5 ms·

> It’s absolutely worth it to roll your own crypto if you want to learn from it No. If you want to "learn from it", the first thing you should do is buy a copy

> It’s absolutely worth it to roll your own crypto if you want to learn from it No. If you want to "learn from it", the first thing you should do is buy a copy of Bruce Schneier's Applied Cryptography. Just reading (and fully understanding !) that book will alone put you in a position where you already know more about cryptography than 90% of other people. If after that you still want to play around with rolling your own crypto, then fine, go for it. But be aware you are very much making your own bed and should be prepared to lie in the inevitable mucky consequences. For the rest of us, frankly, no matter what your choice of programming language is, there will be at least one if not many more well respected long-established crypto libraries. Most people should just do themselves a favour and just use those libraries. As the saying goes ... crypto is hard. A tiny, easily overlooked, mistake in your crypto code can have major consequences.

stingraycharles 4y ago
That’s super personal. I am the type of person who learns by doing, much less reading, and I reject not being “allowed” to do it this way. I will of course study the reading material as I go, but “doing while learning” is an absolute necessity for me, as is studying existing codebases. You learn your way, I learn my way, but don’t tell me my way is wrong just because it’s crypto. I honestly think, as a community, we’re being far too dogmatic about our advice here, and we should recognise that there is value in learning things by example, and that more people having a better understanding of crypto is generally a Good Thing. Using it in production, of course, is an entirely different matter, but that’s not what I’m contesting.
- Beldin 4y ago
  > don’t tell me my way is wrong just because it’s crypto. The way where people think they learn cryptography by making their own implementation is, indeed, wrong. Cryptography is about ensuring specific requirements in the face of active adversaries. Self-implemented crypto misses many well-known caveats, causing them to be easily breakable. As such, it is not reasonable to consider them as something that aims learn about ensuring security properties in the face of active adversaries... but then that effort is not actually teaching about crypto, which is exactly that. This is also the reason that the established wisdom for learning cryptography is to learn to break systems first. Almost everyone can make a cryptographic system they cannot break. For most folks, that means little. For those skilled at breaking crypto, that carries weight.
  - stingraycharles 4y ago
    But you're approaching it from the wrong perspective: the idea isn't to use the crypto you implement yourself, the idea is to gain a better understanding of how the "magic" works. Of course my hand-rolled RSA/AES crypto is breakable, I know that because that's the default assumption. It's akin to saying, "you're not allowed to build your own smoke detector because it will be unsafe!". Of course I know that, I want to understand the differences between a photoelectric and ionization smoke detector, how they work in practice, because reading some PDF schematics just doesn't cut it for me. I honestly don't understand the line of reasoning of all this crypto gatekeeping. Fun fact: while I was doing my crypto deep dive in 2015, my language of choice being Haskell, I found issues in several libraries, specifically around entropy, and even one library with modulo bias [1]. They were acknowledged and addressed. It was a super fun learning exercise, and seeing all these comments how it's supposedly almost illegal to do this misses the point of people exploring and learning in their own ways. https://github.com/vincenthz/hs-crypto-numbers/commit/bceb5493dbe96d216c40efdf0b8eff5cc2e909cd https://github.com/vincenthz/hs-crypto-numbers/commit/bceb54...
    - ziddoap 4y ago
      >I found issues in several libraries, specifically around entropy, and even one library with modulo bias This is exactly what the other people in this thread mean when they say "learn by breaking other crypto", assuming you didn't write those libraries.
      - stingraycharles 4y ago
        One of the reasons I want to learn how these things work in detail is that I want to understand the whole stack I’m working with, from top to bottom. As part of my quest to implement an asymmetrical encryption algo, I ended up wondering “how do I create truly random entropy?”, and went down that rabbit hole. It’s all about intent: my intent is understanding “how does this work?”, “how do I do this the right way?”, not breaking, and that’s how I found these things. I don’t care about breaking stuff, it’s just not appealing to me. My whole frustration with this discussion is that for some reason, my intentions are not the True Way of the Crypto Experts, and then I’m not allowed to proceed. It’s such utter nonsense, and this whole discussion made me realise the situation is actually worse than I thought. If these commenters here are representative of the wider crypto community, they’re really a bunch of elitist gatekeepers that cannot understand the difference between being the NSA and a mere mortal trying to learn things in their own way.
watwut 4y ago
Just no. This idea that people are not allowed to learn by doing things and must read huge books first is absurd. The guidelines for learning you gave here are impractical for majority of people who are interested. It is actually good when people are trying to learn about security. Just about worst thing these absurd rules achieve is that effectively only rule breakers are allowed in.
- traceroute66 4y ago
  > Just no. This idea that people are not allowed to learn by doing things and must read huge books first is absurd. No, its not absurd. Sure, I agree, for many things in life you can "learn by doing". But this is cryptography. There is no escaping that cryptography IS mathematics and an algorithm built on top of that mathematics. Unfortunately the only way to learn the theory is by reading and understanding books or academic papers. Otherwise you are just taking shortcuts based on a summary that someone else has written for you on a short blog or forum post. Which, aside from the fact that you are skipping the detail and hence not really learning, also brings us into the region of trust... If you have no interest in learning the dry theory behind the cryptography, then you have no business rolling your own crypto. Because if you are not willing to understand the theory then you are going to make serious mistakes.
  - hamburglar 4y ago
    > If you have no interest in learning the dry theory behind the cryptography, then you have no business rolling your own crypto. As someone who wholeheartedly buys into the “thou shalt not roll thine own crypto” mantra, this attitude is just sad. Everyone who wants to has all the business rolling their own crypto for learning purposes, and you have no business telling them they shouldn’t. Stifling this sort of exploration is fundamentally wrong.
  - pverghese 4y ago
    This is kind of ridiculous. Everyone has to start somewhere whether it is by doing or by reading books. Even crypto experts started by doing at some point. It's not like the person is going to be using their own crypto in production.
xenocratus 4y ago
Obligatory reply to an endorsement of Applied Cryptography: https://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ https://sockpuppet.org/blog/2013/07/22/applied-practical-cry...
dingleberry420 4y ago
No. If you want to "learn from it", you should do whatever you want that works for you. You're not our dad.
stu2b50 4y ago
> If after that you still want to play around with rolling your own crypto, then fine, go for it. But be aware you are very much making your own bed and should be prepared to lie in the inevitable mucky consequences. I'm very confused. OP was suggesting to roll your own crypto as a learning exercise. What possible consequences could there be? Let alone "murky" ones? Will your RSA implementation summon an eldritch monster or something?
unethical_ban 4y ago
It is shocking to me how many people in the computer community explicitly tell curious minds not to even try building a crypto protocol. It isn't enough to say "you'll never get it right for production, please use a framework or library for production". You simply don't want them to even experiment on their own. I agree with saying "the most effective way to learn cryptography is through books and tools X, Y, Z". But one would imagine that writing a poor hashing algo would open up a door to alternate dimensions by how superstitious some are about it on this site.
thayne 4y ago
It sounds like you didn't read the disclaimer. The first paragraph specifically tells you not to actually use the crypto you roll for anything important. The purpose of this is to learn how AES works, not to write a library you would actually use.

stingraycharles 4y ago

That’s super personal. I am the type of person who learns by doing, much less reading, and I reject not being “allowed” to do it this way. I will of course study the reading material as I go, but “doing while learning” is an absolute necessity for me, as is studying existing codebases. You learn your way, I learn my way, but don’t tell me my way is wrong just because it’s crypto. I honestly think, as a community, we’re being far too dogmatic about our advice here, and we should recognise that there is value in learning things by example, and that more people having a better understanding of crypto is generally a Good Thing. Using it in production, of course, is an entirely different matter, but that’s not what I’m contesting.

Beldin 4y ago
> don’t tell me my way is wrong just because it’s crypto. The way where people think they learn cryptography by making their own implementation is, indeed, wrong. Cryptography is about ensuring specific requirements in the face of active adversaries. Self-implemented crypto misses many well-known caveats, causing them to be easily breakable. As such, it is not reasonable to consider them as something that aims learn about ensuring security properties in the face of active adversaries... but then that effort is not actually teaching about crypto, which is exactly that. This is also the reason that the established wisdom for learning cryptography is to learn to break systems first. Almost everyone can make a cryptographic system they cannot break. For most folks, that means little. For those skilled at breaking crypto, that carries weight.
- stingraycharles 4y ago
  But you're approaching it from the wrong perspective: the idea isn't to use the crypto you implement yourself, the idea is to gain a better understanding of how the "magic" works. Of course my hand-rolled RSA/AES crypto is breakable, I know that because that's the default assumption. It's akin to saying, "you're not allowed to build your own smoke detector because it will be unsafe!". Of course I know that, I want to understand the differences between a photoelectric and ionization smoke detector, how they work in practice, because reading some PDF schematics just doesn't cut it for me. I honestly don't understand the line of reasoning of all this crypto gatekeeping. Fun fact: while I was doing my crypto deep dive in 2015, my language of choice being Haskell, I found issues in several libraries, specifically around entropy, and even one library with modulo bias [1]. They were acknowledged and addressed. It was a super fun learning exercise, and seeing all these comments how it's supposedly almost illegal to do this misses the point of people exploring and learning in their own ways. https://github.com/vincenthz/hs-crypto-numbers/commit/bceb5493dbe96d216c40efdf0b8eff5cc2e909cd https://github.com/vincenthz/hs-crypto-numbers/commit/bceb54...
  - ziddoap 4y ago
    >I found issues in several libraries, specifically around entropy, and even one library with modulo bias This is exactly what the other people in this thread mean when they say "learn by breaking other crypto", assuming you didn't write those libraries.
    - stingraycharles 4y ago
      One of the reasons I want to learn how these things work in detail is that I want to understand the whole stack I’m working with, from top to bottom. As part of my quest to implement an asymmetrical encryption algo, I ended up wondering “how do I create truly random entropy?”, and went down that rabbit hole. It’s all about intent: my intent is understanding “how does this work?”, “how do I do this the right way?”, not breaking, and that’s how I found these things. I don’t care about breaking stuff, it’s just not appealing to me. My whole frustration with this discussion is that for some reason, my intentions are not the True Way of the Crypto Experts, and then I’m not allowed to proceed. It’s such utter nonsense, and this whole discussion made me realise the situation is actually worse than I thought. If these commenters here are representative of the wider crypto community, they’re really a bunch of elitist gatekeepers that cannot understand the difference between being the NSA and a mere mortal trying to learn things in their own way.

watwut 4y ago

Just no. This idea that people are not allowed to learn by doing things and must read huge books first is absurd. The guidelines for learning you gave here are impractical for majority of people who are interested. It is actually good when people are trying to learn about security. Just about worst thing these absurd rules achieve is that effectively only rule breakers are allowed in.

traceroute66 4y ago
> Just no. This idea that people are not allowed to learn by doing things and must read huge books first is absurd. No, its not absurd. Sure, I agree, for many things in life you can "learn by doing". But this is cryptography. There is no escaping that cryptography IS mathematics and an algorithm built on top of that mathematics. Unfortunately the only way to learn the theory is by reading and understanding books or academic papers. Otherwise you are just taking shortcuts based on a summary that someone else has written for you on a short blog or forum post. Which, aside from the fact that you are skipping the detail and hence not really learning, also brings us into the region of trust... If you have no interest in learning the dry theory behind the cryptography, then you have no business rolling your own crypto. Because if you are not willing to understand the theory then you are going to make serious mistakes.
- hamburglar 4y ago
  > If you have no interest in learning the dry theory behind the cryptography, then you have no business rolling your own crypto. As someone who wholeheartedly buys into the “thou shalt not roll thine own crypto” mantra, this attitude is just sad. Everyone who wants to has all the business rolling their own crypto for learning purposes, and you have no business telling them they shouldn’t. Stifling this sort of exploration is fundamentally wrong.
- pverghese 4y ago
  This is kind of ridiculous. Everyone has to start somewhere whether it is by doing or by reading books. Even crypto experts started by doing at some point. It's not like the person is going to be using their own crypto in production.

xenocratus 4y ago

Obligatory reply to an endorsement of Applied Cryptography: https://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ https://sockpuppet.org/blog/2013/07/22/applied-practical-cry...

dingleberry420 4y ago

No. If you want to "learn from it", you should do whatever you want that works for you. You're not our dad.

stu2b50 4y ago

> If after that you still want to play around with rolling your own crypto, then fine, go for it. But be aware you are very much making your own bed and should be prepared to lie in the inevitable mucky consequences. I'm very confused. OP was suggesting to roll your own crypto as a learning exercise. What possible consequences could there be? Let alone "murky" ones? Will your RSA implementation summon an eldritch monster or something?

unethical_ban 4y ago

It is shocking to me how many people in the computer community explicitly tell curious minds not to even try building a crypto protocol. It isn't enough to say "you'll never get it right for production, please use a framework or library for production". You simply don't want them to even experiment on their own. I agree with saying "the most effective way to learn cryptography is through books and tools X, Y, Z". But one would imagine that writing a poor hashing algo would open up a door to alternate dimensions by how superstitious some are about it on this site.

thayne 4y ago

It sounds like you didn't read the disclaimer. The first paragraph specifically tells you not to actually use the crypto you roll for anything important. The purpose of this is to learn how AES works, not to write a library you would actually use.