Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Let the math alone be the driver in this domain. What is solid and true will eventually trickle up.

Unless you have some way of proving that one-way functions exist, which would imply as a consequence P ≠ NP, this is literally untrue (unless by "eventually" you mean "one day centuries hence, maybe we'll prove P ≠ NP"). There is not a single piece of crypto that can be proven correct today; all crypto that we use is safe because mathematicians have so far been unable to find a practical way to break.

This requires mathematicians to be actively trying to break the crypto, so personalities matter because you can't get a worldwide community of experts to study every random person's algorithm. This also requires mathematicians to have a sense of which ways a particular algorithm might be fragile, even if they can't break it quite yet, which requires some non-mathematically-provable trust in the cryptanalyst's good sense.

And, of course, if you believe that a certain cryptographer might be inserting back doors or prone to approving crypto that has back doors (see for instance Dual_EC_DRBG), you might distrust other output from that same cryptographer even if you can't prove anything yet.



Not only is One-time pad proven secure, it is also obvious without any knowledge of math.


It is not secure: it doesn't provide authentication (integrity protection) and it isn't nonce-reuse-resistant.


Integrity can be provided with a Wegman-Carter scheme, which come with a security reduction. The combination one-time pad + poly1305 for instance is provably secure. It's just impractical, and you have to rely on your chacha20 random number generator from /dev/urandom anyway.

Also good luck finding a nonce-reuse resistant algorithm.


Does the correctness of Poly1305 not depend on P ≠ NP? I guess this boils down to whether the correctness of AES depends on P ≠ NP, which it might not since it's symmetric?

The failure modes of reusing a nonce are never good, but some are far worse than others. The one-time pad's failure mode is particularly disastrous; it leaks the XOR of two plaintexts. There are a good number of algorithms that only leak whether the same message was repeated.


> Does the correctness of Poly1305 not depend on P ≠ NP?

Not that I know of. As far as I know the security reductions are unconditional.

Even worse than revealing the XOR of 2 plaintexts is the key recovery enabled by GCM (source: other comments in this thread). And if you're that scared of nonce reuse, just

Nevertheless, it doesn't matter. Avoiding nonce reuse is easy. And if you're really scared, just use a random nonce from a big enough space (192 bits, like XChacha20, are good). That way if you have access to a random source, you can turn any encryption algorithm into a nonce-less algorithm.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: