<story><title>Cryptographic Right Answers</title><url>http://www.daemonology.net/blog/2009-06-11-cryptographic-right-answers.html</url></story><parent_chain></parent_chain><comment><author>tptacek</author><text>First, I&apos;ll quibble with some of these recommendations --- even though Colin (and Alex Ross, and probably Bruce) is more qualified to have an opinion here.&lt;p&gt;For instance, CTR+HMAC is a weird recommendation. Not because of speed (though HMAC does pessimize speed) and not because of cryptographic strength, but because it introduces another moving part in your design. Colin can deal with the junction between plaintext, ciphertext, and HMAC, because this is mostly all he thinks about. You can&apos;t.&lt;p&gt;A simpler recommendation would have been to use CCM or EAX mode. These have the advantages of being NIST standards-tracked and heavily vetted, and of providing &lt;i&gt;both&lt;/i&gt; authentication and encryption in the same construction. If your libraries are good, you get both these features just by switching the name of your block mode.&lt;p&gt;Second, I&apos;ll quibble with the content of the post: these recommendations are exactly what Nate was talking about in his Yahoo talk about how bad cryptographic guidance has gotten. Key size and hash function selection (as long as you&apos;re not using MD5) are &lt;i&gt;the least important&lt;/i&gt; design considerations you have.&lt;p&gt;Here&apos;s a design consideration this post doesn&apos;t even touch on: renewability. How do you safely design a system so that your selection of algorithms, modes, and key sizes isn&apos;t set in stone? Because if you don&apos;t get that right today, what you inevitably do to handle it 2 years from now is going to be a vulnerability.&lt;p&gt;Finally, a real concern about the structure of these recommendations: telling people to keep group negotiation out of Diffie-Hellman protocols is fine --- a good recommendation, since there&apos;s a really scary sounding, really easily-exploitable vulnerability that eliminates. But that&apos;s --- I think --- the &lt;i&gt;only place&lt;/i&gt; in this post where Colin actually addresses something that actually does go wrong in crypto protocols.&lt;p&gt;If you follow all of Colin&apos;s recommendations here from scratch in a reasonably complicated, and you have never found a crypto vulnerability or fixed two reported crypto vulnerabilities, I will bet $500 that you end up with a broken system. Colin won&apos;t. But you will.</text></comment>
<story><title>Cryptographic Right Answers</title><url>http://www.daemonology.net/blog/2009-06-11-cryptographic-right-answers.html</url></story><parent_chain></parent_chain><comment><author>cperciva</author><text>This was largely inspired by Thomas&apos;s blog post yesterday about AES vs. RC4 -- he started me thinking &quot;gee, someone really should sit down and tell people what they should be using so that they don&apos;t keep doing dumb things like using RC4&quot;.</text></comment>