8 ms·

Not at all, what I am saying is that "Don't roll your own crypto" mono-culture makes impossible for people to grasp the basics of crypto. I do not see many foru

Not at all, what I am saying is that "Don't roll your own crypto" mono-culture makes impossible for people to grasp the basics of crypto. I do not see many forums experimenting in new ways to encrypt or analyze methods proposed by others, I do see a higher number of threads discussing pseudo-scientifically that is stupid to even try to learn something in this field. So I am not saying that a newbe will do a better job than experienced experts. I am saying that we will not have many experienced experts without seeing today newbies making mistakes. To me seems not a complicated concept.

dozzie 9y ago
> what I am saying is that "Don't roll your own crypto" mono-culture makes impossible for people to grasp the basics of crypto. It's not. People not wanting to learn cryptography systematically make impossible for themselves to grasp the basics of crypto. There are a lot of topics to be covered, which goes way, way beyond encrypting stuff. People dabbling with making their own cipher or implementing DES on their own would learn exactly nothing of the cryptography. You really need to be shown a lot of stuff to understand where the industry and research were decades ago, much less where they are now, and you can't really learn that on your own, you need a guide to show you where your knowledge is still lacking.
viraptor 9y ago
What? I think you very much misunderstand "don't roll your own crypto". It was never meant about learning, experimenting, and analysis. It was about actually using your creation. If you want to learn about cryptography there's lots of resources (uni courses, books, and informal tutorials like matasano crypto challenge). If you're interested enough to learn, there's nothing stopping you. For the record, I've done all 3 and apart from some practical cryptography stuff, I really learned one thing: don't roll your own crypto - it's super tricky :-D We will have new experts though. There are people interested enough to continue and learn and they will get their work reviewed by standard bodies one day.
dsacco 9y ago
> Not at all, what I am saying is that "Don't roll your own crypto" mono-culture makes impossible for people to grasp the basics of crypto. To be brutally frank with you: most people are not qualified to implement their own cryptography, and you cannot become qualified if you skip the significant prerequisites. Much like computer science in general, cryptography is not comparable to software engineering or programming. You can learn e.g. web development in a piecemeal, circuitous fashion. You cannot learn cryptography that way - you’d first need to understand advanced mathematics (abstract algebra, number theory, probability theory, maybe some game semantics) and computational complexity. Then you need to thoroughly understand the existing algorithms before you figure out how they can be (safely) improved. Attempting to develop novel cryptosystems (“roll your own crypto”) without this background is irresponsible. It’s not that it’s impossible to grasp the basics, rather it’s that you need to be willing to work through a significant amount of material before you can even understand what your “unknown unknowns” might be. To put it very succinctly, would you attempt to publish new research in computer science or mathematics without significant training in either?

dozzie 9y ago

> what I am saying is that "Don't roll your own crypto" mono-culture makes impossible for people to grasp the basics of crypto. It's not. People not wanting to learn cryptography systematically make impossible for themselves to grasp the basics of crypto. There are a lot of topics to be covered, which goes way, way beyond encrypting stuff. People dabbling with making their own cipher or implementing DES on their own would learn exactly nothing of the cryptography. You really need to be shown a lot of stuff to understand where the industry and research were decades ago, much less where they are now, and you can't really learn that on your own, you need a guide to show you where your knowledge is still lacking.

viraptor 9y ago

What? I think you very much misunderstand "don't roll your own crypto". It was never meant about learning, experimenting, and analysis. It was about actually using your creation. If you want to learn about cryptography there's lots of resources (uni courses, books, and informal tutorials like matasano crypto challenge). If you're interested enough to learn, there's nothing stopping you. For the record, I've done all 3 and apart from some practical cryptography stuff, I really learned one thing: don't roll your own crypto - it's super tricky :-D We will have new experts though. There are people interested enough to continue and learn and they will get their work reviewed by standard bodies one day.

dsacco 9y ago

> Not at all, what I am saying is that "Don't roll your own crypto" mono-culture makes impossible for people to grasp the basics of crypto. To be brutally frank with you: most people are not qualified to implement their own cryptography, and you cannot become qualified if you skip the significant prerequisites. Much like computer science in general, cryptography is not comparable to software engineering or programming. You can learn e.g. web development in a piecemeal, circuitous fashion. You cannot learn cryptography that way - you’d first need to understand advanced mathematics (abstract algebra, number theory, probability theory, maybe some game semantics) and computational complexity. Then you need to thoroughly understand the existing algorithms before you figure out how they can be (safely) improved. Attempting to develop novel cryptosystems (“roll your own crypto”) without this background is irresponsible. It’s not that it’s impossible to grasp the basics, rather it’s that you need to be willing to work through a significant amount of material before you can even understand what your “unknown unknowns” might be. To put it very succinctly, would you attempt to publish new research in computer science or mathematics without significant training in either?