3 ms·

What do you recommend as a good reference on implementing AES encryption?

• tptacek 15y ago
  There isn't one. Even _Practical Cryptography_, my favorite of the encryption books, misses details (some of them recent discoveries, others older) that can completely wreck the security of an application that depends on AES for security; also, as well-written as the book is, it's organized in a way that makes it possible to miss some of the key details that it does document. If you need encryption in your application, you should use TLS or GPG/PGP to get it.
  • yuhong 15y ago
    What about "Cryptography Engineering"?
    • tptacek 15y ago
      It's effectively the exact same book as "Practical Cryptography". Get whichever is cheaper.
• bonzoesc 15y ago
  http://chargen.matasano.com/chargen/2009/7/22/if-youre-typing-the-letters-a-e-s-into-your-code-youre-doing.html http://chargen.matasano.com/chargen/2009/7/22/if-youre-typin... is the best reference. (Don't do it!)
  • tptacek 15y ago
    That's just a few of the issues; we wrote that to talk to other pentesters about how to look for flaws, not how to build something secure.