Emscripten and ClojureScript: Transpiling to Avoid Rolling Your Own Crypto

Re:Emscripten and ClojureScript: Transpiling to Avoid Rollin... by tptacek on Wednesday November 18, 2015 @03:29PM (#10590513)

It is super weird to see new code using Skein; doing that almost by definition implies you're rolling your own crypto (which has more to do with how you connect crypto primitives than which primitives you choose), but it's never made clear in this post exactly what they're doing with it.

[ Parent | on HN ]

Re:Emscripten and ClojureScript: Transpiling to Avoid Rollin... by dchest on Wednesday November 18, 2015 @04:02PM (#10590727)

From https://www.balboa.io/security.html:

"Skein-1024-CTR, with Skein-1024 as an HMAC in an encrypt-then-mac scheme"

I guess Skein-CTR is based on "Skein as a Stream Cipher" section from the spec.

https://github.com/pkcsecurity/trabant/blob/master/pkc_skein...

From homepage: "We use 1024-bit symmetric key encryption, a stronger level of encryption than most industry standards."

I guess the reason for using Skein is so that they can use this bullshit marketing :)

[ Parent | on HN ]

Re:Emscripten and ClojureScript: Transpiling to Avoid Rollin... by tedunangst on Wednesday November 18, 2015 @05:02PM (#10591098)

"1024-bit symmetric key encryption" certainly has the flavor of a statement which is technically correct, but designed to be favorably misinterpreted. I'm surprised they didn't mention that Skein is gluten free.

[ Parent | on HN ]

Re:Emscripten and ClojureScript: Transpiling to Avoid Rollin... by tptacek on Wednesday November 18, 2015 @04:07PM (#10590756)

Skein HMAC? Why? Skein was designed not to need the HMAC construction.

[ Parent | on HN ]

Re:Emscripten and ClojureScript: Transpiling to Avoid Rollin... by dchest on Wednesday November 18, 2015 @04:08PM (#10590763)

It looks like they are actually using keyed Skein and call it HMAC

https://github.com/pkcsecurity/trabant/blob/master/pkc_skein...

[ Parent | on HN ]

Re:Emscripten and ClojureScript: Transpiling to Avoid Rollin... by bpolverini on Wednesday November 18, 2015 @05:07PM (#10591127)

You're right. To be honest, the reason why we don't use it the way it is described in the paper, is entirely out of fear of misconfiguring the Skein context. The NIST reference implementation for Skein doesn't provide a simple way or an example for building the valid configuration for the HMAC construction they recommend, and we always wanted to feel like we had a wall to our back (i.e. being able to check against the NIST implementation or to check against test vectors). They do mention in the paper that doing the keyed mac approach is provably safe, which just felt easier to implement.

[ Parent | on HN ]

Re:Emscripten and ClojureScript: Transpiling to Avoid Rollin... by squidlogic on Wednesday November 18, 2015 @03:50PM (#10590637)

Interesting thought, "rolling your own crypto" seems to be something of an accordion term. I took it to mean creating your own crypto primitives, but I guess there are plenty of opportunities to mess up security while writing code.

[ Parent | on HN ]

Re:Emscripten and ClojureScript: Transpiling to Avoid Rollin... by hackcasual on Wednesday November 18, 2015 @04:58PM (#10591075)

Wasn't one of Skein's selling points how optimized it was for Intel's newer architectures? asm.js isn't going to be able to leverage that.

[ Parent | on HN ]

Re:Emscripten and ClojureScript: Transpiling to Avoid Rollin... by bpolverini on Wednesday November 18, 2015 @05:01PM (#10591088)

Yeah, it is. We use the optimized 64bit version through JNI in our backend.

[ Parent | on HN ]

Re:Emscripten and ClojureScript: Transpiling to Avoid Rollin... by tptacek on Wednesday November 18, 2015 @05:16PM (#10591176)

Why are you using Skein at all? It doesn't look like you have a problem that is hard for AES-CTR or Salsa/Chacha to solve.

[ Parent | on HN ]

Re:Emscripten and ClojureScript: Transpiling to Avoid Rollin... by bpolverini on Wednesday November 18, 2015 @05:44PM (#10591308)

Definitely right about that.

The biggest reason was familiarity with the Skein NIST implementation--I've dug through it in the past in research and the like, so I wanted to leverage some experience there. We decided against just using crypto_secretbox from NaCl because it doesn't have a way for us to simply pause and resume to keep from blocking our UI thread on big files. We thought about trying to bolt ways into seeking into the stream output of crypto_stream, but that wasn't performing well. We went as far as trying to use crypto_secretbox in an Asm.js-ified WebWorker, but the performance hit was just too big, so we knew we had to find a way to "schedule" our encryption, otherwise our React.js app would crawl. The reason I passed on AES is far less justifiable, but important to me for aesthetic reasons: Using Skein just seemed like way more fun. Programming without whimsy is drudgery.

My next blog post will cover some of these decisions and performance tradeoffs in more detail with some code. Since you mentioned it, I will add an AES-CTR implementation into the metrics so people can see. I'm curious myself to see how we stack up!

[ Parent | on HN ]

Re:Emscripten and ClojureScript: Transpiling to Avoid Rollin... by tptacek on Wednesday November 18, 2015 @06:07PM (#10591408)

The reason I passed on AES is far less justifiable, but important to me for aesthetic reasons: Using Skein just seemed like way more fun. Programming without whimsy is drudgery.

You seem like you know what you're talking about but that last sentence is approximately the scariest thing any software developer working with crypto has ever said.

[ Parent | on HN ]