Hacker News Reader

Comment by dragontamer | Hacker News Reader

Or... you can have a more nuanced viewpoint and note that CBC is really, really, really easy to implement, and _really_ doesn't fall into that category of discussion.

The reason you don't implement your own block ciphers is because side-channel attacks are damn near impossible for normal programmers to understand. Especially timing attacks.

But block-modes of operation? Some of them are really easy. I've ever heard of a bad implementation of CBC causing a security bug.

-------

I'd say you shouldn't implement your own GCM mode. GCM is quite complex, and the Galois Field's authentication bits could be side-channeled if you don't know what you're doing.

CBC? Where's the flaw? Its so stupid simple I don't think that even a novice would make a critical error.

View on HN

You keep saying "the Galois Field" as if that was a thing. It's GCM. The components of GCM are CTR mode and the GMAC authentication code, which is based on GHASH. If you're afraid of Galois fields, you don't get to use AES at all! Nobody should be implementing any of these primitives themselves, very much including CBC, which, as you saw downthread, left both you and the author of this project with an insecure cryptosystem.

Vulnerabilities in CBC systems were for a long time during the 2000s the most common crypto vulnerabilities on the Internet. There are more things that go wrong with CBC mode than just forgetting to authenticate it!

> You keep saying "the Galois Field" as if that was a thing

You're kidding, right? You've never looked at how GCM-mode works? The entire set of math is inside of the GF(2^128) field. That's why its called a Galois Counter Mode.

I don't think anyone should be implementing their own GCM mode. Its very subtle and potentially full of traps. CBC on the other hand is pretty dumb and simple, and surprisingly secure and robust

> Vulnerabilities in CBC systems were for a long time during the 2000s the most common crypto vulnerabilities on the Internet. There are more things that go wrong with CBC mode than just forgetting to authenticate it!

If they're so common, you shouldn't have much of an issue naming one such vulnerability.

The math used in AES (Rijndael) utilize operations in GF(2^8) tho, so you're doing operations using Galois fields whether your utilizing GCM or CBC. I don't really see how adding the GCM mode utilizing GF(2^128) on top is significantly more difficult or error prone than implementing the AES block cipher itself. You should still be familiar with operations over Galois fields regardless if you've for some reason (foolishly imo) decided you want to implement AES cryptographic primitives on your own.

Regardless there's no good reason not to use a vetted open source implementation instead, preferably with an even higher level of abstraction so your not having to worry about ciphers or modes of operation at all[1].

[1] https://doc.libsodium.org/secret-key_cryptography/secretbox

The library used in this Javascript widget has AES already implemented, but not GCM mode.

> Regardless there's no good reason not to use a vetted open source implementation instead, preferably with an even higher level of abstraction so your not having to worry about ciphers or modes of operation at all[1].

I think that's generally the preferred solution, yes.

I think some of my comment went over your head.

BEAST and POODLE were both high profile attacks against how SSL used CBC.

But neither were attacks on CBC itself. That is to say: to "fix" BEAST or POODLE, you don't change a lick of CBC code at all.

> Or... you can have a more nuanced viewpoint

The nuanced viewpoint is never implement your own cryptography.

> Its so stupid simple I don't think that even a novice would make a critical error.

Ask Microsoft about that one: https://learn.microsoft.com/en-us/security-updates/securityb...

That's a Padding Oracle vulnerability, not a CBC error.

It's a CBC padding oracle, intrinsic to the operation of CBC --- if you PKCS7-pad some other mode, you do not get the same attack --- the single best-known cryptographic vulnerability on the Internet, and the parent commenter took the time to give you the most famous instance of it. For the record: that's also not the only CBC vulnerability.

The padding is a key part of using a block cipher in CBC mode.

I’m not sure why you’re ferociously defending the practice of implementing your own cryptography. It’s well known that this is a horrible idea for good reason.

Padding is an important part of CBC.

Reply on news.ycombinator.com