6 ms·

> you shouldn't use your (or their) self-made cryptography in production Absolutely, and that was the very first thing I thought when I saw the title. For some

> you shouldn't use your (or their) self-made cryptography in production Absolutely, and that was the very first thing I thought when I saw the title. For some reason I've got the "don't roll your own crypto" commandment heavily ingrained into my brain (even though I've never been in any context where I might have tried), together with "don't let the frying pan handle stick out over the edge of the cooker in case a kid grabs it" (even though I have no kids, nor nephews etc), as well as trigger discipline and "every gun is loaded" (even though I've never touched a gun in my life and have never lived in the USA).

bowsamic 4y ago
Those other mantras work but the crypto one is dangerous because it actually implicitly discourages people from playing with it and learning about it
- bramblerose 4y ago
  The fundamental problem with cryptography (that doesn't apply as much to other areas) is that it's not a subject you can learn by playing with it. That's a result of the complexity of building a correct solution, the ease of building a solution that _looks_ correct at first glance but isn't, and the extreme adversarial nature of the problem. In most of software a "looks correct at first glance" solution is fine -- the 1% that is broken will not have significant consequences. In cryptography, your adversary will find that 1% and abuse it.
  - jonathanstrange 4y ago
    You mostly learn cryptography by doing cryptanalysis, and that certainly is a form of playing with ciphers. To be fair, modern cryptanalysis also involves a bit of math and reading some papers. None of this is something that hobby cryptographers can't do. In fact, there is no real difference between "professional" and hobby cryptographers. Many of the professional ones started as hobby cryptographers, and there are plenty of allegedly professional "cryptographers" who do not have sufficient experience in cryptanalysis. Moreover, anybody can make a fairly secure Feistel cipher, for example, it's just hard to create an efficient one. Note that proofs of security either don't exist or are based on unreasonable assumptions. Cryptography is still mostly a black art, not a science. In a nutshell, you really shouldn't reinforce the "don't roll your own crypto" mantra. It just means you'll get less skilled cryptographers in the end. Bear in mind that nearly all debacles in cryptography were caused by professional cryptographers.
    - feanaro 4y ago
      The "don't roll your own crypto" is a mantra mostly useful for deciding what to put into production, not as a general ban on even touching the stuff before you become some kind of mythical, long-bearded, tome-possessing wizard. I thought this was pretty obvious but I guess this important context was not sufficiently disseminated given the prevalence of the latter position.
      - bowsamic 4y ago
        Almost all mantras that are stated in absolutes will be accepted by the public in every single possible way. Unfortunately, and I know it sounds unbelievable, for a lot of people it really has become "don't even think of learning about crypto", not just "don't use your own crypto in prod"
heleninboodler 4y ago
I think the title was a nod to the fact that this is something everyone's been taught not to do. It metaphorically could have been titled "Running With Scissors."
stingraycharles 4y ago
It’s absolutely worth it to roll your own crypto if you want to learn from it. I feel like there is almost a stigma against articles like these because we’ve all been conditioned so much to avoid even thinking about it lol. I did some deep dive into AES and RSA at some point in a distant past, it was a learning experience that to this day allows me to make much better decisions when choosing algorithms.
- traceroute66 4y ago
  > It’s absolutely worth it to roll your own crypto if you want to learn from it No. If you want to "learn from it", the first thing you should do is buy a copy of Bruce Schneier's Applied Cryptography. Just reading (and fully understanding !) that book will alone put you in a position where you already know more about cryptography than 90% of other people. If after that you still want to play around with rolling your own crypto, then fine, go for it. But be aware you are very much making your own bed and should be prepared to lie in the inevitable mucky consequences. For the rest of us, frankly, no matter what your choice of programming language is, there will be at least one if not many more well respected long-established crypto libraries. Most people should just do themselves a favour and just use those libraries. As the saying goes ... crypto is hard. A tiny, easily overlooked, mistake in your crypto code can have major consequences.
  - stingraycharles 4y ago
    That’s super personal. I am the type of person who learns by doing, much less reading, and I reject not being “allowed” to do it this way. I will of course study the reading material as I go, but “doing while learning” is an absolute necessity for me, as is studying existing codebases. You learn your way, I learn my way, but don’t tell me my way is wrong just because it’s crypto. I honestly think, as a community, we’re being far too dogmatic about our advice here, and we should recognise that there is value in learning things by example, and that more people having a better understanding of crypto is generally a Good Thing. Using it in production, of course, is an entirely different matter, but that’s not what I’m contesting.
badsectoracula 4y ago
I always found this "mantra" shortsighted and damaging on the long run - if nobody does their own crypto then who does their crypto? You are incentivizing people against learning this by that and a very significant part of learning something is actually using it in practice.
- charlieyu1 4y ago
  Because there are always someone who think they learnt enough and do their own implementation, putting the data of them and others at risk. Writing secure implementation of crypto algorithms is hard and there are millions of ways that you can screw up.
  - badsectoracula 4y ago
    A lot of things are hard and yet people do them and implement them all the time, that it might be hard is not a reason for people to not implement things - if anything by implementing them is how they'll learn (especially for those, as mentioned elsewhere in this thread, who learn better by doing). You can screw up all sorts of things - which may (depending on the situation, application, etc) also end up with data at risk (assuming that there is even such a requirement in the first place). That also doesn't mean people shouldn't implement crypto, otherwise they shouldn't implement anything that touches any data at all - after all someone might use the most secure library in the world and accidentally forget to check for user authentication (or whatever else that has nothing to do with crypto itself but still check for privileged data access) in a specific way and let the data leak out. And honestly i'm personally vehemently against this elitism-preserving "this is for us enlightened few to dabble with, not you plebeian hands" attitude towards crypto that some people have as if it is some forbidden knowledge that only a few high priests can have.
  - vbezhenar 4y ago
    Don’t selfhost. You inevitably will misconfigure your servers and lose your customer data. Bow to amazon overlords and don’t even think otherwise. Don’t drive. You inevitably will kill some pedestrian. Use Uber and let professionals do it. I don’t think that’s a healthy attitude. And exposing data because of misconfigured firewall (ahem, DOCKER-USER, ahem) is like 1000x more probable than someone hacking your cryptoschemes. There must be freedom in software engineering. Even at cost of some grave mistakes.
chmod600 4y ago
"don't roll your own crypto" is good advice, but it's also against the hacker ethos. It's another way of saying "you'll never really understand this so don't try, just rely on a mysterious cabal of experts". May be true, but not exactly a great message.
- IncRnd 4y ago
  >It's another way of saying "you'll never really understand this so don't try, just rely on a mysterious cabal of experts". It's more along the lines of, "you absolutely can understand this if you try, buy trying will take years of your life to learn and apply all attack vectors and their mitigations." The admonition not to roll your own crypto isn't so that people don't look at crypto. Take a look, fiddle, and hack all you want - just not in production. The saying comes from crypto people noticing avoidable security issues that get created many times people have touched or used crypto code - because even 100% correct crypto code is often also broken in practice.
- woodruffw 4y ago
  I think it's closer to "don't think you can half-ass your way into an understanding," rather than "you'll never be able to understand this." That "cabal of experts" all had to learn at some point, too. In general, I think DRYAC is excellent advice, and that we should apply similar reasoning to unsafe programming languages. And that is not to say that people shouldn't use them; only that we, as a community, should be making ourselves more half-ass-resistant.
  - chmod600 4y ago
    Most of what I've learned has been by overconfidently trying to do something I didn't understand, and then learning better ways incrementally. Granted, this is a bad idea when it comes to nuclear engineering. But it's sad when we say it's bad for software engineering, even crypto. The fact that you want to apply that to C programming is really sad. That's effectively saying that people can play with web apps, but not operating systems. I am not saying you are wrong. Just that you're no fun at all.
Joker_vD 4y ago
How does crypto even get created, then? Like, those cryptography experts — they do roll their own crypto, and then it gets standardized as Blowfish/AES/Salsa20/etc. How did they learn to make ciphers that are "good enough" to use in production? Are those people special somehow, and it's not possible to become one of them?
- zrail 4y ago
  They're not special. Cryptographers are mostly (but not exclusively) the products of a few academic programs around the world that teach the specialized math involved in developing and proving (and breaking) crypto algorithms. The standards are either the outcome of competitions the US government (through NIST) has held over the years, or they're de-facto standards because they're provably better for certain use cases than other algorithms.

bowsamic 4y ago

Those other mantras work but the crypto one is dangerous because it actually implicitly discourages people from playing with it and learning about it

bramblerose 4y ago
The fundamental problem with cryptography (that doesn't apply as much to other areas) is that it's not a subject you can learn by playing with it. That's a result of the complexity of building a correct solution, the ease of building a solution that _looks_ correct at first glance but isn't, and the extreme adversarial nature of the problem. In most of software a "looks correct at first glance" solution is fine -- the 1% that is broken will not have significant consequences. In cryptography, your adversary will find that 1% and abuse it.
- jonathanstrange 4y ago
  You mostly learn cryptography by doing cryptanalysis, and that certainly is a form of playing with ciphers. To be fair, modern cryptanalysis also involves a bit of math and reading some papers. None of this is something that hobby cryptographers can't do. In fact, there is no real difference between "professional" and hobby cryptographers. Many of the professional ones started as hobby cryptographers, and there are plenty of allegedly professional "cryptographers" who do not have sufficient experience in cryptanalysis. Moreover, anybody can make a fairly secure Feistel cipher, for example, it's just hard to create an efficient one. Note that proofs of security either don't exist or are based on unreasonable assumptions. Cryptography is still mostly a black art, not a science. In a nutshell, you really shouldn't reinforce the "don't roll your own crypto" mantra. It just means you'll get less skilled cryptographers in the end. Bear in mind that nearly all debacles in cryptography were caused by professional cryptographers.
  - feanaro 4y ago
    The "don't roll your own crypto" is a mantra mostly useful for deciding what to put into production, not as a general ban on even touching the stuff before you become some kind of mythical, long-bearded, tome-possessing wizard. I thought this was pretty obvious but I guess this important context was not sufficiently disseminated given the prevalence of the latter position.
    - bowsamic 4y ago
      Almost all mantras that are stated in absolutes will be accepted by the public in every single possible way. Unfortunately, and I know it sounds unbelievable, for a lot of people it really has become "don't even think of learning about crypto", not just "don't use your own crypto in prod"

heleninboodler 4y ago

I think the title was a nod to the fact that this is something everyone's been taught not to do. It metaphorically could have been titled "Running With Scissors."

stingraycharles 4y ago

It’s absolutely worth it to roll your own crypto if you want to learn from it. I feel like there is almost a stigma against articles like these because we’ve all been conditioned so much to avoid even thinking about it lol. I did some deep dive into AES and RSA at some point in a distant past, it was a learning experience that to this day allows me to make much better decisions when choosing algorithms.

traceroute66 4y ago
> It’s absolutely worth it to roll your own crypto if you want to learn from it No. If you want to "learn from it", the first thing you should do is buy a copy of Bruce Schneier's Applied Cryptography. Just reading (and fully understanding !) that book will alone put you in a position where you already know more about cryptography than 90% of other people. If after that you still want to play around with rolling your own crypto, then fine, go for it. But be aware you are very much making your own bed and should be prepared to lie in the inevitable mucky consequences. For the rest of us, frankly, no matter what your choice of programming language is, there will be at least one if not many more well respected long-established crypto libraries. Most people should just do themselves a favour and just use those libraries. As the saying goes ... crypto is hard. A tiny, easily overlooked, mistake in your crypto code can have major consequences.
- stingraycharles 4y ago
  That’s super personal. I am the type of person who learns by doing, much less reading, and I reject not being “allowed” to do it this way. I will of course study the reading material as I go, but “doing while learning” is an absolute necessity for me, as is studying existing codebases. You learn your way, I learn my way, but don’t tell me my way is wrong just because it’s crypto. I honestly think, as a community, we’re being far too dogmatic about our advice here, and we should recognise that there is value in learning things by example, and that more people having a better understanding of crypto is generally a Good Thing. Using it in production, of course, is an entirely different matter, but that’s not what I’m contesting.

badsectoracula 4y ago

I always found this "mantra" shortsighted and damaging on the long run - if nobody does their own crypto then who does their crypto? You are incentivizing people against learning this by that and a very significant part of learning something is actually using it in practice.

charlieyu1 4y ago
Because there are always someone who think they learnt enough and do their own implementation, putting the data of them and others at risk. Writing secure implementation of crypto algorithms is hard and there are millions of ways that you can screw up.
- badsectoracula 4y ago
  A lot of things are hard and yet people do them and implement them all the time, that it might be hard is not a reason for people to not implement things - if anything by implementing them is how they'll learn (especially for those, as mentioned elsewhere in this thread, who learn better by doing). You can screw up all sorts of things - which may (depending on the situation, application, etc) also end up with data at risk (assuming that there is even such a requirement in the first place). That also doesn't mean people shouldn't implement crypto, otherwise they shouldn't implement anything that touches any data at all - after all someone might use the most secure library in the world and accidentally forget to check for user authentication (or whatever else that has nothing to do with crypto itself but still check for privileged data access) in a specific way and let the data leak out. And honestly i'm personally vehemently against this elitism-preserving "this is for us enlightened few to dabble with, not you plebeian hands" attitude towards crypto that some people have as if it is some forbidden knowledge that only a few high priests can have.
- vbezhenar 4y ago
  Don’t selfhost. You inevitably will misconfigure your servers and lose your customer data. Bow to amazon overlords and don’t even think otherwise. Don’t drive. You inevitably will kill some pedestrian. Use Uber and let professionals do it. I don’t think that’s a healthy attitude. And exposing data because of misconfigured firewall (ahem, DOCKER-USER, ahem) is like 1000x more probable than someone hacking your cryptoschemes. There must be freedom in software engineering. Even at cost of some grave mistakes.

chmod600 4y ago

"don't roll your own crypto" is good advice, but it's also against the hacker ethos. It's another way of saying "you'll never really understand this so don't try, just rely on a mysterious cabal of experts". May be true, but not exactly a great message.

IncRnd 4y ago
>It's another way of saying "you'll never really understand this so don't try, just rely on a mysterious cabal of experts". It's more along the lines of, "you absolutely can understand this if you try, buy trying will take years of your life to learn and apply all attack vectors and their mitigations." The admonition not to roll your own crypto isn't so that people don't look at crypto. Take a look, fiddle, and hack all you want - just not in production. The saying comes from crypto people noticing avoidable security issues that get created many times people have touched or used crypto code - because even 100% correct crypto code is often also broken in practice.
woodruffw 4y ago
I think it's closer to "don't think you can half-ass your way into an understanding," rather than "you'll never be able to understand this." That "cabal of experts" all had to learn at some point, too. In general, I think DRYAC is excellent advice, and that we should apply similar reasoning to unsafe programming languages. And that is not to say that people shouldn't use them; only that we, as a community, should be making ourselves more half-ass-resistant.
- chmod600 4y ago
  Most of what I've learned has been by overconfidently trying to do something I didn't understand, and then learning better ways incrementally. Granted, this is a bad idea when it comes to nuclear engineering. But it's sad when we say it's bad for software engineering, even crypto. The fact that you want to apply that to C programming is really sad. That's effectively saying that people can play with web apps, but not operating systems. I am not saying you are wrong. Just that you're no fun at all.

Joker_vD 4y ago

How does crypto even get created, then? Like, those cryptography experts — they do roll their own crypto, and then it gets standardized as Blowfish/AES/Salsa20/etc. How did they learn to make ciphers that are "good enough" to use in production? Are those people special somehow, and it's not possible to become one of them?

zrail 4y ago
They're not special. Cryptographers are mostly (but not exclusively) the products of a few academic programs around the world that teach the specialized math involved in developing and proving (and breaking) crypto algorithms. The standards are either the outcome of competitions the US government (through NIST) has held over the years, or they're de-facto standards because they're provably better for certain use cases than other algorithms.