4 ms·

I work with cryptographers daily and crypto is magic, and the amount of variables you need to consider when working on crypto systems is so large and varied tha

I work with cryptographers daily and crypto is magic, and the amount of variables you need to consider when working on crypto systems is so large and varied that it takes a team to succeed. You should not roll your own crypto because your recruiting is not good enough to gather that team around you. The only thing from that article that I agree with is that gate keeping is bad. Crypto is so hard that we need more cryptographers to help us, not less.

loup-vaillant 6y ago
Oh, I didn't consider the perspective of a team or a company. For those, I believe I agree with you, if only because it's pretty much impossible to assess a cryptographer if you aren't already one. For my part, I think I can evaluate people who know less than I do. Those who are more competent than I am however, I could not tell by how much. I'd have to rely on reputation or past achievements.
- beefhash 6y ago
  At least PhDs in cryptography establish some amount of a baseline in that regard.
tptacek 6y ago
Do we need more cryptographers? Do you have a sense of how easy it is for strong cryptographers to get meaningful work in industry doing this stuff? We all know cryptography engineering rates are very high, but that doesn't mean there's a surfeit of open reqs for them; some high-value specialties are performed mostly by consultants because most companies don't need them full-time.
- Ar-Curunir 6y ago
  I think as more advanced crypto starts being deployed (stuff based on MPC AND zkSNARKs), we’ll see a need for more long-term cryptographer positions
- quadrifoliate 6y ago
  > some high-value specialties are performed mostly by consultants because most companies don't need them full-time I think there is a conflation here of "cryptographer" in the sense of "person who studies, and maybe invents cryptographic algorithms" v/s "someone who needs a broad understanding of cryptographic algorithms in their day-to-day software work, studies them in some depth, but likely doesn't invent new ones". The former is the kind you mean, but likely most people (including the OP, I think) are referring to the latter when they say "cryptographers". An unscientific test of this can be done by searching jobs.lever.co for "cryptographer" v/s "cryptography" – the former yield one position, whereas the latter yields ten pages. [1][2] And maybe some of this is just due to the term being imprecise. For example, would you term this position as being a "cryptographer"? https://jobs.lever.co/protocol/9afbc1c9-8b3b-4c03-856d-6b0cb5518eaa https://jobs.lever.co/protocol/9afbc1c9-8b3b-4c03-856d-6b0cb.... It's certainly full time. ------- [1] https://www.google.com/search?q=%22cryptographer%22+site%3Ajobs.lever.co https://www.google.com/search?q=%22cryptographer%22+site%3Aj... [2] https://www.google.com/search?q=%22cryptography%22+site%3Ajobs.lever.co https://www.google.com/search?q=%22cryptography%22+site%3Ajo...
  - tptacek 6y ago
    No, I can understand why you'd think that, but that's not what I meant. I used the word "cryptography engineer" carefully. I'm talking about people who can implement and verify the implementation of known algorithms. I don't know. Maybe cryptocurrency startups change the equation. I know that prior to crypto-mania, good jobs doing pure cryptography engineering were not especially easy to come by.
    - loup-vaillant 6y ago
      I'm not sure, but if the supply of cryptographic engineers were adequate, I believe someone would have written Monocypher before I did. We'd also have more working Elligator2 reverse map implementations. If DJB & al themselves didn't provide a working reference implementation over Curve25519, that suggests serious labour shortage, at least locally.
      - 6y ago

loup-vaillant 6y ago

Oh, I didn't consider the perspective of a team or a company. For those, I believe I agree with you, if only because it's pretty much impossible to assess a cryptographer if you aren't already one. For my part, I think I can evaluate people who know less than I do. Those who are more competent than I am however, I could not tell by how much. I'd have to rely on reputation or past achievements.

beefhash 6y ago
At least PhDs in cryptography establish some amount of a baseline in that regard.

tptacek 6y ago

Do we need more cryptographers? Do you have a sense of how easy it is for strong cryptographers to get meaningful work in industry doing this stuff? We all know cryptography engineering rates are very high, but that doesn't mean there's a surfeit of open reqs for them; some high-value specialties are performed mostly by consultants because most companies don't need them full-time.

Ar-Curunir 6y ago
I think as more advanced crypto starts being deployed (stuff based on MPC AND zkSNARKs), we’ll see a need for more long-term cryptographer positions
quadrifoliate 6y ago
> some high-value specialties are performed mostly by consultants because most companies don't need them full-time I think there is a conflation here of "cryptographer" in the sense of "person who studies, and maybe invents cryptographic algorithms" v/s "someone who needs a broad understanding of cryptographic algorithms in their day-to-day software work, studies them in some depth, but likely doesn't invent new ones". The former is the kind you mean, but likely most people (including the OP, I think) are referring to the latter when they say "cryptographers". An unscientific test of this can be done by searching jobs.lever.co for "cryptographer" v/s "cryptography" – the former yield one position, whereas the latter yields ten pages. [1][2] And maybe some of this is just due to the term being imprecise. For example, would you term this position as being a "cryptographer"? https://jobs.lever.co/protocol/9afbc1c9-8b3b-4c03-856d-6b0cb5518eaa https://jobs.lever.co/protocol/9afbc1c9-8b3b-4c03-856d-6b0cb.... It's certainly full time. ------- [1] https://www.google.com/search?q=%22cryptographer%22+site%3Ajobs.lever.co https://www.google.com/search?q=%22cryptographer%22+site%3Aj... [2] https://www.google.com/search?q=%22cryptography%22+site%3Ajobs.lever.co https://www.google.com/search?q=%22cryptography%22+site%3Ajo...
- tptacek 6y ago
  No, I can understand why you'd think that, but that's not what I meant. I used the word "cryptography engineer" carefully. I'm talking about people who can implement and verify the implementation of known algorithms. I don't know. Maybe cryptocurrency startups change the equation. I know that prior to crypto-mania, good jobs doing pure cryptography engineering were not especially easy to come by.
  - loup-vaillant 6y ago
    I'm not sure, but if the supply of cryptographic engineers were adequate, I believe someone would have written Monocypher before I did. We'd also have more working Elligator2 reverse map implementations. If DJB & al themselves didn't provide a working reference implementation over Curve25519, that suggests serious labour shortage, at least locally.
    - 6y ago