5 ms·

I honestly think it's a meme born of propaganda. 'Don't roll your own' is good advice a lot of the time when there are hardened libraries at your disposal, but

I honestly think it's a meme born of propaganda. 'Don't roll your own' is good advice a lot of the time when there are hardened libraries at your disposal, but who does it serve if less people know how to build useful cryptography? Three letter agencies mostly. I had no trouble implementing useful algorithms in college as part of my study of it, or understanding different potential weaknesses like timing or known plaintext attacks. We didn't cover side channels like power analysis but how often does that actually matter outside of a lab?

xvector 2y ago
No, you can not competently roll your own crypto because you took an algorithms class in college. Even the assumption you could is absurd.
- smolder 2y ago
  It wasn't 'an algorithms class' but grad level cryptography. We did implement boxes as a project and were graded on them. Where do you think people learn this stuff? Super secret cryptography school? I even used it. I previously built a secondary layer protocol using diffie hellman that runs on top of TLS such that in the event TLS is broken there's still some level of secrecy, and I'm very confident that it's better than nothing. Defense in depth, you know?
  - xvector 2y ago
    Yes, most of us have likely taken a grad level cryptography course. Still, that's not enough to securely roll your own crypto. You want many years of experience and a community of experts working with you. If you don't have that - 99.9999% of devs do not - just use libsodium.
    - smolder 2y ago
      The arrogance and elitism is wild. I never said people shouldn't use libsodium.
      - tptacek 2y ago
        No, instead you said you learned about how to understand "known plaintext attacks", counting on the average reader of this thread not to know that's a content-free claim. One time, in a "graduate level" cryptography class, you even built a protocol using Diffie-Hellman on top of TLS. OK!
        smolder 2y ago
        That project wasn't for school.
        tptacek 2y ago
        You provided it as a proof-point of some sort, but I've led lab exercises of freshmen CS students doing the same exercise, so I'm unclear what it's proof of.
        smolder 2y ago
        Proof that you don't need to be super-human to build something useful, also demonstrated by your freshman CS student anecdote.
        tptacek 2y ago
        Anybody can build a Diffie-Hellman protocol. You can practically do with a calculator; in fact, we did that as an exercise at a talk, with a big audience, using frisbees to "exchange" the keys. But: the talk was about how, as a pentester, to trivially break these systems, because making a system that uses a DH key exchange safely, as opposed to one that simply appears correct in unit tests, is treacherously hard. I'm still curious about what you could have possibly meant by learning about "weaknesses" like "known-plaintext attacks". Can you say more?
        smolder 2y ago
        It's been years, but I recall that, for example, when you know every piece of plaintext starts with "https://www https://www", or perhaps know the full contents of particular messages, it may become some degree easier to brute force your way to a key. I don't think it's a concern for standards in broad use, more like something you would worry about if you were cooking up your own cipher.
tptacek 2y ago
The fact that you're referring to useful algorithms here is kind of a "tell", for what it's worth. "Known plaintext attacks" are not a broad class of vulnerability in cryptosystems; they're a setting for attacks. It's like saying "I've studied the browser security model including weaknesses such as the same origin policy".
- smolder 2y ago
  What do you think an algorithm is? This weird criticism is kind of a "tell", for what it's worth. Ciphers are algorithms. This is unnecessarily combative. I'm disappointed by your posts in this thread, because they're low on substance an high on posturing.
scott_w 2y ago
Learning crypto isn’t just a box ticking exercise that you learn it and now you’re qualified to “do crypto” for the rest of your career. I also studied this in university but I know that I don’t spend anywhere near enough time to day to avoid, well, any pitfalls of rolling my own crypto. I currently work on our company’s Auth systems and half my team still side-eyes our own work, despite having worked on this area for years now.
- smolder 2y ago
  All I'm reading here is more of the same scare-mongering. I don't casually implement cryptosystems to be used in critical situations, and I wouldn't attempt it without a serious amount of research. But "never do it yourself" is a poor substitute for actually spreading knowledge about how to do it and open discussion of pitfalls. It rubs me the wrong way.
  - scott_w 2y ago
    You do understand “never do it yourself” implicitly applies to a commercial/production context, right? Nobody is stopping you learning or choosing to enter the field (to make it your sole professional focus).
    - Asraelite 2y ago
      It certainly comes across like people are discouraging others from even learning about it. Just read through this thread and see how few people are saying anything like "you should still learn how cryptographic primitives work though". It's almost nothing but negativity and discouragement.
      - some_furry 2y ago
        The blog post in question (which I wrote) literally opens with a link to https://www.cryptofails.com/post/75204435608/write-crypto-code-dont-publish-it https://www.cryptofails.com/post/75204435608/write-crypto-co... that encourages people to learn about it! Yes, even if that type of learning means (privately) writing crypto code. Why would you expect the comments about it to argue in favor of "still learning" when the blog post never advocated against learning? They aren't making this point because I didn't make the contrary one, so there's nothing to argue with. That you're only seeing negativity and discouragement is a cognitive distortion. I'm not qualified to help people with those, but I hope pointing that out might help you see that the world isn't against you. That software developers presently and generally are bad at understanding cryptography doesn't mean it's impossible to learn, or that you should be discouraged from learning.

xvector 2y ago

No, you can not competently roll your own crypto because you took an algorithms class in college. Even the assumption you could is absurd.

smolder 2y ago
It wasn't 'an algorithms class' but grad level cryptography. We did implement boxes as a project and were graded on them. Where do you think people learn this stuff? Super secret cryptography school? I even used it. I previously built a secondary layer protocol using diffie hellman that runs on top of TLS such that in the event TLS is broken there's still some level of secrecy, and I'm very confident that it's better than nothing. Defense in depth, you know?
- xvector 2y ago
  Yes, most of us have likely taken a grad level cryptography course. Still, that's not enough to securely roll your own crypto. You want many years of experience and a community of experts working with you. If you don't have that - 99.9999% of devs do not - just use libsodium.
  - smolder 2y ago
    The arrogance and elitism is wild. I never said people shouldn't use libsodium.
    - tptacek 2y ago
      No, instead you said you learned about how to understand "known plaintext attacks", counting on the average reader of this thread not to know that's a content-free claim. One time, in a "graduate level" cryptography class, you even built a protocol using Diffie-Hellman on top of TLS. OK!
      - smolder 2y ago
        That project wasn't for school.
        tptacek 2y ago
        You provided it as a proof-point of some sort, but I've led lab exercises of freshmen CS students doing the same exercise, so I'm unclear what it's proof of.
        smolder 2y ago
        Proof that you don't need to be super-human to build something useful, also demonstrated by your freshman CS student anecdote.
        tptacek 2y ago
        Anybody can build a Diffie-Hellman protocol. You can practically do with a calculator; in fact, we did that as an exercise at a talk, with a big audience, using frisbees to "exchange" the keys. But: the talk was about how, as a pentester, to trivially break these systems, because making a system that uses a DH key exchange safely, as opposed to one that simply appears correct in unit tests, is treacherously hard. I'm still curious about what you could have possibly meant by learning about "weaknesses" like "known-plaintext attacks". Can you say more?
        smolder 2y ago
        It's been years, but I recall that, for example, when you know every piece of plaintext starts with "https://www https://www", or perhaps know the full contents of particular messages, it may become some degree easier to brute force your way to a key. I don't think it's a concern for standards in broad use, more like something you would worry about if you were cooking up your own cipher.

tptacek 2y ago

The fact that you're referring to useful algorithms here is kind of a "tell", for what it's worth. "Known plaintext attacks" are not a broad class of vulnerability in cryptosystems; they're a setting for attacks. It's like saying "I've studied the browser security model including weaknesses such as the same origin policy".

smolder 2y ago
What do you think an algorithm is? This weird criticism is kind of a "tell", for what it's worth. Ciphers are algorithms. This is unnecessarily combative. I'm disappointed by your posts in this thread, because they're low on substance an high on posturing.

scott_w 2y ago

Learning crypto isn’t just a box ticking exercise that you learn it and now you’re qualified to “do crypto” for the rest of your career. I also studied this in university but I know that I don’t spend anywhere near enough time to day to avoid, well, any pitfalls of rolling my own crypto. I currently work on our company’s Auth systems and half my team still side-eyes our own work, despite having worked on this area for years now.

smolder 2y ago
All I'm reading here is more of the same scare-mongering. I don't casually implement cryptosystems to be used in critical situations, and I wouldn't attempt it without a serious amount of research. But "never do it yourself" is a poor substitute for actually spreading knowledge about how to do it and open discussion of pitfalls. It rubs me the wrong way.
- scott_w 2y ago
  You do understand “never do it yourself” implicitly applies to a commercial/production context, right? Nobody is stopping you learning or choosing to enter the field (to make it your sole professional focus).
  - Asraelite 2y ago
    It certainly comes across like people are discouraging others from even learning about it. Just read through this thread and see how few people are saying anything like "you should still learn how cryptographic primitives work though". It's almost nothing but negativity and discouragement.
    - some_furry 2y ago
      The blog post in question (which I wrote) literally opens with a link to https://www.cryptofails.com/post/75204435608/write-crypto-code-dont-publish-it https://www.cryptofails.com/post/75204435608/write-crypto-co... that encourages people to learn about it! Yes, even if that type of learning means (privately) writing crypto code. Why would you expect the comments about it to argue in favor of "still learning" when the blog post never advocated against learning? They aren't making this point because I didn't make the contrary one, so there's nothing to argue with. That you're only seeing negativity and discouragement is a cognitive distortion. I'm not qualified to help people with those, but I hope pointing that out might help you see that the world isn't against you. That software developers presently and generally are bad at understanding cryptography doesn't mean it's impossible to learn, or that you should be discouraged from learning.