I didn't buy the GPG/TLS thing before. After reading this I do. I just realized how completely out of my depth I am for crypto stuff. At least now I know ...
Typing The Letters A-E-S Into Your Code? You’re Doing It Wrong
11–20 of 76 posts
Re: Typing The Letters A-E-S Into Your Code? You’re Doing It Wrong
#12Hm. I wrote this for our normal blog readers, who live and breathe security stuff, so I don't know how well it'll carry here.
I enjoyed it, even if it makes my head spin. I'm several years from my last reading of 'Applied Cryptography' and have never really gone into the deep end of that pool. So what, it [edit: meaning the blog article] is a fun read of hacking away in the security code world.
[edit: Thomas, thanks for the book recommendation below, I'll definitely grab a copy]
Re: Typing The Letters A-E-S Into Your Code? You’re Doing It Wrong
#13Earlier quoted context omitted.
You blogged the shit outta that post! Definitely an interesting read even for crypto dilettantes. Perhaps, especially for crypto dilettantes. I took Rivest's Computer and Network Security class in college and the most important takeaway for me, far outstripping all of the interesting technical content, was "Don't implement crypto."
Man, you had "don't implement crypto" and I was all, that kicks ass. Then you edited it to say "in general", and now I'm sad.
Ha! Good point. Edit undone. :)
Re: Typing The Letters A-E-S Into Your Code? You’re Doing It Wrong
#14Hm. I wrote this for our normal blog readers, who live and breathe security stuff, so I don't know how well it'll carry here.
I enjoyed it, even if it makes my head spin. I'm several years from my last reading of 'Applied Cryptography' and have never really gone into the deep end of that pool. So what, it [edit: meaning the blog article] is a fun read of hacking away in the security code world. [edit: Thomas, thanks for the book recommendation below, I'll definitely grab a copy]
Throw that book away, and buy Ferguson and Schneier's "Practical Cryptography", which Schneier contributed to in penance for writing "Applied Cryptography". Portions of the proceeds of "Practical Cryptography" are donated to a fund that helps the people who wrote crypto based on "Applied Cryptography".
Re: Typing The Letters A-E-S Into Your Code? You’re Doing It Wrong
#15It seems kind of silly to write one's own code for anything, if you have access to a well-tested library that does what you want. The only reason to do otherwise is where there is no such library. Crypto is just an example of an area that's particularly hard to get right: the solution is no different than for other things.
Re: Typing The Letters A-E-S Into Your Code? You’re Doing It Wrong
#16It seems kind of silly to write one's own code for anything, if you have access to a well-tested library that does what you want. The only reason to do otherwise is where there is no such library. Crypto is just an example of an area that's particularly hard to get right: the solution is no different than for other things.
The problem is everyone thinks they have a library that does crypto for them --- OpenSSL or CryptoAPI. But that's not what they have. They have the moral equivalent of a small pebble bed reactor, and they're strapping it to the tops of their electric cars and hoping to go for a drive.
Keyczar and cryptlib are two libraries that offer a high-level interface that is deliberately hard to screw up. But Google Keyczar is very new (it recently had a really horrible flaw) and cryptlib is not free unless you GPL your code.
Re: Typing The Letters A-E-S Into Your Code? You’re Doing It Wrong
#17Good read. +1 for Louis CK reference. A question to start up founders: How do you guys handle security? Do you hire consultants/pen-testers? Do you just copy+paste code from the internet? Do you use whatever framework's components for it?
http://news.ycombinator.com/item?id=638531
Gotta love putting a lot of effort into an HN comment thread on a submission that ends up flagged. =)
Re: Typing The Letters A-E-S Into Your Code? You’re Doing It Wrong
#18It seems kind of silly to write one's own code for anything, if you have access to a well-tested library that does what you want. The only reason to do otherwise is where there is no such library. Crypto is just an example of an area that's particularly hard to get right: the solution is no different than for other things.
The problem is everyone thinks they have a library that does crypto for them --- OpenSSL or CryptoAPI. But that's not what they have. They have the moral equivalent of a small pebble bed reactor, and they're strapping it to the tops of their electric cars and hoping to go for a drive. Keyczar and cryptlib are two libraries that offer a high-level interface that is deliberately hard to screw up. But Google Keyczar is…
Yes; I should've specified that you should use the highest-level well-tested library that does what you want. The libs you listed (in the blog post) are definitely best-in-class for that purpose.
Re: Typing The Letters A-E-S Into Your Code? You’re Doing It Wrong
#19A “young, cool-people’s” coffee shop on the first floor of an old office building in downtown Chicago.
A place like this exists? All I can think of is Intelligensia.
Re: Typing The Letters A-E-S Into Your Code? You’re Doing It Wrong
#20A “young, cool-people’s” coffee shop on the first floor of an old office building in downtown Chicago. A place like this exists? All I can think of is Intelligensia.
Right you are, sir.