3 ms·
Cryptography-related code is incredibly easy to fuck up, and the tiniest mistake can completely break your security model. A mistake that could be insignificant
by joepie91_ 10y ago
Cryptography-related code is incredibly easy to fuck up, and the tiniest mistake can completely break your security model. A mistake that could be insignificant in other kinds of code, could easily be critical in crypto-related code.
Thus, you reduce both the amount of mistakes and the impact of mistakes by avoiding crypto where possible.
EDIT: Yes, this includes using existing libraries. It's not just the implementation of the primitives themselves where issues occur.
- girvo 10y agoIn fact, a heap of JWT libraries had massive vulnerabilities in them not that long ago, that mean you could easily forge JWTs.