3 ms·
I'm building an app that uses the Web Crypto API and the annoying thing about cryptography is that in practice you're calling a ton of different algorithms with
by sph 3y ago
I'm building an app that uses the Web Crypto API and the annoying thing about cryptography is that in practice you're calling a ton of different algorithms with slightly varied argument, which of course you have to name, and makes code reuse practically impossible.
You can have an `encrypt` function, that takes an RSA key, but wait, if you're encrypting with AES-GCM you also need a salt and an IV, that other times is called a nonce (which is similar to an IV but not exactly). But wait, if you're encrypting a key, you're actually "wrapping" a key, so your API should clarify all these little variations in process, which is a pain. Given that the error conditions are very opaque, to avoid mistakes you need a very clear and verbose API on top of the bare crypto functions to stay sane.
Literally my morning plan for today is refactor the cryptography functions in my project because they're an unwieldy mess.
- adammarples 3y agoWould be pretty cool to use multiple dispatch, a la Julia. The encryption function knows which one you're using based on the types you pass as arguments.
- dan-robertson 3y agoI would not find that cool. I think for a typical crypto use case: (A) you want to use exactly one encryption method (eg no algorithm negotiation) (B) you want to be very careful about calling the right functions with the right arguments Relying on compiler magic doesn’t sound good for that to me. Though the grandparent comment does seem to go against (A) so maybe the situation is different.