3 ms·
Not rolling your own crypto makes sense given that one is unlikely to fully comprehend the potential failures. But then does that not also mean that rolling on
by ooqr 10y ago
Not rolling your own crypto makes sense given that one is unlikely to fully comprehend the potential failures. But then does that not also mean that rolling ones own crypto (with full intention to never use it on anything 'real') and learning at least a little more about potential failures will aid understanding when using crypto?
For example, naive me once wanted to use BCrypt as a signature algorithm for a web-based game when exchanging game state information, to prevent cheating by allowing the server to verify game state transitions. For the purposes at hand, it seemed like a strong enough cryptographic hash (the server handled the signing between clients). The only problem was that BCrypt disregards everything after the first 72 characters. So after headers, everything was signed valid. Everything.
- Ar-Curunir 10y agoRolling own crypto for learning is different from rolling own crypto for deployment. The former is good, the latter a most-definite no-no unless you have training.