安全与密码学2019eprint.iacr.org
过多的加密
Too Much Crypto
进阶 · 约 90 分钟读完前置知识：对称密码学基础、分组密码轮函数、密码分析基础
导读
这篇论文《Too Much Crypto》质疑主流密码算法（AES、ChaCha、SHA-3 等）的轮数是否设置得过多。作者认为这些算法的轮数远超实际安全所需，并给出了减少轮数的具体建议（如 AES-256 从 14 轮减到 11 轮、ChaCha 从 20 轮减到 8 轮），以换取更好的性能。
HN 关注点：密码算法安全余量与性能之间的权衡：减少轮数是否安全，还是应该坚持'攻击总会变强'的保守原则。
HN 评论精选
这几条评论里：支持 1 质疑 2 补充 1
质疑反对论文观点：密码算法应保留大安全余量，因为算法可能被秘密攻破且替换周期漫长
我读了论文，但总体不买账。大多数场景下我们需要足够的安全余量，论文中'攻击总会变强'一节淡化了严重问题。首先，认为算法在人类消失前都不会被攻破是极端的傲慢——历史上被攻破的算法很多，且现有算法并无不可攻破的数学证明。其次，算法一旦被攻破，用户可能几十年后才被告知，许多国家会投入大量资源攻击并利用这些优势。最后，如果 AES 这类核心算法被攻破，替换它可能需要十年以上，而软件系统升级往往很难。唯一已知的解法就是留足余量——物理工程中工程师都留有显著余量，而密码学缺乏证明不可攻破的模型、失败影响又大，更应留更大的余量。
dwheeler查看英文原文
I read it, I don't buy it in general. In most use cases we need serious safety margins. Their "attacks always get better" section downplays serious issues. First, it seems extreme hubris to think that something can't ever be broken before the human race disappears. There are plenty of algorithms that have been broken over the years, and there is no mathematical proof that the current set are unbreakable. Sure, the algorithms they listed aren't broken yet, but that's a carefully crafted list. In any case, "not broken yet" is a far cry from "unbreakable". Another problem is that if a crypto algorithm is broken, there's a significant risk that the users of the algorithm will not be informed until possibly decades later. Many countries dedicate serious resources to attack, and would want to exploit those advantages if they could find them. Finally, if a major algorithm (e.g., AES) was broken, it would take many years (probably more than 10) to replace it. The reality is that software systems are often hard to upgrade. Yes, that's a problem, but ignoring reality doesn't make it go away. The only solution we know of is to have large margins. In the physical engineering world, where we have far better understanding (due to physical models), smart engineers include significant margins when designing things. In the crypto area, where we do not have good models showing that something cannot be broken and the impact of failure is large, it is wise to have much bigger margins. I agree that sometimes cryptographers incorrectly ignore other attacks. And no matter what, impractical attacks are - by definition - impractical. But I think it's wise to assume that attacks will get better, and we cannot reasonably predict how much better they'll get over the years. Past performance is no guarantee of future results. Margins also increase the likelihood of a break being partial, giving people time to switch to another algorithm. In special cases, maybe the margin doesn't need to be so big. But nobody likes dealing with special cases.
质疑用比特币挖矿数据反驳作者对攻击成本高估的例子，并指出零和区分器攻击并非无用
论文称即使出现 2^100 的 AES-128 攻击，用 100 亿个 10GHz 核心每周期试一个密钥，达到百万分之一成功率也平均需要一万两千年的计算。但根据我电脑上的比特币节点，比特币挖矿至今已执行了约 2^92.4 次 SHA-2 压缩函数运算——正是这种可大规模并行、无内存需求的任务，作者所说的'显然安全'的攻击强度已被比特币挖矿超出数千倍。另外作者调侃'零和区分器'是最牵强无意义的攻击，我认为他夸大了其无用性：找到使哈希输出之和为零的输入集合，可直接转化为对使用这些哈希的密码系统的攻击，尤其是可能导致门限签名和盲签名协议被完全攻破。
nullc查看英文原文
> Suppose that against all expectations, someone finds a 2^100 attack on AES-128 that is embarrassingly parallel and uses no additional memory. Say you have 10 billion cores, each running at 10 GHz, trying one key per cycle, and you’re aiming for a one-in-a-million success rate: it’d still take you on average more than twelve thousand years of computation to do the ≈ 2^80 required According to the Bitcoin node on my computer, there have been ≈ 2^92.4 executions of the sha-2 compression function used for Bitcoin so far, exactly the sort of embarrassingly parallel memory-less task that the author speculates about. So the author's example of a obviously secure attack resistance level has already been exceeded just by bitcoin mining by a factor of thousands. > For example, “zero-sum distinguishers” [4],arguably the most contrived and meaningless type of attack ever, are about finding a set of input values whose output values sum to zero. I realize that the author is making fun of his own prior work, but I think he exaggerates the uselessness of such an attack. Finding a set of inputs to a hash function such that the hashes sum to zero (or other specific values) can be directly turned into attacks on cryptographic systems that use those hashes. In particular, attacks like that can lead to total breaks in things like threshold signature protocols and blind signing. When cryptographic primitives have surprising structured properties there often seems to be a greater fool hiding right around the corner waiting to build a system that almost magically is broken by the structured property. :)
补充整理论文的具体轮数建议，并引用 DJB 对 ChaCha8 的相关表态
论文建议的轮数（§5.3）：AES-256 从 14 轮减到 11 轮；Blake2b 从 12 轮减到 8 轮；ChaCha 从 20 轮减到 8 轮；SHA-3 (Keccak) 从 24 轮减到 10 轮。我不是密码学家，只是偶尔接触密码算法的工程师，无法评价这些具体建议。关于 ChaCha8，可参考 DJB 2018 年的这条推文。
loeg查看英文原文
Their proposed number of rounds is: AES: 11 instead of 14 for AES-256; Blake2: 8 instead of 12 for Blake2b (IIRC, Blake's rounds are derived from Chacha); Chacha: 8 rounds instead of 20. SHA-3: 10 rounds instead of 24 (Keccak). (§5.3, "How many rounds?") I'm not any kind of cryptographer, just an engineer who sometimes interacts with cryptographic algorithms, so I cannot comment on the specific recommendations. On Chacha8 vs 20, see this tweet from DJB (2018): https://twitter.com/hashbreaker/status/1023969586696388613
支持以 Skipjack 为例说明'刚好够用的轮数'确实能抵御攻击
已过时的 NSA Skipjack 算法是'轮数刚好够用'的典型：它有 32 轮，1998 年解密后几个月内，针对 31 轮版本的攻击就发表了。但至今仍没有针对完整 32 轮 Skipjack 的攻击。
RcouF1uZ4gsC查看英文原文
The obsolete NSA Skipjack algorithm was the epitome of having just enough rounds. It has 32 rounds. It was declassified in 1998 and within months, attacks on 31 of 32 rounds were published. However, there are still no attacks against 32 round Skipjack. https://en.m.wikipedia.org/wiki/Skipjack_(cipher)
历次讨论
- 2019Hacker News 讨论帖182 分 · 98 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选