5 ms·
Do *not* implement your own cryptography. There are a lot of nuances. This is a very dangerous article. The basic RSA algorithm is quite simple to implement,
by zgs 5y ago
Do *not* implement your own cryptography. There are a lot of nuances.
This is a very dangerous article. The basic RSA algorithm is quite simple to implement, although the most difficult part isn't done in this article -- multi-precision multiplication is the difficult part in my experience.
However, using this implementation cryptographically is very bad. A cryptographically good implementation needs to consider a lot more than just the basic algorithm. Is the implementation constant time? Does it including blinding? How is it padded? These are just the basics, they are plenty more subtleties. Then people want it fast.
RSA should not be used to encrypt plaintext. Simplistically: symmetric cryptographic algorithms are first used and then RSA is used to encrypt the key.
- forgotmypw17 5y agoImplementing it yourself is a good way to understand how it works and is often part of required CS courses. I don't think the article said anything about using it in production.
- michaelcampbell 5y agoWe did exactly this in a Cybersecurity program at Georgia Tech.
- fps_doug 5y agoYou are right. What is a good idea however, is to implement a TLSv1.3 library in Visual Basic 6[1], that doesn't have any external dependencies, by embedding machine code for AES encryption generated with MSVC in the source code, that you patch into memory at runtime, by using all sorts of tricks to do things in VB6 that you aren't supposed to do in VB6. Yes, that VB6, that was released in 1998, superseded by VB.NET in 2002. Because Microsoft has just announced it's supported on Windows 11.[2] So when developing new software, why not use something future-proof? ;) [1] https://github.com/wqweto/VbAsyncSocket https://github.com/wqweto/VbAsyncSocket [2] https://docs.microsoft.com/en-us/previous-versions/visualstudio/visual-basic-6/visual-basic-6-support-policy https://docs.microsoft.com/en-us/previous-versions/visualstu...
- tiahura 5y agoThe amount of corporate cognitive dissonance required to refuse to acknowledge that dropping VB was a huge mistake and yet continue to support it - because it’s still widely used because it’s so effective - over 25 years must be staggering.
- johnisgood 5y agoImplement your own cryptography library, just be careful about using it. Why are we telling people to not learn by doing? You can even get some constructive criticism if you post it here. :)
- unbanned 5y agoBecause similar to deep learning now, we like the cloak and dagger approach to cryptography. Keeps the salaries high.
- Buttons840 5y agoThose who want to weaken cryptography now or in the future smile every time the advice to not implement your own cryptography is given. (Which is not to say everyone giving the advice wants to weaken cryptography, and yes, there are real reason to be extra careful.)