As American students are preparing to return to the classroom during a pandemic–in flagrant disregard of everything ranging from our scientific understanding to matters of good taste–we keep hearing from politicians how essential education is.

Of course, if they actually believed the words coming out of their mouth, you’d expect them to be a little more consistent with their treatment of teachers throughout their legislative voting records.

But while they’re pantomiming concern for our students’ education, I thought I’d take the opportunity to share some lessons you won’t hear about in the classroom. And the reason you won’t hear any of these in the classroom is because of incentives. That’s our first lesson.

Incentives Override Character

Most of the time, people are driven by two things:

1. The structure of incentives in their environment
2. Satisfying their own ego

If you have a passing interest in philosophy or religion, you might be familiar with the “free will” debates: Do humans have free will? It wouldn’t really matter if they did; most people will make choices based on those two factors, rather than any deep or intrinsic quality to their character.

The reason why this matters is, a lot of the bullshit adults put kids through is intended to instill certain character attributes, like grit, determination, honesty, and integrity. But the simple fact is, most adults don’t possess these qualities themselves–they’ve just accumulated the delusion that they have them. (Ask your friends how many of their upstanding, law-abiding parents hit the bong on weekends in states where marijuana isn’t legal yet, and you’ll see what I mean.)

Instead of participating in publicly accepted hazing rituals also known as extra-curricular activities, students would be better off learning the two ways to escape from the psychological tarpit that leads to poor decisions and upholding the socioeconomic status quo as if it was something worth preserving.

How to Be Better

The first escape hatch is to overcome one’s ego. There are a lot of different schools of thought about how to do this, but the most obvious example is the practice of Buddhism. Ask a Buddhist for some insight in how to accomplish this, because I certainly don’t have the answers on this one.

The other way out is to choose different incentives. This is more honest and practical for most people than expecting them to become less self-centered. Instead of desiring the same things (wealth, prestige, power), focus first on the bottom two slices of the hierarchy of needs, and then once those are met, pin your self-actualization to something downright strange. I’ll give you an example.

Incentives: The Usual Suspects

Your average American is conditioned from a young age to graduate from high school and go to college so they can secure stable employment and start a family. Not all of them follow this track, but it’s a typical expectation that gets communicated throughout the public school system’s cultural indoctrination of our youth.

Along the way, a student’s incentive structure is “outperform their peers on standardized tests to get into more prestigious colleges” then “outperform their peers to graduate higher in your classes to get a stable, well-paying job” then “outperform their coworkers to ensure job security when the downsizing hammer comes down on your department”. Competition, competition, competition. Uninspiring.

Y’know what you don’t see a whole lot? Students who aim to graduate in the bottom 10% of their class because they’re spending their college years helping others succeed and forming lifelong friendships. It might sound ridiculous, but a lot of those can yield long-term business relationships that can be spun into a successful career as an independent consultant–thereby freeing you from the “rat race” that leads to so much depression, burn-out, and failed marriages because one or both partners is working so damn much.

Get creative with your incentives. You get to decide what motivates you (beyond a threshold of what’s determined through genetics and epigenetics, anyway). So why choose the same high-demand, low-supply incentives everyone else chooses? Where’s the fun in that?

I say it’s okay to be weird. And this isn’t my own incentives speaking. I gain nothing by strangers being less self-conscious and insecure about this, since I’m already surrounded by friends who are (in their own way) just as weird as I am.

And if you’re afraid of being ostracized and losing yourself in the process of embracing your weirdness, at least that will be instrumental in overcoming your own ego.

On Kindness and Weakness

Going back to my previous hypothetical example of a student aspiring to be in the bottom 10% of their graduating class (because they’re focused on helping their low-performing peers achieve higher than they otherwise would), anyone who attempts this in earnest will likely find themselves with both a greater understanding of the subject matter and greatly improved communication skills.

To another student with a purely competitive mindset aiming for the top 10% and a “perfect” 4.0 GPA, the behavior of our hypothetical nonconformist might seem like weakness. They might call them an underachiever (or some modern euphemism that may or may not also be a dog-whistle meme for something racist).

But is attaining greater mastery of your chosen field and better skills at explaining topics to non-experts really a form of weakness? This is yet another crack in the armor of the bullshit indoctrination that our society likes to subject us all to, but our education system should aspire to counteract every chance it gets.

Most people confuse kindness for weakness, and the worst of us choose to exploit weakness for their own selfish gain. However, this tendency is in itself exploitable: It makes assholes predictable to the point of being tiresome.

If you choose to be kind in the areas where you’re the strongest, this will do two things: First, it will completely fuck over the plots of the terrible. And second, it will make life a little more pleasant for the rest of us.

I call that a win-win.

If you take nothing else away from this blog, remember this: The purest expression of integrity, personal conviction, and resilience is through kindness, empathy, and compassion.

Anyone who doesn’t understand this is trying too hard to be macho, to deflect from their own deep-seated insecurities. It almost makes you wonder what their incentives are.

Ignorance and Stupidity

Ignorance gets a bad rap. It’s perfectly acceptable to not know something, even if it’s something everyone else knows. As long as you’re aware of your own ignorance and actively seeking the knowledge you lack, there’s nothing to be ashamed about.

On the other hand, willful ignorance–where you don’t know something, and don’t want to know it–is a form of stupidity. But being stupid isn’t the same thing as being ignorant.

Stupidity (for lack of a better term) doesn’t usually stem from a lack of knowledge. Consequently, you can’t inform someone into being less stupid. Careless? Sure. But stupid? Not a chance.

Stupidity–or at least the American brand of stupidity we’re all too familiar with especially from four years with Donald Trump as president–stems from believing in things that are untrue rather than not knowing.

Therefore, the correct word for people who support a Trump presidency in 2020 isn’t “ignorant”. Instead, these people fall into two camps that have distinct words to describe them: Bigoted and spiteful. (And if you don’t think that’s true, try sitting down to watch the news with one of them in a relaxed environment and watch how long it takes them to say something racist, homophobic, or otherwise hateful. You won’t need the patience of a saint to observe results, although it might help with escaping the encounter with your blood pressure at a healthy level.)

When discussing stupidity, it’s tempting for writers to point to obvious examples like anti-vaxxers or the Flat Earth Society and insist, “This is what stupidity looks like.” But this does a lot of harm. Focusing on extreme and obvious examples trains your mental heuristics to expect stupidity to be broadly or generally obvious. It isn’t. Stupidity is subtle, pernicious, and ubiquitous.

A specific example: Any gay person that supports the so-called “LGB Alliance” is stupid because they’re being manipulated into attacking transgender people by right-wing jerk-offs who want to create a wedge in the LGBT community in order to divide and conquer us and ultimately deprive us of our civil rights. It’s also stupid because it stems from beliefs that have been thoroughly debunked by science.

Stupidity ultimately comes from two main sources:

1. Authority figures and institutions
2. Our brains’ tendency to invent and believe stories

Sometimes, possibly as a result of trauma, our cognitive storytellers decide to distrust official sources even if they’re not associated with political power. This is why stupid people believe stupid conspiracy theories: Anyone who could disprove it is perceived to be part of the conspiracy.

Rather than fall for these trappings, a much more reasonable position is to default to a mild distrust and to judge sources of information on their own merits. Make them earn your trust.

But this requires effort, so nobody does this consistently. Still, you can get a lot of mileage out of limiting your media consumption to unbiased and pro-science publications.

Why These Lessons Matter

Anyone capable of reading and comprehending the lessons I’m sharing today will find themselves more capable of resisting the trappings of modern American society.

If enough of us do this, we can pull the rug out from under the feet of the wealthy business interests that continue to make the American education system terrible (through lobbying and/or monopolies on textbook publishing). Ideally, this would especially harm these companies’ soulless advertising and marketing efforts by rendering them less effective. Good riddance to bad garbage.

https://soatok.blog/2020/08/21/a-few-missing-lessons-from-american-education/

#America #AmericanEducation #education #ignorance #incentives #kindness #lessons #Politics #Society #stupidity #weakness

Dhole Moments

2020-07-02 21:22:50

As America prepares for record-breaking infection statistics on a daily basis, many of us are looking at other countries safely reopening and wondering, “Why can’t we have nice things?”

What you see if you type “COVID-19 statistics” into a search engine. Data sourced from Wikipedia.

Of course, everyone has their favorite target to blame for this catastrophe. Democrats blame Republicans. Republicans blame Democrats.

I’m not interested in blame. Regardless of who takes the blame in the end, the responsibility for fixing this problem is shared among everyone. Instead, I’m more interested in answering the “Why?” question.

Why Did Things Get This Bad?

Art by circuitslime.

There are a lot of popular theories–many of them politically useful–about why the COVID-19 crisis is particularly bad in the United States.

A Failure of Trump’s Leadership?

Let’s get this one out of the way:

Was the current hellscape we found ourselves in a direct consequence of Donald J Trump’s failure to ethically and responsibly use his power as President of the United States in the best interest of the people?

https://www.youtube.com/embed/svrxYLvJYto?feature=oembed
“It’ll miraculously go away in April!” – Morons
It’s certain that Trump has totally failed at leadership, but I don’t think that’s a satisfactory explanation for the current crisis.

https://www.youtube.com/embed/s9vzT-0hchw?feature=oembed

That is not to say that Trump is without fault! Just that the problem is bigger than one idiot in a three piece suit.

Challenges Due to Scale?

A lot of the countries that performed better at responding to COVID-19 had smaller populations and occupied smaller land masses than the United States. Is that a reasonable explanation for why the USA suffers?

No, it isn’t.

Per-capita analyses and samples from other countries with similar populations and occupied surface area would be consistent with the USA if that was the reason. This problem is mostly uniquely American.

Are the Protesters at Fault?

COVID-19 has an incubation period of up to two weeks.

The first signs of an uptick in COVID-19 infections was visible early into the nationwide Black Lives Matter protests, which implicates an earlier cause. The most likely one was the Memorial Day weekend celebrations that took place before George Floyd’s murder sparked widespread outrage.

Indeed, a further analysis did not show an uptick of COVID-19 infections even 4 weeks into the nationwide protests (which is two incubation periods).

Instead, the sharp spike in COVID-19 infections–factoring in the incubation period–coincided with states reopening their bars and restaurants. (Especially Florida.)

Why Things Are So Bad Today

The problem that America faces is the same one we’ve been faced with for many decades: Rampant Anti-Intellectualism.

https://www.youtube.com/embed/bZnBL2dFgyI?feature=oembed

American anti-intellectualism is the juxtaposition of proud ignorance and conspiracy theories.

Let me ask all you female mask wearing ASSHOLES… are you ready to put a burka on next?

That mask is NOT about your safety…. it's about MIND CONTROL

The only reason I know masks are worthless is because Andrew Cuomo keeps telling EVERYONE to wear one

Stick it up your ass!

— 🇺🇸🍺TRUMP WON🍺🇺🇸 (@PISDI94_96) June 30, 2020

Tweet is also archived in case it gets deleted.
Anti-intellectualism takes many forms:

Every single time y'all tell me you're not ready to submit a talk on a subject you've been researching for months, I want you to think about "I don't actually ride in Ubers" internet-commentator guy. pic.twitter.com/aK2LAcFtzb

— Lesley Carhart (@hacks4pancakes) July 1, 2020

People are so willing to die on the hill of their ignorance that even literally dying doesn’t deter them from campaigning for self-destruction.

RIGHT NOW: Dozens are marching in Sanford chanting “My body. My choice.” They are protesting after a mask order went into place in Seminole County today. pic.twitter.com/kMT7EebDKN

— Stephanie Buffamonte (@StephBuffamonte) July 1, 2020

The reason that things are so bad in the United States of America boils down to the following:

1. Too many Americans are proud to be ignorant, and in many cases, argue in support of “my ignorance is just as good as your facts”.
2. Too many Americans are susceptible to bullshit conspiracy theories.
3. Too many Americans are so selfish and short-sighted that they’d rather go to bars and waste money they don’t have on alcohol and shallow conversation than save the lives of the people they profess to love and care about.
4. Conservative politics and media is a death cult that literally turned “wearing a mask to stop COVID-19” into a culture war issue.
5. The people I’ve described in points 1-4 vote in every election, to make sure someone representing their bullshit has a seat at the political table.

It’s far too tempting to scapegoat the sitting President–especially when they’re as terrible as Donald J Trump. But if you do that, you’re ignoring the reason that he’s in the oval office to begin with.

Willful Ignorance Kills

I’ve talked about this before, when I used to write on Medium:

1. https://medium.com/@soatok/american-ignorance-in-2020-c72c78d11dbb
2. https://medium.com/@soatok/dear-furries-bullshit-and-misinformation-will-hurt-you-4a6f531d62bd

The sole cause for the situation we’re in is the same anti-intellectualism that Isaac Asimov complained about back in 1980.

Even if you want to solely blame Donald Trump, about 40% of Americans currently approve of his presidency (archive).

How to Escape This Hellscape

Art by Swizz.

The only way to get out of the mess we’re in today is to stop tolerating ignorance and bullshit in your daily life. (Yes, this means you too, furry fandom! It’s not “all fun and games” anymore.)

That means, at a minimum:

• Not spreading the Myers-Brigg personality test bullshit
• Not giving the anti-LGBTQIA+ bigots at Chick-Fil-A any money
• Listening to experts (this means: SCIENTISTS, not talk show hosts or politicians)
• Being willing to admit “I don’t know” and then being curious enough to seek the truth
• Stop reading or financially supporting biased news media

Even if we manage to get out of the current COVID-19 hellscape without addressing these flaws, the next catastrophe will hit us just as hard.

Can People’s Minds Be Changed?

No. I don’t think most of the willfully ignorant assholes currently living in America that favor Trump’s presidency today are willing and capable of redemption.

There will be exceptions, and we should remain open to the possibility of some people coming around, but in general most of these jerks will dig their heels in when pressured.

Instead, we’re going to have to wait for them to die off naturally.

What we can do in the meantime is promote better education for the American kids.

https://www.youtube.com/embed/ILQepXUhJ98?feature=oembed

A nation of enlightened free-thinkers fully capable of critical thought would be a good thing (even if Carlin thinks it will never happen). And we can get there, eventually.

All it takes is everyone deciding to be humble and actually verify what other people tell them (n.b. by referencing reputable sources).

It might not make a difference today, but in 10 or 20 years, a consistent effort to enable younger Americans to become smarter, wiser, and more empathetic than their parents and grandparents will change the political landscape of our country–and maybe even the world–for the better.

Art by Khia

Of course, the Powers That Be know that, which is why we see bullshit like this keep happening during a pandemic:

With a stroke of his veto pen, Gov. Ron DeSantis wiped out the entire $29.4 million budget for a suite of online education services that have become critical to students and faculty during the Covid-19 outbreak https://t.co/6PMop4SIPv

— POLITICO (@politico) June 30, 2020

Remember, DeSantis is the governor of the state whose COVID-19 infections-per-day graph looks like this:

You can see a clear data pattern with Florida's COVID-19 with a lull each Sunday. I've computed the baseline for this week (Sunday's numbers) and the last two weeks' increase relative to Sunday. We're easily on track to hit 10,000 new cases Friday-ish, maybe even higher. pic.twitter.com/8pnXF5uEwR

— 💙💛 "Dog Boy" Nex' 💙💛 (@NexJql) July 1, 2020

It won’t be easy. Bullshit is everywhere. But it’s doable.

---

Addendum: A Carnival of Stupid

In case you still had any doubt about the potent lethality of American anti-intellectualism, look no further than this story:

Florida teen dies after conspiracy theorist mom takes her to church ‘COVID party’ and tries to treat her with Trump-approved drug: report – https://t.co/Bw3SMVitxx

— Jeffrey Levin 🇺🇦 (@jilevin) July 6, 2020

We have to demand better of ourselves before we can demand better of others. But damn if the bar isn’t really, really low to begin with.

I believe someday we'll open up textbooks and find this screenshot under the definition of "cognitive dissonance". pic.twitter.com/n535Obq6SB

— 🦊 Ennex is trying this again! 🦊 (@EnnexTheFox) July 7, 2020

The White House Press Secretary on Trump's push to reopen schools: "The science should not stand in the way of this."

— Jim Acosta (@Acosta) July 16, 2020

https://soatok.blog/2020/07/02/how-and-why-america-was-hit-so-hard-by-covid-19/

#Politics

A question I get asked frequently is, “How did you learn cryptography?”

I could certainly tell everyone my history as a self-taught programmer who discovered cryptography when, after my website for my indie game projects kept getting hacked, I was introduced to cryptographic hash functions… but I suspect the question folks want answered is, “How would you recommend I learn cryptography?” rather than my cautionary tale about poorly-implemented password hash being a gateway bug.

The Traditional Ways to Learn

There are two traditional ways to learn cryptography.

If you want a book to augment your journey in either traditional path, I recommend Serious Cryptography by Jean-Philippe Aumasson.

Academic Cryptography

The traditional academic way to learn cryptography involves a lot of self-study about number theory, linear algebra, discrete mathematics, probability, permutations, and field theory.

You’d typically start off with classical ciphers (Caesar, etc.) then work your way through the history of ciphers until you finally reach an introduction to the math underpinning RSA and Diffie-Hellman, and maybe taught about Schneier’s Law and cautioned to only use AES and SHA-2… and then you’re left to your own devices unless you pursue a degree in cryptography.

The end result of people carelessly exploring this path is a lot of designs like Telegram’s MTProto that do stupid things with exotic block cipher modes and misusing vanilla cryptographic hash functions as message authentication codes; often with textbook a.k.a. unpadded RSA, AES in ECB, CBC, or some rarely-used mode that the author had to write custom code to handle (using ECB mode under the hood), and (until recently) SHA-1.

People who decide to pursue cryptography as a serious academic discipline will not make these mistakes. They’re far too apt for the common mistakes. Instead, they run the risk of spending years involved in esoteric research about homomorphic encryption, cryptographic pairings, and other cool stuff that might not see real world deployment (outside of novel cryptocurrency hobby projects) for five or more years.

That is to say: Academia is a valid path to pursue, but it’s not for everyone.

If you want to explore this path, Cryptography I by Dan Boneh is a great starting point.

Security Industry-Driven Cryptography

The other traditional way to learn cryptography is to break existing cryptography implementations. This isn’t always as difficult as it may sound: Reverse engineering video games to defeat anti-cheat protections has led several of my friends into learning about cryptography.

For security-minded folks, the best place to start is the CryptoPals challenges. Another alternative is CryptoHack.

There are also plenty of CTF events all year around, but they’re rarely a good cryptography learning exercise above what CryptoPals offers. (Though there are notable exceptions.)

A Practical Approach to Learning Cryptography

Art by Kyume.

If you’re coming from a computer programming background and want to learn cryptography, the traditional approaches carry the risk of Reasoning By Lego.

Instead, the approach I recommend is to start gaining experience with the safest, highest-level libraries and then slowly working your way down into the details.

This approach has two benefits:

1. If you have to implement something while you’re still learning, your knowledge and experience is stilted towards “use something safe and secure” not “hack together something with Blowfish in ECB mode and MD5 because they’re familiar”.
2. You can let your own curiosity guide your education rather than follow someone else’s study guide.

To illustrate what this looks like, here’s how a JavaScript developer might approach learning cryptography, starting from the most easy-mode library and drilling down into specifics.

Super Easy Mode: DholeCrypto

Disclaimer: This is my project.

Dhole Crypto is an open source library, implemented in JavaScript and PHP and powered by libsodium, that tries to make security as easy as possible.

I designed Dhole Crypto for securing my own projects without increasing the cognitive load of anyone reviewing my code.

If you’re an experienced programmer, you should be able to successfully use Dhole Crypto in a Node.js/PHP project. If it does not come easy, that is a bug that should be fixed immediately.

Easy Mode: Libsodium

Using libsodium is slightly more involved than Dhole Crypto: Now you have to know what a nonce is, and take care to manage them carefully.

Advantage: Your code will be faster than if you used Dhole Crypto.

Libsodium is still pretty easy. If you use this cheat sheet, you can implement something secure without much effort. If you deviate from the cheat sheet, pay careful attention to the documentation.

If you’re writing system software (i.e. programming in C), libsodium is an incredibly easy-to-use library.

Moderate Difficulty: Implementing Protocols

Let’s say you’re working on a project where libsodium is overkill, and you only need a few cryptography primitives and constructions (e.g. XChaCha20-Poly1305). A good example: In-browser JavaScript.

Instead of forcing your users to download the entire Sodium library, you might opt to implement a compatible construction using JavaScript implementations of these primitives.

Since you have trusted implementations to test your construction against, this should be a comparatively low-risk effort (assuming the primitive implementations are also secure), but it’s not one that should be undertaken without all of the prior experience.

Note: At this stage you are not implementing the primitives, just using them.

Hard Difficulty: Designing Protocols and Constructions

Repeat after me: “I will not roll my own crypto before I’m ready.” Art by AtlasInu.

To distinguish: TLS and Noise are protocols. AES-GCM and XChaCha20-Poly1305 are constructions.

Once you’ve implemented protocols and constructions, the next step in your self-education is to design new ones.

Maybe you want to combine XChaCha20 with a MAC based on the BLAKE3 hash function, with some sort of SIV to make the whole shebang nonce-misuse resistant?

You wouldn’t want to dive headfirst into cryptography protocol/construction design without all of the prior experience.

Very Hard Mode: Implementing Cryptographic Primitives

It’s not so much that cryptography primitives are hard to implement. You could fit RC4 in a tweet before they raised the character limit to 280. (Don’t use RC4 though!)

The hard part is that they’re hard to implement securely. See also: LadderLeak.

Usually when you get to this stage in your education, you will have also picked up one or both of the traditional paths to augment your understanding. If not, you really should.

Nightmare Mode: Designing Cryptography Primitives

A lot of people like to dive straight into this stage early in their education. This usually ends in tears.

If you’ve mastered every step in my prescribed outline and pursued both of the traditional paths to the point that you have a novel published attack in a peer-reviewed journal (and mirrored on ePrint), then you’re probably ready for this stage.

Bonus: If you’re a furry and you become a cryptography expert, you can call yourself a cryptografur. If you had no other reason to learn cryptography, do it just for pun!

Header art by circuitslime.

https://soatok.blog/2020/06/10/how-to-learn-cryptography-as-a-programmer/

#cryptography #education #programming #Technology

Dhole Moments

2020-05-27 00:13:21

A paper was published on the IACR’s ePrint archive yesterday, titled LadderLeak: Breaking ECDSA With Less Than One Bit of Nonce Leakage.

The ensuing discussion on /r/crypto led to several interesting questions that I thought would be worth capturing and answering in detail.

What’s Significant About the LadderLeak Paper?

This is best summarized by Table 1 from the paper.
The sections labeled “This work” are what’s new/significant about this research.
The paper authors were able to optimize existing attacks exploiting one-bit leakages against 192-bit and 160-bit elliptic curves. They were further able to exploit leakages of less than one bit in the same curves.

How Can You Leak Less Than One Bit?

We’re used to discrete quantities in computer science, but you can leak less than one bit of information in the case of side-channels.

Biased modular reduction can also create a vulnerable scenario: If you know the probability of a 0 or a 1 in a given position in the bit-string of the one-time number (i.e. the most significant bit) is not 0.5 to 0.5, but some other ratio (e.g. 0.51 to 0.49), you can (over many samples) conclude a probability of a specific bit in your dataset.

If “less than one bit” sounds strange, that’s probably our fault for always rounding up to the nearest bit when we express costs in computer science.

What’s the Cost of the Attack?

Consult Table 3 from the paper for empirical cost data:
Table 3 from the LadderLeak paper.

How Devastating is LadderLeak?

First, it assumes a lot of things:

1. That you’re using ECDSA with either sect163r1 or secp192r1 (NIST P-192). Breaking larger curves requires more bits of bias (as far as we know).
2. That you’re using a cryptography library with cache-timing leaks.
3. That you have a way to measure the timing leaks (and not just pilfer the ECDSA secret key; i.e. in a TPM setup). This threat model generally assumes some sort of physical access.

But if you can pull the attack off, you can successfully recover the device’s ECDSA secret key. Which, for protocols like TLS, allow an attacker to impersonate a certificate-bearer (typically the server)… which is pretty devastating.

Is ECDSA Broken Now?

Non-deterministic ECDSA is not significantly more broken with LadderLeak than it already was by other attacks. LadderLeak does not break the Internet.

Fundamentally, LadderLeak doesn’t really change the risk calculus. Bleichenbacher’s attack framework for solving the Hidden Number Problem using Lattices was already practical, with sufficient samples.

There’s even a CryptoPals challenge about these attacks.

As an acquaintance put it, the authors made a time-memory trade-off with a leaky oracle. It’s a neat result worthy of publication, but we aren’t any minutes closer to midnight with this revelation.

Is ECDSA’s k-value Really a Nonce?

Ehhhhhhhhh, sorta.

It’s complicated!

Nonce in cryptography has always meant “number that must be used only once” (typically per key). See: AES-GCM.

Nonces are often confused for initialization vectors (IVs), which in addition to a nonce’s requirements for non-reuse must also be unpredictable. See: AES-CBC.

However, nonces and IVs can both be public, whereas ECDSA k-values MUST NOT be public! If you recover the k-value for a given signature, you can recover the secret key too.

That is to say, ECDSA k-values must be all of the above:

1. Never reused
2. Unpredictable
3. Secret
4. Unbiased

They’re really in a class of their own.

For that reason, it’s probably better to think of the k-value as a per-signature key than a simple nonce. (n.b. Many cryptography libraries actually implement them as a one-time ECDSA keypair.)

What’s the Difference Between Random and Unpredictable?

The HMAC-SHA256 output of a message under a secret key is unpredictable for anyone not in possession of said secret key. This value, though unpredictable, is not random, since signing the same message twice yields the same output.

A large random integer when subjected to modular reduction by a non-Mersenne prime of the same magnitude will be biased towards small values. This bias may be negligible, but it makes the bit string that represents the reduced integer more predictable, even though it’s random.

What Should We Do? How Should We Respond?

First, don’t panic. This is interesting research and its authors deserve to enjoy their moment, but the sky is not falling.

Second, acknowledge that none of the attacks are effective against EdDSA.

If you feel the urge to do something about this attack paper, file a support ticket with all of your third-party vendors and business partners that handle cryptographic secrets to ask them if/when they plan to support EdDSA (especially if FIPS compliance is at all relevant to your work, since EdDSA is coming to FIPS 186-5).

Reason: With increased customer demand for EdDSA, more companies will adopt this digital signature algorithm (which is much more secure against real-world attacks). Thus, we can ensure an improved attack variant that actually breaks ECDSA doesn’t cause the sky to fall and the Internet to be doomed.

(Seriously, I don’t think most companies can overcome their inertia regarding ECDSA to EdDSA migration if their customers never ask for it.)

https://soatok.blog/2020/05/26/learning-from-ladderleak-is-ecdsa-broken/

#crypto #cryptography #digitalSignatureAlgorithm #ECDSA #ellipticCurveCryptography #LadderLeak