How I implemented my own crypto
loup-vaillant.fr
How I implemented my own crypto
1–10 of 409 posts
Re: How I implemented my own crypto
#2[deleted]
Re: How I implemented my own crypto
#3Are there other fields where the slogan "don't roll your own XXX unless you are an infallible expert" is applicable?
Re: How I implemented my own crypto
#4I still believe it's a bad idea to roll your own crypto, interesting as an exercise, but I would never use it in a production environment.
Re: How I implemented my own crypto
#5Are there other fields where the slogan "don't roll your own XXX unless you are an infallible expert" is applicable?
Aviation, medical devices, civil engineering.
Re: How I implemented my own crypto
#6Are there other fields where the slogan "don't roll your own XXX unless you are an infallible expert" is applicable?
If you were a cook you wouldn't really be qualified to build a stove or make your own knives, but you'd know what kind of stove and knives you'd want.
Re: How I implemented my own crypto
#7Are there other fields where the slogan "don't roll your own XXX unless you are an infallible expert" is applicable?
Parachute?
Re: How I implemented my own crypto
#8Are there other fields where the slogan "don't roll your own XXX unless you are an infallible expert" is applicable?
reefer?
Re: How I implemented my own crypto
#9Main lesson not learned: instead of testing, prove correctness in high assurance code like this. Rigorously and formally.
Preferably even refine the proof to executable code.
(Yes, it would take somewhere on the order of 10k LOC to prove correctness of this 1k.)
Re: How I implemented my own crypto
#10I still believe it's a bad idea to roll your own crypto, interesting as an exercise, but I would never use it in a production environment.
well if you have enough people especially working with crypto, than why not?
It's not like that the existing solutions came out of nowhere. some people actually wrote them.
I mean libsodium is actually really simple to use. however before libsodium it was probably easier and mostly more correct to roll your own. there are so many things you can do wrong with other libraries that the chance to do it wrong is as high as in your own implementation.