3 ms·
The article makes the point that it is insufficient to use good crypto algorithms / implementations. You must also use it correctly. "A component can only be s
by mikegagnon 13y ago
The article makes the point that it is insufficient to use good crypto algorithms / implementations. You must also use it correctly.
"A component can only be secure under certain well-defined circumstances, not for any use that happens to look similar."
- StavrosK 13y agoA hash is a crypto primitive, it's not what you use for that. If you want to store a password, you use a KDF. If you want to fake-sign, you use an HMAC with a secret. You don't use a hash, just like you don't use plain AES to encrypt a file.
- finnw 13y ago> don't use plain AES to encrypt a file What does "plain" mean in this context? (If you mean ECB then you are right, but it is ambiguous.)
- StavrosK 13y agoI mean a mode without authenticated encryption: http://en.wikipedia.org/wiki/Authenticated_encryption http://en.wikipedia.org/wiki/Authenticated_encryption