3 ms·

As someone who has written userland implementations of several crypto algorithms in the past (parts of PKCS5: PBKDF2 and PBES2), I’m positive you could say this

As someone who has written userland implementations of several crypto algorithms in the past (parts of PKCS5: PBKDF2 and PBES2), I’m positive you could say this about my code as well. If you were both following the same spec, they should be very similar. Intentionally renaming things would just make it more confusing for the next guy and more difficult for anyone to validate your code. EDIT: and of course that’s not to say they didn’t “steal” it, just saying that similarity in this kind of code is to be highly expected.

Jaruzel 6y ago
Does that include creating comments in the code that are the same too? :)
- chrismeller 6y ago
  Yes, actually. For instance if section 3 of the spec says to pad the hash... my comment will be exactly (or 90%) the same as several other implementations I saw because we’re all literally reading from the same playbook. There are only so many ways to say something like: // step 2: figure out how many blocks of hash length will be in the derived key, rounding up
hinkley 6y ago
My first assignment as a developer was porting some common formats to Java, mostly PNG and MD5 (weird combo I know, but there were reasons). I spent a week banging my head against the FFI for Java to get MD5 C code wrapped, and then in a fit of pique tried to do an all-Java implementation. Since Java is a C-family language, transcribing the code from the specification was a cakewalk, and I had something working within a day. Because of the PNG work (and a fascination with compression) I've also spent some time in the zlib code, and the zlib code is... unusual. Among other things, it has longjmp support built in so you can do cooperative multitasking in single-threaded systems. That and some aggressive work to assert that there is sufficient free memory to run zlib properly, makes the code a bit more novel. I don't think you or I would write the code that way, so it's implausible that someone would accidentally replicate the code, in this scenario or any other.
- chrismeller 6y ago
  I will completely trust your superior level of experience in this area regarding the coding approach. I still think that, given the two pairs of screenshots we have, most of the code and comments looks like obvious boilerplate that could easily be identical. A couple of lines perhaps not, but it’s far from conclusive.

Jaruzel 6y ago

Does that include creating comments in the code that are the same too? :)

chrismeller 6y ago
Yes, actually. For instance if section 3 of the spec says to pad the hash... my comment will be exactly (or 90%) the same as several other implementations I saw because we’re all literally reading from the same playbook. There are only so many ways to say something like: // step 2: figure out how many blocks of hash length will be in the derived key, rounding up

hinkley 6y ago

My first assignment as a developer was porting some common formats to Java, mostly PNG and MD5 (weird combo I know, but there were reasons). I spent a week banging my head against the FFI for Java to get MD5 C code wrapped, and then in a fit of pique tried to do an all-Java implementation. Since Java is a C-family language, transcribing the code from the specification was a cakewalk, and I had something working within a day. Because of the PNG work (and a fascination with compression) I've also spent some time in the zlib code, and the zlib code is... unusual. Among other things, it has longjmp support built in so you can do cooperative multitasking in single-threaded systems. That and some aggressive work to assert that there is sufficient free memory to run zlib properly, makes the code a bit more novel. I don't think you or I would write the code that way, so it's implausible that someone would accidentally replicate the code, in this scenario or any other.

chrismeller 6y ago
I will completely trust your superior level of experience in this area regarding the coding approach. I still think that, given the two pairs of screenshots we have, most of the code and comments looks like obvious boilerplate that could easily be identical. A couple of lines perhaps not, but it’s far from conclusive.