A
Adam Langley
imperialviolet.org · Personal blog · on HN since 2008
Adam Langley, a Google security engineer, writes about TLS, certificates, browser security, and authentication such as WebAuthn.
What HN saysCommenters recommend it as the best explanation of WebAuthn and passkeys, and cite his analysis of Apple's goto fail bug.
346HN people shared it
241linked it in comments
164stories submitted
6.5Kstory points
3 months agolast shared
2008people per year2026
Most-shared posts
- 1Overclocking SSL33 people · 141 points · first shared 2010 · 21 comments on HN
- 2Public key pinning coming in Chrome 1331 people · 69 points · first shared 2011 · 15 comments on HN
- 3Apple's SSL/TLS bug23 people · 418 points · first shared 2014 · 281 comments on HN
- 4Revocation checking and Chrome's CRL21 people · 36 points · first shared 2012 · 7 comments on HN
- 5Adam Langley: Playing with the Certificate Transparency pilot log15 people · 1 points · first shared 2013 · discussion on HN
- 6No, don't enable revocation checking14 people · 180 points · first shared 2014 · 155 comments on HN
- 7Cryptographic Agility13 people · 106 points · first shared 2016 · 31 comments on HN
- 8Why not DANE in browsers13 people · 65 points · first shared 2015 · 29 comments on HN
- 9Revocation doesn't work10 people · 5 points · first shared 2011 · discussion on HN
- 10How to botch TLS forward secrecy9 people · 146 points · first shared 2013 · 18 comments on HN
- 11TLS Symmetric Crypto8 people · 118 points · first shared 2014 · 15 comments on HN
- 12DNSSEC authenticated HTTPS in Chrome8 people · 30 points · first shared 2011 · 5 comments on HN
- 13Security Keys8 people · 12 points · first shared 2018 · discussion on HN
- 14Implementing fixes for the Lucky Thirteen attack on TLS CBC8 people · 11 points · first shared 2013 · discussion on HN
- 15Revocation still doesn't work8 people · 8 points · first shared 2014 · 2 comments on HN
What HN people wrote when they linked it
snowstormsun · 2023-11-19
For fido2 and passkeys, I'd recommend Adam Langley's blog: https://www.imperialviolet.org/
zerotolerance · 2026-02-12
Apple has some of my favorite vulnerabilities, most notably GOTO Fail: https://www.imperialviolet.org/2014/02/22/applebug.html
GauntletWizard · 2022-09-07
I'm aware. That trust model is inherently broken, and it's not followed anyway. In practice, any CA you trust can sign a revocation for any certificate (the serial numbers are all grouped together) - And that's the way it should be. You should not wait for the issuing CA to get it's act together, you should burn a certificate as soon as anyone distrusts it, and if you have a rogue CA that starts burning Google.com and other important sites, it's better that they burn them (and take you offline) than that they issue false certs (and leak all your data); It's also far more obvious.
https://www.imperialviolet.org/2014/04/19/revchecking.html
Revocation checking is useful for your security team to blacklist site. That's the only useful use.
psanford · 2022-02-05
Adam Langley's blog about webauthn is still the best resource that explains how everything fits together: https://www.imperialviolet.org/2018/03/27/webauthn.html
dane-pgp · 2021-01-17
> Krypton is built on top of an end-to-end verified and encrypted architecture. This means zero trust. We, Krypt.co, cannot access your keys or see where you're authenticating. The keys only live in the Krypton app on your phone.
Sounds great, except one of the "ends" is likely the Secure Enclave (iOS) or Keystore (Android), over which the user has basically no control. So while the architecture might require "zero trust" of Krypt.co, it still requires complete trust of Apple or Google.
Perhaps completely trusting one of those companies is already the reality for nearly everyone, in terms of using a mobile device to access online data, but hopefully WebAuthn-supporting sites don't put extra restrictions on the devices you can use, via the "feature" of attestation:
https://www.imperialviolet.org/2019/01/01/zkattestation.html
tialaramex · 2020-12-24
A Security Key is a physical object. For example here are some reviews by tech press people:
https://www.zdnet.com/article/best-security-key/
https://www.wired.co.uk/article/best-security-keys
Or here's an actual expert writing about them a few years ago if you suspect "tech press people" are worthless:
https://www.imperialviolet.org/2018/03/27/webauthn.html
Or, more practically, if you have a nice phone, try visiting it on that. If it's a relatively modern iPhone or high end Android with a touch sensor running the current OS version you can use that.
Since you mentioned Mac keychain, if your Mac has TouchID that will work on the current OS (in Safari at least) too. Some Windows PCs with fingerprint sensors likewise.
dwenzek · 2020-05-14
The https://saltpack.org/ web-site links to a insightful post about authenticated encryption with associated data (AEAD) and the shortcomings addressed by saltpack: https://www.imperialviolet.org/2015/05/16/aeads.html
wereHamster · 2018-09-13
Privacy is still a worthwhile goal.
Also, HTTPS is not expensive, contrary to popular belief.
> On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that.
(source: https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html)
chrismorgan · 2018-04-10
What I would really like is a straightforward migration guide for those of us already using the FIDO U2F JS API, to help people migrate in a backwards-compatible way from the old, poorly-documented stuff to the new, currently poorly-documented but very soon better-supported stuff.
So far, https://www.imperialviolet.org/2018/03/27/webauthn.html is the closest; it’s good, but I’d love to have something with more straightforward instructions—“so you currently use U2F? Change this to this, that to that, do this to maintain compatibility and you’re roughly done”. We’ll figure it out for FastMail, but if the migration is straightforward and well-documented it’ll help all the web services out there to move sooner rather than later, which as a user I would very much like.
kruhft · 2018-01-29
From their Learning IOTA FAQ:
What makes IOTA quantum-secure?
IOTA uses hash-based signatures (https://www.imperialviolet.org/2013/07/18/hashsig.html) instead of elliptic curve cryptography (ECC). Not only is hash-based signatures a lot faster than ECC, but it also greatly simplifies the overall protocol (signing and verification). What actually makes IOTA quantum-secure is the fact that we use Winternitz signatures. IOTA's ternary hash function is called Curl.)[1]
Curl is designed by Genetic Algorithm. I wonder how they could test this? Did they 'do the math'?
[1] https://learn.iota.org/faq/what-makes-iota-quantum-secure
Matt3o12_ · 2017-12-29
This might be a bit off topic but I wonder why the vulnerability has been patched this way:
if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
goto Efault;
Why doesn’t the if use curly brackets? I thought it has been established that it is best practices to always use curly brackets even if they are explicit, especially after Apple's infamous goto bug[1].
Secondly, why does it use goto at all? I thought it has also been established not to use goto unless it is the only performant solution (and performance is important in that case). Sure Efault with probably kill the program but wouldn’t it still be better to use a function call considering that the desired resolution should be the same?
[1]: https://www.imperialviolet.org/2014/02/22/applebug.html
flignats · 2017-12-18
"IOTA uses hash-based signatures (https://www.imperialviolet.org/2013/07/18/hashsig.html) instead of elliptic curve cryptography (ECC). Not only is hash-based signatures a lot faster than ECC, but it also greatly simplifies the overall protocol (signing and verification). What actually makes IOTA quantum-secure is the fact that we use Winternitz signatures. IOTA's ternary hash function is called Curl."
dgacmu · 2017-10-17
Why to use security keys: http://fc16.ifca.ai/preproceedings/25_Lang.pdf
(updated from my earlier link to the yubico article about that paper: https://www.yubico.com/2016/02/use-of-fido-u2f-security-keys-focus-of-… )
Review of security keys by Adam Langley:
https://www.imperialviolet.org/2017/08/13/securitykeys.html
and testing security keys:
https://www.imperialviolet.org/2017/10/08/securitykeytest.html
tl;dr: Yubikeys are $$ but really solid for USB and NFC; the Feitian is probably the best option for Bluetooth but YMMV there. Those are what I personally use.
(Note that Yubico recently announced a problem with their RSA key generation, which they're fixing, but that bug does not affect the security of the device when used as a FIDO authenticator as it is for Google/Github/Dropbox/Vanguard/etc.)
morecoffee · 2017-02-28
Amazing how this was predicted coming on a year ago*
> At this point it's worth recalling the Law of the Internet: blame attaches to the last thing that changed.
> There's a lesson in all this: have one joint and keep it well oiled.
> When we try to add a fourth (TLS 1.3) in the next year, we'll have to add back the workaround, no doubt. In summary, this extensibility mechanism hasn't worked well because it's rarely used and that lets bugs thrive.
* https://www.imperialviolet.org/2016/05/16/agility.html
barsonme · 2016-05-31
Streams can be encrypted and decrypted, even arbitrarily. Here's a good read by Adam Langley: https://www.imperialviolet.org/2014/06/27/streamingencryption.html
tptacek · 2015-11-12
No. See:
https://www.imperialviolet.org/2015/01/17/notdane.html
There are 3873497 CAs your browser has to trust today. DANE adds a 3873498th and a 3873499th, and the ones it adds are controlled by NSA.
The solution to the CA problem is to drastically reduce the power CAs have, which is what is happening with key pinning and certificate transparency and whatever follows that.
The solution to the CA problem can't possibly be "create a new super-CA controlled by governments".
emaste · 2015-02-17
This is a very good point, one that I missed in my followup on the FreeBSD-CURRENT mailing list. See also https://www.imperialviolet.org/2013/06/15/suddendeathentropy.html
bradleyjg · 2014-12-29
There's a section in the tweetNaCl paper that discusses some limited formal verification.
For some interesting commentary on the difficulty in formally verifying c code (with crypto examples) see:
https://www.imperialviolet.org/2014/09/07/provers.html
and the followup
https://www.imperialviolet.org/2014/09/11/moveprovers.html
edwintorok · 2014-12-09
I like the alternative described here: https://www.imperialviolet.org/2014/02/27/tlssymmetriccrypto.html
"The end result is that Chrome talking to Google uses AES-GCM if there's hardware support at the client and ChaCha20-Poly1305 otherwise."
It seems to be specific to Chrome though, and all TLS clients would have to reimplement that choice.
Would be good if there was a way to tell the SSL library to give you the best cipher that works on your hardware
(i.e. don't give AES-GCM/AES-CBC when there is no hardware support and the software implementation isn't constant time).
exo762 · 2014-11-15
Few sources that claim that TSL is almost free today.
https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html
https://istlsfastyet.com/
http://blog.codinghorror.com/should-all-web-traffic-be-encrypted/
Although you may argue that if you are a CDN, encryption can be a significant portion of your costs.
Also, Jeff Atwood writes following:
> Of course, there's no reason to encrypt traffic for anonymous, not-logged-in users, and Twitter doesn't. You get a plain old HTTP connection until you log in, at which point they automatically switch to HTTPS encryption. Makes sense.
Today we know that it is no longer a valid point. TOR users can be deanonimized by injecting traffic into plain HTTP connections. Upgrade to HTTPS seems to be fixing that. So we really should use HTTPS by default and HTTP only in very well articulated cases.
seccess · 2014-09-18
This. SSL/TLS can ensure perfect forward secrecy when the private key is compromised, as long as the session information is ephemeral. With session tickets, compromise of the key used to create the tickets means every session created under that key can be compromised, regardless of whether the private key is lost. See https://www.imperialviolet.org/2013/06/27/botchingpfs.html for a great discussion of this.
phlo · 2014-09-09
> I think it's missing a verb?
Gervase may have meant to write "Currently, it is not permitted by the CAB Forum Baseline Requirements to [remove] revocation pointers out of a cert, ever."
For more details, see Appendix B (2) b of the CAB Forum's Baseline Requirements [0]. Per the document, a CRL distribution point MUST always be provided.
Currently, certificate revocation is ineffective, prone to failure and a potential privacy risk. Adam Langley has described the issues comprehensibly and at length in a series [1, 2, 3] of insightful posts on ImperialViolet.
[0] https://cabforum.org/wp-content/uploads/Baseline_Requirements_V1_1_9.p…
[1] https://www.imperialviolet.org/2011/03/18/revocation.html
[2] https://www.imperialviolet.org/2014/04/19/revchecking.html
[3] https://www.imperialviolet.org/2014/04/29/revocationagain.html
mballantyne · 2014-04-16
Do CRLs even work? My understanding is that the only browser that hard-fails to load a page if OCSP is blocked is Chrome for certs in CRLSets. Everyone else is vulnerable to MITM if access to the CRL / OCSP servers is blocked.
I would love to be wrong. Does anyone know if anything has changed for the better since 2011?
http://blog.spiderlabs.com/2011/04/certificate-revocation-behavior-in-…
http://dev.chromium.org/Home/chromium-security/crlsets
https://www.imperialviolet.org/2011/03/18/revocation.html
pjscott · 2014-03-20
At the time this article was written, AEAD modes were apparently still too new, and their implementations too untrustworthy:
http://www.daemonology.net/blog/2009-06-24-encrypt-then-mac.html
At the moment, the best-supported AEAD mode seems to be AES-GCM, which has received a fair bit of attention since then. Alternately, {Salsa20,ChaCha20}-Poly1305 has some good implementations, e.g.
http://nacl.cr.yp.to/
and in TLS:
https://www.imperialviolet.org/2014/02/27/tlssymmetriccrypto.html
higherpurpose · 2014-03-12
http://blog.cryptographyengineering.com/
He posts more regularly on Twitter, and his tweets are pretty interesting: https://twitter.com/matthew_d_green
https://www.imperialviolet.org/
http://www.cryptofails.com/
http://blog.cr.yp.to/index.html (new)
https://whispersystems.org/blog/ (good team to follow on their progress)
https://moderncrypto.org/ (new)
itg · 2014-02-25
Just tried it with Safari on 10.9.2
>Safari can't open the page "https://www.imperialviolet.org:1266" because Safari can't establish a secure connection to the server "www.imperialviolet.org".
wernerb · 2014-02-25
I can't afford to switch environments at the moment. I don't however use any apple applications such as calendar/reminders/safari. Does this mean I have a modicum of relative safety?
https://www.imperialviolet.org:1266/ produces an error for me. And from what I gather that means I am at least safe using google chrome on OSX.
praseodym · 2014-02-25
Maybe someone who has already installed this could check if the SSL bug is fixed? https://www.imperialviolet.org:1266
bcl · 2014-02-22
You can already do this here - https://www.imperialviolet.org:1266/
On OSX Firefox and Chrome fail and Safari happily loads it. Yay for not using system crypto libraries.
adsr · 2014-02-22
The article contains a similar test: https://www.imperialviolet.org:1266