[blazingice]

I'd be the first to tell you that I don't understand crypto. Most people don't.

You're unwilling to have this conversation again; I understand. Do you have a link to one of your talks? I'd be interested in watching.

Can you at least tell me what definition you're using for "fall", if not key retrieval? Replay attack? Information leakage?

Edit:

> "I don't understand the vulnerabilities you're talking about so I'm going to assume there's something basic about how stuff works that I grasp but you do not"

Sorry if it came off that way! I'm assuming that you understand something basic about how this works that I do not, and wondering what it is :)

[tptacek]

The security of most block ciphers revolves, in some ways, on the difficulty of brute force iterating through very large numbers --- 2^128, say.

"Byte-at-a-time decryption" means creating a scenario where attackers can brute force numbers like 2^8, winning a single byte of "plaintext" (or whatever the equivalent is depending on the primitive you're targeting). If your block size is 16 bytes long, the attacker might have to brute force 2^8 16 times; with a laptop, you might be talking about whole seconds of work.

Block cipher attacks generally never recover crypto keys.

I am being intentionally vague. Not because I want to keep information from you, but because I don't want to create yet another crypto thread that gives developers a false sense of knowing what the risks are when building crypto.

If this is something you're seriously interested in, and you can code in any programming language, email me and I'll give you a syllabus of straightforward things to work on.

[ircmaxell]

Ok, you have me confused. I half want to raise the BS flag...

Could you explain something here? How can a block cipher that has 128 bits of output be attacked 8 bits at a time (where 1 bit change in the input will change on average 64 bits of the output in a non-predictable manner)? Sure, you can try every 8 bit permutation, but without knowing the form of the original text how can you know if you have a valid character? And how is that different from extracting "raw data" out of pure randomness (where the fallacy is obvious, you're extracting data that was never there)?

I'm genuinely interested, so if an email will do it, could you please follow up: ircmaxell [at] php [dot] net...

Thanks!

[tptacek]

If I sound smart about any of this stuff, alarm bells should be going off in your head, because in terms of testing and breaking crypto, I am a piker.

I think you get my point now. Maybe rethink the crypto stuff in your pledge.