2 ms·
I used Argon2 as an example because it was mentioned in TFA, as the author discovered that the test vectors were wrong because the reference implementation was
by cyphar 9y ago
I used Argon2 as an example because it was mentioned in TFA, as the author discovered that the test vectors were wrong because the reference implementation was wrong. That author noted that if someone else had implemented it from scratch they would've noticed this immediately when testing the test vectors.
- laumars 9y agoI got why you used that as a reference. I was just saying it's a bit of a stretch to say your arguments about the aforementioned rule are the reason nobody else attempted to implement Argon2 when we already have a long list of examples of people who do roll their own ciphers. The point of the rule is to discourage those who don't know what they're doing from compromising live systems. The kinds of people interested in Argon2 are the kind who are already security minded so will understand the point behind the rule and will understand it's fine to ignore that rule if you understand the caveats that rule implies. The fact Argon2 hadn't been reimplemented can easily be explained for a number of other reasons too. Most people with even a casual interest in security do understand that point behind the "don't roll your own" rule so I think it's odd to suggest that we are all too literally minded. As evidenced by the fact that a great many people do write their own hobby libraries.