11–20 of 92 posts
Refreshing to see "crypto" meaning cryptography, not cryptocurrencies... And also good that they mention right from the start that you shouldn't use your (or their) self-made cryptography in production (although they could have emphasized it a bit more).
Earlier quoted context omitted.
> you shouldn't use your (or their) self-made cryptography in production Absolutely, and that was the very first thing I thought when I saw the title. For some reason I've got the "don't roll your own crypto" commandment heavily ingrained into my brain (even though I've never been in any context where I might have tried), together with "don't let the frying pan handle stick out over the edge of the cooker in case a k…
Those other mantras work but the crypto one is dangerous because it actually implicitly discourages people from playing with it and learning about it
Refreshing to see "crypto" meaning cryptography, not cryptocurrencies... And also good that they mention right from the start that you shouldn't use your (or their) self-made cryptography in production (although they could have emphasized it a bit more).
> you shouldn't use your (or their) self-made cryptography in production Absolutely, and that was the very first thing I thought when I saw the title. For some reason I've got the "don't roll your own crypto" commandment heavily ingrained into my brain (even though I've never been in any context where I might have tried), together with "don't let the frying pan handle stick out over the edge of the cooker in case a k…
I did some deep dive into AES and RSA at some point in a distant past, it was a learning experience that to this day allows me to make much better decisions when choosing algorithms.
My own introduction to AES and developing further variations was via the print version of the algorithm in 1981 edition of Computer Networks by Andrew S. Tanenbaum & David J. Wetherall, talking about combinatorics and groups at length with people good in that field, and then tinkering with extending early versions of Cayley [-1] If you are going to dabble in cryptography it might be wise to approach it via the theory…
Earlier quoted context omitted.
Those other mantras work but the crypto one is dangerous because it actually implicitly discourages people from playing with it and learning about it
The fundamental problem with cryptography (that doesn't apply as much to other areas) is that it's not a subject you can learn by playing with it. That's a result of the complexity of building a correct solution, the ease of building a solution that _looks_ correct at first glance but isn't, and the extreme adversarial nature of the problem. In most of software a "looks correct at first glance" solution is fine -- th…
None of this is something that hobby cryptographers can't do. In fact, there is no real difference between "professional" and hobby cryptographers. Many of the professional ones started as hobby cryptographers, and there are plenty of allegedly professional "cryptographers" who do not have sufficient experience in cryptanalysis. Moreover, anybody can make a fairly secure Feistel cipher, for example, it's just hard to create an efficient one. Note that proofs of security either don't exist or are based on unreasonable assumptions. Cryptography is still mostly a black art, not a science.
In a nutshell, you really shouldn't reinforce the "don't roll your own crypto" mantra. It just means you'll get less skilled cryptographers in the end. Bear in mind that nearly all debacles in cryptography were caused by professional cryptographers.
Refreshing to see "crypto" meaning cryptography, not cryptocurrencies... And also good that they mention right from the start that you shouldn't use your (or their) self-made cryptography in production (although they could have emphasized it a bit more).
Do roll your own crypto if you have nation state actors as potential attackers. Make life hard for them.
Earlier quoted context omitted.
> you shouldn't use your (or their) self-made cryptography in production Absolutely, and that was the very first thing I thought when I saw the title. For some reason I've got the "don't roll your own crypto" commandment heavily ingrained into my brain (even though I've never been in any context where I might have tried), together with "don't let the frying pan handle stick out over the edge of the cooker in case a k…
It’s absolutely worth it to roll your own crypto if you want to learn from it. I feel like there is almost a stigma against articles like these because we’ve all been conditioned so much to avoid even thinking about it lol. I did some deep dive into AES and RSA at some point in a distant past, it was a learning experience that to this day allows me to make much better decisions when choosing algorithms.
No. If you want to "learn from it", the first thing you should do is buy a copy of Bruce Schneier's Applied Cryptography.
Just reading (and fully understanding !) that book will alone put you in a position where you already know more about cryptography than 90% of other people.
If after that you still want to play around with rolling your own crypto, then fine, go for it. But be aware you are very much making your own bed and should be prepared to lie in the inevitable mucky consequences.
For the rest of us, frankly, no matter what your choice of programming language is, there will be at least one if not many more well respected long-established crypto libraries. Most people should just do themselves a favour and just use those libraries.
As the saying goes ... crypto is hard. A tiny, easily overlooked, mistake in your crypto code can have major consequences.
Refreshing to see "crypto" meaning cryptography, not cryptocurrencies... And also good that they mention right from the start that you shouldn't use your (or their) self-made cryptography in production (although they could have emphasized it a bit more).
> you shouldn't use your (or their) self-made cryptography in production Absolutely, and that was the very first thing I thought when I saw the title. For some reason I've got the "don't roll your own crypto" commandment heavily ingrained into my brain (even though I've never been in any context where I might have tried), together with "don't let the frying pan handle stick out over the edge of the cooker in case a k…
Earlier quoted context omitted.
It’s absolutely worth it to roll your own crypto if you want to learn from it. I feel like there is almost a stigma against articles like these because we’ve all been conditioned so much to avoid even thinking about it lol. I did some deep dive into AES and RSA at some point in a distant past, it was a learning experience that to this day allows me to make much better decisions when choosing algorithms.
> It’s absolutely worth it to roll your own crypto if you want to learn from it No. If you want to "learn from it", the first thing you should do is buy a copy of Bruce Schneier's Applied Cryptography . Just reading (and fully understanding !) that book will alone put you in a position where you already know more about cryptography than 90% of other people. If after that you still want to play around with rolling you…
I honestly think, as a community, we’re being far too dogmatic about our advice here, and we should recognise that there is value in learning things by example, and that more people having a better understanding of crypto is generally a Good Thing.
Using it in production, of course, is an entirely different matter, but that’s not what I’m contesting.