We talk about it all the time. For a little while I was playing with a set on fundamental block cipher cryptanalysis (Matsui, differential, etc) but I put it down. When we interview people for the podcast, I'm going to start asking them for suggestions for new challenges; for instance, I'd love to see if there's dumb lattice crypto bugs we can capture.
Love cryptopals beyond my ability to articulate it well enough. This is monumental work many engineers owe their “cryptography 101-404” education to.
For a long while company I work for used Cryptopals as means to train/qualify interns before letting them touch serious practical stuff.
Not that knowing answers is a problem (there were public solutions, albeit clunky, before), but such careful explanation almost eliminates the fun in solving to some extent.
Gotta come up with our own take w/o public tour now, is anyone aware of any similar sets of challenges? CryptoHack is ok, but fairly deterministic one that removes “oh where do I go now” feeling, which is essential to bear with to learn to love the craft.
This is what I've been waiting for for many years. I did these before answers could be found, and there's a few places I had "working" answers but wasn't happy with the maths and wished I could discuss it.
Just a few months ago a padding Oracle exploit was found against Microsoft exchange. There's a immense attack surface still out there for people who do these challenges.
11 comments
[ 2.4 ms ] story [ 42.3 ms ] threadRecommend both for experienced and novice techies.
Loads of fun!
(In case anyone else was curious - looks like the original authors are currently at Apple, Bridgewater, and Fly.io)
For a long while company I work for used Cryptopals as means to train/qualify interns before letting them touch serious practical stuff.
Not that knowing answers is a problem (there were public solutions, albeit clunky, before), but such careful explanation almost eliminates the fun in solving to some extent.
Gotta come up with our own take w/o public tour now, is anyone aware of any similar sets of challenges? CryptoHack is ok, but fairly deterministic one that removes “oh where do I go now” feeling, which is essential to bear with to learn to love the craft.
Edits: typos.
Just a few months ago a padding Oracle exploit was found against Microsoft exchange. There's a immense attack surface still out there for people who do these challenges.