The Joy of Cryptography

by signa11 • 5 years ago

431 99 5 years ago

Mike was my cryptography professor and an advisor on an independent cryptography course I took a an undergraduate at OSU. We used an early copy of this book and it was wonderful. This is a great, free, resource for anybody interested in crypto maths.

1cvmask• 5 years ago

This is the coolest way I have seen someone write their email and avoid email harvesting bots:

For inquiries related to this book, use x@joyofcryptography.com, where x is the author's first name.

Nearly everyone with a high school education can “crack” that puzzle and figure out his email and yet most bots will fail.

stevenjgarner• 5 years ago

RFC 5321 requires compliant domains to have both a "postmaster" and an "abuse" email address (e.g. postmaster@joyofcryptography.com). This technique will not stop a flood of spam emails to x@joyofcryptography.com, which will end up in the postmaster inbox.

quesera• 5 years ago

Not sure what you mean.

Mail to the literal 'x@joyofcryptography.com' address would just be dropped. There's no expectation that mail to a nonexistent address would be placed in the postmaster mailbox.

slig3• 5 years ago

I prefer cmlja2FzdGxleQ== at example.com, for instance, if the target audience is tech literate.

MobiusHorizons• 5 years ago

lol, nice one.

a-dub• 5 years ago

i'd guess that bots these days harvest domain names and then human names associated with them and then spam tools try common schemes for constructing email addresses. don't know for sure though.

i always thought the hotness would be to encrypt the address in source text and render/decrypt it client side in javascript, but i suppose scrapers these days use full blown headless browsers complete with javascript runtimes.

clint• 5 years ago

Its a very old technique from the 90s actually!

max_• 5 years ago

This is exactly the kind of book on cryptography I need. The book uses math & pseudocode to describe algorithms instead of using popular languages like Python or C/C++.

This makes it language agnostic. Code can be very opinionated in my opinion.

davidmurdoch• 5 years ago

I don't know mathematic notation well at all, but can easily reason about most code.

eru2• 5 years ago

They are different notations for different purposes. With some overlap.

In some sense, programming languages are a mathematical notation, too.

randombits0• 5 years ago

I got that same impression from “Applied Cryptography” (Schneier). But Bruce isn’t exactly giving it away! :)

le-mark• 5 years ago

All the sensible textbook titles were already taken. Actual joy not guaranteed.

Like a lot of people (I imagine) I made it through a CS bachelors program not really ‘getting’ the discrete math combinatorics part. Crypto is an area where those concepts really really matter. It’s great to see this resource available!

hackcasual• 5 years ago

I learned so much math when I looked into RLWE based lattice crypto. Some times it just takes a distinct use case to have something click

k__2• 5 years ago

Somehow discrete math was the only math I understood in CS. Calculus, on the other hand, completely eluded me.

copperx• 5 years ago

How did you graduate with a CS degree?

__MatrixMan__8• 5 years ago

If the whole of math were represented by the surface of the planet, "discrete math" would be more than half of it. Calculus (i.e. differentiation/integration on the reals) on the other hand, would be a city. Perhaps a very populated city, but just one.

It's a shame that match curriculum for non-math-majors is an all-roads-lead-to-calculus affair. I think we scare a lot of potentially talented people away from math with that approach.

christophilus• 5 years ago

For what it’s worth, I had the damndest time with Calculus until I got a good professor. When he explained it, everything clicked. A good teacher makes a massive difference. It might be worth giving it another go.

nabeelms• 5 years ago

My book recommendation for learning calculus would be Calculus Basic Concepts For High School by Tarasov.

anjanb• 5 years ago

Is there a good text book/resource to (re) learn 'discrete math combinatorics' ?

Moodles• 5 years ago

Looks like an excellent book. Would the author prefer the solutions to the exercises not be public? Or would it be welcome for someone to publish them? If the latter, I would quite happily work on it.

slig3• 5 years ago

Related question: when using Block Cipher Mode, how does Alice and Bob exchange the IV?

mcpherrinm• 5 years ago

It depends on the protocol and mode, but it’s usually transmitted in the clear along with the encrypted message.

slig3• 5 years ago

Thanks! I thought it had to be somehow not transmitted in the clear.

not-elite• 5 years ago

Signal message keys seem to include an IV. [1] Message keys are generated by passing a chain key through a key derivation function. [2] So you can also expand a shared secret established through Diffie-Hellman.

Someone please correct me if I'm wrong.

[1] https://github.com/signalapp/libsignal-protocol-java/blob/ma...

[2] https://signal.org/docs/specifications/doubleratchet/Set0_1....

tptacek6• 5 years ago

The IV (or the nonce, in an AEAD) is usually public, but authenticated; often just appended to the message; with CBC mode, you'd normally prefix the message with the IV, and include the IV in your HMAC.

Terry_Roll4• 5 years ago

I've often thought the use of prime numbers to be the weakness in cryptography. Whilst theory is different in practice due to machine limitations, there are only so many prime numbers a machine can present in a limited timespan restricting the range of primes available to use. With this in mind, and then knowing what a webserver will typically use by simply browsing the website with different encryption algo's disabled in the browser if its not possible to work out the underlying webserver software and version from a variety of methods like a simple 404 message, decoding the URL or using DPI, further limits the encryption algorithms to spend time reversing when using the replay attack method making it somewhat more targeted. Its still a sort of brute force but a more targeted brute force.

So should I see primes as a weakness in cryptography?

bdamm4• 5 years ago

No.

First of all, primes are only used to arrive at a session key, and once you have a session key you're in the land of symmetric algorithms, which provide security by permutations rather than vectoring into prime spaces. The content of a web page does not matter at all in terms of the security being provided. A 404 is just as secure as a valid home page, in terms of cryptography. (Not in terms of application security, but that's a whole different thing.)

Second, the supply of prime numbers is countable but also infinite, and the relation between a number space and the number of primes within it is well established within the workable sizes. We have upper and lower bounds on the number of primes within certain ranges. This is partly why we end up with certain key sizes as being secure and other key sizes as being insufficient. Secure key sizes (in asymmetric algorithms) partly are secure because there are so many primes that can be fodder for key generation.

schoen• 5 years ago

Well said.

A fun way to improve one's intuition for the huge space of primes in the regions that are used in cryptography is to run something like

openssl prime -generate -bits 1024

(This would give you one of two secret parameters for a 2048-bit RSA modulus.)

Here is an example output:

171512683213144641422165911053946068613736141364433791764418217818329805042681574174826781297743340609766353737741548521280185783254625590756752560896455821248403501924867464886010664489035275551178636464876794754383911750620888923620343965444339734253757757361106691647372710935609902417522529107877592063581

Not very easy to guess just because the space in question is limited to "1024-bit primes"!

And indeed, that's part of why we use primes that are this big when we still use RSA. They're big enough that the number of possibilities makes them not easy to guess (even given the extra hint of "the secret number you're looking for is one of the factors of this 2048-bit semiprime").

Exponentials are always hard for human intuition. We start with some kind of pattern and it feels like there just aren't that many numbers that would satisfy it. But when you get out to large numbers (even numbers as large as the one above), there just are that many numbers that would satisfy the pattern!

Terry_Roll4• 5 years ago

So in a replay attack all the communication is recorded including the session keys, and whilst primes are infinite dont dispute this, where the theory (human) and the practical (cpu's) differs is the limitations in the machine hardware, in much the same way Spectre and Meltdown exploited the hardware to obtain secrets.

The point about the webserver was using methods to work out what the underlying webserver and version was and potentially the OS, after all not much point trying to decrypt an algo that is not used on the webserver, but metadata is given out by many webservers to suggest what type of webserver it is.

And then there is education, we see people believe many things because this is what's taught to them, we see this cognitive dissonance with religious people but also in "educated" people like some GP's or academics because its their life's work and I'm sure cryptography has consumed many hours of people thinking things through, without much time spent on other areas of weakness like the limitations of a cpu and memory registers.

After all how many crypto experts are fully conversant with the inner workings of a CPU design? If they were conversant with CPU designs would Spectre and Meltdown have been found years earlier?

Admittedly side channel attacks but I did say in my original post "Whilst theory is different in practice due to machine limitations" and this is the thing is the current implementation of cryptography on devices suitable when considering the design of CPU's and devices?

CasperDern• 5 years ago

Not an expert, but I don't think it's necessarily a weakness in the current applications of cryptography. In something like RSA a typical key is >=1024 bits, which is 1.7e308 possible number so even though primes are more "limited" the actual reduction in security (if non-primes could have been used by magic) the primes that are left are still plentiful. One reason RSA is not really used anymore is because other algorithms such as elliptic curve cryptography provides much better efficiency (partially due to it not requiring primes keys). So it's less efficient than more modern technologies, but not necessarily weaker.

garmaine6• 5 years ago

Almost no cryptography being deployed today uses prime numbers.

(Not because of any weakness, but because there are better, more efficient algorithms instead.)

marcan_426• 5 years ago

RSA is still in wide use in both old and new deployments (e.g. it is still the majority of TLS handshakes).

Elliptic curves are faster and use smaller keys, but they're also a more fragmented ecosystem; plus, in particular for the older NIST curves, there is the unshakable fear that they're backdoored by the NSA (since they use magic unexplainable numbers, which RSA does not).

Thankfully ed25519 gave us an alternative free of magic numbers, and it's seeing a lot of adoption (in particular in open source software), but it's nowhere near taking over RSA.

jounus• 5 years ago

I read this book as an introduction to cryptography. Very well written. More understandable and easier to follow than any other texts I've read on cryptography.

ianpurton• 5 years ago

Is this using a LateX template of some sort?

Or more specifically how could I create a book with formatting that looks as nice as this.

BossingAround• 5 years ago

This looks excellent. I tried to go through the Introduction to Cryptography by Christof Paar [1] and that material was not really suitable for me, personally. I found it too dense, and written in not very interesting manner.

Thank you for posting this book, I'll give it a go! Crypto is one of those things I have on my shameful "how-come-you-don't-know-it-yet" to-learn list :).

[1] https://www.youtube.com/channel/UC1usFRN4LCMcfIV7UjHNuQg

cleemens• 5 years ago

Really? The book might not be suitable to read it from cover to cover in bed, but still approachable. The videos are also really nice and easy going (I took the lecture at his uni, nice foundation).

Compared to this book you seem right, the glimps I had was easily digestable and still concise.

tuxie_• 5 years ago

Is it available in a format other than PDF? Like HTML or MOBI for example? PDF is very inconvenient to read on small screens like phones or kindle. Thanks!

ZoomZoomZoom4• 5 years ago

In case you haven't tried, I suggest using koreader. It has a good combination of a reliable crop and a usable reflow feature. Not ideal, but it's much better than constant zooming and moving the view around.

https://koreader.rocks/

azalemeth• 5 years ago

Beautiful typography and beautiful text -- it's very easy to read (and wonderful LaTeX'd output). I very much appreciate this -- thanks for sharing.

cugniere• 5 years ago

For those looking for a more exercise-oriented approach to cryptography, the Cryptopals challenge (https://cryptopals.com/) is an excellent way to discover cryptography step by step with 64 exercises with an increasing difficulty level

pretext• 5 years ago

Thank you! Looks like crypto version of Project Euler and Rosalind.

oleganza• 5 years ago

Myself going from "web designer" to a "zero-knowledge proof cryptographer" (I'm a coauthor of Dalek Bulletproofs implementation, the cleanest API, documentation and fastest ZKP system ever) I'm sad to see crypto textbooks spending most of the time on symmetric ciphers, going through the same nonsense like ECB and then touching asymmetric only with RSA and annoying GCD stuff when everyone moved onto elliptic curves already.

I'd like to see material around modern stuff (Keccak and ECC) with only a cursory discussion of pitfalls of the past standards in contrast with the current stuff. And more time on asymmetric, discrete log and fiat-shamir protocols that are so much fun and require really a 7th grade algebra to grasp.

I've also made a couple of videos on ECC basics with that approach: https://www.youtube.com/channel/UCk0r9S76wngNPJb_GlhJYdw

EDIT: what i mean, is focus first on how to use primitives and what they promise, rather than how they actually work. Once you feel like you can play with these legos, it's more fun to dig deeper and see why ECDLP is hard and how ciphers are made. But please don't start from within - it's an annoying boring mess that distracts from the true beauty: the cool things you can build with these tools.

ogogmad• 5 years ago

what i mean, is focus first on how to use primitives and what they promise

These sorts of "provable security" textbooks (like the one in the article) try and do that. They emphasise less the exact inner workings of algorithms, and more on what they supposedly achieve. Various kinds of security proofs are possible. This school of thought in cryptography does also allow you to argue fairly convincingly that some concrete ciphers are secure. So it can talk about both the inner workings of ciphers as well as what security properties they achieve.

The "provable security" approach seems to be in line with your suggestion. In fact, it was the framework under which Zero Knowledge Proofs were developed. Not every cryptographer knows about that though, so I'm not sure if you were aware...

ZoomZoomZoom4• 5 years ago

Again I complain on the irritating habit of non-descriptive naming of files.

book.pdf

Really? I'm saving the file for a later review and this name will guarantee I either completely lose the file or will spend more time than necessary to locate it. The other option is to rename the file on saving, which is some work which needs to be performed by each user, instead of being done just once on the source. I think this is just impolite.

Here's a proper name you can copy-paste:

Mike_Rosulek_-_The_Joy_Of_Cryptography_(draft_2021-01-03).pdf

PS: The short-link-for-verbal-sharing problem is solved via a symbolic link.

ASalazarMX• 5 years ago

Your observation is very valid, that's one of my pet peeves too, but renaming the file before saving it is also very easy. Your observation, while helpful, feels excessively negative.

ZoomZoomZoom4• 5 years ago

The only negative adjectives I used were "irritating" and "impolite". The first one is strictly my feelings, and if you don't share them, I can only congratulate you on your self-restrain. The second one is just my opinion, I could explain why I think so, but I don't think it's that big of a deal to waste time on further discussions. Just please, keep file naming in mind if you can. No one will come to any harm if you won't, though, so I guess it's not that important.

On the second thought, one part of my job is preparing products for the final consumption, so this attention to minutiae is probably a professional deformation.

jimmygrapes• 5 years ago

I know there are a ton of pitfalls with spaces in filenames, but surely this is not one of the cases where it would apply? Unless your file save dialog replaces spaces for some reason, in which case even %20 is about as readable as _ to me.

mavelikara• 5 years ago

Also, avoid resume.pdf for similar reasons.

The Joy of Cryptography

Related Stories