3 ms·
> Don't roll your own crypto. This is exactly the meme I would try to propagate if I had backdoored every popular crypto implementation. More people should rol
by Lammy 3y ago
> Don't roll your own crypto.
This is exactly the meme I would try to propagate if I had backdoored every popular crypto implementation. More people should roll their own crypto so they can stumble and learn and eventually get good at it.
- woodruffw 3y agoThis assumes that implementation diversity stymies an attacker, which isn't really true in cryptography. Cryptographic errors have well-understood "shapes," frequently present even when the raw algebra of the implementation is correct; adversaries are delighted when they discover yet another hand-rolled RSA implementation that's susceptible to BB'98 or BB'06.
- LoganDark 3y agohttps://en.wikipedia.org/wiki/Daniel_Bleichenbacher https://en.wikipedia.org/wiki/Daniel_Bleichenbacher
- YoshiRulz 3y ago> More people should roll their own crypto so they can stumble and learn and eventually get good at it. This would only work if it were always obvious when your implementation is unsecure, which is not the case.
- tptacek 3y agoSeems like a great way to get new brain surgeons, too!
- aborsy 3y agoRolling your own crypto is obviously a bad idea. It turned out the cryptography implemented by developers not expert in cryptography sometimes was merely obfuscation. If you want to roll your crypto, become a cryptographer first. That sounds circular, but isn’t.