Hacker News Reader

Comment by adrienthebo | Hacker News Reader

GOST seems like an oddball; it's been around for a long time but doesn't seem like it got any traction outside of Russia. To the best of my knowledge GOST cipher suites were never accepted into TLS, there was a draft (http://tools.ietf.org/id/draft-chudov-cryptopro-cptls-04.htm...) but it expired in June 2009. Given that it's not in TLS, isn't widely used, there aren't good reasons to use GOST over AES, and GOST is considered "deeply flawed" (https://en.wikipedia.org/wiki/GOST_(block_cipher)#Cryptanaly...) I wouldn't be surprised if GOST implementations in a number of other places were equally broken.

View on HN

Three reasons we sometimes see GOST (there are probably lots more; these are just the ones I'm aware of):

* It's a block cipher with a large key that was well-known in the mid-90s, when TripleDES was the best-practice.

* Its big competitor for the time, IDEA, had IP issues, so if you were looking for "natively better than DES", you might land on GOST.

* Schneier wrote about it in Applied Cryptography (blech; spit).

I think similar logic applies to why we still see RC4; when it was finally revealed, after having been an RSA, Inc trade secret for years, it was the only regularly-available stream cipher with any kind of pedigree. Since 99 times out of 100 when you're encrypting data with a computer you're really asking for a stream cipher, RC4 got a lot of use.

Obviously: don't use GOST or RC4 or TripleDES or IDEA (or Blowfish).

May I ask why you include Blowfish in the blacklist? I'm relatively new to the technical side of computers but I use Blowfish (as implemented in GPG) to encrypt my password and other files.

1. You shouldn't encrypt passwords. https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass...

2. Blowfish and bcrypt are totally separate, if that's what you meant.

3. It has a 64-bit block size.

Oops I think I was a bit unclear. I encrypt my passwords file (which contains other information too, like credit card details and so on), much like how password managers like keepass do, but I do it manually with gpg set to use the blowfish cipher.

Don't use Blowfish.

What about legacy applications that rely on Blowfish? :)

Burn them.

Haha, allright then. I was recently shopping for a backup system and I guess I made the right choice when I avoided the one that made use of Blowfish.

It's considered "deeply flawed" by one (rather famous) cryptographer. And by "deeply flawed" he meant [1] that if the attacker has 2^64 plaintext/ciphertext pairs, he can then attack ciphertext 256 times faster than by bruteforce.

The relevance of this "deep flaw" to a realistic attack is unclear. (The attacker will need at least 0.25 zettabyte storage for those plaintext/ciphertext pairs - and don't forget about the time and bandwidth for obtaining them...)

TL;DR: GOST 28147-89 is an old cipher. You shouldn't use it today because there are newer and stronger algorithms available. But for its time, it was a brilliant algorithm, and attacking it still requires NSA-level resources.

And if you are interested and can read Russian, see [2] for a summary of known ways to attack GOST.

[1] http://eprint.iacr.org/2011/211 [2] https://ru.wikipedia.org/wiki/Криптоанализ_ГОСТа_28147-89

Reply on news.ycombinator.com