense I think, don't you ?

I laughed, I cried!

[Ratface]

Well - actually, I only laughed - over this passage

(Note: If you're in the media or telecoms industry this becomes "Get there
first with something patented, proprietary, and broken, then send lawyers
after anyone who points out problems", but this is a special case).

Heh! What a wag!

Re:Why do I find that so funny?

[Llanfairpwllgwyngyll]

If you're reading about crypto, and you have not heard of Peter Gutmann, then you are either just *starting* to read about crypto, or you have missed out some of the most important *practical* parts of your reading!

Check also the X509 Style Guide. Outstanding and insightful. Trust no one claiming to know about PKI unless they have read and understood this :-)

But...

[Anonymous Coward]

The paper is encrypted with a 64 bit key which you are responsible for cracking if you wish to read it.

The Real Question

[The Subliminal Kid]

The problem I face every day has bugger all to do with the vague under the hood stuff that I see everyday about the inside or crypto engines but the problem of getting my clients to understand that the extra clicks when they send an email, the remebering a pass phrase, and the extra clicks to read incoming email is not only advisable but absolutly necessary. everyday I see lawyers send priviliged material over the internet and getting them to see both that it is going on a electronic post card and there is a solution is a task that has proved beyond me.

Suggestions from the floor?

Re:The Real Question

[Anonymous Coward]

Read all of the flirtatious mail they send each other. Send the originator a summary of the juiciest bits, and add the text

"If you would like to stop me reading your mail like this, give me a ring and I'll tell you how. If I find anything good in next month, I'll print it out and pin it up on everyone's messageboard. Give Janice a kiss from me, sugarplum."

Re:The Real Question

[plcurechax]

You are right, the human factor is often ignored in building secure systems, though Schneier's Secrets and Lies and Anderson's Security Engineering (Chapter 3 I believe) deals with building entire systems that are secure including making them usable to the human users.

Re:The Real Question

[plcurechax]

What I'd advocate, and I'm sure that privacy nuts and other security wonks would hate, would be government-issued smart cards that contain a user's private key.

Security wonks hate it because it is insecure. It links the security of everything you authenicate to, from your parking permit, or restaraut reservation, to your root password to the corporate servers you maintain, to your personal financial details. So if the bus boy at the restaraut gets your details, clones them onto a forged card, and saves a "snapshot" of your biometric details, that bus boy can get your SSN, credit report, and likely get credit cards in your name as well as commit government mandated identity theft.

That sounds like a stupid idea. Bypassing the Chinese Wall of everyday life, is a dumb idea. A single id card is as stupid as Microsoft's universial id system formally known as Passport.

... key management systems are either proprietary or too complex for ordinary users, or just involve too many steps ...

You are right, it is too complex, hard to use, and security engineers need to work on building better systems, and customers need to demand and pay for better systems.

Or you'll have an Oracle/Microsoft/US Government national id card secured by MS Windows, and Oracle's nearly unbreakable database.

Re:The Real Question

[Daniel_Staal]

1. Get two of them together. Have one send an email to the other. (i.e. The Legal Document)
2. Log into the mailserver. Modify the message in the mailqueue.
3. Have the other retrieve the email. Point out that they cannot tell that the message was modified.
4. Point out legal consiquences of agreeing to The Legal Document that has been modified.
5. Offer to show them how to make sure that doesn't happen.

Re:The Real Question

[lenski]

Having only *one* token/object/system for all of a person's access means that only one thing needs to be hacked to gain access to that person's stuff: Not Good.

Having only *one* token/object/system for all of a person's access means that the person cannot (easily) grant a subset of their secured "capabilities" to another person (think "power of attorney" as a similar concept).

Finally, I would want the issuer of such a token/object/system to be a Disinterested Third Party. No single organization can be disinterested for long, they would become the target of all sorts of human-hacks: Payoffs, "standard hacking", etc. And worst of all, the government is not under any circumstances a disinterested third party! "The government" is not a monolith, "it" consists of lots of departments/divisions/people, many of whom love power.

In entirely too many situations, some entity would claim "legal right" to use their information/influence, sometimes for "good", sometimes for a rather narrower or shortsighted "good", as defined by them, not me. It is those people that I worry about. (Too tinfoil-hat? Maybe. But I know lots of people who cannot see past the ends of their noses, and some of them are in government. It's not so much paranoia as it is a recognition that pelple can be real assholes, and I have already given them too much influence over my life already!)

Re:The Real Question

[angst_ridden_hipster]

Three cards for police choppers in the sky
Seven for politicians in their halls of stone
Nine for Justices doomed to lie
One for the President on his dark throne
In the Land of DC where the lobbyists vie.
One card to rule them all, one card to find them,
one card to track IP, and in a lawsuit bind them...

why isn't an implementation standard?

[PissedOffGuy]

the article says:

Crypto designs are often described as mathematical abstractions that, while easy to work with mathematically, require a significant amount of work to translate into an actual implementation.

i'm surprised by this, why can't the crypto whizzes put together a few lines of math.h and networking code to be a proof of concept? crypto is very much an applied field, so the theorists should include example source in their papers.

Re:why isn't an implementation standard?

[chialea]

>crypto is very much an applied field, so the theorists should include example source in their papers.

Er.. security is an applied field. Crypto is applied non-applied mathematics, basically. I don't /do/ code, generally, and very rarely C or C++, which you seem to be implying should be used. The people who are interested in one are not always interested in the other. Coming from the math side of it, I'm sometimes tempted to say "learn some math and read the proofs before you implement". Not always practical, sure, but just as valid as expecting me to know about networking this'n'that.

There's also not generally room in a paper for source. Rigorous proofs and definitions can take up a LOT of room. (Everyone who's read the 5x page HILL paper, or one of Dan Boneh's 3x page papers, raise your hand if you want to see source at the end of it.)

Lea

Re:why isn't an implementation standard?

[dracken]

i'm surprised by this, why can't the crypto whizzes put together a few lines of math.h and networking code to be a proof of concept? crypto is very much an applied field, so the theorists should include example source in their papers.

Well, There is nothing to be surprised about. Many theoretically secure encryption schemes have been broken in practice because the implementation is very difficult. One common pitfall: in theory, often, we assume the existance of a perfect source of random bits. Practically it is very very very difficult to ensure this (remember that part from cryptonomicon - where the encryption is broken because the keys were not perfectly random and there was a slight statistical anomaly ?).

Also in theory, some schemes are secure only if the keys have some mathematical property. In practice, someone who does not understand this subtle point might make a horrendous implementation. (I dont want to go into the gory details about the field from which the keys should be chosen in the diffie-hellman scheme).

Even with a perfect implementation, the user is also a very weak link in the chain.There is this famous incident of the more secure german naval enigma getting broken because some ship tranmitted using the new enigma scheme and the same message using the old enigma scheme (which was already broken).

Re:why isn't an implementation standard?

[plcurechax]

why can't the crypto whizzes put together a few lines of math.h and networking code to be a proof of concept?

Nearly all cryptographers do write reference implementations of their cryptographic algorithms. Rivest (RSA, MD4, MD5?, RC4, RC5, many more), Schneier (Blowfish, Twofish), Daemen (AES), Rijmen (AES), and many others write their own code AFAIK.

The issue that Peter Gutmann is focusing on (cryptographic) security protocols and systems, not cryptographic primitives like encrypting, signing which can be insecure when used incorrectly. E.g. A working RSA implmentation can be written in about 100 lines of C and a multi-percision interger library like GMP or MPI. The problem is that unless you do message padding following a scheme like OEAP your security is not as strong as expected / advertised.

crypto is very much an applied field, so the theorists should include example source in their papers.

Cryptography / cryptology falls into a relation with number theory and abstract algebra and computation computer science. Security Engineering is the practice of building secure systems including using cryptographic algorithms and protocols.

Re:why isn't an implementation standard?

[Bishop]

the theorists should include example source in their papers

There is no need. In the mathematical world the paper is the "proof of concept." The problems hinted at in the paper go far beyond source code. It is implementation problems such as algorithms requireing a trusted channel for the initial key exchange, and tying a public key to a real person. Other problems are processor issues. Algorithms that are only practical with non existant processors such are requireing 512bit registers, or unrealistic numbers of registers. Source code would not solve these types of issues as math lib can use arbitrary persision. If the source code is slow it will be explained as "it is only sample code." Finally Cryptologists are theoritical mathematicians, not computer scientists. Many modern crypto designs require a real Computer Scientist to implement, not a passing knowledge of C. This is probably the way it should be. Let the cryptologist concentrate on what they are good at.

Re:Very readable..

[xmath]

Message Authentication Code
Hashed Message Authentication Code
Pseudo Random Function
Initialization Vector

Re:Glossary

[Sheridan]

But that would require more than one pass over the data to process ;-)

security thru obscurity, anyone?

[djupedal]

Hey! Aren't you Peter G., that famous cryptlib guy???

uh...no, sorry, you have me mixed up with some other cryto guy. My name is, uh, Chuck...Chuck Laylow. I don't know squat about anything dealing with secrets, really...now, please go away before someone sees you talking to me, and don't tell anyone you talked to me...ever...thanks.

What about the other side?

[WPIDalamar]

I'm no crypto expert, and many of those suggestions make perfect sense. But I wonder if some of those suggestions decrease the strength of encryption? Perhaps there should be a paper that tells hardware makers how to create hardware to support some of these features that the cryptogaphers want. Or better yet, if the cryptographers could do whatever they want, but then somehoe make multiple versions of their algorithms that follow various subsets of these rules. Then list the drawbacks to using each one. Of course, this would probably create way too much work for those guys.

Re:What about the other side?

[chialea]

>But I wonder if some of those suggestions decrease the strength of encryption?

Most modern cryptography is based on a variety of problems which are believed -- NOT known -- to be hard in certain contexts. Factoring, RSA, CDH, DDH, bilinear maps over CDH/DDH gap groups, braid factoring, CVP, etc. There are people who believe that factoring (and thus RSA) may be poly-time solvable, and thus cryptosystems based on it may be insecure. Cryptosystems based on different hard problems are important for that reason. It's a hedge bet.

There are also interesting things which come "for free" with certain types of hard problems, which may be very expensive to add on to more common cryptosystems. These properties, for example committment, are used in protocols like Deniable Ring Authentication. This sort of thing follows your suggestion of "a variety of rules", but it's really not possible to list every single cryptosystem in existance and how well it fits in. The authors simply say "(E,D) is a cryptosystem with the following properties", and leave anyone who wants to use it to find the best such cryptosystem, as it may change over time. (They usually do provide a trivial example or a reference, though)

Of course, if one-way functions don't exist, we'll all be back to information-theoretically secure stuff, and some of these problems will go away :P

Lea

for beginners i totally recommend this:

[colonel.sys]

bruce schneier: secrets and lies - digital security in a networked world

(http://www.amazon.com/exec/obidos/tg/detail/-/0 47 1253111/qid=1044455851/sr=8-2/ref=sr_8_2/102-63475 44-3715317?v=glance&s=books&n=507846)

excellent book on crypto and security basics. also contains basic concepts of avoiding general security issues.

nico

Top 5 reasons to use cryptography

[Amsterdam Vallon]

5 -- At least your mom will think you're 1337

4 -- You need a BFS (Big Fucking pgp Sig) for all those blogs you waste your time on

3 -- To avoid letting the FBI know that Dear Matt, I you thought the last comp sci lab was hard and will probably just wait until Punjab Moltisontorilho hands his in and then we can steal his answers From Peter

2 -- Its geek factor will offset the fact that you still run Windows 95
... and the number 1 reason to use cryptography

1 -- Get that "terrorist feel" without all the violence

Copyright Eric Krout, Editor of *nix.org

False advertising!

[Greedo]

Damn ... I read the title and I thought "Whoa, someone has come up with a way to hide secret messages in their garden."

Kinda like steganography, but with flowers.

Now *that* would be news for nerds.

Follow the money

[c64cryptoboy]

Gutmann writes "cryptographers don't work on things that implementors need because it's not cool, and implementors don't use what cryptographers design because it's not useful or sufficiently aligned with real-world considerations to be practical."

Last decade's crypto research tends not to be used, not because the research is not applicable or practical to the company/government/end user, but because it doesn't fit well into any cryptography business model. Threshold cryptography schemes (key splitting), zero knowledge proofs, identity based encryption, etc. are very useful, but it is difficult to make $$$ developing any of these. And if it made $$$, cryptographers would work on it, even if "it's not cool".

Re:One of the problems with crypto

[Steve Hamlin]

Is that the data is only as secure as the OS it is on - at some point, the OS' protections become the only thing protecting the data from being decrypted.

Data encrypted with secure methods does NOT depend on the underlying OS. Why encrypt anything, if you can just crack the OS?

Oh, wait, I forgot that encrypted data gets sent plain through emails, and is posted publically, and is used on public, non-secure systems. Doesn't dnet post the encrypted message, and offer rewards for cracking?

It doesn't matter is you crack the OS because properly secured data is not dependent on anything else.

This means that running it on anything but Linux is a bad idea, b/c you cannot read the source...

You realize Linux is just a kernel, right?

And not the only one?

(I realize I've probably been trolled, but...)

Political problems just as complex

[Anonymous Coward]

I was hoping the paper would touch on some of the political problems facing cryptography, such as how amateur cryptographers in the U.S. should go about posting code for review and humiliation without the black vans pulling up outside.

The technical environment seems considerably less fuzzy to me than the political and regulatory environment. I have a hard time believing that amateur crypto development within the U.S. is virtually nonexistent, but if you go surfing for code and software, that seems to be the case. Do all amateur crypto people in the U.S. have to send emails off to crypt@bis.doc.gov and enc@ncsc.mil before they can talk to anyone?

Cryptography is a unique area of computing in that free speech rights don't fully apply. I'd love to be able to post my SHA-based symmetric encryption algorithm and app that even grandmoms can use to sci.crypt and ask many people much smarter than I how much of an idiot I am, but I don't know how to do that without jumping through a byzantine array of frightening federal hoops.

Re:One of the problems with crypto

[Anonymous Coward]

You are missing something. You are assuming that it is possible for you to even get to "properly secured data" on a cracked OS.

If the OS has been compromised, how do you know that every call that your application makes into the crypto library isn't intercepted? You statically link? How do you guarantee that the loader didn't patch your own internal calls? Too difficult to be practical, you say? Isn't that sort of thing exactly what keeps some viruses going?

The only situation where a compromised OS doesn't matter is when that machine is being used to temporarily store or pass encrypted data. You cannot safely encrypt or decrypt anything on a compromised OS.