5 ms·
How keyczar could be compared with the Bouncy Castle we JVM guys stuck for years? Was it reviewed by credible cryptographers?
by kushti 11y ago
How keyczar could be compared with the Bouncy Castle we JVM guys stuck for years? Was it reviewed by credible cryptographers?
- jbtule 11y agoKeyczar is a wrapper around crypto primitive libraries. The .net Version actually is based on Bouncy Castle even. However the big downside is that Keyczar is not maintained well. Pull requests sit for years, not good for a security related framework.
- tptacek 11y agoBouncyCastle is a low-level library, like OpenSSL. It's very hazardous to use in practice. It also gets less cryptographic scrutiny than OpenSSL does. The point of this article is that you should use high-level libraries that supply high-level constructions you can use directly in your code, rather than primitives that you'll have to knit together into high-level constructions yourself.
- 102030485868 11y agoWhy is it hazardous to use in practice?
- pvg 11y agoBecause it won't stop you from doing any of this stuff and more. https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2009/july/if-youre-typing-the-letters-a-e-s-into-your-code-youre-doing-it-wrong/ https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...