Thread by @tqbf

This, as they say, is “a take”.

I don’t even know what to say.

Yes. Yessss. More.

So like, it’s maybe worth picking apart what’s going on in this thread as opposed to just having cryptography hipsters dunk on it.

I “learned” cryptography back in the 1990s from Schneier’s Applied Cryptography, and what I remember most — all I remember really — from the cipher modes chapter was “some cipher modes give you error recovery and resynchronize after errors”.

Sounds like a good thing! Like, you don’t want a single bit error in your ciphertext to totally blow up your message?

Turns out, though, no, that’s exactly what you want.

The property we’re looking for, that any error — 1 bit, 10 bits, 1000 bits — blows up decryption, “authenticated encryption”. The original bits you produced from encryption _and only those bits_ can be decrypted with the right key.

There’s a bunch of theatrical examples of why this is the case. The best known is Vaudenay’s CBC Padding Oracle, where attackers could, by inducing errors in AES-encrypted blocks, decrypt whole messages under repeated trial decryption. Broke _TONS_ of real-world systems.

More recently, and in the context of PGP, similar attacks on PGP’s CFB-mode encryption allowed remote attackers to EXFILTRATE PLAINTEXT from PGP-encrypted email (never encrypt email).

There are generalizations of these attacks (“format oracles”) and generalizations of the generalizations and the general credo among cryptography engineers seems to be “authentication and confidentiality: pick 2 or 0”.

This was explained to me 15 years ago as the difference between “cryptography 1.0” (pre-authenticated 1990s cryptography) and “cryptography 2.0” (AEAD cryptography), by a researcher at Cryptography Research.

Since my biggest complaint with PGP is that it’s built out of jealously protected 1990s cryptography by Unix gnomes who constitutionally fear change, it’s rich to see PGP defended using Schneier’s error-recovery logic from Applied Cryptography. More:

sockpuppet.org/blog/2013/07/2…

The most popular reference for “authentication or confidentiality, pick 2 or 0” is Moxie Marlinspike’s “Cryptographic Doom Principle” post: moxie.org/2011/12/13/the…

Moxie’s post is great, but if you’re looking to win a message board slapfight, the best closer is probably Rogaway (this paper is great, and extremely approachable): cs.ucdavis.edu/~rogaway/paper…

And then, if you’re looking to put cryptography hipsters in their place, the deep cut cite is Bellare and Namprempre; you don’t even really have to understand it (I mostly don’t). cseweb.ucsd.edu/~mihir/papers/…