4 ms·
Yup. That works. Just don't forget the follow-up, where external feedback is crucial. Shameless plug: I've written my own crypto library¹. Not just for the
by loup-vaillant 9y ago
Yup. That works. Just don't forget the follow-up, where external feedback is crucial.
Shameless plug: I've written my own crypto library¹. Not just for the lulz, I fully intend to use it in production. To do that, I had to disregard the crypto community, that basically says anyone who does that deserves to burn in Crypto Hell the time it takes them to count to 2^256. (I might exaggerate a tad).
They say that for a reason however. I had to seek and listen to external advice eventually. Which, judging by the holes they poked through my library, was invaluable.
I think there are two phases. The "I'll show them" phase where you hide under your cave doing your thing, and the phase where you actually show some results and confirm whether this was a worthwhile endeavour.
[1]: http://loup-vaillant.fr/projects/monocypher http://loup-vaillant.fr/projects/monocypher
- woahhvicky 9y agoI think the point is that you don’t need approval from anyone to find value in your own work. Who cares if crypto “experts” condone the use of your library? All that matters is that it provides you value in your endeavors. “Showing them” is not necessary for that.
- baking 9y agoI don't think that is the point at all. To that end lies madness.
- woahhvicky 9y agoIf you think so then you’ve misinterpreted my comment.
- baking 9y agoI would make a distinction between 1) working on some project ignoring what others are working on or what they would say about the potential value of the work until you have reached some milestone and are ready to present it to the world and receive critical feedback, and 2) working on something without concern for anyone else ever finding value in it. Feynman is clearly saying disregard others while you are doing the work, not disregard others when you present it for feedback and criticism. That is the spirit with which I responded. As a developer, there is a third option where your work is simply ignored. If it is functional for you and you are satisfied with your own work, then sure, feel free to disregard others lack of interest, like an artist who values their own work but meets a deafening silence. But please don't disregard serious criticism.
- woahhvicky 9y agoIt seems like your view of “valuing your own work” is narrower than mine. I never said disregard criticism, I said approval is not necessary to find value.
- lovemenot 9y agoI suspect you may've misinterpreted your parent. Showing "them" would be pure social validation and, according to your parent, not recommended. Showing "that" would be sanity protection, just as you understand it.
- baking 9y agoThanks for the clarification.
- dhartsfield 9y agoIf it's going into production it matters. Bad crypto is only slightly better than no crypto. In some cases it could be worse.
- woahhvicky 9y agoWhere did I say bad crypto is fine in production?
- bitexploder 9y agoI am just curious, how much effort went into side channel mitigation, etc? There are a lot of things libsodium does to mitigate side channels that aren't obvious or documented.
- loup-vaillant 9y ago> how much effort went into side channel mitigation, etc? Very little. The chosen primitives are naturally resistant to timing attacks, thanks to the utter absence of secret dependent branches and secret dependent indices. I did have doubts about constant time comparison (code generated under -O3 was crazy), which I solved by changing the API. Locking the memory is not implemented, only discussed in the manual (Monocypher wants to stay portable). Zeroing out memory is neither implemented nor discussed. I'm not sure what to make of it, actually. If it is useful, then wiping the contexts is not enough, you likely also have to wipe temporary buffers above the top of the stack (I don't think anybody does this). In any case, if the attacker can read your memory, you're probably screwed anyway. Now if some attacker can read your memory only after you've processed your secret stuff, a `crypto_wipe()` function would have its uses. But if you've processed secret stuff once, you're likely to do it again, and then crypto_wipe won't save you. I'm also afraid zeroing out memory gives a false sense of security. I'm more in favour of segregating the sensitive stuff in a separate process, like Qmail.
- loup-vaillant 9y agoStrange. This comment used to be on top, and in very little time got buried to the very bottom, despite its relatively high score (24). Could there be an algorithmic reason for this surprising behaviour, or is this a manual intervention?