Dhole Moments

2020-07-12 21:33:27

There seems to be a lot of interest among software developers in the various cryptographic building blocks (block ciphers, hash functions, etc.), and more specifically how they stack up against each other.

Today, we’re going to look at how some symmetric encryption methods stack up against each other.

If you’re just looking for a short list of cryptographic “right answers”, your cheat sheet can be found on Latacora’s blog.

Comparisons

• AES-GCM vs. ChaCha20-Poly1305
• AES-GCM vs. XChaCha20-Poly1305
• AES-GCM vs. AES-CCM
• AES-GCM vs. AES-GCM-SIV
• AES-GCM vs. AES-SIV
• AES-GCM-SIV vs. AES-SIV
• AES-GCM vs. AES-CBC
• AES-GCM vs. AES-CTR
• AES-CBC vs. AES-CTR
• AES-CBC vs. AES-ECB
• AES vs. Blowfish
• ChaCha vs. Salsa20
• ChaCha vs. RC4
• Cipher Cascades

AES-GCM vs. ChaCha20-Poly1305

• If you have hardware acceleration (e.g. AES-NI), then AES-GCM provides better performance. If you do not, AES-GCM is either slower than ChaCha20-Poly1305, or it leaks your encryption keys in cache timing.
• Neither algorithm is message committing, which makes both unsuitable for algorithms like OPAQUE (explanation).
• AES-GCM can target multiple security levels (128-bit, 192-bit, 256-bit), whereas ChaCha20-Poly1305 is only defined at the 256-bit security level.
• Nonce size:
  
  • AES-GCM: Varies, but standard is 96 bits (12 bytes). If you supply a longer nonce, this gets hashed down to 16 bytes.
  • ChaCha20-Poly1305: The standardized version uses 96-bit nonces (12 bytes), but the original used 64-bit nonces (8 bytes).

  
  

• Wearout of a single (key, nonce) pair:
  
  • AES-GCM: Messages must be less than 2^32 – 2 blocks (a.k.a. 2^36 – 32 bytes, a.k.a. 2^39 – 256 bits). This also makes the security analysis of AES-GCM with long nonces complicated, since the hashed nonce doesn’t start with the lower 4 bytes set to 00 00 00 02.
  • ChaCha20-Poly1305: ChaCha has an internal counter (32 bits in the standardized IETF variant, 64 bits in the original design).

  
  

• Neither algorithm is nonce misuse resistant.

Conclusion: Both are good options. AES-GCM can be faster with hardware support, but pure-software implementations of ChaCha20-Poly1305 are almost always fast and constant-time.

Back to the top

AES-GCM vs. XChaCha20-Poly1305

• XChaCha20 accepts 192-bit nonces (24 bytes). The first 16 of the nonce are used with the ChaCha key to derive a subkey, and then the rest of this algorithm is the same as ChaCha20-Poly1305.
• To compare AES-GCM and ChaCha20-Poly1305 for encryption, see above.
• The longer nonce makes XChaCha20-Poly1305 better suited for long-lived keys (i.e. application-layer cryptography) than AES-GCM.

Conclusion: If you’re using the same key for a large number of messages, XChaCha20-Poly1305 has a wider safety margin than AES-GCM. Therefore, XChaCha20-Poly1305 should be preferred in those cases.

Back to the top

AES-GCM vs. AES-CCM

AES-GCM is AES in Galois/Counter Mode, AES-CCM is AES in Counter with CBC-MAC mode.

Although I previously stated that AES-GCM is possibly my least favorite AEAD, AES-CCM is decidedly worse: AES-GCM is Encrypt-then-MAC, while AES-CCM is MAC-then-encrypt.

Sure, CCM mode has a security proof that arguably justifies violating the cryptographic doom principle, but I contend the only time it’s worthwhile to do that is when you’re building a nonce-misuse resistant mode (i.e. AES-GCM-SIV).

A lot of cryptography libraries simply don’t even implement AES-CCM; or if they do, it’s disabled by default (i.e. OpenSSL). A notable exception is the Stanford Javascript Cryptography Library, which defaults to AES-CCM + PBKDF2 for encryption.

Conclusion: Just use AES-GCM.

Back to the top

AES-GCM vs. AES-GCM-SIV

AES-GCM-SIV encryption runs at 70% the speed of AES-GCM, but decryption is just as fast. What does this 30% encryption slowdown buy? Nonce misuse resistance.

Nonce misuse resistance is really cool. (Art by Swizz)

The algorithms are significantly different:

• AES-GCM is basically AES-CTR, then GMAC (parameterized by the key and nonce) is applied over the AAD and ciphertext. (Encrypt then MAC)
• AES-GCM-SIV derives two distinct keys from the nonce and key, then uses POLYVAL (which is related to GHASH) over the AAD and message with the first key to generate the tag. Then the tag used to derive a series of AES inputs that, when encrypted with the second key, are XORed with the blocks of the message (basically counter mode). (MAC then Encrypt)

AES-GCM is a simpler algorithm to analyze. AES-GCM-SIV provides a greater safety margin. However, like AES-GCM, AES-GCM-SIV is also vulnerable to the Invisible Salamanders attack.

So really, use which ever you want.

Better security comes from AES-GCM-SIV, better encryption performance comes from AES-GCM. What are your priorities?

https://twitter.com/colmmacc/status/986286693572493312

Conclusion: AES-GCM-SIV is better, but both are fine.

Back to the top

AES-GCM vs. AES-SIV

At the risk of being overly reductionist, AES-SIV is basically a nonce misuse resistant variant of AES-CCM:

• Where AES-CCM uses CBC-MAC, AES-SIV uses CMAC, which is based on CBC-MAC but with a doubling step (left shift then XOR with the round constant).
• AES-SIV is MAC then encrypt (so is AES-CCM).
• AES-SIV uses AES-CTR (so does AES-CCM).

If you need nonce misuse resistance, AES-SIV is a tempting choice, but you’re going to get better performance out of AES-GCM.

AES-GCM also has the added advantage of not relying on CBC-MAC.

Conclusion: Prefer AES-GCM in most threat models, AES-SIV in narrower threat models where nonce misuse is the foremost security risk.

Back to the top

AES-GCM-SIV vs. AES-SIV

If you read the previous two sections, the conclusion here should be obvious.

• AES-GCM-SIV is slightly better than AES-GCM.
• AES-GCM is better than AES-SIV.

Conclusion: Use AES-GCM-SIV.

Back to the top

AES-GCM vs. AES-CBC

Just use AES-GCM. No contest.

AES-GCM is an authenticated encryption mode. It doesn’t just provide confidentiality by encrypting your message, it also provides integrity (which guarantees that nobody tampered with the encrypted message over the wire).

If you select AES-CBC instead of AES-GCM, you’re opening your systems to a type of attack called a padding oracle (which lets attackers decrypt messages without the key, by replaying altered ciphertexts and studying the behavior of your application).

If you must use AES-CBC, then you must also MAC your ciphertext (and the initialization vector–IV for short). You should also devise some sort of key-separation mechanism so you’re not using the same key for two different algorithms. Even something like this is fine:

1. encKey := HmacSha256(“encryption-cbc-hmac”, key)
2. macKey := HmacSha256(“authentication-cbc-hmac”, key)
3. iv := RandomBytes(16)
4. ciphertext := AesCbc(plaintext, iv, encKey)
5. tag := HmacSha256(iv + ciphertext, macKey)

For decryption you need a secure compare function. If one is not available to you, or you cannot guarantee it will run in constant time, a second HMAC call with a random per-comparison key will suffice.

There is no possible world in which case unauthenticated AES-CBC is a safer choice than AES-GCM.

AES-CBC + HMAC-SHA256 (encrypt then MAC) is message-committing and therefore can be safely used with algorithms like OPAQUE.

The Signal Protocol uses AES-CBC + HMAC-SHA2 for message encryption.

Back to the top

AES-GCM vs. AES-CTR

Just use AES-GCM. No contest.

Unlike AES-GCM, AES-CTR doesn’t provide any message integrity guarantees. However, strictly speaking, AES-GCM uses AES-CTR under the hood.

If you must use AES-CTR, the same rules apply as for AES-CBC:

1. encKey := HmacSha256(“encryption-ctr-hmac”, key)
2. macKey := HmacSha256(“authentication-ctr-hmac”, key)
3. nonce := RandomBytes(16)
4. ciphertext := AesCtr(plaintext, nonce, encKey)
5. tag := HmacSha256(nonce + ciphertext, macKey)

For decryption you need a secure compare function.

AES-CTR + HMAC-SHA256 (encrypt then MAC) is message-committing and therefore can be safely used with algorithms like OPAQUE.

Back to the top

AES-CBC vs. AES-CTR

If you find yourself trying to decide between CBC mode and CTR mode, you should probably save yourself the headache and just use GCM instead.

That being said:

AES-CTR fails harder than AES-CBC when you reuse an IV/nonce.

AES-CBC requires a padding scheme (e.g. PKCS #7 padding) which adds unnecessary algorithmic complexity.

If you have to decide between the two, and you have a robust extended-nonce key-splitting scheme in place, opt for AES-CTR. But really, unless you’re a cryptography engineer well-versed in the nuances and failure modes of these algorithms, you shouldn’t even be making this choice.

Back to the top

AES-CBC vs. AES-ECB

Never use ECB mode. ECB mode lacks semantic security.

Block cipher modes that support initialization vectors were invented to compensate for this shortcoming.

Conclusion: If you’re trying to decide between these two, you’ve already lost. Rethink your strategy.

Back to the top

AES vs. Blowfish

A lot of OpenVPN configurations in the wild default to Blowfish for encryption. To the authors of these configuration files, I have but one question:

Why?! (Art by Khia)

Sure, you might think, “But Blowfish supports up to 448-bit keys and is therefore more secure than even 256-bit AES.”

Cryptographic security isn’t a dick-measuring contest. Key size isn’t everything. More key isn’t more security.

AES is a block cipher with a 128-bit block size. Blowfish is a block cipher with a 64-bit block size. This means that Blowfish in CBC mode is vulnerable to birthday attacks in a practical setting.

AES has received several orders of magnitude more scrutiny from cryptography experts than Blowfish has.

Conclusion: Use AES instead of Blowfish.

Back to the top

ChaCha vs. Salsa20

Salsa20 is an eSTREAM finalist stream cipher. After years of cryptanalysis, reduced round variants of Salsa20 (specifically, Salsa20/7 with a 128-bit key) were found to be breakable. In response to this, a variant called ChaCha was published that increased the per-round diffusion.

That is to say: ChaCha is generally more secure than Salsa20 with similar or slightly better performance. If you have to choose between the two, go for ChaCha.

Conclusion: Your choice (both are good but ChaCha is slightly better).

Back to the top

ChaCha vs. RC4

Don’t use RC4 for anything! What are you doing?

My reaction when I read that the CIA was using a modified RC4 in their Assassin malware instead of a secure stream cipher, per the Vault7 leaks. (Art by Khia)

RC4 was a stream cipher–allegedly designed by Ron Rivest and leaked onto a mailing list–that has been thoroughly demolished by cryptanalysis. RC4 is not secure and should never be relied on for security.

Conclusion: Use ChaCha. Never use RC4.

Back to the top

Cipher Cascades

A cipher cascade is when you encrypt a message with one cipher, and then encrypt the ciphertext with another cipher, sometimes multiple times. One example: TripleSec by Keybase, which combines AES and Salsa20 (and, formerly, Twofish–an AES finalist).

Cipher cascades don’t meaningfully improve security in realistic threat models. However, if your threat model includes “AES is broken or backdoored by the NSA”, a cipher cascade using AES is safer than just selecting a nonstandard cipher instead of AES. However, they’re necessarily slower than just using AES would be.

If you’re worried about this, your time is better spent worrying about key management, side-channel attacks, and software supply chain attacks.

Conclusion: Avoid cipher cascades, but they’re better than recklessly paranoid alternatives.

Back to the top

Symmetric Encryption Rankings

So with all of the above information, can we rank these algorithms into tiers?

Art by Riley

Sort of! Although it’s based on the above analyses, ranking is inherently subjective. So what follows is entirely the author’s opinion of their relative goodness/badness.

S	XChaCha20-Poly1305, AES-GCM-SIV
A	AES-GCM, ChaCha20-Poly1305
B	AES-SIV
C	AES-CTR + HMAC-SHA2, AES-CBC + HMAC-SHA2
D	AES-CCM
F	Any: AES-ECB, RC4, Blowfish Unauthenticated: AES-CBC, AES-CTR, Salsa20, ChaCha

Soatok’s ranking of symmetric encryption methods
https://soatok.blog/2020/07/12/comparison-of-symmetric-encryption-methods/

#AEAD #AES #AESGCM #AESGCMSIV #ChaCha20Poly1305 #ciphers #comparison #cryptography #encryption #NMRAEAD #ranking #SecurityGuidance #streamCiphers #symmetricCryptography #symmetricEncryption #XChaCha20Poly1305

speak no evil

2024-09-02 20:02:59

Idén újra vonatvakációztunk (és újra Interraillel), belejöttünk ebbe a fenntartható vakáció dologba. A célpont Anglia és Skócia volt.

Az útvonal

1. Amsterdam –> London, Eurostarral (sajnos Brüsszeli átszállással, az nem a kedvencem)
2. Innen rögtön Watford és Harry Potter Studios
3. Innen Plainham, és Straford-upon-Avon, Shakespeare’s Birthplace (or not) és kiválllló vacsi a Lambs étteremben (ha esetleg arra jársz…)
4. Ezután Stuffing és Stopping érintésével Staveley – Lake District, sok remek buszozással és kirándulással. Egy 1600-as években épült cottage-ban laktunk, ahol a házinéni kb. 70 éve tolta a vendéglátást, és nagyon élvezetesen sztorizott amikor csak találkoztunk (étkezések közben, tipikusan.
5. Utána Wasteonly és Layby, persze igazából az ikonikus Settle-Carlisle vasútvonal
6. Aztán Skócia egy hétig, itt autóztunk különféle várakba: a Camelot/mocsárvár/francia erőd Doune-ba, a Castle Urquhart-ba, és a Hegylakról elhíresült Eilean Donan-ba
7. Skócia után Scarborough (ami not so fair any more), és egy Helmsley-Rievaulx kirándulás
8. Utána York és a Shambles
9. …majd London, és vissza Amsterdam (szerencsére közvetlen Eurostarral, de vagy 2 óra késéssel az éjszaka kellős közepén).

Mielőtt a fotókra térnénk,

A legfőbb takeaway-ek

• Hot take: Skócia tulajdonképpen Norvégia fűvel.
• A Eurostarra maximum 7,5 cm-es pengehosszúságú kést szabad felvinni, ez dokumentálva van. Ami nincs, az az, hogy a késnek nem szabad önzáródónak lenni. Szóval: svájci bicska — OK; kis Gerber zsebkés — not OK. Ott is kellett hagynom az állomáson.
• A Harry Potter Studios a legprofibb kiállítás, amit valaha láttam.
• Angliában a távolsági buszjegy max. 2 font, szóval simán felülhetsz az egyik scenicebb buszjáratra ami bejár Ungot-Berket-Baranyát (pontosabban Windermere-t, Kendalt, Lancastert), és nézheted a tájat, falvakat, tavakat, erdőket az emeletről 74 megállón át. Mindegy hogy 1 megálló, vagy (esetünkben) 74, a jegy 2 font.
• (Egyszer láttunk egy adag — szerintem — F-35-öt is, illetve egyszer konfirmáltan a teljes Red Arrows-t, kötelékben, low level flyover közben. Azonnal kitört belőlem a harcászati repülés nörd.)
• Az angol tömegközelekedés állapota (legalábbis amerre mi jártunk, amiben azért volt város és vidék is) nagyon jó. Késések vannak, de a vonatok-buszok tiszták, töltő van mindehol, nem kell helyjegyet venni, és a legkisebb falunak is van hatékony tömegközlekedése.
• A lovak szívritmusa egészen elképesztő: nyugalmi állapotban 28-46, terhelés alatt viszont 260-ra is fel tud menni! Az olyan, mintha nekem futás közben 500-600-as lenne a pulzusom. Nem csoda hogy a lovak jobban futnak mint én!
• Ebből az utazásból hiányzott az az “ülünk az állomáson és olvasunk” slowdown-feeling, ami a skandináv vakáción annyira bejött. Aztán persze rájöttünk, hogy ennek az az oka, hogy Angliában átlag 10-20 percet vársz max. a csatlakozásra, míg mondjuk Svédországban voltak órás üresjáratok is.
• Az utazásunk során kb. heti 60 km-t gyalogoltunk, egy részét túrahátizsákkal. Rocksztár gyerekeink vannak, egy zokszó nélkül tolták végig ők is.
• Bejártuk e hely minden zegét s zugát a Lake District, a North York Moors, és (kis csalással, mert nagyon a szélén, de) a North Yorkshire Dales nemzeti parkokat. Skóciában kevésbé kirándultunk, mert ott autózás és futás ment inkább.
• Az időjárás nagyon kegyes volt hozzánk, talán 1-2 nap volt amikor esett, ezek közül az egyik London (ami nem is lenne London, ha nem áznánk szarrá egyszer); illetve a Bronte vidéken stílusosan akkora szél volt, hogy majdnem visszafordultunk. Üvöltő, ugyebár.
• Angliában nagyon kevés a macska.

Fotók

Shakespeare szülőháza! (Vagy nem…)

Sétáltunk egyet a Wythburn Church környékén

Sétáltunk egyet a Wythburn Church környékén

Sétáltunk egyet a Wythburn Church környékén

Megmásztuk a Place Fell csúcsot (657 m)

Megmásztuk a Place Fell csúcsot (657 m)

Megmásztuk a Place Fell csúcsot (657 m)

Megmásztuk a Place Fell csúcsot (657 m)

Megmásztuk a Place Fell csúcsot (657 m)

Megmásztuk a Place Fell csúcsot (657 m)

Elzarándokoltunk Helmsleyből Rievaulx-ba

Helmsley se semmi…

…de Rievaulx beszarásszép…

…egy teljes középkori kolostorrom…

…a semmi közepén.

Random North York Dales táj

Peace was never an option

A Settle vasútállomás. Egy csomó ilyen védett vasútállomáson mentünk át, már ezért megérte a vonatozás.

We’re Knights of the Round Table, we dance when ere we’re able

Scottish Highlands skanzen

Innen (a Castle Urquhart-ból) lesték eleink a Loch Ness-i szörnyet

Semmi zörej!

Semmi Ness!

Eilean Donan Castle – csak egy fotó maradhatott

Ez meg már Oxenhope környéke…

…a vidék, ami az Üvöltő szeleket ihlette…

…és az Üvöltő szelek szemafor változatát…

Nem zörög a hanga, ne nem szarik a haraszt

Ez maga a Bronte Falls

Random North Yorkshire táj

Random North Yorkshire víztározó

York Minster…

Ezt is Duct Tape tartja össze

Jók!

https://lipilee.hu/2024/09/02/training-britain-aka-interraileztunk-angliaban/

#anglia #onTheRoad #photo #skócia #UK

Horse Heart: A Guide To Rate, Size, And Function

Find out what a horse's heart rate should be and why it's essential. Also included is exciting information about the size and functions of horse hearts.

^{Miles Henry (horseracingsense.com)}

Roy Gardiner

2021-05-10 21:12:29

Plan called on to resolve Hitachi Class 800 cracking and network disruption

https://www.globalrailwayreview.com/news/122692/uk-government-hitachi-class-800/

UK government calls for action plan following Class 800 train cracking and subsequent disruption

The UK Rail Minister has requested a comprehensive plan from Hitachi to identify the extent of cracking found on some Class 800 Series trains, and has asked the rail industry to urgently set out a strategy to resolve prolonged passenger and network disruption.
hitachi class 800 gwr

It was announced on 8 May 2021 that, following maintenance checks on the Hitachi Class 800 Series trains in the UK, cracks were identified on part of the chassis of some trains, resulting in the vast majority of Great Western Railway (GWR) and a significant number of London North Eastern Railway (LNER) and TransPennine Express (TPE) trains to be taken out of service to undergo further inspection.

A spokesperson for Hitachi Rail has said: “Safety is our number one priority and, as a precaution, the decision was taken to halt the entry into service of our intercity fleets pending inspection. We understand the frustration caused, and we would like to apologise for the inconvenience caused to passengers and operators. Having been cleared for service, some trains are now running again across the network. We are working as quickly and safely as possible to investigate the issue across the remainder of the fleets.”

#Transport #Rail #UK #Hitachi

Roy Gardiner

2021-04-09 22:16:47

The Queen has lost her protector, but everything they built together lives on

In marrying for love, the Queen pulled off a rebellious feat for a monarch – and forged a terrific team that stood the test of time
Allison Pearson
9 April 2021 • 7:18pm
Allison Pearson

The Queen flashes a smile at Prince Philip, during the Trooping the Colour parade in 2009



If you surprised yourself by shedding a tear – as millions of us did – when you heard that Prince Philip was gone, no small part of that sadness will have been for his widow, our Queen and his beloved wife.

In 62 days, Her Majesty would have been able to send the Duke of Edinburgh a telegram for his 100th birthday. That would have amused them both. (They never stopped laughing together.) If he could possibly have hung on to give her that satisfaction, you just know that he would. For that was his job, always and until his final breath. He was her champion, “my strength and stay all these years,” the Queen called him on their Golden Wedding anniversary. Who will be there for her now he is gone?

Elizabeth and Philip, Philip and Elizabeth, their names and their destinies braided tightly together since their marriage 73 years ago in Westminster Abbey. The bride on that freezing November day appeared to be almost levitating with happiness, and no wonder.

The ridiculously handsome groom was an impecunious Greek prince (mainly Danish actually) out of a Hans Christian Andersen fairytale. Not for her some three-chinned Earl. Mrs Philip Mountbatten (as she would never be known) had pulled off one of the most daring feats ever observed in a constitutional monarchy. She had married for love.

Philip and Elizabeth, they must have thought they had 20 years to themselves, when they could raise a family and he could become Admiral on merit, before her father, King George, died and the door on the cage of Royal duty clanged shut. It was not to be.

Just four and a quarter years later, they were back in the Abbey for the Coronation and that restless, questing, charismatic man was kneeling before her, making a solemn promise: “I Philip, Duke of Edinburgh, do become your liegeman of life and limb and of earthly worship; and faith and truth I will bear unto you, to live and die against all manner of folks. So help me God.”

That was always the deal. To be her eyes and her ears, to speak truth unto Majesty. To not lie to her, nor fawn or flatter as others would. The Duke was the only one who dared shout at the Queen (she was known to yell back, particularly when he criticised her driving). Hers was the loneliest job in the world. Because she was a human to him before she plighted her troth to God, he made it less lonely.

All marriages are complicated. Philip and Elizabeth’s, it’s fair to say, was on another level. On Coronation Day, the flesh and blood woman he had taken for his wife was suddenly his anointed sovereign. A report in The Telegraph captured the metaphysical moment when the two roles – of husband and subject – became one: “She took his hand in hers before he drew back to touch the Crown and to kiss her on the left cheek.”

An impatient dynamo who passed out as best all-round cadet in his class at Dartmouth, Lieutenant Philip Mountbatten was destined to be a leader of men. From then on, he would follow a woman. It was a huge ask for an Alpha male of his generation. But if Elizabeth ruled the country, Philip’s word was law at home, even when she disagreed with him (about Prince Charles’s schooling to take one example).

So indispensable did he become to our national life that we now feel that, if there had never been a Duke of Edinburgh, it would have been necessary to invent him. It’s very easy to forget that, when he first came on the scene, Philip was considered a risk by a xenophobic Establishment. “Moustache types bristling away about ‘ghastly foreign fellows’, especially after the war,” as one courtier recalled.

But Lilibet loved him from the first time she saw him, when she was just 13 years old, and refused to consider more suitable candidates. You could say that he was her one act of rebellion, she his one act of conformity.
The Queen and Prince Philip in 2012
The Queen and Prince Philip in 2012 Credit: WireImage

Such different characters, they made a terrific team. As Sir John Colville, private secretary to Princess Elizabeth before she married, noted, “The Queen was frightfully good at knowing when to say ‘No’, though not so good at saying ‘Yes’. Philip on the other hand is good at ‘Yes’. Not the sort of yes-man who agrees with everyone else, but the sort of yes-man who will take a risk.” Today, the monarchy retains much of its pomp, but it had shed a lot of its pomposity thanks to a modernising Duke’s influence over his more traditionalist wife.

They were never openly romantic. Asked once to sign a copy of a mushy book about the Royal couple called Manifest Destiny, Philip crossed out the title and wrote “Manifest Bunkum”. Bunkum was a favourite word, so was travesty.

If they were not given to public displays of affection, the couple were bound together by the invaluable adhesive of humour. One of my favourite photographs shows the Queen, her head back and roaring with laughter in front of a Guardsman, his busby sunk low over his eyes. It was Philip, he was teasing her, and her whole face lit up as it had on that freezing November day seventy year before.

Elizabeth and Philip, like any long union, theirs had its secrets. In the late-Fifties, the Duke went on a voyage of self-discovery, leaving his wife at home for four months with the two children. For the prurient, the ten-year gap between the births of Charles and Anne and those of Andrew and Edward – two separate families almost – speaks of a possible drifting apart and eventual reconciliation. None of that matters today.

All the rumours and the gossip fall away and what remains is an enormous sense of gratitude for a magnificent marriage, a monument to patient and tender longevity. After seven often turbulent decades, the Queen and her handsome Prince were a sterling example of the unfashionable virtue of perseverance, of sticking to your vows.

It’s already been such a tough year for the Queen. A dark cloud of suspicion removed Prince Andrew from public life, then came the Duke and Duchess of Sussex with their petulant, cruelly-timed allegations of racism and insensitive treatment when Harry’s grandfather was ill. Throughout lockdown, Her Majesty has tried to keep the nations’ spirits up with stirring speeches (“We’ll meet again”) and Zoom calls. One consolation must have been that husband and wife were isolating together at Windsor, without the call of multiple engagements, ending married life as they began it all those years ago.

Prince Philip’s oldest friend, from his Navy days, recalled that “the Queen always came before everything else for him, how determined he was that everything he did should be for the benefit of his wife, both as a person and as Her Majesty”. Of all the many services the Duke performed for his country, that was the greatest. While he lived, we could take the monarch’s stability and contentment utterly for granted.

Now, at the age of 94, the Queen faces the future without her liegeman of life and limb, of faith and truth. The nation’s heart goes out to her. Her loss is our loss. When she grieves, we grieve.

Her family, particularly her heirs, Prince Charles, and Prince William, who is devoted to his grandmother, will rally round, but the Windsors, who have a tendency to keep their distance, need to draw much closer. Princess Anne, most like her father of all the children, will be a huge consolation and support to her mother.

Today, as we mourn a great and irreplaceable national character, we may half-fear that this is but a dress rehearsal for the sorrow we will feel when we lose our Queen. Not yet, please, not that, not yet. Her champion and protector is gone, but everything they built together lives on.

How blessed we were, Elizabeth and Philip.

https://www.telegraph.co.uk/royal-family/2021/04/09/queen-has-lost-protector-everything-built-together-lives/

#PrincePhilip #DukeOfEdinburgh #UK #QueenElizabeth