5 ms·
As someone not in the know about cryptography, I know just enought that the words "custom cryptography" scare the hell out of me.
by noduerme 2mo ago
As someone not in the know about cryptography, I know just enought that the words "custom cryptography" scare the hell out of me.
- deadbabe 2mo agoIt's time to get over the "never roll your own crypto!" bs. AI can roll you crypto far better than what humans have built by hand. They can literally test things to an extent that no human ever would.
- Jhater 2mo agoLmao, please go do that and get back to me. The Dunning Krueger in this day and age is alarming.
- RunSet 2mo agoIf no one rolled their own crypto then there would be none. "Don't roll your own crypto." sounds a lot like "Don't you worry about crypto. Let _me_ worry about crypto."
- svpk 2mo agoThat's not really the point of the saying though. The point is more so that if you are the kind of person who is in a position to roll your own crypto you probably have a PhD and have worked with cryptography for years. And the thing that you're setting out to do is to produce a cryptography library. If you're that kind of person, then sure go for it! But if you're a top person in the field of cryptography you didn't need anyone to tell you if you were fit to make a cryptography library anyway. And if you're not that kind of person you do need someone to tell you because the whole field is a minefield where subtle oversights break the whole thing. If you want to just implement cryptography as a fun learning experience that's great. But actual implementations that people will actually depend on need to be handled by experts.
- flir 2mo agoThe necessary computer science, you could probably implement. The necessary computer engineering, however...
- cure_42 2mo agoThey did. And it was broken. And we iterated like crazy with people devoting their lives to studying the incredibly advanced mathematics underpinning modern cryptography. But please, roll your own using an LLM and show us all how wrong we are :)
- benj111 2mo agoThe point is that crypto is hard. Therefore many people need to check it, to ensure it is correct. The crypto you rolled yourself is unlikely to have been extensively tested. It's like alpha software. It may have no known bugs, but it hasn't been tested in the wild. Once it has been tested and the bugs fixed, because there will be bugs, you can release a stable version. You shouldn't rely on alpha software for critical things, like keeping secrets, secret. So yes, write a crypto algorithm, but don't represent it as working correctly if you don't know it is or force others to use it, and don't use crypto that hasn't been extensively tested.
- throwayay4929 2mo ago"Dropbox is like a thin bash script around rsync" vibe here
- mr_mitm 2mo agoEverybody can device an encryption algorithm that they can't break themselves. That is not sufficient.
- librasteve 2mo agoyeah, but imagine every message has custom (but flawed) encryption… security by infinite obfuscation
- josephg 2mo agoThey don’t though. LLMs are massive cheaters when it comes to unit tests. Claude will just conveniently not write tests for things it knows will fail.
- deleted 2mo ago[deleted]
- inigyou 2mo agoPlease continue believing this so I can make more money by hacking your products.
- jkercher 2mo agoPlease tell me this is sarcasm...
- datakan 2mo agoI'm not clear why someone would roll their own crypto. There are so many good solutions out there that are free that it seems pointless. I keep hearing about post-quantum being an issue though.
- tptacek 2mo agoI don't love it, but I have to acknowledge that a frontier model building a feature that uses cryptography is going to have a better track record than the median human developer. The immediate practical problem with cryptography engineering has always been that there's a huge amount of detail you need to understand in order to get something right, but only a little bit to know to get something working. LLMs know all the details. They take shortcuts, but fuckups in mainstream cryptography features aren't really about shortcuts, they're about knowledge. The most important thing to do with cryptography features is to stress test them ("spend $10 on verification for every $1 on implementation"), and that too has become a lot easier with frontier models.
- sarchertech 2mo ago> building a feature that uses cryptography is going to have a better track record than the median human developer. Let’s say that’s true. That doesn’t mean that we won’t have a higher percentage of bad implementations because more people are rolling their own.
- tptacek 2mo agoLike I said, I don't love it.