Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Implementing RSA from Scratch in JavaScript

coderoasis.com

Post reply on HN
Print view View original

21–27 of 27 posts

Re: Implementing RSA from Scratch in JavaScript

#21

Post by thraxil »

tialaramex wrote: post #18
thraxil wrote: post #14

Earlier quoted context omitted.

Yeah, the implementation here obviously has problems, but as a learning exercise, I do still think it's worth implementing RSA (or anything else complex) in whatever language you're comfortable with. Personally, I implemented RSA in JavaScript back in 1998 as an exercise. I had to roll my own basic BigNum implementation and it didn't perform well enough to handle non-trivial key or message sizes, but I still think it…

If it was "valuable for my education" what did you learn? Your take away seems to have been that your toy RSA implementation "didn't perform well enough" which isn't a lesson.

I learned... how RSA works... better than I would have just from reading about the algorithm in a book or from a lecture? Why is it a strange concept that one could learn something by doing rather than just reading/listening? The RSA algorithm isn't inherently about bit-twiddling, but to implement it efficiently for real-world use, you have to get into a lot of those weeds that distract you from the core ideas.

Re: Implementing RSA from Scratch in JavaScript

#22

Post by throwayaw84330 »

shiomiru wrote: post #13
tyingq wrote: post #11

Earlier quoted context omitted.

I see the peer comments regarding big ints, but the OP is still right in that the presented code doesn't work, for more than one reason.

Besides, the code does not use BigInts at all, so the fact that JavaScript has them does not help much. I agree with the sibling commenter that this seems to be automatically generated. The disclaimer is weird, you don't just use a random rsa implementation found in a blog post "with careful consideration and expert guidance". The article's structure is weird, it's just a bullet list of steps and then code dump. It g…

100% agree.

Many red flags here:

- Look at the text below the headers "Explaining RSA Cryptography" and "Explaining RSA Cryptography with JavaScript". Both paragraphs start with the exact same text. I believe there are far more chances that this was generated by a machine rather than a human.

- Look at the math! There is a code block where it says "scssCopy" -- the "Copy" is generally garbage from machine generated text+code snippets.

- The code has a missing function, `lcm`. Author has forgotten to include it, which can be a human or machine error.

This kind of episode makes me wonder if I should continue posting, suggest that people filter everything through an LLM, or just resign to the botspamcallypse.

Re: Implementing RSA from Scratch in JavaScript

#23

Post by tialaramex »

thraxil wrote: post #21
tialaramex wrote: post #18

Earlier quoted context omitted.

If it was "valuable for my education" what did you learn? Your take away seems to have been that your toy RSA implementation "didn't perform well enough" which isn't a lesson.

I learned... how RSA works... better than I would have just from reading about the algorithm in a book or from a lecture? Why is it a strange concept that one could learn something by doing rather than just reading/listening? The RSA algorithm isn't inherently about bit-twiddling, but to implement it efficiently for real-world use, you have to get into a lot of those weeds that distract you from the core ideas.

I'm not at all convinced that "I made this thing which didn't actually work" constitutes learning more than say the colour-mixing video from "Art of the Problem".

In both cases you're only learning the concept, and if you actually do this it won't actually work†. So, why do it rather than just reading about it? Usually our argument for learning by doing is that you're gaining valuable experience of it actually working - but textbook RSA doesn't work, it doesn't deliver security.

So the best case is the same as just reading about it or watching a video, except it took much longer. The worst case is that you believe what you're doing (a toy which can't work) is how it actually works (which it isn't) and then you try to apply this incorrect lesson.

† Specifically, textbook RSA doesn't achieve security, you're missing a crucial component of a working system which wasn't important to the explanation but is crucial to a working system.

Re: Implementing RSA from Scratch in JavaScript

#24

Post by zelphirkalt »

simpaticoder wrote: post #16
less_less wrote: post #2

This isn't a particularly good way to learn RSA, and Javascript isn't a good environment to teach it. It's better to use Python, which at least has bignums. And obviously, seeing a wrong implementation of RSA isn't at all essential for implementing secure systems, contrary to the article's claims. Few people will actually need to implement RSA, and for those people, all those details that the article gets wrong reall…

Hi there! I think JavaScript is a great way to teach, since it's such an accessible language. It also allows you to ship your code to run easily for your users. The OP's code needed a little help; there were some missing functions, misnamed calls, and he didn't use js BigInts (which are built-in to the browser, and you can use them as literals by appending 'n' to a number.) See (and run) the fixed up code here: https…

I think many people here object to the statement, that using JS is a good way of teaching, since there are many people here with in-depth knowledge about programming language theory and knowledge about the far too many bad parts of JS. I myself would recommend conceptually richer and yet syntactically simpler languages than JS or Python, with the note, that it depends on what you want to learn. If you want to learn to make a website with dynamic features, sure, learn some JS. If you want to learn computer programming and grasp important concepts well, you are better off learning other languages.

Re: Implementing RSA from Scratch in JavaScript

#25

Post by simpaticoder »

zelphirkalt wrote: post #24
simpaticoder wrote: post #16

Earlier quoted context omitted.

Hi there! I think JavaScript is a great way to teach, since it's such an accessible language. It also allows you to ship your code to run easily for your users. The OP's code needed a little help; there were some missing functions, misnamed calls, and he didn't use js BigInts (which are built-in to the browser, and you can use them as literals by appending 'n' to a number.) See (and run) the fixed up code here: https…

I think many people here object to the statement, that using JS is a good way of teaching, since there are many people here with in-depth knowledge about programming language theory and knowledge about the far too many bad parts of JS. I myself would recommend conceptually richer and yet syntactically simpler languages than JS or Python, with the note, that it depends on what you want to learn. If you want to learn t…

People have strong preferences in this area, as to be expected. After all, good programming pedagogy itself is weakened because it is, by nature, partitioned by language (and often further, by framework).

I prefer to zoom out and realize that everyone wants all tutorials to be written in their favorite language, and realizing this makes me a little less attached to mine, and more accepting of others, even if they are not for me.

Re: Implementing RSA from Scratch in JavaScript

#26

Post by zelphirkalt »

simpaticoder wrote: post #25
zelphirkalt wrote: post #24

Earlier quoted context omitted.

I think many people here object to the statement, that using JS is a good way of teaching, since there are many people here with in-depth knowledge about programming language theory and knowledge about the far too many bad parts of JS. I myself would recommend conceptually richer and yet syntactically simpler languages than JS or Python, with the note, that it depends on what you want to learn. If you want to learn t…

People have strong preferences in this area, as to be expected. After all, good programming pedagogy itself is weakened because it is, by nature, partitioned by language (and often further, by framework). I prefer to zoom out and realize that everyone wants all tutorials to be written in their favorite language, and realizing this makes me a little less attached to mine, and more accepting of others, even if they are…

This is true, but it is also true, that some concepts cannot be taught well in languages, that do not support them well and will get the wrong message to the learner.

Many learn, that recursion is something dangerous for example, because their learning vehicle language has no good implementation for it. Another example is memory allocation. You wouldn't teach that in Python probably. Or a concept like ownership, which would be good to teach in Rust, where the language has that concept explicitly and visibly built into it.

Re: Implementing RSA from Scratch in JavaScript

#27

Post by thraxil »

tialaramex wrote: post #23
thraxil wrote: post #21

Earlier quoted context omitted.

I learned... how RSA works... better than I would have just from reading about the algorithm in a book or from a lecture? Why is it a strange concept that one could learn something by doing rather than just reading/listening? The RSA algorithm isn't inherently about bit-twiddling, but to implement it efficiently for real-world use, you have to get into a lot of those weeds that distract you from the core ideas.

I'm not at all convinced that "I made this thing which didn't actually work" constitutes learning more than say the colour-mixing video from "Art of the Problem". In both cases you're only learning the concept, and if you actually do this it won't actually work†. So, why do it rather than just reading about it? Usually our argument for learning by doing is that you're gaining valuable experience of it actually workin…

Should students ever write code then? Most of it's not going to be production quality, so it seems like you think that would be a waste of their time.

My experience over and over in life is that I read about something complex, think I understand it, go try to do it, eg, writing a proof or code or teaching it to someone else, and discover that there were some aspects of the thing that I didn't fully understand or had a misconception about. That observation that even very smart people are good at convincing themselves they understand something better than they actually do is basically why the Feynman Technique works so well. I tend to just like to write toy programs and simulations to check my understanding. The resulting prose or program isn't the point, it's all the points you hit in the process where you realize you're missing something. I write small prototypes pretty much every day, learn from them, throw them away, then apply what I learned on the real problem I'm working on. I find that to be an incredibly fruitful approach.

I coded up a toy RSA implementation after we had a lecture about RSA in my Number Theory class. And I didn't say that it didn't work; it just obviously didn't perform very well because that wasn't the point (I was very new to programming and working in JS as that was the only environment available to me). I'm sorry I can't pinpoint the exact details of what I learned about RSA a quarter century ago. When I took a Cryptography class a couple years later taught by Michael Rabin, I did very well and felt like I had a better grasp of some of the basic ideas than I would've if I hadn't spent some time working through some basic implementations.

Post reply on HN