3 ms·

What advice would you give to someone who did realistically want to work in, implement, and evaluate industrial-strength crypto?

• tptacek 15y ago
  Spend 6-8 years breaking it. (I haven't spent that much time on crypto, and so as a general rule we don't do implementation projects).
  • pnathan 15y ago
    I'm going to presume you also by that imply "read all the standard texts, seminal papers, and current state of the art papers".
    • timsally 15y ago
      You'll want to follow people in the industry as well (I've found Nate's blog in particular an enjoyable read). A lot of the practical knowledge accumulates in the brains of the guys who actually get hired to do crypto work. It's an interesting feedback loop to be sure. Also, it's my impression that start of the art papers aren't really necessary to start off with. The implementation errors people make in their code are flaws that have long been published, sometimes for decades.
      • tptacek 15y ago
        Crypto papers actually kind of suck; my experience is that roughly 2/3rds of the time, the complicated formula on the page works out to a "for" loop that would be trivially easy to understand if expressed in algol syntax. Best advice: do deep research on TLS. For every feature, do a directed search of the literature and do experimentation to try to figure out why that feature is there. Most of the features in TLS exist as a countermeasure to some attack. Follow this tack all the way down the stack, starting with the high-level protocol features and working your way all the way down through the block cipher modes and configuration that it uses.
        • timsally 15y ago
          Yeah there definitely is a bit of an art to reading them. But we can't have cryptographers and security professionals merging too fast... that would just make too much sense. :P
    • eru 15y ago
      Studying mathematics also helps. Gives you a framework for studying, and contacts to people who are interested in the same field.