Real-World Cryptography

What Hacker News says

1. tptacekMar 2025
   Cryptography Engineering definitely does not hold up. It predates (almost willfully, given the chronology) modern notions of AEAD, key derivation, random number generation, and elliptic curve asymmetric cryptography.

   The standard recommendation these days is Aumasson's Serious Cryptography. I like David Wong's Real-World Cryptography as well.

   thread
2. VegenoidAug 2024
   In AES-GCM (simplified explanation), an encrypted message takes 3 inputs: plaintext, a symmetric encryption key (generally unique per-session, as in this program), and a 12-byte nonce (a.k.a. IV).

   If an attacker intercepts 2 messages that were encrypted with the same key and the same nonce, they can reveal the authentication key used for the generation of authentication tags (auth tags), and they can then forge auth tags for any message. These auth tags are how a recipient verifies that the message was created by someone who knows the symmetric key that was used to encrypt the plaintext, and that it was not altered in transit.

   More simply, it allows an attacker to alter the ciphertext of an encrypted message, and then forge an authentication tag so that the modification of the ciphertext could not be detected. It does not reveal the symmetric key that allows decryption of the ciphertext, or encryption of arbitrary plaintext.

   If a random nonce is generated, there is a chance that it is the same as a random nonce that was generated earlier in the session. Since the nonce is 12 bytes, this chance is very small for any 2 random nonces (1 in 2^96), but the chance of a collision increases rapidly with the number of encrypted messages sent in a session (see the birthday problem). It still requires a large number of messages to be sent before the chance of a collision becomes significant: "after 2^28 encryptions the probability of a nonce collision will be around 0,2 % ... After 2^33 [encryptions] the probability will be more than 80 %"[0]

   If this program is sending 1 message per second (1 FPS), it would take 8 years for 2^28 messages to be sent. I haven't looked at the code, it may well be sending many more messages than that.

   The alternative to a random nonce is a "counter" nonce, which starts at 1 and increments with each message. The potential pitfall of counter nonces is that they can be harder to implement, as they require tracking and updating state. If the program ever fails to track or update this state correctly, nonce reuse will occur. A different counter must be used for each symmetric key (which should be randomly generated for each session).

   EXTRA CREDIT: There is also information revealed about the plaintext of the 2 messages that used the same key and nonce - specifically, the XOR of the 2 plaintexts. While this doesn't directly reveal the plaintexts, if some information about one of the plaintexts is known, that can be used to reveal information about the other plaintext.

   I learned most of this information from David Wong's Real-World Cryptography.

   [0]: https://eprint.iacr.org/2016/475.pdf, section 3.3

   Show morethread
3. VegenoidMay 2024
   I wanted to have a better understanding of crypto, simply to feel more confident in writing programs that use existing protocols, and started 'Real-World Cryptography' by David Wong. I'm about 3/4 through, and I've been happy with it. It is light on math, but does go into it a little bit - it seems designed for the kind of person who isn't comfortable using something until they understand how it works under-the-hood, but doesn't actually need to do any under-the-hood work.

   It has taught me enough that I think I could compose a protocol out of primitives that on the surface appears to do what I've intended it to do. It has also taught me that there are many subtleties that can completely break a protocol, combining primitives can lead to unexpected weaknesses, and many people who understand crypto far better than I ever will have created broken protocols out of secure primitives.

   I'm not sure it's the book you're looking for, but I think it's a good book if you want to understand crypto, but not design your own.

   Show morethread
4. helpfulclippyMay 2024
   "Serious Cryptography" is good. There's an updated edition dropping later this year.

   "Real World Cryptography" is also good.

   thread
5. tptacekMay 2024
   Pretty outdated. For awhile, it was the best book available, but in 2024 it's probably harmful.

   Today, I'd read Serious Cryptography or Real World Cryptography.

   thread
6. ilya_mMay 2024
   A better book for what audience? The scientifically minded can do much worse than "A Graduate Course in Applied Cryptography" by Dan Boneh and Victor Shoup (on which the online cryptography course is based). For a more practical angle, I agree with other commenters on this thread: "Cryptography Engineering" (Ferguson, Schneier, Kohno), "Serious Cryptography" (Aumasson) and "Real-World Cryptography" (Wong) are pretty solid.
   Show morethread