3 ms·
> This abets a hugely widespread misunderstanding about the security of crypto. You could in fact invent your own block cipher core, and if you dropped it into
by ori_b 14y ago
> This abets a hugely widespread misunderstanding about the security of crypto. You could in fact invent your own block cipher core, and if you dropped it into Keyczar or cryptlib's high level library be more secure than people using AES-256 directly via OpenSSL.
No.
Someone who knew their way around cryptography algorithms could do that. I can't. This is good advice for someone who isn't a security expert. (Edit: With my level of crypto knowledge, I don't even know how to evaluate whether your claim bears any relationship to reality.)
(Yes. I would like to remedy that. I'm working on it, slowly.)
- tptacek 14y agoAre you sure you're right about that? Because I think you're wrong. I think you could spend 15 minutes on Wikipedia, write your own block cipher core, and if you used Keyczar as the protocol implementation, you'd be better off than if you had used AES directly. Your AES code, I am implying, would be so bad that you'd be better off not having used it at all.
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]
- ircmaxell 14y agoThat's fair. However I'd argue that someone implementing their own algorithm would not use a library like keyczar. They would just write their own. So while it's possible to write your own and be secure, IMHO it'd be better to stick to vetted algorithms and libraries... I think it's just that - all other things being equal - the public algorithm is more likely to be more secure...