4 ms·
I wonder if a good way to go would be to implement standard encryption (AES in most cases), and then take that encrypted payload and encrypt it with your custom
by feelix 10y ago
I wonder if a good way to go would be to implement standard encryption (AES in most cases), and then take that encrypted payload and encrypt it with your custom code that you designed.
So even if it's actually true, and that you shouldn't roll your own encryption in practice, even if they do break yours they'll still have to get through the AES as well. So it's a no risk addition.
- 0x0 10y agoIt's never a no-risk addition. Perhaps your custom code is buggy and ends up adding in random memory contents that happened to contain both your AES key and your custom crypto key, into the message payload ala heartbleed.