3 ms·
Pretty much every crypto library you use was badly broken, multiple times, during its long history. New attacks are still being found, and browsers and librarie
by lawnchair_larry 14y ago
Pretty much every crypto library you use was badly broken, multiple times, during its long history. New attacks are still being found, and browsers and libraries are updated as we learn more.
For a small sample, read the wikipedia page for http://en.wikipedia.org/wiki/Secure_Sockets_Layer http://en.wikipedia.org/wiki/Secure_Sockets_Layer and take a look at how many times we all got that wrong.
The first rule of crypto is not to write crypto code. Reuse a high level library that already made all the mistakes you're about to. If you absolutely have to break the first rule, you need to budget between 5 and 6 digits for experts to review it against known attacks and best practices.
- jiggy2011 14y agoSo , only use stuff written by google/MS sized companies or very mature OS projects?
- lawnchair_larry 14y agoNo, you don't have to go that far. The same libraries used by those companies are available to all projects, and most crypto uses them (or libraries built on top of them). Mistakes such as those made by Mega result from using a crypto library that makes the author do all the work.